@groundfloorcloud/cli 0.1.3 → 0.1.5

package/README.md

@@ -65,7 +65,7 @@ Authentication, mode `groundfloor` or `external`) until the realm is active.
 
 | `--workload-type` | Also called | Package notes |
 |-------------------|-------------|---------------|
-| `function` | Function | HTTP on `PORT`/8080. Node needs `scripts.start`. |
+| `function` | Function | HTTP on `0.0.0.0:PORT`/8080. Node needs `scripts.start`. |
 | `job` | Background job | Run-to-completion. Then `gf coderunner run`. |
 | `schedule` | Scheduled job | Cron. No public URL. |
 | `service` | **Deployment** | Long-running HTTP. **Root `Dockerfile` is required.** |
@@ -88,7 +88,9 @@ How the target is chosen:
 
 Runtime is auto-detected when omitted (`package.json` → node,
 `requirements.txt` / `pyproject.toml` → python), defaulting to python.
-Node images run `npm start` — add `"scripts": { "start": "node index.js" }`.
+Node without a Dockerfile uses the platform bootstrap (`CMD ["npm","start"]`,
+port 8080). Add `"scripts": { "start": "node index.js" }` and bind
+`0.0.0.0`. `gf deploy` fails immediately if `scripts.start` is missing.
 
 ### Local with live data
 
@@ -152,11 +154,12 @@ gf apps publish --path release.zip
 (`/downloads/shell-starter-kit.zip` on the current cell) and stamps
 `APP_ID` / `groundfloor.manifest.json` `appId` to the slug.
 
-`gf apps publish` uploads `release.zip` (or `remoteEntry.js`), flattens a
-Vite `dist/assets/` layout so chunks sit next to `remoteEntry.js`, finalizes
-the release, and by default PATCHes the Portal manifest from
-`groundfloor.manifest.json` next to the bundle. Pass an app id/slug, or set
-`appId` in that manifest. Prefer `npm run release` over zipping `dist/` by hand.
+`gf apps publish` uploads **only** `release.zip` from `npm run release`.
+It flattens a Vite `dist/assets/` layout when needed, then **rejects** a zip
+that is only `remoteEntry.js` (missing `__federation_*.js` / CSS) or whose
+federation `name` does not match `federationRemoteName(slug)`. A lone
+`.js` file is also rejected. Pass an app id/slug, or set `appId` in
+`groundfloor.manifest.json` next to the zip.
 
 Wrap an existing **service** coderunner as a product:
 
@@ -200,6 +203,7 @@ gf apps get <id|slug>
 | `gf workspaces` (`ws`) | List workspaces; `gf workspaces use <id>` sets the default. |
 | `gf coderunner ls` (`cr ls`) | List coderunners. |
 | `gf coderunner status -c <id\|slug>` | Status and current deployment. |
+| `gf coderunner logs -c <id\|slug>` | Process Log (stdout/stderr). Also printed automatically on `gf deploy` failure. |
 | `gf coderunner run -c <id\|slug> [--payload '{}']` | Invoke a deployed function or job. |
 | `gf deploy` | Package code and deploy as a coderunner. |
 | `gf domains ls\|add\|rm\|verify -c <id\|slug>` | Custom domains for a service. |

package/dist/index.js

@@ -533,9 +533,9 @@ async function parseError(res) {
   }
   return `${res.status} ${detail}`;
 }
-async function cpGet(apiUrl, path7) {
+async function cpGet(apiUrl, path8) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path7}`, {
+  const res = await fetch(`${apiUrl}${path8}`, {
     headers: {
       Authorization: `Bearer ${token}`,
       Accept: "application/json"
@@ -546,9 +546,9 @@ async function cpGet(apiUrl, path7) {
   }
   return await res.json();
 }
-async function cpPostJson(apiUrl, path7, body) {
+async function cpPostJson(apiUrl, path8, body) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path7}`, {
+  const res = await fetch(`${apiUrl}${path8}`, {
     method: "POST",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -562,9 +562,9 @@ async function cpPostJson(apiUrl, path7, body) {
   }
   return await res.json();
 }
-async function cpDelete(apiUrl, path7) {
+async function cpDelete(apiUrl, path8) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path7}`, {
+  const res = await fetch(`${apiUrl}${path8}`, {
     method: "DELETE",
     headers: { Authorization: `Bearer ${token}`, Accept: "application/json" }
   });
@@ -572,9 +572,9 @@ async function cpDelete(apiUrl, path7) {
     throw new CpError(res.status, await parseError(res));
   }
 }
-async function cpPutJson(apiUrl, path7, body) {
+async function cpPutJson(apiUrl, path8, body) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path7}`, {
+  const res = await fetch(`${apiUrl}${path8}`, {
     method: "PUT",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -588,9 +588,9 @@ async function cpPutJson(apiUrl, path7, body) {
   }
   return await res.json();
 }
-async function cpPatchJson(apiUrl, path7, body) {
+async function cpPatchJson(apiUrl, path8, body) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path7}`, {
+  const res = await fetch(`${apiUrl}${path8}`, {
     method: "PATCH",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -604,9 +604,9 @@ async function cpPatchJson(apiUrl, path7, body) {
   }
   return await res.json();
 }
-async function cpPutBytes(apiUrl, path7, body, contentType) {
+async function cpPutBytes(apiUrl, path8, body, contentType) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path7}`, {
+  const res = await fetch(`${apiUrl}${path8}`, {
     method: "PUT",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -724,6 +724,18 @@ function runCoderunner(apiUrl, workspaceId, coderunnerId, payload) {
     payload
   );
 }
+function getProcessLogs(apiUrl, workspaceId, query = {}) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (value == null || value === "") continue;
+    params.set(key, String(value));
+  }
+  const qs = params.toString();
+  return cpGet(
+    apiUrl,
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/logs${qs ? `?${qs}` : ""}`
+  );
+}
 function domainsBase(workspaceId, coderunnerId) {
   return `/v1/workspaces/${encodeURIComponent(
     workspaceId
@@ -1003,9 +1015,188 @@ async function coderunnerListCommand(opts) {
   }
 }
 
