@matthesketh/fleet 1.2.0 → 1.7.0

package/dist/commands/guard.js

@@ -0,0 +1,144 @@
+import { spawnSync } from 'node:child_process';
+import { chmodSync, copyFileSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { error, info, success } from '../ui/output.js';
+const SCRIPTS = [
+    { name: 'notify', mode: 0o700 },
+    { name: 'fleet-guard', mode: 0o750, group: 'fleet-guard' },
+    { name: 'fleet-guard-execute', mode: 0o750, group: 'fleet-guard' },
+    { name: 'cf-audit-monitor', mode: 0o700 },
+    { name: 'cf-snapshot', mode: 0o700 },
+    { name: 'dns-drift-watch', mode: 0o750, group: 'fleet-guard' },
+    { name: 'cert-expiry-watch', mode: 0o750, group: 'fleet-guard' },
+];
+const TARGET_BIN = '/usr/local/sbin';
+const STATE_DIR = '/var/lib/fleet-guard';
+const LOG_DIR = '/var/log/fleet-guard';
+const SNAP_DIR = '/var/lib/cf-snapshots';
+const CRON_TARGET = '/etc/cron.d/cf-protect';
+function scriptsDir() {
+    // dist/commands/guard.js -> ../../scripts/guard relative to compiled file
+    const here = dirname(fileURLToPath(import.meta.url));
+    return join(here, '..', '..', 'scripts', 'guard');
+}
+function requireRoot() {
+    if (process.getuid && process.getuid() !== 0) {
+        throw new Error('this command needs root. try: sudo fleet guard install');
+    }
+}
+function run(cmd, args) {
+    const r = spawnSync(cmd, args, { stdio: 'inherit' });
+    if (r.status !== 0)
+        throw new Error(`${cmd} ${args.join(' ')} failed`);
+}
+function ensureUser() {
+    const r = spawnSync('id', ['fleet-guard'], { stdio: 'ignore' });
+    if (r.status === 0)
+        return;
+    run('useradd', ['--system', '--no-create-home', '--shell', '/usr/sbin/nologin', 'fleet-guard']);
+    info('created system user fleet-guard');
+}
+function ensureDir(path, mode, group) {
+    if (!existsSync(path))
+        mkdirSync(path, { recursive: true });
+    chmodSync(path, mode);
+    if (group)
+        run('chgrp', ['-R', group, path]);
+}
+function installScripts() {
+    const src = scriptsDir();
+    if (!existsSync(src)) {
+        throw new Error(`scripts not bundled at ${src} — broken install`);
+    }
+    for (const s of SCRIPTS) {
+        const from = join(src, s.name);
+        const to = join(TARGET_BIN, s.name);
+        if (!existsSync(from))
+            throw new Error(`missing bundled script: ${from}`);
+        copyFileSync(from, to);
+        chmodSync(to, s.mode);
+        if (s.group)
+            run('chown', [`root:${s.group}`, to]);
+        info(`installed ${to}`);
+    }
+}
+function installCron() {
+    const cron = `# fleet guard — auto-installed, edit with care
+SHELL=/bin/bash
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+*/15 * * * * root /usr/local/sbin/cf-audit-monitor >> /var/log/cf-audit-monitor.log 2>&1
+*/30 * * * * root /usr/local/sbin/cf-snapshot >> /var/log/cf-snapshot.log 2>&1
+*/30 * * * * root /usr/local/sbin/dns-drift-watch >> /var/log/dns-drift-watch.log 2>&1
+17 4 * * * root /usr/local/sbin/cert-expiry-watch >> /var/log/cert-expiry-watch.log 2>&1
+* * * * * fleet-guard /usr/local/sbin/fleet-guard execute >> /var/log/fleet-guard/execute.log 2>&1
+`;
+    writeFileSync(CRON_TARGET, cron, { mode: 0o644 });
+    info(`installed cron at ${CRON_TARGET}`);
+}
+function installCommand() {
+    requireRoot();
+    ensureUser();
+    ensureDir(STATE_DIR, 0o700, 'fleet-guard');
+    ensureDir(join(STATE_DIR, 'pending'), 0o700, 'fleet-guard');
+    ensureDir(join(STATE_DIR, 'approved'), 0o700, 'fleet-guard');
+    ensureDir(join(STATE_DIR, 'processed'), 0o700, 'fleet-guard');
+    ensureDir(LOG_DIR, 0o700, 'fleet-guard');
+    ensureDir(SNAP_DIR, 0o700);
+    installScripts();
+    installCron();
+    success('fleet guard installed.');
+    info('next steps:');
+    info('  1. seed creds at /etc/fleet/guard.cf.json (cloudflare api key + email + accountId)');
+    info('  2. ensure /etc/fleet/notify.json has telegram and/or bluebubbles adapters');
+    info('  3. add /approve, /reject, /guard commands to fleet-bot (PR #60 in fleet repo)');
+}
+function delegate(verb, args) {
+    // every other verb just shells out to the host /usr/local/sbin/fleet-guard cli
+    // so we have a single source of truth for the queue logic.
+    const r = spawnSync('/usr/local/sbin/fleet-guard', [verb, ...args], { stdio: 'inherit' });
+    return r.status ?? 1;
+}
+function helpText() {
+    return [
+        'fleet guard <subcommand>',
+        '',
+        'subcommands:',
+        '  install                            install scripts, user, cron, dirs (root)',
+        '  status                             show queue counts + pending tokens',
+        '  list [pending|approved|processed]  list records',
+        '  hold <kind> <summary> [--payload]  create a pending action',
+        '  approve <token>                    approve a pending action',
+        '  reject <token>                     reject a pending action',
+        '  show <token>                       dump one record',
+        '  execute                            run all approved actions',
+    ].join('\n');
+}
+export function guardCommand(args) {
+    const [sub, ...rest] = args;
+    if (!sub || sub === 'help' || sub === '--help' || sub === '-h') {
+        info(helpText());
+        return;
+    }
+    if (sub === 'install') {
+        try {
+            installCommand();
+        }
+        catch (e) {
+            error(e.message);
+            process.exit(1);
+        }
+        return;
+    }
+    const passthrough = new Set(['status', 'list', 'hold', 'approve', 'reject', 'show', 'execute']);
+    if (passthrough.has(sub)) {
+        const code = delegate(sub, rest);
+        if (code !== 0)
+            process.exit(code);
+        return;
+    }
+    error(`unknown subcommand: ${sub}`);
+    console.log(helpText());
+    process.exit(2);
+}

