[joshk]

What

CLI support for the device log APIs added in nerves-hub/nerves_hub_web#2939:

GET /orgs/:org/products/:product/devices/:identifier/logs

nh device logs thermostat-4021
nh device logs thermostat-4021 --level error,warning --limit 50
nh device logs thermostat-4021 --since 2h --order asc
nh device logs thermostat-4021 --meta -o json

Changes

• internal/api — LogLine plus ListDeviceLogs with a DeviceLogsFilter (level, since, before, limit, order). Unset fields are omitted entirely so the server applies its own defaults (100 lines, newest first). Repeated --level is joined into the comma-separated list the API expects.
• cmd — nh device logs <identifier>: a TIMESTAMP / LEVEL / MESSAGE table by default, full lines under -o json.

Choices worth a look

Offsets as well as timestamps. --since/--before take ISO 8601 or an offset from now (30m, 2h, 3d), resolved client-side to absolute timestamps. A log window is usually described relatively, and lines are only kept three days, so --since 2h is the common case. 3d is handled explicitly since time.ParseDuration has no day unit.

Metadata behind --meta. It's often long and the message is what you're scanning for, so it's hidden by default and always present in -o json. When shown it's sorted key=value pairs, so repeated runs read the same.

Local validation. --order and --limit (1–1000) are checked against the server's own rules before any request, so a typo fails immediately instead of costing a round trip and a 422. Levels are deliberately not validated — the server matches them as given, since a device may log at any level.

meta typed as map[string]any. The server documents string values, but a permissive type can't fail the whole response if that ever varies.

[joshk]

Added --follow (-f), implemented as polling since the API has no streaming endpoint.

nh device logs thermostat-4021 --follow
nh device logs thermostat-4021 -f --level error --interval 5s

How it works: the first page is fetched newest-first (so it's the most recent lines), then reversed — a tail reads oldest to newest. Polls then ask oldest-first from the last timestamp seen.

The subtle part — since is inclusive, so the boundary line comes back on every poll. Nudging the timestamp forward by a microsecond would be simpler, but would silently drop a line sharing that microsecond. Instead the lines already printed at that exact timestamp are remembered and skipped; only the boundary is tracked, so memory stays flat however long the tail runs. There's a test asserting a different line at the same microsecond still prints.

Other behaviour:

• No history → follow starts at now, rather than replaying the oldest page.
• A full page → poll again immediately instead of pacing behind the interval, so bursts catch up.
• Ctrl-C ends the tail cleanly; signal handling is scoped to the loop, leaving the rest of the CLI unchanged.
• JSON becomes one object per line while following (a stream has no closing bracket). One-shot -o json is unchanged — still an indented array.
• --order and --before contradict --follow and are refused, as is --interval without --follow.

Test-infrastructure fix included. resetState now clears each command's context between tests. PersistentPreRunE stores the resolved config on the context, and cobra only inherits the root's context when a command's own is nil (command.go#L1144) — so a command kept the previous test's context and ignored the one passed to ExecuteContext. That hung the follow tests whenever they ran after any other test in the package. Worth knowing beyond this PR: it also meant a cancelled context could leak into a later test.

Full suite green, including under -race.

[joshk]

Added --search, matching the param just added to the server PR.

nh device logs thermostat-4021 --search "sensor bus"
nh device logs thermostat-4021 -f --search timeout --level error

Notes on the implementation:

• The term is passed through untouched. The server matches literally, so % and _ are searched for rather than treated as wildcards — escaping or stripping them here would stop a device that logs 100% being found by searching for 100%. There's a test pinning that.
• A blank term is omitted, not sent as an empty value — the server treats blank as "no filter" anyway, so there's no reason to put it on the wire.
• It applies to every poll a --follow tail makes, not just the first page, with a test asserting the filter survives across requests.

Full suite green.