+// src/process-log.ts
+var PROCESS_STATUS_LABELS = {
+  1: "Pending",
+  2: "Processing",
+  3: "Completed",
+  4: "Failed",
+  5: "Deleting",
+  6: "Deleted",
+  7: "Stopped"
+};
+function statusLabel(status) {
+  if (status == null) return "unknown";
+  const name = PROCESS_STATUS_LABELS[status];
+  return name ? `${name} (${status})` : `status=${status}`;
+}
+function customerPortalOrigin(apiUrl) {
+  try {
+    const url = new URL(apiUrl);
+    url.host = url.host.replace(/^platform\./, "app.");
+    return url.origin;
+  } catch {
+    return "https://app.groundfloor.cloud";
+  }
+}
+function processLogPortalUrl(portalOrigin, workspaceId, runnerId) {
+  const params = new URLSearchParams({
+    workspace_id: workspaceId,
+    runner_id: runnerId
+  });
+  return `${portalOrigin.replace(/\/+$/, "")}/process-log?${params.toString()}`;
+}
+function formatLogPreview(entries, limit = 20) {
+  const slice = entries.slice(0, limit);
+  return [...slice].reverse().map((entry) => {
+    const ts = entry.ts?.trim() ? `${entry.ts} ` : "";
+    return `${ts}${entry.line}`;
+  }).join("\n");
+}
+function formatDeployFailure(input) {
+  const lines = [input.headline, ""];
+  lines.push(`coderunner:  ${input.coderunnerId}`);
+  if (input.versionId) lines.push(`version:     ${input.versionId}`);
+  if (input.deploymentId) lines.push(`deployment:  ${input.deploymentId}`);
+  if (input.status != null) lines.push(`status:      ${statusLabel(input.status)}`);
+  if (input.logLines) {
+    lines.push("", "logs:", input.logLines);
+  } else {
+    lines.push("", "logs:        (none yet)");
+  }
+  if (input.portalUrl) {
+    lines.push("", `portal:      ${input.portalUrl}`);
+  }
+  lines.push(`more logs:   gf coderunner logs -c ${input.coderunnerId}`);
+  return lines.join("\n");
+}
+async function fetchFailureLogEntries(apiUrl, workspaceId, ids) {
+  const attempts = [];
+  if (ids.deploymentId) attempts.push({ deployment_id: ids.deploymentId });
+  attempts.push({ runner_id: ids.coderunnerId });
+  if (ids.versionId && ids.versionId !== ids.coderunnerId) {
+    attempts.push({ runner_id: ids.versionId });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  let lastError;
+  let anyOk = false;
+  for (const query of attempts) {
+    const key = JSON.stringify(query);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    try {
+      const page = await getProcessLogs(apiUrl, workspaceId, {
+        ...query,
+        limit: 20,
+        since_seconds: 3600
+      });
+      anyOk = true;
+      if (page.entries?.length) return page.entries;
+    } catch (err) {
+      lastError = err;
+    }
+  }
+  if (!anyOk && lastError) throw lastError;
+  return [];
+}
+async function diagnoseDeployFailure(opts) {
+  let logLines = "";
+  try {
+    const entries = await fetchFailureLogEntries(opts.apiUrl, opts.workspaceId, {
+      coderunnerId: opts.coderunnerId,
+      versionId: opts.versionId ?? void 0,
+      deploymentId: opts.deploymentId ?? void 0
+    });
+    logLines = formatLogPreview(entries);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    logLines = `(could not fetch Process Log: ${message})`;
+  }
+  const runnerForPortal = opts.deploymentId || opts.coderunnerId;
+  return formatDeployFailure({
+    headline: opts.headline,
+    coderunnerId: opts.coderunnerId,
+    versionId: opts.versionId,
+    deploymentId: opts.deploymentId,
+    status: opts.status,
+    logLines,
+    portalUrl: processLogPortalUrl(
+      customerPortalOrigin(opts.apiUrl),
+      opts.workspaceId,
+      runnerForPortal
+    )
+  });
+}
+
+// src/resolve-coderunner.ts
+async function resolveCoderunnerId(apiUrl, workspaceId, idOrSlug) {
+  const list = await listCoderunners(apiUrl, workspaceId);
+  const match = list.find((c) => c.id === idOrSlug || c.slug === idOrSlug);
+  if (!match) {
+    throw new Error(`Coderunner not found: ${idOrSlug}`);
+  }
+  return match.id;
+}
+
+// src/commands/logs.ts
+async function logsCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  const coderunnerId = await resolveCoderunnerId(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    opts.coderunner
+  );
+  const limit = opts.limit ? Number(opts.limit) : 50;
+  const sinceSeconds = opts.sinceSeconds ? Number(opts.sinceSeconds) : 3600;
+  if (!Number.isFinite(limit) || limit < 1) {
+    throw new Error("Invalid --limit (expected a positive number).");
+  }
+  if (!Number.isFinite(sinceSeconds) || sinceSeconds < 10) {
+    throw new Error("Invalid --since-seconds (minimum 10).");
+  }
+  const page = await getProcessLogs(cfg.apiUrl, cfg.workspaceId, {
+    runner_id: coderunnerId,
+    limit,
+    since_seconds: sinceSeconds,
+    search: opts.search
+  });
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(page, null, 2)}
+`);
+    return;
+  }
+  const preview = formatLogPreview(page.entries ?? [], limit);
+  if (!preview) {
+    process.stdout.write("No log entries.\n");
+  } else {
+    process.stdout.write(`${preview}
+`);
+  }
+  if (page.has_more) {
+    process.stdout.write(
+      `(more available \u2014 raise --limit or narrow --since-seconds)
+`
+    );
+  }
+  process.stdout.write(
+    `
+portal: ${processLogPortalUrl(
+      customerPortalOrigin(cfg.apiUrl),
+      cfg.workspaceId,
+      coderunnerId
+    )}
+`
+  );
+}
+
 // src/commands/deploy.ts
-import { promises as fs3 } from "fs";
-import path3 from "path";
+import { promises as fs4 } from "fs";
+import path4 from "path";
 