package/dist/commands/logs.d.ts

@@ -1 +1 @@
-export declare function logsCommand(args: string[]): void;
+export declare function logsCommand(args: string[]): void | Promise<void>;

package/dist/commands/logs.js

@@ -2,31 +2,260 @@ import { load, findApp } from '../core/registry.js';
 import { getContainerLogs } from '../core/docker.js';
 import { execLive } from '../core/exec.js';
 import { AppNotFoundError } from '../core/errors.js';
-import { error } from '../ui/output.js';
+import { c, error, heading, info, success, table, warn } from '../ui/output.js';
+import { confirm } from '../ui/confirm.js';
+import { prompt } from '../ui/prompt.js';
+import { effectivePolicy, writeComposeOverride, getLogStatus, pruneLogs, readContainerLogs, } from '../core/logs-policy.js';
+import { startMultiTail, resolveSources } from '../core/logs-multi.js';
 export function logsCommand(args) {
+    const sub = args[0];
+    if (sub === 'setup')
+        return logsSetup(args.slice(1));
+    if (sub === 'status')
+        return logsStatus(args.slice(1));
+    if (sub === 'prune')
+        return logsPrune(args.slice(1));
+    // --all / --apps / --containers route to the multi-source tail.
+    if (args.includes('--all') || args.includes('--apps') || args.includes('--containers')) {
+        return logsMulti(args);
+    }
+    // Default: single-app tail / follow — synchronous so existing test
+    // expectations and process.exit semantics work unchanged.
+    return logsTail(args);
+}
+// ── Slice 1: multi-source CLI tail ─────────────────────────────────────────
+const SOURCE_COLORS = [c.cyan, c.green, c.yellow, c.magenta, c.blue, c.red];
+const sourceColorCache = new Map();
+function colorForSource(name) {
+    let cached = sourceColorCache.get(name);
+    if (cached)
+        return cached;
+    // Stable hash → colour assignment so the same source always gets the same colour.
+    let h = 0;
+    for (let i = 0; i < name.length; i++)
+        h = (h * 31 + name.charCodeAt(i)) | 0;
+    cached = SOURCE_COLORS[Math.abs(h) % SOURCE_COLORS.length];
+    sourceColorCache.set(name, cached);
+    return cached;
+}
+function logsMulti(args) {
+    const all = args.includes('--all');
+    const follow = args.includes('-f') || args.includes('--follow');
+    const valOf = (flag) => {
+        const i = args.indexOf(flag);
+        return i >= 0 ? args[i + 1] : undefined;
+    };
+    const appsCsv = valOf('--apps');
+    const containersCsv = valOf('--containers');
+    const since = valOf('--since');
+    const grep = valOf('--grep');
+    const level = valOf('--level');
+    const tail = parseInt(valOf('--tail') ?? valOf('-n') ?? '50', 10) || 50;
+    if (!all && !appsCsv && !containersCsv) {
+        error('Usage: fleet logs --all [-f] [--since 15m] [--grep err] [--level warn]');
+        error('       fleet logs --apps macpool,shiftfaced [-f]');
+        error('       fleet logs --containers "*-postgres" [-f]');
+        process.exit(1);
+    }
+    const reg = load();
+    const sources = resolveSources(reg.apps, {
+        apps: appsCsv ? appsCsv.split(',').map(s => s.trim()).filter(Boolean) : undefined,
+        containers: containersCsv ? containersCsv.split(',').map(s => s.trim()).filter(Boolean) : undefined,
+    });
+    if (sources.length === 0) {
+        error('No matching containers found.');
+        process.exit(1);
+    }
+    // Width-align the prefix so lines stack readably.
+    const maxLabelLen = Math.max(...sources.map(s => `${s.app}/${s.container}`.length));
+    const onLine = (l) => {
+        const label = `${l.app}/${l.container}`.padEnd(maxLabelLen);
+        const colour = colorForSource(`${l.app}/${l.container}`);
+        process.stdout.write(`${colour}${label}${c.reset} ${l.text}\n`);
+    };
+    return new Promise(resolve => {
+        const handle = startMultiTail(sources, { tail, since, grep, level, follow }, onLine);
+        const shutdown = async (signal) => {
+            process.removeListener('SIGINT', sigintHandler);
