@lamalibre/create-lamaste 4.4.1 → 4.6.0

package/vendor/server/src/commands/plugin-web-surface.js

@@ -0,0 +1,269 @@
+/**
+ * lamaste-server plugins web-surface — the web surface of an agent-hosted
+ * plugin that declares one (its manifest's `userSurface.web`): the site it
+ * owns, where the relay serves the static shell its server package ships
+ * beside its user surface's API.
+ *
+ *   web-surface <name>    What its installed version declares, its site,
+ *                         whether the site serves (and why not), the trees
+ *                         the relay holds, the tunnel still bound as its user
+ *                         surface, and — while it owns no site — the offer
+ *   web-surface <name> create [--subdomain <label>] [--access-mode authenticated|restricted]
+ *                         Give it its site (default: the subdomain and access
+ *                         mode it declares)
+ *   web-surface <name> move --tunnel <id | subdomain | fqdn>
+ *                         Hand the host of the tunnel bound as its user
+ *                         surface to its site, in one reload; the tunnel
+ *                         stays, disabled and unbound
+ *   web-surface <name> delete [--yes]
+ *                         Delete its site, its trees and the grants on it,
+ *                         after typing the site's FQDN (--yes skips it)
+ *
+ * The plugin is named by its name or its route (as `sites list` shows a
+ * site's owner). Every action goes through the running panel
+ * (`/api/plugins/:name/web-surface[/move]`, admin certificate). What the
+ * panel says is printed only as `terminalText`; `--json` emits it as it
+ * came.
+ */
+
+import chalk from 'chalk';
+import * as prompts from '@clack/prompts';
+import { panelRequest } from '../panel-api.js';
+import { readTunnels } from '../state.js';
+import { emit, emitComplete, emitError } from '../ndjson.js';
+import { findHostTunnel, findPluginByNameOrRoute } from '../plugin-identity.js';
+import { terminalText } from '../plugin-settings.js';
+import {
+  createBody,
+  parseWebSurfaceArgs,
+  webSurfaceRefusalHint,
+  webSurfaceServedText,
+  webTreeRows,
+} from '../plugin-web-surface.js';
+
+/** `/api/plugins/<name>/web-surface[/<rest>]`. */
+function webSurfacePath(name, rest = '') {
+  return `/api/plugins/${encodeURIComponent(name)}/web-surface${rest ? `/${rest}` : ''}`;
+}
+
+/**
+ * Exit with a usage error or a refused request, as text (with what the
+ * refusal asks next) or NDJSON (with the refusal's `code`).
+ *
+ * @param {string} message
+ * @param {boolean} json
+ * @param {{ code?: string }} [err]
+ * @param {string} [name]  the plugin, for the hint
+ * @returns {never}
+ */
+function fail(message, json, err = {}, name = '<name>') {
+  const code = typeof err.code === 'string' ? err.code : null;
+  if (json) {
+    emitError(message, false, code ? { code } : {});
+  } else {
+    console.error(`\n  ${chalk.red(terminalText(message))}`);
+    const hint = webSurfaceRefusalHint(code, name);
+    if (hint) console.error(`  ${chalk.dim(hint)}`);
+    console.error('');
+  }
+  process.exit(1);
+}
+
+/**
+ * A panel request; a refusal exits through `fail`, with what it asks next
+ * of plugin `name`.
+ */
+async function request(json, name, method, path, body) {
+  try {
+    return await panelRequest(method, path, body);
+  } catch (err) {
+    fail(err.message, json, err, name);
+  }
+}
+
+/** `label:` padded, then the value. */
+function row(label, value) {
+  console.log(`  ${chalk.dim(`${label}:`.padEnd(16))}${value}`);
+}
+
+/**
+ * Print a web surface's status (`webSurface`) for plugin `name`: what it
+ * declares, its site, whether it is served, its trees, the bound tunnel and
+ * the offer.
+ */
+function printWebSurface(name, view) {
+  const plugin = terminalText(name);
+  console.log('');
+  if (!view.declared && !view.site) {
+    console.log(`  Plugin ${chalk.cyan(plugin)} declares no web surface and owns no site.`);
+    console.log('');
+    return;
+  }
+  console.log(chalk.bold(`  Web surface of ${plugin}`));
+  console.log(chalk.dim('  ' + '─'.repeat(40)));
+  row(
+    'declares',
+    view.declared
+      ? terminalText(
+          `${view.declared.defaultSubdomain} (${view.declared.accessMode}), the shell from ${view.declared.root}/`,
+        )
+      : chalk.yellow('nothing — its installed version declares no web surface'),
+  );
+  row(
+    'site',
+    view.site
+      ? `${chalk.cyan(`https://${terminalText(view.site.fqdn)}/`)}${chalk.dim(` ${terminalText(view.site.accessMode ?? 'access mode unknown')} · id ${terminalText(view.site.id)}`)}`
+      : chalk.dim('none'),
+  );
+  const served = webSurfaceServedText(view, name);
+  row('served', served.served ? chalk.green(served.text) : chalk.yellow(served.text));
+  for (const [label, value] of webTreeRows(view.tree)) row(label, value);
+  if (view.boundTunnel) {
+    const host = terminalText(view.boundTunnel.fqdn ?? view.boundTunnel.id);
+    const others = (view.boundTunnel.routes ?? []).length > 1;
+    row(
+      'bound tunnel',
+      `${chalk.cyan(host)}${chalk.dim(` id ${terminalText(view.boundTunnel.id)}${others ? ` · also serves ${terminalText(view.boundTunnel.routes.join(', '))}` : ''}`)}`,
+    );
+  }
+  if (view.offer) {