 // src/deploy/package.ts
 import { execFile } from "child_process";
@@ -1173,6 +1364,45 @@ async function detectRuntime(dir) {
   return null;
 }
 
+// src/deploy/preflight.ts
+import { promises as fs3 } from "fs";
+import path3 from "path";
+var NODE_BOOTSTRAP_MISSING_START = 'Node packages without a Dockerfile use the platform bootstrap image (CMD ["npm","start"], EXPOSE 8080). Add package.json "scripts": { "start": "node <entrypoint>" }. The process must listen on process.env.PORT || 8080 and bind 0.0.0.0 (not 127.0.0.1).';
+var NODE_BOOTSTRAP_MISSING_PACKAGE = 'Node packages without a Dockerfile need package.json with "scripts.start" (bootstrap image runs `npm start` and probes 0.0.0.0:8080).';
+var NODE_DOCKERFILE_NPM_START_MISSING = 'Dockerfile runs `npm start` but package.json has no "scripts.start". Add "scripts": { "start": "node <entrypoint>" }.';
+function dockerfileRunsNpmStart(text) {
+  return /npm["'\s,]+start/.test(text);
+}
+async function readOptional(filePath) {
+  try {
+    return await fs3.readFile(filePath, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function preflightNodePackage(sourceDir) {
+  const dockerfile = await readOptional(path3.join(sourceDir, "Dockerfile"));
+  const needsStartScript = dockerfile == null || dockerfileRunsNpmStart(dockerfile);
+  if (!needsStartScript) return;
+  const raw = await readOptional(path3.join(sourceDir, "package.json"));
+  if (raw == null) {
+    throw new Error(
+      dockerfile == null ? NODE_BOOTSTRAP_MISSING_PACKAGE : NODE_DOCKERFILE_NPM_START_MISSING
+    );
+  }
+  let npm;
+  try {
+    npm = JSON.parse(raw);
+  } catch {
+    throw new Error("package.json is not valid JSON.");
+  }
+  if (!npm.scripts?.start?.trim()) {
+    throw new Error(
+      dockerfile == null ? NODE_BOOTSTRAP_MISSING_START : NODE_DOCKERFILE_NPM_START_MISSING
+    );
+  }
+}
+
 // src/commands/deploy.ts
 var RUNTIMES = /* @__PURE__ */ new Set(["python", "node", "dotnet-script"]);
 var WORKLOAD_TYPES = /* @__PURE__ */ new Set(["function", "service", "job", "schedule"]);
@@ -1202,6 +1432,9 @@ function parseEnvPairs(pairs) {
 }
 var log = (msg) => process.stderr.write(`${msg}
 `);
+async function failDeploy(opts) {
+  throw new Error(await diagnoseDeployFailure(opts));
+}
 async function deployCommand(opts) {
   const cfg = await resolveConfig({
     apiUrl: opts.apiUrl,
@@ -1214,7 +1447,7 @@ async function deployCommand(opts) {
   }
   const ws = cfg.workspaceId;
   log(
-    opts.git ? `Cloning ${opts.git}${opts.ref ? ` (${opts.ref})` : ""}...` : `Packaging ${path3.resolve(opts.path ?? process.cwd())}...`
+    opts.git ? `Cloning ${opts.git}${opts.ref ? ` (${opts.ref})` : ""}...` : `Packaging ${path4.resolve(opts.path ?? process.cwd())}...`
   );
   const pkg = await packageSource({
     path: opts.path,
@@ -1241,7 +1474,7 @@ async function deployCommand(opts) {
     }
     if (workloadType === "service") {
       try {
-        await fs3.access(path3.join(pkg.sourceDir, "Dockerfile"));
+        await fs4.access(path4.join(pkg.sourceDir, "Dockerfile"));
       } catch {
         throw new Error(
           'workload type "service" (also called Deployment) requires a Dockerfile at the project root.'
@@ -1249,26 +1482,11 @@ async function deployCommand(opts) {
       }
     }
     if (runtime === "node") {
-      try {
-        const raw = await fs3.readFile(
-          path3.join(pkg.sourceDir, "package.json"),
-          "utf8"
-        );
-        const npm = JSON.parse(raw);
-        if (!npm.scripts?.start?.trim()) {
-          throw new Error(
-            'Node Coderunner packages require package.json "scripts.start" (runtime CMD is npm start).'
-          );
-        }
-      } catch (err) {
-        if (err instanceof Error && err.message.includes("scripts.start")) {