+            process.removeListener('SIGTERM', sigtermHandler);
+            await handle.stop();
+            if (signal !== 'exit')
+                process.stderr.write(`\nStopped (${signal})\n`);
+            resolve();
+        };
+        const sigintHandler = () => { void shutdown('SIGINT'); };
+        const sigtermHandler = () => { void shutdown('SIGTERM'); };
+        process.on('SIGINT', sigintHandler);
+        process.on('SIGTERM', sigtermHandler);
+        // Non-follow: poll until all tailers have closed, then resolve.
+        if (!follow) {
+            const tick = () => {
+                if (handle.active() === 0) {
+                    void shutdown('exit');
+                    return;
+                }
+                setTimeout(tick, 100);
+            };
+            setTimeout(tick, 100);
+        }
+    });
+}
+function logsTail(args) {
     const follow = args.includes('-f') || args.includes('--follow');
     const nIdx = args.indexOf('-n');
     const lines = nIdx >= 0 ? parseInt(args[nIdx + 1], 10) || 100 : 100;
-    const appName = args.find(a => !a.startsWith('-') && (nIdx < 0 || args.indexOf(a) !== nIdx + 1));
+    const cIdx = args.indexOf('-c');
+    const containerArg = cIdx >= 0 ? args[cIdx + 1] : undefined;
+    const sinceIdx = args.indexOf('--since');
+    const since = sinceIdx >= 0 ? args[sinceIdx + 1] : undefined;
+    const grepIdx = args.indexOf('--grep');
+    const grep = grepIdx >= 0 ? args[grepIdx + 1] : undefined;
+    const levelIdx = args.indexOf('--level');
+    const level = levelIdx >= 0 ? args[levelIdx + 1] : undefined;
+    const skipIndices = new Set();
+    for (const i of [nIdx, cIdx, sinceIdx, grepIdx, levelIdx]) {
+        if (i >= 0) {
+            skipIndices.add(i);
+            skipIndices.add(i + 1);
+        }
+    }
+    const appName = args.find((a, i) => !a.startsWith('-') && !skipIndices.has(i));
     if (!appName) {
-        error('Usage: fleet logs <app> [-f] [-n <lines>]');
+        error('Usage: fleet logs <app> [-f] [-n <lines>] [-c <container>]');
+        error('       Subcommands: setup [--all] | status [<app>] | prune <app>');
+        error('       Tail filters: --since <Nm|Nh> | --grep <text> | --level info|warn|error');
         process.exit(1);
     }
     const reg = load();
     const app = findApp(reg, appName);
     if (!app)
         throw new AppNotFoundError(appName);
-    const container = app.containers[0];
-    if (!container) {
+    if (app.containers.length === 0) {
         error(`No containers registered for ${app.name}`);
         process.exit(1);
     }
+    let container = containerArg ?? app.containers[0];
+    if (containerArg && !app.containers.includes(containerArg)) {
+        error(`Container "${containerArg}" not found in ${app.name}. Available:`);
+        for (const ct of app.containers)
+            process.stderr.write(`  - ${ct}\n`);
+        process.exit(1);
+    }
     if (follow) {
-        const code = execLive('docker', ['logs', '-f', '--tail', lines.toString(), container]);
+        // For follow mode we delegate to native docker — filtering would buffer.
+        const dockerArgs = ['logs', '-f', '--tail', lines.toString()];
+        if (since)
+            dockerArgs.push('--since', since);
+        dockerArgs.push(container);
+        const code = execLive('docker', dockerArgs);
         process.exit(code);
     }
+    // Non-follow: use the policy-aware reader so --level / --grep / size cap apply.
+    if (since || grep || level) {
+        const sinceMinutes = since ? parseSinceMinutes(since) : undefined;
+        const result = readContainerLogs(container, { lines, level, sinceMinutes, grep });
+        process.stdout.write(result.text + '\n');
+        if (result.truncated) {
+            warn('Output truncated at 200KB. Narrow with --since/--grep/--level/-n.');
+        }
+        return;
+    }
+    // Plain tail: existing fast path.
+    const output = getContainerLogs(container, lines);
+    process.stdout.write(output + '\n');
+}