+    const offer = `${terminalText(view.offer.subdomain)} (${terminalText(view.offer.accessMode)})`;
+    row(
+      'offer',
+      view.offer.available
+        ? `${offer} ${chalk.green('— free')}`
+        : `${offer} ${chalk.yellow('— taken; create with --subdomain <label>')}`,
+    );
+  }
+  if (!view.site && view.declared) {
+    console.log('');
+    if (view.boundTunnel) {
+      console.log(
+        chalk.dim(
+          `  Move the bound tunnel's host to it: lamaste-server plugins web-surface ${plugin} move --tunnel ${terminalText(view.boundTunnel.fqdn ?? view.boundTunnel.id)}`,
+        ),
+      );
+    } else {
+      console.log(
+        chalk.dim(
+          `  Give it its site: lamaste-server plugins web-surface ${plugin} create [--subdomain <label>] [--access-mode authenticated|restricted]`,
+        ),
+      );
+    }
+  }
+  console.log('');
+}
+
+/**
+ * Ask for the site's FQDN before deleting it — or refuse where nobody can
+ * answer (no terminal, `--json`) without `--yes`.
+ *
+ * @param {string} name
+ * @param {{ fqdn: string }} site
+ * @param {{ yes: boolean, json: boolean }} options
+ */
+async function confirmDelete(name, site, { yes, json }) {
+  if (yes) return;
+  if (json || !process.stdin.isTTY || !process.stdout.isTTY) {
+    fail(
+      `Deleting the web surface of "${name}" (${site.fqdn}) asks for confirmation — pass --yes`,
+      json,
+    );
+  }
+  const fqdn = terminalText(site.fqdn);
+  console.log('');
+  console.log(chalk.bold.red(`  Delete the web surface of ${terminalText(name)}?`));
+  console.log(`    - ${chalk.cyan(fqdn)} stops answering: its vhost is removed`);
+  console.log('    - the web trees the relay holds for it are deleted');
+  console.log('    - the grants on the site are revoked (a restricted site loses its users)');
+  console.log('    - the plugin stays installed and hosted; create the site again at any time');
+  console.log('');
+  const answer = await prompts.text({ message: `Type ${fqdn} to delete it` });
+  if (prompts.isCancel(answer) || String(answer ?? '').trim() !== site.fqdn) {
+    console.log('\n  Aborted — nothing was deleted.\n');
+    process.exit(0);
+  }
+}
+
+/**
+ * `plugins web-surface <name> [create|move|delete]`.
+ *
+ * @param {string[]} args  what follows the subcommand
+ * @param {{ json: boolean }} options
+ */
+export async function webSurfaceCmd(args, { json }) {
+  const parsed = parseWebSurfaceArgs(args);
+  if (!parsed.ok) fail(parsed.error, json);
+
+  const { plugins = [] } = await request(json, parsed.name, 'GET', '/api/plugins');
+  const named = findPluginByNameOrRoute(plugins, parsed.name);
+  if (named.error) fail(named.error, json, { code: 'not_found' }, parsed.name);
+  const { name } = named.plugin;
+  const plugin = terminalText(name);
+
+  if (parsed.action === 'status') {
+    const result = await request(json, name, 'GET', webSurfacePath(name));
+    if (json) emit(result);
+    else printWebSurface(name, result.webSurface);
+    return;
+  }
+
+  if (parsed.action === 'create') {
+    const result = await request(json, name, 'POST', webSurfacePath(name), createBody(parsed));
+    if (json) {
+      emitComplete({ name, ...result });
+      return;
+    }
+    const fqdn = terminalText(result.webSurface?.site?.fqdn ?? '');
+    console.log(
+      `\n  ${chalk.green('✓')} ${plugin} has its site: ${chalk.cyan(`https://${fqdn}/`)}`,
+    );
+    printWebSurface(name, result.webSurface);
+    return;
+  }
+
+  if (parsed.action === 'move') {
+    const found = findHostTunnel(await readTunnels(), parsed.tunnel);
+    if (found.error) fail(found.error, json);
+    const { tunnel } = found;
+    const result = await request(json, name, 'POST', webSurfacePath(name, 'move'), {
+      tunnelId: tunnel.id,
+    });
+    if (json) {
+      emitComplete({ name, tunnelId: tunnel.id, ...result });
+      return;
+    }
+    const host = terminalText(tunnel.fqdn ?? tunnel.id);
+    console.log(
+      `\n  ${chalk.green('✓')} ${chalk.cyan(host)} is the web surface of ${plugin} now — the shell from its approved tree, the API as before`,
+    );
+    console.log(
+      chalk.dim(
+        `  The tunnel ${terminalText(tunnel.id)} stays, disabled and unbound, its vhost unlinked: delete the web surface, then enable the tunnel, to roll back by hand.`,
+      ),
+    );
+    printWebSurface(name, result.webSurface);
+    return;
+  }
+
+  // delete
+  const current = await request(json, name, 'GET', webSurfacePath(name));
+  const site = current.webSurface?.site ?? null;
+  if (!site) fail(`Plugin "${name}" owns no site — there is no web surface to delete`, json);
+  await confirmDelete(name, site, { yes: parsed.yes, json });
+  const result = await request(json, name, 'DELETE', webSurfacePath(name));
+  if (json) {
+    emitComplete({ name, siteId: site.id, fqdn: site.fqdn, ...result });
+    return;
+  }
+  console.log(
+    `\n  ${chalk.green('✓')} The web surface of ${plugin} is deleted: ${chalk.cyan(terminalText(site.fqdn))} no longer answers\n`,
+  );
+  if (Array.isArray(result.grantsNotRevoked) && result.grantsNotRevoked.length > 0) {
+    console.log(
+      chalk.yellow(
+        `  Gatekeeper kept ${result.grantsNotRevoked.length} grant(s) on the deleted site — they name a site that no longer exists; their ids are in the audit log\n`,
+      ),
+    );
+  }
+}

