Yabanin CLI (yb)

yb is two things in one binary: an offline spend audit (yb audit) that never talks to the network, and a thin operator client that checks service health and reads org data (API keys, cost/savings analytics) from the yabanin-admin read-only service API (/internal/*).

# install (from the repository root)
go build -o bin/yb ./cmd/yb
bin/yb --help

Global flags

Flag	Default	Description
--admin-url	http://localhost:8086	yabanin-admin base URL the service commands talk to
--api-key	—	Admin service key; sent as the X-Admin-Key header (see below)
--org	—	Organization ID; required for keys list and spend
--base-url	auto-detect	Gateway base URL (used by gateway-facing commands)

The service key must match YABANIN_ADMIN_API_KEY configured on the yabanin-admin server; without it the /internal service API is not mounted at all. See production runbook — Internal service API.

Never put a real key in shell history or scripts that get committed — pass it via --api-key or an environment variable your shell expands locally.

Commands

yb version

Prints the CLI version.

yb version
# yb 0.1.0

yb doctor

Checks connectivity to the gateway (/healthz) and the admin panel (/healthz). Base URLs are taken from --base-url/--admin-url or auto-detected from YABANIN_DEPLOY_MODE (onprem → localhost, otherwise the cloud endpoints).

yb doctor

yb keys list

Lists the API keys of one organization (name, active status, creation date). The key list contains no plaintext key material by design — the admin store keeps hashes only.

yb keys list --org <org-id> --api-key <service-key>
# NAME      STATUS    CREATED
# deploy    active    2026-08-01
# ci        inactive  2026-07-01

Pagination: yb keys list --org <org-id> --api-key <service-key> --page 2 --page-size 10. Without --page/--page-size the server defaults (page 1, size 50) apply; when the organization has more keys than fit on one page, a "Showing N of M keys" hint is printed.

yb spend

Shows the organization's savings analytics for a look-back window: request total, actual vs counterfactual cost, combined savings, and a per-model breakdown.

yb spend --org <org-id> --api-key <service-key>
yb spend --org <org-id> --api-key <service-key> --days 30   # -d 30

yb audit

Offline spend analyzer. Point it at a local LLM request log (JSONL, CSV, or this gateway's format). It reports actual spend and simulated cache/routing savings. It needs no gateway, admin URL, API key, or organization, and in --cache-mode exact (the default) it makes no network calls.

yb audit path/to/traffic.jsonl
yb audit path/to/traffic.jsonl --format html --output report.html --no-prompts

Flag	Default	Meaning
--format, -f	md	md, json, or html
--cache-mode	exact	exact, semantic, or off
--output, -o	(stdout)	write the report to this file
--no-prompts	false	drop raw prompt text after hashing

--cache-mode semantic is the one path that needs a running embedder. Use exact for a fully offline run. Full semantics, sample data, and what the report will not claim: Offline spend audit.

Error semantics

CLI error	Meaning
--api-key required	--api-key flag not provided
org required	--org flag not provided
admin service rejected the key: check --api-key and that yabanin-admin has YABANIN_ADMIN_API_KEY set	HTTP 401 — wrong key, or the admin server has no YABANIN_ADMIN_API_KEY configured
admin service: org_id query parameter is required	HTTP 400 — server-side org validation
admin service unreachable at <url>	connection refused / timeout (10s client timeout)

Security notes

• The /internal service API is read-only and org-scoped: both endpoints require org_id and expose no mutation operations.
• The key comparison is constant-time on the server; the key value is never logged by the CLI or the server.
• All traffic to the service API is unauthenticated by session cookie — it is meant for local/loopback automation. Expose it only to trusted networks.