+function parseSinceMinutes(s) {
+    const m = s.match(/^(\d+)([mhd])?$/);
+    if (!m)
+        return 60;
+    const n = parseInt(m[1], 10);
+    const unit = m[2] ?? 'm';
+    return unit === 'h' ? n * 60 : unit === 'd' ? n * 1440 : n;
+}
+async function logsSetup(args) {
+    const all = args.includes('--all');
+    const yes = args.includes('-y') || args.includes('--yes');
+    const reg = load();
+    const apps = all ? reg.apps : (() => {
+        const name = args.find(a => !a.startsWith('-'));
+        if (!name) {
+            error('Usage: fleet logs setup <app>  OR  fleet logs setup --all');
+            process.exit(1);
+        }
+        const a = findApp(reg, name);
+        if (!a)
+            throw new AppNotFoundError(name);
+        return [a];
+    })();
+    let policy;
+    if (all || yes) {
+        policy = { retentionDays: 7, maxSizeMB: 100, level: 'info' };
+        info(`Applying default policy: ${policy.maxSizeMB}MB / ${policy.retentionDays}d / ${policy.level}`);
+    }
     else {
-        const output = getContainerLogs(container, lines);
-        process.stdout.write(output + '\n');
+        const ret = await prompt('Retention days', '7');
+        const size = await prompt('Max size MB per container', '100');
+        const lvl = await prompt('Min level (debug|info|warn|error)', 'info');
+        policy = {
+            retentionDays: parseInt(ret, 10) || 7,
+            maxSizeMB: parseInt(size, 10) || 100,
+            level: lvl ?? 'info',
+        };
+    }
+    for (const app of apps) {
+        const path = writeComposeOverride(app, policy);
+        success(`${app.name}: wrote ${path}`);
+    }
+    info('To activate: include the override in your compose start command,');
+    info('  e.g. `docker compose -f docker-compose.yml -f .fleet/logging.override.yml up -d`');
+    info('Or have fleet patch the systemd unit (see: fleet patch-systemd).');
+}
+function logsStatus(args) {
+    const json = args.includes('--json');
+    const appName = args.find(a => !a.startsWith('-'));
+    const reg = load();
+    const apps = appName ? [findApp(reg, appName)].filter(Boolean) : reg.apps;
+    const rows = [];
+    const data = [];
+    for (const app of apps) {
+        if (!app)
+            continue;
+        const policy = effectivePolicy(app);
+        const status = getLogStatus(app);
+        for (const s of status) {
+            data.push({ ...s, policy });
+            const sizeStr = s.totalBytes != null ? `${(s.totalBytes / 1024 / 1024).toFixed(1)}M` : '?';
+            const policyStr = `${policy.maxSizeMB}M/${policy.retentionDays}d/${policy.level}`;
+            const ind = s.policyApplied ? `${c.green}*${c.reset}` : `${c.yellow}!${c.reset}`;
+            rows.push([app.name, s.container, s.driver, sizeStr, policyStr, ind]);
+        }
+    }
+    if (json) {
+        process.stdout.write(JSON.stringify(data, null, 2) + '\n');
+        return;
+    }
+    heading(`Log status (${rows.length} containers)`);
+    table(['APP', 'CONTAINER', 'DRIVER', 'SIZE', 'POLICY', 'CONFIGURED'], rows);
+    process.stdout.write('\n');
+    info('* = override file present, ! = using docker defaults (unbounded by default)');
+}
+async function logsPrune(args) {
+    const yes = args.includes('-y') || args.includes('--yes');
+    const appName = args.find(a => !a.startsWith('-'));
+    if (!appName) {
+        error('Usage: fleet logs prune <app>');
+        process.exit(1);
+    }
+    const reg = load();
+    const app = findApp(reg, appName);
+    if (!app)
+        throw new AppNotFoundError(appName);
+    const policy = effectivePolicy(app);
+    warn(`Will vacuum journald to ${policy.retentionDays}d and truncate any json-file logs > 5x the policy max.`);
+    if (!yes && !await confirm('Proceed?', false)) {
+        info('Cancelled');
+        return;
     }
+    const freed = pruneLogs(app, policy);
+    success(`Freed approximately ${(freed / 1024 / 1024).toFixed(1)}MB from json-file logs (journald vacuum applied separately).`);
 }

