@mesh-tech/mesh-cli 0.12.7 → 0.14.0

package/skills/core/SKILL.md

@@ -102,7 +102,7 @@ Top-level commands (each `register*` is wired in `src/program.ts`, which `bin/me
 | `mesh stack` | `init`, `rm <name>` | `init` creates a personal dev stack `dev-{github-user}`, copying base-stack config, setting `mesh:deploy: false`, inheriting KMS secrets provider; `--worktree` appends the git-worktree token (`dev-{user}-{token}`) so concurrent worktrees deploy to **distinct** stacks (SSM paths, Temporal namespace, Nexus endpoint all derive from the stack name → one discriminator isolates all three; no-op on the primary checkout). `rm <name>` removes a personal stack (backend state + local config), credentialed. Both assume the deployer role — no raw `pulumi` / manual creds needed. | `init`: `--from <stack>`, `--name <stack>`, `--worktree`; `rm`: `--yes` |
 | `mesh tenant` | `add <name>`, `list` | Register/inspect app tenants on a platform stack. Run from the **platform layer** of a tenant platform repo (e.g. `mesh-sandbox/platform`). `add` inserts the tenant under `mesh:tenants` in `Pulumi.<stack>.yaml` via a comment-preserving YAML round-trip (untouched lines don't reformat), refuses a tenant that is already declared (an existing entry may carry fields a re-add would drop), derives the `{name}-{env}` subdomain from the stack name (echoed in the success line), and guards against running on the core layer or an app dir; it then prints the deploy + verify sequence — `mesh deploy up` is what makes the registration live. `list` prints what the stack config declares, so "is it registered?" is answerable without opening YAML (warns when the project doesn't look like a platform layer, so an empty result isn't mistaken for "no tenants"). | `add`: `--display-name <name>`, `--subdomain <sub>`, `--zitadel-org-id <id>`, `--stack <stack>`, `--json`; `list`: `--stack <stack>`, `--json` |
 | `mesh tunnel [group]` | `external <name>` | SSM port-forward to platform services. Groups: `dev` (temporal+db), `temporal`. **`external <name>`** tunnels to a *registered* `ExternalService`: host/port are read from its credential secret (`mesh/{app-tenant}/{app-stage}/external/{name}`) — the same values deployed apps resolve at runtime — so anything the bastion can reach is tunnelable with no per-service CLI entry and no bastion services-map change. `-t/-e` are **optional everywhere** — they fall back to the same Pulumi/SST context detection `mesh dev` uses, and `AWS_REGION`/`AWS_PROFILE` default from the nearest Pulumi config + the `{tenant}-{env}` profile convention (region falls back to the effective profile's own `region` — the `[default]` profile when none was resolved — before the platform default us-east-2). | root: `-t/--tenant`, `-e/--env`, `-l/--list`, `-s/--services <csv\|group>`, `--db-port`, `--temporal-ui-port`, `--temporal-frontend-port`; `external`: `-p/--port` (default: the remote port), `-k/--key <key>` (multi-instance `credentials.keyedBy` externals), `--app-tenant`/`--app-stage` (credential axis; default to `-t`/`-e`) |
-| `mesh secrets` | `exec <command...>`, `set [service]`, `migrate-config` | Manage external-service creds in Secrets Manager. `exec` injects secrets as env; `set` reads field schema from SSM and prompts (or `--json`). | `set`: `--key <id>` (multi-instance), `--all`, `--json <str>`, `--stage`, `--region`; `migrate-config`: `--force`, `--dry-run`, `--stage`, `--region` |
+| `mesh secrets` | `exec <command...>`, `set [service]`, `reindex [service]`, `migrate-config` | Manage external-service creds in Secrets Manager. `exec` injects secrets as env; `set` reads field schema from SSM and prompts (or `--json`) — with `--key` it also records the instance in the service's instance index (`{prefix}/.index`, what `listInstances()` reads). `reindex` rebuilds that index from the per-key secrets actually in Secrets Manager (operator-credential `ListSecrets`) — the repair for an index that drifted (out-of-band secret create/delete, concurrent writers, malformed value) and the populate step when rolling the index out to an estate: **deploy the declaring stack first** (creates the managed, empty index), then `reindex`. | `set`: `--key <id>` (multi-instance), `--all`, `--json <str>`, `--stack`, `--region`; `reindex`: `--dry-run`, `--stack`, `--region`; `migrate-config`: `--force`, `--dry-run`, `--stack`, `--region` |
 | `mesh artifacts` | `get <ref>` | Download workflow artifact files from an AI-agent conversation. Ref `<conversationId>:<artifactId>` (artifactId defaults to `workflow-artifact`). | `-o/--output <dir>`, `--target <name>`, `--api-url <url>`, `--context <ctx>` (default `mesh.dev`) |
 | `mesh conversations` (alias `conv`) | `list`, `show <id>`, `artifacts <id>` | Read a deployed Mesh agent's conversations: list the caller's conversations, render a transcript, or list a conversation's artifacts. Resolves against the same `agent-targets` registry the MCP `agent_*` tools use. | all three: `--target <name>`, `--api-url <url>` (overrides `--target`), `--context <ctx>` (used with `--api-url`, default `mesh.dev`), `--json` (default when stdout isn't a TTY) |
 | `mesh vpn` | `connect <context>`, `disconnect`, `status`, `tunnel <up\|down\|status>`, `api-key`, `pre-auth-key`, `users` | Headscale VPN mgmt via Tailscale + kubectl. **`connect` now defaults to the userspace `tailscaled`** (brew formula, NOT the GUI Tailscale.app) — the same daemon `mesh dev --transport tailscale` / `mesh vpn tunnel` use, so it **runs headless / under the sandbox** and exposes a local SOCKS5 proxy (route a tool via `ALL_PROXY=socks5://127.0.0.1:<port>`). It relays a one-time browser-register URL for Zitadel auth. `--system` opts into the whole-machine GUI Tailscale.app (system TUN) — needs the app installed and **cannot run headless/sandboxed** (Sparkle.framework abort). For auto-forwarded VPC services (Temporal/RDS) prefer **`mesh vpn tunnel up`** or `mesh dev`. `tunnel status` reports runner **ownership** (`Runner: owned (verified)` vs `NOT OWNED (<reason>)` — a port answering a dial is not proof it's mesh's, MESH-2407); `--json` adds `owned` (bool) + `ownership` (reason string). Admin subcommands `exec` into the `headscale-0` pod. | root: `-t/--tenant` (default `mesh`), `-e/--env` (default `dev`), `-n/--namespace`; `connect`/`disconnect`: `--system`; `tunnel up`: `--context <ctx>`; `tunnel down`: `--stop` (stop daemon, keep login), `--logout`; `tunnel status`: `--json`; `pre-auth-key`: `-u/--user` (**required**), `--expiration <24h>`, `--reusable`, `--ephemeral` |
@@ -156,15 +156,25 @@ self-refreshing credential_process (the deployer role), so no separate `--export
 
