@upend/cli 0.1.4 → 0.1.5

package/README.md

@@ -193,6 +193,40 @@ Neon needs to reach your JWKS URL to validate JWTs for the Data API. After your
 bunx upend setup:jwks
 ```
 
+### Operations
+
+```bash
+# check service health, disk, memory, cron jobs
+bunx upend status
+
+# tail logs (all services, or pick one)
+bunx upend logs
+bunx upend logs api
+bunx upend logs claude
+bunx upend logs -f              # follow in realtime
+
+# SSH into the remote instance
+bunx upend ssh                  # interactive shell, cd'd to project
+bunx upend ssh "bun -v"         # run a command
+```
+
+### Workflows
+
+Workflows are TypeScript files in `workflows/` that run on a cron schedule or manually:
+
+```bash
+# list workflows and their schedules
+bunx upend workflows
+
+# run one manually
+bunx upend workflows run cleanup-sessions
+
+# install cron schedules (also happens on deploy)
+bunx upend workflows install
+```
+
+Workflows are also visible in the dashboard with a manual trigger button.
+
 ## CLI Commands
 
 | Command | What |
@@ -201,6 +235,11 @@ bunx upend setup:jwks
 | `upend dev` | Start gateway + claude + caddy locally |
 | `upend migrate` | Run SQL migrations from `migrations/` |
 | `upend deploy` | rsync to remote, install, migrate, restart |
+| `upend status` | Check remote service health |
+| `upend logs [service]` | Tail remote logs (`-f` to follow) |
+| `upend ssh [cmd]` | SSH into remote instance |
+| `upend workflows` | List, run, or install workflow cron schedules |
+| `upend env:set <K> <V>` | Set an env var (decrypts, sets, re-encrypts) |
 | `upend infra:aws` | Provision an EC2 instance |
 
 ## Config

package/bin/cli.ts

@@ -22,6 +22,9 @@ const commands: Record<string, () => Promise<void>> = {
   infra: () => import("../src/commands/infra").then((m) => m.default(args.slice(1))),
   env: () => import("../src/commands/env").then((m) => m.default(args.slice(1))),
   workflows: () => import("../src/commands/workflows").then((m) => m.default(args.slice(1))),
+  logs: () => import("../src/commands/logs").then((m) => m.default(args.slice(1))),
+  status: () => import("../src/commands/status").then((m) => m.default(args.slice(1))),
+  ssh: () => import("../src/commands/ssh").then((m) => m.default(args.slice(1))),
 };
 
 if (!command || command === "--help" || command === "-h") {
@@ -37,6 +40,10 @@ if (!command || command === "--help" || command === "-h") {
     upend workflows          list workflows
     upend workflows run <n>  run a workflow manually
     upend workflows install  install cron schedules
+    upend logs [service]     tail remote logs (api|claude|caddy|all)
+    upend logs -f            follow logs in realtime
+    upend status             check remote service health
+    upend ssh [cmd]          SSH into remote (or run a command)
     upend infra:aws          provision AWS infrastructure
 
   options:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upend/cli",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Anti-SaaS stack. Deploy live apps with Claude, Postgres, and rsync.",
   "type": "module",
   "bin": {

package/src/commands/logs.ts

@@ -0,0 +1,43 @@
+import { log } from "../lib/log";
+import { exec } from "../lib/exec";
+
+export default async function logs(args: string[]) {
+  const host = process.env.DEPLOY_HOST;
+  const sshKey = process.env.DEPLOY_SSH_KEY || `${process.env.HOME}/.ssh/upend.pem`;
+
+  if (!host) {
+    log.error("DEPLOY_HOST not set. Add it to .env");
+    process.exit(1);
+  }
+
+  const service = args[0]; // api, claude, caddy, workflow-<name>, or blank for all
+  let logFiles: string;
+
+  if (service === "api") {
+    logFiles = "/tmp/upend-api.log";
+  } else if (service === "claude") {
+    logFiles = "/tmp/upend-claude.log";
+  } else if (service === "caddy") {
+    logFiles = "/tmp/upend-caddy.log";
+  } else if (service?.startsWith("workflow-")) {