-          throw err;
-        }
-      }
+      await preflightNodePackage(pkg.sourceDir);
     }
     let coderunnerId = opts.coderunner;
     if (!coderunnerId) {
-      const name = opts.name ?? manifest.name ?? (opts.git ? nameFromGitUrl(opts.git) : path3.basename(path3.resolve(opts.path ?? process.cwd())));
+      const name = opts.name ?? manifest.name ?? (opts.git ? nameFromGitUrl(opts.git) : path4.basename(path4.resolve(opts.path ?? process.cwd())));
       const slug = manifest.slug ?? slugify(name);
       const existing = await listCoderunners(cfg.apiUrl, ws);
       const match = existing.find((c) => c.slug === slug || c.name === name);
@@ -1317,16 +1535,38 @@ async function deployCommand(opts) {
         break;
       }
       if (status === 4) {
-        throw new Error(
-          `Build failed for version ${uploaded.version_id} (status=4).`
-        );
+        return await failDeploy({
+          apiUrl: cfg.apiUrl,
+          workspaceId: ws,
+          headline: `Build failed for version ${uploaded.version_id} (${statusLabel(4)}).`,
+          coderunnerId,
+          versionId: uploaded.version_id,
+          status: 4
+        });
       }
       process.stderr.write(".");
       await new Promise((r) => setTimeout(r, VERSION_POLL_INTERVAL_MS));
     }
     process.stderr.write("\n");
     if (!built) {
-      throw new Error("Timed out waiting for the build to complete.");
+      let lastStatus = null;
+      try {
+        lastStatus = (await getVersion(
+          cfg.apiUrl,
+          ws,
+          coderunnerId,
+          uploaded.version_id
+        )).status ?? null;
+      } catch {
+      }
+      return await failDeploy({
+        apiUrl: cfg.apiUrl,
+        workspaceId: ws,
+        headline: "Timed out waiting for the build to complete.",
+        coderunnerId,
+        versionId: uploaded.version_id,
+        status: lastStatus
+      });
     }
     log("Build completed.");
     if (opts.skipDeploy) {
@@ -1358,16 +1598,38 @@ async function deployCommand(opts) {
         break;
       }
       if (dStatus === 4) {
-        throw new Error(
-          `Deployment failed for coderunner ${coderunnerId} (status=4).`
-        );
+        return await failDeploy({
+          apiUrl: cfg.apiUrl,
+          workspaceId: ws,
+          headline: `Deployment failed for coderunner ${coderunnerId} (${statusLabel(4)}).`,
+          coderunnerId,
+          versionId: uploaded.version_id,
+          deploymentId: result.deployment_id ?? deployment?.id,
+          status: 4
+        });
       }
       process.stderr.write(".");
       await new Promise((r) => setTimeout(r, DEPLOY_POLL_INTERVAL_MS));
     }
     process.stderr.write("\n");
     if (!deployOk) {
-      throw new Error("Timed out waiting for the deployment to complete.");
+      let lastStatus = null;
+      let deploymentId = result.deployment_id;
+      try {
+        const latest = await getDeployment(cfg.apiUrl, ws, coderunnerId);
+        lastStatus = latest?.status ?? null;
+        deploymentId = latest?.id ?? deploymentId;
+      } catch {
+      }
+      return await failDeploy({
+        apiUrl: cfg.apiUrl,
+        workspaceId: ws,
+        headline: "Timed out waiting for the deployment to complete.",
+        coderunnerId,
+        versionId: uploaded.version_id,
+        deploymentId,
+        status: lastStatus
+      });
     }
     log("Deployment completed.");
     process.stdout.write(`
@@ -1388,21 +1650,13 @@ Deployed coderunner ${coderunnerId}
     }
   } finally {
     if (pkg.cleanup) {
-      await fs3.rm(pkg.cleanup, { recursive: true, force: true }).catch(() => {
+      await fs4.rm(pkg.cleanup, { recursive: true, force: true }).catch(() => {
       });
     }
   }
 }
 