 ### 2. Scaffold and run an app locally
 
+Run this from the root of your tenant apps repo (`{tenant}-mesh-apps`) — apps
+land in `apps/<name>/`:
+
 ```bash
 mesh create-app --tenant acme --name billing --primitives service,database,temporal
-cd tenants/acme/apps/billing && pnpm install
+cd apps/billing && pnpm install
+mesh skills sync             # picks up the platform skills now that deps are installed
 mesh stack init              # personal dev-{github-user} stack (deploy:false)
 mesh deploy up --yes         # pulumi up via mesh:deployerRole
 mesh dev                     # tunnels + secrets + tmux (needs VPN for VPC access)
 mesh dev logs api            # tail one service;  mesh dev --kill to stop
 ```
 
+> **Where the app lands.** `create-app` writes to the first of `tenants/<tenant>/apps/`,
+> `../<tenant>/apps/`, `apps/` that exists — so a tenant apps repo gets `apps/<name>/`.
+> The `tenants/<tenant>/apps/…` and `tests/tenants/…` paths you see elsewhere in this
+> file are the **mesh-platform monorepo's own** layouts (the second is test-only, from
+> `--test`); no tenant repo has them.
+
 ### 2b. Watch your dev-local stack in the Hub (`mesh hub dev`)
 
 ```bash
@@ -198,7 +208,7 @@ block per worktree handed both the same ports.
 
 ```bash
 # worktree A
-cd .worktrees/feature-a/tests/tenants/acme/apps/demo-agent
+cd .worktrees/feature-a/tests/tenants/acme/apps/demo-agent   # monorepo test tenant
 mesh dev --dry-run          # preview: session name, port block, state/env paths, task queue
 mesh dev                    # launch (attaches tmux; --headless to skip)
 
@@ -273,6 +283,8 @@ mesh db exec --secret <arn> -- node seed.js   # direct mode, skips SSM discovery
 mesh secrets set external/symitar                         # interactive (schema from SSM)
 mesh secrets set external/symitar --json '{"baseUrl":"…"}'
 mesh secrets set external/symitar --key 12345 --json '{…}'  # multi-instance (key = FI id)
+mesh secrets reindex external/symitar --dry-run           # show instance-index drift, write nothing
+mesh secrets reindex external/symitar                     # rebuild {prefix}/.index from real secrets
 mesh secrets exec -- node ./script.js                     # secrets injected as env
 ```
 

package/templates/apps-repo/package.json.hbs

@@ -10,6 +10,7 @@
     "typecheck": "pnpm -r typecheck"
   },
   "devDependencies": {
-    "@mesh-tech/mesh-cli": "latest"
+    "@mesh-tech/mesh-cli": "latest",
+    "@tanstack/intent": "{{intentRange}}"
   }
 }

package/templates/apps-repo/pnpm-workspace.yaml

@@ -1,3 +1,11 @@
-# Workspace packages — each app is an independent Pulumi project
+# Workspace packages — each app is an independent Pulumi project.
+#
+# `apps/*` alone is not enough: a composed app (`mesh create-app --primitives
+# service,temporal`) puts its runnable packages one level deeper, in
+# `apps/<name>/api/` and `apps/<name>/worker/`. Without the nested globs those
+# package.json files are not workspace members, so `pnpm install` never
+# installs their dependencies and `pnpm dev` dies on `Cannot find package
+# 'hono'` — with the app itself looking installed.
 packages:
   - apps/*
+  - apps/*/*