+    logFiles = `/tmp/upend-workflow-${service.replace("workflow-", "")}.log`;
+  } else {
+    logFiles = "/tmp/upend-api.log /tmp/upend-claude.log /tmp/upend-caddy.log";
+  }
+
+  const lines = args.includes("-n") ? args[args.indexOf("-n") + 1] || "50" : "50";
+  const follow = args.includes("-f") || args.includes("--follow");
+
+  const tailCmd = follow
+    ? `tail -f ${logFiles}`
+    : `tail -n ${lines} ${logFiles}`;
+
+  log.dim(`ssh ${host} → ${tailCmd}`);
+
+  // use spawn for streaming output (especially -f)
+  const proc = Bun.spawn(["ssh", "-i", sshKey, host, tailCmd], {
+    stdout: "inherit",
+    stderr: "inherit",
+  });
+  await proc.exited;
+}

package/src/commands/ssh.ts

@@ -0,0 +1,32 @@
+import { log } from "../lib/log";
+
+export default async function ssh(args: string[]) {
+  const host = process.env.DEPLOY_HOST;
+  const sshKey = process.env.DEPLOY_SSH_KEY || `${process.env.HOME}/.ssh/upend.pem`;
+  const appDir = process.env.DEPLOY_DIR || "/opt/upend";
+
+  if (!host) {
+    log.error("DEPLOY_HOST not set. Add it to .env");
+    process.exit(1);
+  }
+
+  // if args provided, run as remote command
+  if (args.length > 0) {
+    const cmd = args.join(" ");
+    log.dim(`ssh ${host} → ${cmd}`);
+    const proc = Bun.spawn(["ssh", "-i", sshKey, host, `cd ${appDir} && ${cmd}`], {
+      stdout: "inherit",
+      stderr: "inherit",
+    });
+    process.exit(await proc.exited);
+  }
+
+  // otherwise, interactive shell
+  log.dim(`ssh ${host} (cd ${appDir})`);
+  const proc = Bun.spawn(["ssh", "-i", sshKey, "-t", host, `cd ${appDir} && exec bash`], {
+    stdout: "inherit",
+    stderr: "inherit",
+    stdin: "inherit",
+  });
+  process.exit(await proc.exited);
+}

package/src/commands/status.ts

@@ -0,0 +1,47 @@
+import { log } from "../lib/log";
+import { exec } from "../lib/exec";
+
+export default async function status(args: string[]) {
+  const host = process.env.DEPLOY_HOST;
+  const sshKey = process.env.DEPLOY_SSH_KEY || `${process.env.HOME}/.ssh/upend.pem`;
+
+  if (!host) {
+    log.error("DEPLOY_HOST not set. Add it to .env");
+    process.exit(1);
+  }
+
+  const appDir = process.env.DEPLOY_DIR || "/opt/upend";
+
+  log.header(`${host}`);
+
+  // check services
+  const { stdout } = await exec(["ssh", "-i", sshKey, host, `bash -c '
+    echo "=== services ==="
+    pgrep -af "bun services/api" > /dev/null && echo "api: running" || echo "api: stopped"
+    pgrep -af "bun services/claude" > /dev/null && echo "claude: running" || echo "claude: stopped"
+    pgrep -af "caddy" > /dev/null && echo "caddy: running" || echo "caddy: stopped"
+
+    echo ""
+    echo "=== health ==="
+    curl -s -o /dev/null -w "api: %{http_code}" http://localhost:3001/ 2>/dev/null || echo "api: unreachable"
+    echo ""
+    curl -s -o /dev/null -w "caddy: %{http_code}" http://localhost:80/ 2>/dev/null || echo "caddy: unreachable"
+    echo ""
+
+    echo ""
+    echo "=== system ==="
+    uptime
+    df -h / | tail -1 | awk "{print \"disk: \" \\$3 \" used / \" \\$2 \" (\" \\$5 \")\"}"
+    free -h 2>/dev/null | awk "/Mem:/{print \"memory: \" \\$3 \" used / \" \\$2}" || echo "memory: n/a"
+
+    echo ""
+    echo "=== workflows (crontab) ==="
+    crontab -l 2>/dev/null | grep "upend-workflow" || echo "none installed"
+
+    echo ""
+    echo "=== last deploy ==="
+    cd ${appDir} && git log --oneline -1 2>/dev/null || echo "no git history"
+  '`]);
+
+  console.log(stdout);
+}

package/src/lib/middleware.ts

@@ -27,7 +27,7 @@ export const requireAuth = createMiddleware<{
     const user = {
       sub: payload.sub as string,
       email: payload.email as string,
-      role: (payload.role as string) || "user",
+      role: (payload.app_role as string) || (payload.role as string) || "user",
     };
     console.log(`[auth] ${user.email} → ${method} ${path}`);
     c.set("user", user);