 // src/commands/run.ts
-async function resolveCoderunnerId(apiUrl, workspaceId, idOrSlug) {
-  const list = await listCoderunners(apiUrl, workspaceId);
-  const match = list.find((c) => c.id === idOrSlug || c.slug === idOrSlug);
-  if (!match) {
-    throw new Error(`Coderunner not found: ${idOrSlug}`);
-  }
-  return match.id;
-}
 async function runCommand(opts) {
   const cfg = await resolveConfig({ workspaceId: opts.workspace });
   if (!cfg.workspaceId) {
@@ -1436,14 +1690,6 @@ async function runCommand(opts) {
 }
 
 // src/commands/status.ts
-async function resolveCoderunnerId2(apiUrl, workspaceId, idOrSlug) {
-  const list = await listCoderunners(apiUrl, workspaceId);
-  const match = list.find((c) => c.id === idOrSlug || c.slug === idOrSlug);
-  if (!match) {
-    throw new Error(`Coderunner not found: ${idOrSlug}`);
-  }
-  return match.id;
-}
 async function statusCommand(opts) {
   const cfg = await resolveConfig({ workspaceId: opts.workspace });
   if (!cfg.workspaceId) {
@@ -1451,7 +1697,7 @@ async function statusCommand(opts) {
       "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
     );
   }
-  const coderunnerId = await resolveCoderunnerId2(
+  const coderunnerId = await resolveCoderunnerId(
     cfg.apiUrl,
     cfg.workspaceId,
     opts.coderunner
@@ -1634,10 +1880,10 @@ async function secretsRmCommand(key, opts) {
 }
 
 // src/commands/files.ts
-import { promises as fs4 } from "fs";
-import path4 from "path";
+import { promises as fs5 } from "fs";
+import path5 from "path";
 function guessContentType(filename) {
-  const ext = path4.extname(filename).toLowerCase();
+  const ext = path5.extname(filename).toLowerCase();
   const types = {
     ".json": "application/json",
     ".txt": "text/plain",
@@ -1672,9 +1918,9 @@ async function filesListCommand(opts) {
 }
 async function filesUploadCommand(filePath, opts) {
   const cfg = await requireWorkspace(opts.workspace);
-  const resolved = path4.resolve(filePath);
-  const buf = await fs4.readFile(resolved);
-  const name = opts.name ?? path4.basename(resolved);
+  const resolved = path5.resolve(filePath);
+  const buf = await fs5.readFile(resolved);
+  const name = opts.name ?? path5.basename(resolved);
   const contentType = guessContentType(name);
   const init = await initFileUpload(cfg.apiUrl, cfg.workspaceId, {
     name,
@@ -1711,8 +1957,8 @@ async function filesDownloadCommand(fileId, opts) {
     throw new Error(`Download failed: ${res.status} ${res.statusText}`);
   }
   const buf = Buffer.from(await res.arrayBuffer());
-  const dest = path4.resolve(opts.out ?? fileId);
-  await fs4.writeFile(dest, buf);
+  const dest = path5.resolve(opts.out ?? fileId);
+  await fs5.writeFile(dest, buf);
   process.stdout.write(`Wrote ${dest}
 `);
 }
@@ -1724,8 +1970,8 @@ async function filesRmCommand(fileId, opts) {
 }
 
 // src/commands/apps.ts
-import { promises as fs5 } from "fs";
-import path5 from "path";
+import { promises as fs6 } from "fs";
+import path6 from "path";
 