package/dist/commands/patch-systemd.d.ts

@@ -0,0 +1 @@
+export declare function patchSystemdCommand(args: string[]): void;

package/dist/commands/patch-systemd.js

@@ -0,0 +1,126 @@
+import { copyFileSync, existsSync, renameSync, writeFileSync } from 'node:fs';
+import { load } from '../core/registry.js';
+import { readServiceFile } from '../core/systemd.js';
+import { execSafe } from '../core/exec.js';
+import { success, warn, info, error } from '../ui/output.js';
+const SERVICE_DIR = '/etc/systemd/system';
+export function patchSystemdCommand(args) {
+    if (args.includes('--rollback'))
+        return rollback();
+    const reg = load();
+    const dbServiceName = reg.infrastructure.databases.serviceName;
+    const appServiceNames = reg.apps.map(a => a.serviceName);
+    // dedupe by service name with infra (rewriteExecStart=false) winning. a stale
+    // registry can list docker-databases under both reg.apps and infrastructure;
+    // without this guard the apps entry would rewrite ExecStart on the shared
+    // databases service, defeating the safety carve-out.
+    const targetMap = new Map();
+    for (const name of appServiceNames) {
+        targetMap.set(name, { name, rewriteExecStart: true });
+    }
+    targetMap.set(dbServiceName, { name: dbServiceName, rewriteExecStart: false });
+    const targets = Array.from(targetMap.values());
+    info(`Patching ${targets.length} service(s)...`);
+    let patched = 0;
+    let skipped = 0;
+    for (const { name, rewriteExecStart } of targets) {
+        const path = `${SERVICE_DIR}/${name}.service`;
+        const content = readServiceFile(name);
+        if (content === null) {
+            warn(`${name}: no service file found, skipping`);
+            skipped++;
+            continue;
+        }
+        let updated = content;
+        let changed = false;
+        // Existing behavior: add StartLimitBurst if missing (applies to ALL services including databases)
+        if (!updated.includes('StartLimitBurst=')) {
+            updated = updated.replace(/(\[Service\])/, '$1\nStartLimitBurst=5\nStartLimitIntervalSec=300');
+            changed = true;
+        }
+        // ExecStart + TimeoutStartSec rewrite ONLY for app services — databases has no git repo
+        if (rewriteExecStart) {
+            const expectedExecStart = `ExecStart=/usr/bin/env fleet boot-start ${name}`;
+            if (!updated.includes(expectedExecStart)) {
+                updated = updated.replace(/^ExecStart=.*$/m, expectedExecStart);
+                changed = true;
+            }
+            // Ensure TimeoutStartSec=900
+            if (!updated.includes('TimeoutStartSec=900')) {
+                if (/^TimeoutStartSec=\d+/m.test(updated)) {
+                    updated = updated.replace(/^TimeoutStartSec=\d+.*$/m, 'TimeoutStartSec=900');
+                }
+                else {
+                    updated = updated.replace(/(\[Service\])/, '$1\nTimeoutStartSec=900');
+                }
+                changed = true;
+            }
+        }
+        if (!changed) {
+            info(`${name}: already patched, skipping`);
+            skipped++;
+            continue;
+        }
+        // Backup original before overwrite
+        try {
+            copyFileSync(path, `${path}.bak`);
+        }
+        catch (err) {
+            warn(`${name}: failed to create .bak (${err instanceof Error ? err.message : String(err)}); skipping for safety`);
+            skipped++;
+            continue;
+        }
+        writeFileSync(path, updated);
+        success(`${name}: patched`);
+        patched++;
+    }
+    if (patched === 0) {
+        info('No services needed patching');
+        return;
+    }
+    info('Running systemctl daemon-reload...');
+    const result = execSafe('systemctl', ['daemon-reload']);
+    if (result.ok) {
+        success(`Done — patched ${patched} service(s), skipped ${skipped}`);
+    }
+    else {
+        warn(`daemon-reload failed: ${result.stderr}`);
+    }
+}
+function rollback() {
+    const reg = load();
+    const serviceNames = [
+        ...reg.apps.map(a => a.serviceName),
+        reg.infrastructure.databases.serviceName,
+    ];
+    let restored = 0;
+    let missing = 0;
+    for (const name of serviceNames) {
+        const path = `${SERVICE_DIR}/${name}.service`;
+        const bak = `${path}.bak`;
+        if (!existsSync(bak)) {
+            missing++;
+            continue;
+        }
+        try {
+            renameSync(bak, path);
+            success(`${name}: restored from .bak`);
+            restored++;
+        }
+        catch (err) {
+            error(`${name}: failed to restore: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (restored === 0) {
+        info('No .bak files found to restore');
+        return;
+    }
+    info('Running systemctl daemon-reload...');
+    const result = execSafe('systemctl', ['daemon-reload']);
+    if (result.ok) {
+        success(`Done — restored ${restored}, missing ${missing}`);
+    }
+    else {
+        warn(`daemon-reload failed: ${result.stderr}`);
+    }
+}