package/vendor/server/src/commands/plugins.js

@@ -52,6 +52,17 @@
  *   configure <name> [--set key=value]... [--clear key]... [--secrets-stdin]
  *                        Change them (kept by its agent half); in a terminal without
  *                        flags, field by field — a secret never on the command line
+ *   identity <name>      The people of an agent-hosted plugin that declares identity:
+ *                        its roles and attributes, approval, readiness, the feed, erasures
+ *   audience <name>      Its members and the users who left, as its agent half is told
+ *   entitlements <name> [--user <u> | --group <g> --roles a,b] [--revoke --user|--group]
+ *                        Who holds which of its roles; give or take them away
+ *   identity-sync <name> [--reconcile]
+ *                        Sync its audience to its agent half now
+ *   web-surface <name> [create [--subdomain <s>] [--access-mode <m>] | move --tunnel <t> | delete [--yes]]
+ *                        The site an agent-hosted plugin owns for its web surface: what it
+ *                        declares, whether it is served, its trees; create, move a bound
+ *                        tunnel's host to it, delete it
  *
  * Every subcommand goes through the running panel (`/api/plugins/*`, admin
  * certificate): the panel owns the plugin registry (SQLite `state.db`), runs
@@ -69,12 +80,18 @@ import { PANEL_SERVICE } from '../config.js';
 import { panelRequest } from '../panel-api.js';
 import { emit, emitStep, emitError, emitComplete, emitLog } from '../ndjson.js';
 import { configureCmd, settingsCmd } from './plugin-settings.js';
+import { audienceCmd, entitlementsCmd, identityCmd, identitySyncCmd } from './plugin-identity.js';
+import { webSurfaceCmd } from './plugin-web-surface.js';
 import { settingsDiffLines, terminalText } from '../plugin-settings.js';
 import {
   APPROVE_HOOKS_USAGE,
   approveHooksCommand,
+  identityBlockLines,
+  identityDiffLines,
   parseApproveArgs,
   pendingUpdateReasons,
+  webSurfaceBlockLines,
+  webTreeDiffLines,
 } from '../plugin-approval.js';
 