 // src/release-zip.ts
 import AdmZip2 from "adm-zip";
@@ -1765,8 +2011,8 @@ function flattenFederatedBundlePlan(relpaths) {
   const promoteDirs = /* @__PURE__ */ new Set();
   const entryDir = parentDir(entry);
   if (entryDir) promoteDirs.add(entryDir);
-  for (const path7 of pathset) {
-    const parent = parentDir(path7);
+  for (const path8 of pathset) {
+    const parent = parentDir(path8);
     if (parent === "assets" || parent.endsWith("/assets") && parent.split("/").length - 1 < 2) {
       promoteDirs.add(parent);
     }
@@ -1810,8 +2056,80 @@ function flattenFederatedReleaseZip(bytes) {
   }
   return zip.toBuffer();
 }
-function federatedReleaseZipHint() {
-  return "Run `npm run release` in a kit from `gf apps init --slug <portal-slug>` (do not zip Vite dist/ or dist/assets/ by hand).";
+function federatedReleaseZipHint(slug) {
+  return `Run \`npm run release\` in a kit from \`gf apps init\`, then publish that zip (do not zip Vite dist/ or upload only remoteEntry.js). ${initThenPublishHint(slug)}`;
+}
+function federationRemoteName(appId) {
+  const sanitized = appId.replace(/[^a-zA-Z0-9_$]/g, "_");
+  return sanitized.length > 0 ? sanitized : "federatedApp";
+}
+function initThenPublishHint(slug) {
+  const s = (slug ?? "").trim() || "<portal-slug>";
+  return `gf apps init --slug ${s} && cd ${s} && npm install && npm run release && gf apps publish --path release.zip`;
+}
+function extractReferencedSiblings(remoteEntrySource) {
+  const names = /* @__PURE__ */ new Set();
+  for (const match of remoteEntrySource.matchAll(
+    /["']\.\/([^"'/]+\.(?:js|mjs|cjs|css))["']/g
+  )) {
+    if (match[1] !== REMOTE_ENTRY) names.add(match[1]);
+  }
+  for (const match of remoteEntrySource.matchAll(
+    /["']([A-Za-z0-9._-]+\.css)["']/g
+  )) {
+    names.add(match[1]);
+  }
+  return [...names];
+}
+function extractFederationScope(remoteEntrySource) {
+  return remoteEntrySource.match(/css__([A-Za-z0-9_-]+)__/)?.[1];
+}
+function zipRootNames(bytes) {
+  const zip = new AdmZip2(bytes);
+  return zip.getEntries().filter((entry) => !entry.isDirectory).map((entry) => normalizeZipEntryName(entry.entryName));
+}
+function readZipFile(bytes, rel) {
+  const zip = new AdmZip2(bytes);
+  const entry = zip.getEntries().find((item) => {
+    if (item.isDirectory) return false;
+    return normalizeZipEntryName(item.entryName) === rel;
+  });
+  return entry ? entry.getData().toString("utf8") : void 0;
+}
+function assertFederatedReleaseZip(bytes, slug) {
+  const hint = initThenPublishHint(slug);
+  const names = zipRootNames(bytes);
+  const present = new Set(names.map((name) => basename(name)));
+  const entryRel = chooseRemoteEntry(names);
+  if (!entryRel) {
+    throw new Error(`Zip has no remoteEntry.js. ${hint}`);
+  }
+  const source = readZipFile(bytes, entryRel);
+  if (!source) {
+    throw new Error(`Zip has no remoteEntry.js. ${hint}`);
+  }
+  const siblings = extractReferencedSiblings(source);
+  const missing = siblings.filter((name) => !present.has(name));
+  const jsOrCssAtRoot = names.filter((name) => {
+    if (name.includes("/")) return false;
+    const lower = name.toLowerCase();
+    return lower.endsWith(".js") || lower.endsWith(".mjs") || lower.endsWith(".css");
+  });
+  if (missing.length > 0 || siblings.length === 0 && jsOrCssAtRoot.length < 2) {
+    const detail = missing.length > 0 ? `Missing next to remoteEntry.js: ${missing.join(", ")}.` : "Zip is only remoteEntry.js (Vite chunks were never packed).";
+    throw new Error(
+      `${detail} Do not zip dist/ or upload a lone remoteEntry.js. ${hint}`
+    );
+  }
+  const scope = extractFederationScope(source);
+  if (slug && scope) {
+    const expected = federationRemoteName(slug);
+    if (scope !== expected) {
+      throw new Error(
+        `Federation name is "${scope}" but Shell looks up "${expected}" (from slug ${slug}). Use the starter-kit vite.config (federationRemoteName). ${hint}`
+      );
+    }
+  }
 }
 