package/dist/commands/rollback.d.ts

@@ -0,0 +1 @@
+export declare function rollbackCommand(args: string[]): Promise<void>;

package/dist/commands/rollback.js

@@ -0,0 +1,58 @@
+import { load, findApp } from '../core/registry.js';
+import { execSafe } from '../core/exec.js';
+import { restartService } from '../core/systemd.js';
+function log(msg) {
+    process.stdout.write(`[rollback] ${msg}\n`);
+}
+function logErr(msg) {
+    process.stderr.write(`[rollback] ${msg}\n`);
+}
+function resolveImageName(composePath, composeFile) {
+    const args = ['compose', ...(composeFile ? ['-f', composeFile] : []), 'config', '--images'];
+    const r = execSafe('docker', args, { cwd: composePath, timeout: 15_000 });
+    if (!r.ok)
+        return null;
+    return r.stdout.split('\n').filter(Boolean)[0] ?? null;
+}
+function splitImageBase(image) {
+    const lastColon = image.lastIndexOf(':');
+    if (lastColon <= 0)
+        return image;
+    return image.slice(0, lastColon);
+}
+export async function rollbackCommand(args) {
+    const appName = args[0];
+    if (!appName) {
+        logErr('Usage: fleet rollback <app>');
+        process.exit(1);
+    }
+    const reg = load();
+    const app = findApp(reg, appName);
+    if (!app) {
+        logErr(`app not found: ${appName}`);
+        process.exit(1);
+    }
+    const image = resolveImageName(app.composePath, app.composeFile);
+    if (!image) {
+        logErr(`could not resolve image name for ${app.name}`);
+        process.exit(1);
+    }
+    const base = splitImageBase(image);
+    const previous = `${base}:fleet-previous`;
+    const latest = image;
+    if (!execSafe('docker', ['image', 'inspect', previous], { timeout: 10_000 }).ok) {
+        logErr(`no previous image found (${previous}) — nothing to roll back to`);
+        process.exit(1);
+    }
+    const tag = execSafe('docker', ['tag', previous, latest], { timeout: 10_000 });
+    if (!tag.ok) {
+        logErr(`docker tag failed: ${tag.stderr || `exit ${tag.exitCode}`}`);
+        process.exit(1);
+    }
+    const ok = restartService(app.serviceName);
+    if (!ok) {
+        logErr(`tag restored but service restart failed for ${app.serviceName}`);
+        process.exit(1);
+    }
+    log(`rolled back ${app.name} to ${previous}`);
+}

package/dist/commands/routine-run.d.ts

@@ -0,0 +1 @@
+export declare function routineRunCommand(argv: string[]): Promise<void>;