fix: fill in promtool's server argument, refuse the paths that cannot authenticate

[venkatamutyala]

Found while running the CLI-SSO sweep against a freshly rebuilt nonprod.jupiter.onglueops.rocks.

The bug

promtool is the only query wrapper that does not point itself at the cluster. logcli sets --addr and tempo-cli sets --path-prefix, both from grafana-ds — but bin/promtool only appended the two auth headers, so the bare form fails:

$ toolbox promtool query instant 'sum(up)'
promtool.real: error: required argument 'expr' not provided, try --help

The caller has to hand-build https://grafana.<domain>/api/datasources/proxy/uid/<uid>, which the README already told them they would not have to:

Queries go through Grafana’s datasource proxy rather than to Loki/Thanos/Tempo directly, so there is one edge host and one credential for everything. The wrappers resolve the datasource UID at run time (grafana-ds)

A second bug in the same branch

Chasing it turned up that the old wrapper applied --header to subcommands that do not accept it:

$ toolbox promtool debug pprof <server>
promtool.real: error: unknown long flag '--header', try --help

Only two subcommands take --header at all:

subcommand	--header	can reach the cluster
query instant	yes	yes
query range	yes	yes
query series	no	no
query labels	no	no
debug pprof / metrics / all	no	no

Without --header a request arrives at the edge carrying no credential and oauth2-proxy redirects it to the login page — so those paths cannot work here regardless of the flag error.

The change

• Resolve the prometheus datasource UID and insert the <server> positional for query instant and query range.
• Refuse query series, query labels and debug against this cluster with a message that says why, following the precedent of tempo-cli refusing --use-grpc.
• Always pass an explicit http(s) server through untouched, so promtool still works against anything else.
• --help and the local subcommands (check, push, test, tsdb) are unchanged.
• README updated so the command table and the proxy section match the behaviour.

Verification

Built and run against a live cluster:

$ promtool query instant 'sum(up)'
{} => 110 @[1788626601.938]

$ promtool query instant 'count by (alertstate)(ALERTS)'
{alertstate="pending"} => 2 @[1788626604.322]
{alertstate="firing"} => 2 @[1788626604.322]

$ promtool query labels alertstate
toolbox: 'promtool query labels' takes no --header, so it cannot authenticate to this cluster. ...

$ promtool debug pprof
toolbox: 'promtool debug' takes no --header, so it cannot authenticate to this cluster. ...

Explicit server, query --help and check --help all still behave as before.

Not included

The logcli delete create guard discussed separately — deliberately left out, to be sorted later.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TrpnuCduw2KivngVRQmnG7