 // src/commands/apps.ts
@@ -1825,7 +2143,7 @@ function formatApp(app) {
   return `${app.id}  ${app.name ?? app.slug ?? ""}  ${app.app_kind ?? ""}  [${app.status ?? ""}]`;
 }
 async function readJsonObject(filePath) {
-  const raw = await fs5.readFile(filePath, "utf8");
+  const raw = await fs6.readFile(filePath, "utf8");
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error(`${filePath} must contain a JSON object`);
@@ -1834,13 +2152,13 @@ async function readJsonObject(filePath) {
 }
 async function maybeReadManifest(filePath) {
   if (!filePath) return void 0;
-  return readJsonObject(path5.resolve(filePath));
+  return readJsonObject(path6.resolve(filePath));
 }
 async function findSiblingManifest(bundlePath) {
-  const dir = await isDirectory(bundlePath) ? bundlePath : path5.dirname(bundlePath);
-  const candidate = path5.join(dir, "groundfloor.manifest.json");
+  const dir = await isDirectory(bundlePath) ? bundlePath : path6.dirname(bundlePath);
+  const candidate = path6.join(dir, "groundfloor.manifest.json");
   try {
-    await fs5.access(candidate);
+    await fs6.access(candidate);
   } catch {
     return void 0;
   }
@@ -1854,10 +2172,10 @@ function zipHasRemoteEntry(bytes) {
     return name === REMOTE_ENTRY || name.endsWith(`/${REMOTE_ENTRY}`);
   });
 }
-function prepareReleaseZip(bytes) {
+function prepareReleaseZip(bytes, slug) {
   if (!zipHasRemoteEntry(bytes)) {
     throw new Error(
-      `Zip has no remoteEntry.js. ${federatedReleaseZipHint()}`
+      `Zip has no remoteEntry.js. ${initThenPublishHint(slug)}`
     );
   }
   const flattened = flattenFederatedReleaseZip(bytes);
@@ -1867,15 +2185,16 @@ function prepareReleaseZip(bytes) {
   if (Object.keys(plan).length > 0) {
     process.stderr.write(
       `Note: flattened Vite dist/assets layout so chunks sit next to remoteEntry.js.
-Prefer: ${federatedReleaseZipHint()}
+Prefer: ${federatedReleaseZipHint(slug)}
 `
     );
   }
+  assertFederatedReleaseZip(flattened, slug);
   return flattened;
 }
 async function isDirectory(filePath) {
   try {
-    return (await fs5.stat(filePath)).isDirectory();
+    return (await fs6.stat(filePath)).isDirectory();
   } catch {
     return false;
   }
@@ -1969,7 +2288,8 @@ async function appsCreateCommand(opts) {
   } catch (err) {
     if (err instanceof CpError && err.status === 409) {
       throw new Error(
-        `App slug ${slug} already exists. Use \`gf apps publish ${slug}\` to ship a build.`
+        `App slug ${slug} already exists. Init the kit if you do not have it, then publish:
+  ${initThenPublishHint(slug)}`
       );
     }
     throw err;
@@ -1994,14 +2314,14 @@ Do not scaffold src/App.tsx from scratch \u2014 BrowserRouter in App.tsx crashes
 }
 async function appsPublishCommand(appRef, opts) {
   const cfg = await requireWorkspace(opts.workspace);
-  const inputPath = path5.resolve(opts.path ?? "release.zip");
-  const bundlePath = await isDirectory(inputPath) ? path5.join(inputPath, "release.zip") : inputPath;
+  const inputPath = path6.resolve(opts.path ?? "release.zip");
+  const bundlePath = await isDirectory(inputPath) ? path6.join(inputPath, "release.zip") : inputPath;
   let bytes;
   try {
-    bytes = await fs5.readFile(bundlePath);
+    bytes = await fs6.readFile(bundlePath);
   } catch {
     throw new Error(
-      `No bundle at ${bundlePath}. Run \`npm run release\` in the starter-kit, then pass --path release.zip.`
+      `No bundle at ${bundlePath}. ${initThenPublishHint()}`
     );
   }
   if (bytes.byteLength === 0) {
@@ -2025,13 +2345,16 @@ async function appsPublishCommand(appRef, opts) {
       `Releases are only for shell_federated apps (this app is ${app.app_kind}). Use \`gf deploy\` for coderunner workloads.`
     );
   }
-  const ext = path5.extname(bundlePath).toLowerCase();
+  const ext = path6.extname(bundlePath).toLowerCase();
   const isZip = ext === ".zip";
-  if (isZip) {
-    bytes = prepareReleaseZip(bytes);
+  if (!isZip) {
+    throw new Error(
+      `Publish release.zip from \`npm run release\`, not a lone ${path6.basename(bundlePath)}. ` + initThenPublishHint(app.slug)
+    );
   }
-  const bundle = isZip ? "zip" : "remote_entry";
-  const contentType = isZip ? "application/zip" : "application/javascript";
+  bytes = prepareReleaseZip(bytes, app.slug);
+  const bundle = "zip";
+  const contentType = "application/zip";
   if (opts.syncManifest !== false && sibling) {
     await patchApp(cfg.apiUrl, cfg.workspaceId, app.id, {
       manifest: sibling.manifest
@@ -2066,9 +2389,9 @@ async function appsPublishCommand(appRef, opts) {
 }
 