 /** npm runs inside the panel for install and uninstall (its own limit is 120 s). */
@@ -134,6 +151,16 @@ export async function runPlugins(args, { json }) {
       return settingsCmd(args.slice(1), { json });
     case 'configure':
       return configureCmd(args.slice(1), { json });
+    case 'identity':
+      return identityCmd(args[1], { json });
+    case 'audience':
+      return audienceCmd(args[1], { json });
+    case 'entitlements':
+      return entitlementsCmd(args.slice(1), { json });
+    case 'identity-sync':
+      return identitySyncCmd(args.slice(1), { json });
+    case 'web-surface':
+      return webSurfaceCmd(args.slice(1), { json });
     default:
       printPluginUsage();
       process.exit(sub ? 1 : 0);
@@ -191,6 +218,24 @@ ${b('Subcommands:')}
                        --clear puts a field back to its default or clears a secret,
                        --secrets-stdin reads {"key": "value" | null} from stdin;
                        in a terminal without flags, asked field by field
+  ${c('identity <name>')}      People of a plugin that declares identity: its roles and attributes,
+                       approval, whether users reach it (and why not), the feed, erasures
+  ${c('audience <name>')}      Its members and the users who left, as its agent half is told
+  ${c('entitlements <name>')}  Who holds which of its roles (Gatekeeper grants with roles)
+  ${c('entitlements <name> --user <u> | --group <g> --roles a,b')}
+                       Give a user or a Lamaste group exactly these roles
+  ${c('entitlements <name> --revoke --user <u> | --group <g>')}
+                       Take every role away
+  ${c('identity-sync <name> [--reconcile]')}
+                       Sync its audience to its agent half now; --reconcile replays all of it
+  ${c('web-surface <name>')}   The site a plugin owns for its web surface: what it declares, its site,
+                       whether it is served (and why not), its trees, the bound tunnel, the offer
+  ${c('web-surface <name> create [--subdomain <label>] [--access-mode authenticated|restricted]')}
+                       Give it its site (default: the subdomain and access mode it declares)
+  ${c('web-surface <name> move --tunnel <id | subdomain | fqdn>')}
+                       Hand the host of the tunnel bound as its user surface to its site
+  ${c('web-surface <name> delete [--yes]')}
+                       Delete its site, its trees and the grants on it (typed confirmation)
 `);
 }
 
@@ -725,9 +770,11 @@ function printRelayHookSet(relay, title) {
       `    request:  ${hook.stage} ${who} on ${hook.routes.join(', ')}${failOpen}` +
         d(` (body ${hook.bodyMaxBytes ?? 0} B, ${hook.timeoutMs} ms, onError ${hook.onError})`),
     );
-    if (hook.inactiveRoutes.length > 0) {
+    if (hook.userSurfaceRoutes.length > 0) {
       console.log(
-        d(`              not active until the user surface: ${hook.inactiveRoutes.join(', ')}`),
+        d(
+          `              runs on user-surface requests (plugins that declare identity): ${hook.userSurfaceRoutes.join(', ')}`,
+        ),
       );
     }
   }
@@ -757,15 +804,34 @@ function printAgentHalf(agentHalf, title) {
   );
 }
 