 // src/commands/apps-init.ts
-import { promises as fs6 } from "fs";
+import { promises as fs7 } from "fs";
 import os3 from "os";
-import path6 from "path";
+import path7 from "path";
 import AdmZip4 from "adm-zip";
 var MAX_KIT_BYTES = 8 * 1024 * 1024;
 function slugify3(input) {
@@ -2080,7 +2403,7 @@ function titleFromSlug(slug) {
 }
 async function pathExists(filePath) {
   try {
-    await fs6.access(filePath);
+    await fs7.access(filePath);
     return true;
   } catch {
     return false;
@@ -2088,7 +2411,7 @@ async function pathExists(filePath) {
 }
 async function isEmptyDir(dir) {
   try {
-    const entries = await fs6.readdir(dir);
+    const entries = await fs7.readdir(dir);
     return entries.length === 0;
   } catch (err) {
     if (err.code === "ENOENT") return true;
@@ -2097,17 +2420,17 @@ async function isEmptyDir(dir) {
 }
 async function findKitRoot(extracted) {
   const candidates = [
-    path6.join(extracted, "shell-starter-kit"),
+    path7.join(extracted, "shell-starter-kit"),
     extracted
   ];
-  const entries = await fs6.readdir(extracted, { withFileTypes: true });
+  const entries = await fs7.readdir(extracted, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      candidates.push(path6.join(extracted, entry.name));
+      candidates.push(path7.join(extracted, entry.name));
     }
   }
   for (const candidate of candidates) {
-    if (await pathExists(path6.join(candidate, "groundfloor.manifest.json"))) {
+    if (await pathExists(path7.join(candidate, "groundfloor.manifest.json"))) {
       return candidate;
     }
   }
@@ -2189,7 +2512,7 @@ async function appsInitCommand(opts) {
 `);
   }
   const name = opts.name?.trim() || titleFromSlug(slug);
-  const dest = path6.resolve(opts.dir?.trim() || path6.join(process.cwd(), slug));
+  const dest = path7.resolve(opts.dir?.trim() || path7.join(process.cwd(), slug));
   const cfg = await resolveConfig();
   const cell = cfg.environment ?? "production";
   const kitUrl = opts.kitUrl?.trim() || starterKitZipUrl(cell);
@@ -2199,26 +2522,26 @@ async function appsInitCommand(opts) {
     );
   }
   if (opts.force && await pathExists(dest)) {
-    await fs6.rm(dest, { recursive: true, force: true });
+    await fs7.rm(dest, { recursive: true, force: true });
   }
   const bytes = await downloadKit(kitUrl);
   const zip = new AdmZip4(bytes);
   assertSafeZipEntries(zip);
-  const tmp = await fs6.mkdtemp(path6.join(os3.tmpdir(), "gf-starter-kit-"));
+  const tmp = await fs7.mkdtemp(path7.join(os3.tmpdir(), "gf-starter-kit-"));
   try {
     zip.extractAllTo(tmp, true);
     const kitRoot = await findKitRoot(tmp);
-    await fs6.mkdir(dest, { recursive: true });
-    await fs6.cp(kitRoot, dest, { recursive: true, force: true });
+    await fs7.mkdir(dest, { recursive: true });
+    await fs7.cp(kitRoot, dest, { recursive: true, force: true });
   } finally {
-    await fs6.rm(tmp, { recursive: true, force: true });
-  }
-  const identityPath = path6.join(dest, "src", "appIdentity.ts");
-  const manifestPath = path6.join(dest, "groundfloor.manifest.json");
-  const identity = await fs6.readFile(identityPath, "utf8");
-  await fs6.writeFile(identityPath, stampAppIdentity(identity, slug), "utf8");
-  const manifest = await fs6.readFile(manifestPath, "utf8");
-  await fs6.writeFile(manifestPath, stampManifest(manifest, slug, name), "utf8");
+    await fs7.rm(tmp, { recursive: true, force: true });
+  }
+  const identityPath = path7.join(dest, "src", "appIdentity.ts");
+  const manifestPath = path7.join(dest, "groundfloor.manifest.json");
+  const identity = await fs7.readFile(identityPath, "utf8");
+  await fs7.writeFile(identityPath, stampAppIdentity(identity, slug), "utf8");
+  const manifest = await fs7.readFile(manifestPath, "utf8");
+  await fs7.writeFile(manifestPath, stampManifest(manifest, slug, name), "utf8");
   const result = {
     dir: dest,
     slug,
@@ -2301,7 +2624,7 @@ function run(fn) {
 var program = new Command();
 program.name("gf").description(
   "Groundfloor CLI \u2014 sign in, deploy coderunners, publish Shell apps, and manage workspace resources."
-).version("0.1.1");
+).version("0.1.5");
 program.command("login").description(
   "Log in via the browser (production by default; --dev / --stage for other cells)"
 ).option("--dev", "Sign in to Groundfloor dev").option("--stage", "Sign in to Groundfloor stage").option(
@@ -2326,6 +2649,18 @@ workspaces.command("use <workspaceId>").description("Set the default workspace")
 var coderunner = program.command("coderunner").alias("cr").description("Coderunner commands");
 coderunner.command("ls").alias("list").description("List coderunners in the default (or --workspace) workspace").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => coderunnerListCommand(opts)));
 coderunner.command("status").description("Show coderunner status + current deployment JSON").requiredOption("-c, --coderunner <id|slug>", "Coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => statusCommand(opts)));
+coderunner.command("logs").description("Show Process Log lines for a coderunner (stdout/stderr)").requiredOption("-c, --coderunner <id|slug>", "Coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--limit <n>", "Max lines (default 50)").option("--since-seconds <n>", "Lookback window in seconds (default 3600)").option("--search <text>", "Substring filter").option("--json", "Output raw JSON").action(
+  (opts) => run(
+    () => logsCommand({
+      workspace: opts.workspace,
+      coderunner: opts.coderunner,
+      limit: opts.limit,
+      sinceSeconds: opts.sinceSeconds,
+      search: opts.search,
+      json: opts.json
+    })
+  )
+);
 coderunner.command("run").description("Invoke a deployed function/job (smoke run)").requiredOption("-c, --coderunner <id|slug>", "Coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--payload <json>", "JSON payload object", "{}").option("--json", "Output raw JSON").action(
   (opts) => run(
     () => runCommand({
@@ -2398,10 +2733,10 @@ apps.command("create").description("Register a Shell federated or standalone pro
   "Path to groundfloor.manifest.json (Shell apps)"
 ).option("--json", "Output raw JSON").action((opts) => run(() => appsCreateCommand(opts)));
 apps.command("publish [appId]").description(
-  "Upload release.zip (or remoteEntry.js) and publish a Shell app"
+  "Upload release.zip from npm run release (not a lone remoteEntry.js)"
 ).option("-w, --workspace <id>", "Workspace id override").option("--app <id|slug>", "App id or slug (else manifest appId)").option(
   "-p, --path <file>",
-  "release.zip, remoteEntry.js, or a folder containing release.zip",
+  "release.zip from npm run release (or a folder containing it)",
   "release.zip"
 ).option("-m, --label <text>", "Optional release label").option(
   "--no-sync-manifest",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundfloorcloud/cli",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Groundfloor gf CLI — sign in, deploy coderunners, publish Shell apps, and manage secrets, files, and Dataplane.",
   "type": "module",
   "bin": {