+/**
+ * Print an identity block — the roles a plugin's users hold and what it
+ * receives about each member.
+ */
+function printIdentityBlock(block, title) {
+  console.log(chalk.bold(`  ${title}`));
+  for (const line of identityBlockLines(block)) console.log(`    ${line}`);
+}
+
+/**
+ * Print a web surface — the web tree an approval covers and the site
+ * Lamaste offers for it (the hook status's `web`).
+ */
+function printWebSurfaceBlock(web, title) {
+  console.log(chalk.bold(`  ${title}`));
+  for (const line of webSurfaceBlockLines(web)) console.log(`    ${line}`);
+}
+
 /**
  * Print what a version brings that needs approval — the approval digest
  * (what `approve-hooks` takes; none for an update that brings neither
- * relay hooks nor an agent half Lamaste installs), its relay hook set and
- * the agent half Lamaste installs.
+ * relay hooks, nor an agent half Lamaste installs, nor an identity block,
+ * nor a web surface), its relay hook set, the agent half Lamaste installs,
+ * its identity block and its web tree.
  */
-function printApprovalContents({ digest, relay, agentHalf }) {
+function printApprovalContents({ digest, relay, agentHalf, identity = null, web = null }) {
   console.log(
-    `    approval digest: ${digest ? chalk.cyan(digest) : chalk.dim('none — no relay hooks, no agent half Lamaste installs')}`,
+    `    approval digest: ${digest ? chalk.cyan(digest) : chalk.dim('none — no relay hooks, no agent half Lamaste installs, no identity block, no web surface')}`,
   );
   if (relay) {
     console.log('');
@@ -775,12 +841,66 @@ function printApprovalContents({ digest, relay, agentHalf }) {
     console.log('');
     printAgentHalf(agentHalf, 'Agent half — Lamaste installs it on the hosting agent');
   }
+  if (identity) {
+    console.log('');
+    printIdentityBlock(
+      identity,
+      'Identity — Lamaste sends its agent half the users entitled to these roles',
+    );
+  }
+  if (web?.declared) {
+    console.log('');
+    printWebSurfaceBlock(
+      web,
+      'Web surface — the relay serves this tree on the site the plugin owns',
+    );
+  }
+}
+
+/**
+ * Print how an update changes the plugin's web tree (part of the digest):
+ * the tree before and after, its file count and size.
+ */
+function printWebTreeChanges(web) {
+  const shown = webTreeDiffLines(web);
+  if (!shown) return;
+  console.log('');
+  console.log(chalk.bold(`  Web surface — this version ${shown.headline}`));
+  for (const line of shown.lines) {
+    console.log(`    ${shown.changed ? line : chalk.dim(line)}`);
+  }
+}
+
+/**
+ * Print how an update changes the plugin's identity block (part of the
+ * digest): roles added or removed and attributes widened wait for an
+ * administrator whatever auto-approve says; the block it brings.
+ */
+function printIdentityChanges(diff) {
+  const shown = identityDiffLines(diff);
+  if (!shown) {
+    // Declared before and after, unchanged: still part of what is approved.
+    if (diff?.after) {
+      console.log('');
+      printIdentityBlock(diff.after, 'Identity — unchanged');
+    }
+    return;
+  }
+  console.log('');
+  console.log(chalk.bold(`  Identity — this version ${shown.headline}`));
+  for (const line of shown.lines) {
+    console.log(`    ${line.approval ? chalk.yellow(line.text) : line.text}`);
+  }
+  if (diff.after) {
+    for (const line of identityBlockLines(diff.after)) console.log(chalk.dim(`    ${line}`));
+  }
 }
 
 /**
  * Print an update that waits for approval under `title`: why it waits
- * (`approvalRequired` — a secret turned plain in red), what it brings
- * (its digest, relay hook set and agent half), how it changes the settings
+ * (`approvalRequired` — a secret turned plain in red, an identity change
+ * with its note), what it brings (its digest, relay hook set and agent
+ * half), how it changes the identity block, how it changes the settings
  * schema (outside the digest) — fields added and removed with their types,
  * retyped ones, newly required ones, and a warning for secrets that become
  * plain values — what auto-approve could not cover beyond the reasons, and
@@ -791,10 +911,17 @@ function printPendingUpdate(name, update, title) {
   console.log(chalk.bold(`  ${title}`));
   const { required, notCovered } = pendingUpdateReasons(update);
   for (const line of required) {
-    console.log(line.warning ? chalk.red(`    - ${line.text}`) : `    - ${line.text}`);
+    const text = line.warning ? chalk.red(`    - ${line.text}`) : `    - ${line.text}`;
+    console.log(line.note ? `${text}${chalk.dim(` (${line.note})`)}` : text);
   }
   console.log('');
-  printApprovalContents(update);
+  printApprovalContents({
+    digest: update.digest,
+    relay: update.relay,
+    agentHalf: update.agentHalf,
+  });
+  printIdentityChanges(update.identity);
+  printWebTreeChanges(update.web);
   const lines = settingsDiffLines(update.settings);
   if (lines.length > 0) {
     console.log('');
@@ -837,7 +964,7 @@ async function hooksCmd(name, { json }) {
   console.log('');
   if (!approval.required && !hooks.agent && !hooks.pendingUpdate) {
     console.log(
-      `  Plugin ${chalk.cyan(name)} declares no lifecycle hooks and no agent half for Lamaste to install.\n`,
+      `  Plugin ${chalk.cyan(name)} declares no lifecycle hooks, no agent half for Lamaste to install, no identity and no web surface.\n`,
     );
     return;
   }
@@ -853,6 +980,8 @@ async function hooksCmd(name, { json }) {
       digest: approval.digest,
       relay: hooks.relay,
       agentHalf: hooks.agentHalf,
+      identity: hooks.identity?.declared ? hooks.identity.block : null,
+      web: hooks.web ?? null,
     });
     console.log(
       `\n    auto-approve for later versions: ${hooks.autoApprove ? chalk.yellow('on') : 'off'}`,
@@ -860,6 +989,20 @@ async function hooksCmd(name, { json }) {
     if (approval.state !== 'approved') {
       console.log(`\n    Approve with: ${approveCommand(name, { digest: approval.digest })}`);
     }
+    if (hooks.identity?.declared) {
+      console.log(
+        chalk.dim(
+          `    Its people (entitlements, audience, feed): lamaste-server plugins identity ${terminalText(name)}`,
+        ),
+      );
+    }
+    if (hooks.web?.declared) {
+      console.log(
+        chalk.dim(
+          `    Its site (served, trees, offer): lamaste-server plugins web-surface ${terminalText(name)}`,
+        ),
+      );
+    }
   }
   if (hooks.agent) {
     console.log(chalk.bold(`\n  Agent hooks (run by the agent half; no approval)`));
@@ -1174,6 +1317,8 @@ async function installPluginCmd(packageName, { json }) {
       digest: approval.digest,
       relay: result.hooks.relay,
       agentHalf: result.hooks.agentHalf,
+      identity: result.hooks.identity?.declared ? result.hooks.identity.block : null,
+      web: result.hooks.web ?? null,
     });
     if (approval.state === 'pending') {
       console.log(

package/vendor/server/src/commands/registry-credential.js

@@ -8,7 +8,8 @@
  *       The panel authenticates as its own `lamaste-server` OIDC client on
  *       the relay's Authelia (client-credentials grant, Feria login). Nothing
  *       to paste; Feria's auth.json must grant the relay's lamaste-server client
- *       through a "workloads" rule on its groups issuer for the relay Authelia.
+ *       read and admin through a "workloads" rule on its groups issuer for the
+ *       relay Authelia.
  *   registry-credential set --url <registry> [--token-stdin]
  *       A long-lived Feria token, read from LAMASTE_REGISTRY_TOKEN or from
  *       stdin with --token-stdin. Never accepted as a command-line argument.

package/vendor/server/src/commands/sites.js

@@ -7,6 +7,10 @@
  *   delete <id>                     Delete a site by ID
  *   aliases <id> --set <a,b|"">     Replace a custom site's redirect aliases
  *
+ * A site a plugin owns (its web surface) is marked in the list and managed
+ * through `lamaste-server plugins web-surface <plugin>`; the panel refuses
+ * to change or delete it here.
+ *
  * List reads directly from the state file.
  * Create/delete use the panel REST API (which has the full
  * nginx/certbot/directory dependency stack).
@@ -16,6 +20,7 @@ import chalk from 'chalk';
 import { readSites } from '../state.js';
 import { panelRequest } from '../panel-api.js';
 import { emit, emitError, emitComplete } from '../ndjson.js';
+import { siteOwnerTag } from '../plugin-web-surface.js';
 
 /**
  * @param {string[]} args
@@ -92,12 +97,21 @@ async function listSites({ json }) {
     const certStatus = s.certIssued ? g('cert issued') : y('no cert');
     const spaTag = s.spaMode ? d('[SPA]') : '';
     const authTag = s.autheliaProtected ? d('[protected]') : '';
+    const owner = siteOwnerTag(s);
+    const ownerTag = owner ? c(owner) : '';
 
     console.log(
-      `  ${c(s.name)}  ${d(s.fqdn)}  ${s.type}  ${dnsStatus}  ${certStatus} ${spaTag} ${authTag}`.trimEnd(),
+      `  ${c(s.name)}  ${d(s.fqdn)}  ${s.type}  ${dnsStatus}  ${certStatus} ${spaTag} ${authTag} ${ownerTag}`.trimEnd(),
     );
     console.log(`    ${d(`id: ${s.id}`)}`);
   }
+  if (sites.some((s) => siteOwnerTag(s) !== null)) {
+    console.log(
+      d(
+        '\n  A [plugin …] site is the web surface of that plugin: manage it with lamaste-server plugins web-surface <plugin>',
+      ),
+    );
+  }
   console.log('');
 }