@yadurajfleetos/cli 0.1.7 → 0.1.8

package/dist/commands/down.js

@@ -7,13 +7,30 @@
 import { request, requireFleet, CliError, EXIT } from '../api.js';
 import { c } from '../render.js';
 import { glyph } from '../ui.js';
-async function confirmTeardown(name) {
+/**
+ * Say what teardown actually does before doing it.
+ *
+ * The distinction people get wrong is `down` versus `rm`, so the prompt names it:
+ * the container goes, the service definition stays and can be redeployed. Where
+ * it is running is included because that is the machine whose Docker is about to
+ * change, and it is usually not the one this command is typed on.
+ *
+ * Non-interactive callers are taken as consenting. That is deliberate and is not
+ * how `rm` behaves — stopping a service is undone by deploying it again, so a
+ * scripted `fleet down` in a CI teardown step should not need --yes.
+ */
+async function confirmTeardown(service) {
     if (!process.stdin.isTTY)
         return true;
+    const where = service.current?.nodeName;
+    console.log(`\n  This stops ${c.bold(service.name)}${where ? ` on ${c.bold(where)}` : ''}:` +
+        `\n    ${c.dim('·')} its container is removed from that machine` +
+        `\n    ${c.dim('·')} the service definition is kept, so ${c.cyan('fleet deploy')}${c.dim(' brings it back')}` +
+        `\n  ${c.dim('To delete it outright, use `fleet rm` instead.')}\n`);
     const { createInterface } = await import('node:readline/promises');
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     try {
-        const ans = await rl.question(`  Stop and tear down ${c.bold(name)}? [y/N] `);
+        const ans = await rl.question(`  Stop and tear down ${c.bold(service.name)}? [y/N] `);
         return ans.trim().toLowerCase() === 'y';
     }
     finally {
@@ -22,16 +39,18 @@ async function confirmTeardown(name) {
 }
 export const downCommand = {
     async run(args, flags) {
-        const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+        // Before requireFleet, which reaches the control plane when no fleet is
+        // saved: a missing argument should not need the network to be reported.
         const [name] = args;
         if (!name)
             throw new CliError('usage: fleet down <service> [--yes]', EXIT.usage);
+        const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
         const { body: listBody } = await request('GET', `/fleets/${fleetId}/services`);
         const service = listBody.services.find((s) => s.name === name || s.id === name);
         if (!service) {
             throw new CliError(`No service called "${name}". Known: ${listBody.services.map((s) => s.name).join(', ') || 'none'}`, EXIT.usage);
         }
-        if (!flags.yes && !flags.y && !(await confirmTeardown(service.name))) {
+        if (!flags.yes && !flags.y && !(await confirmTeardown(service))) {
             console.log(c.dim('Teardown cancelled.'));
             return;
         }

package/dist/commands/index.js

@@ -7,11 +7,13 @@ import { doctorCommand } from './doctor.js';
 import { upCommand } from './up.js';
 import { openCommand } from './open.js';
 import { downCommand } from './down.js';
-import { applyCommand, deployCommand, deploymentsCommand, initCommand, logsCommand, restartCommand, rollbackCommand, rescheduleCommand, servicesCommand, validateCommand, whereCommand, } from './services.js';
+import { unpairCommand, agentCommand } from './unpair.js';
+import { applyCommand, deployCommand, deploymentsCommand, initCommand, logsCommand, removeServiceCommand, restartCommand, rollbackCommand, rescheduleCommand, servicesCommand, validateCommand, whereCommand, } from './services.js';
 export const commands = {
     up: upCommand,
     open: openCommand,
     down: downCommand,
+    rm: removeServiceCommand,
     auth: authCommand,
     config: configCommand,
     use: useCommand,
@@ -31,4 +33,6 @@ export const commands = {
     rollback: rollbackCommand,
     events: eventsCommand,
     alerts: alertsCommand,
+    unpair: unpairCommand,
+    agent: agentCommand,
 };

package/dist/commands/nodes.js

@@ -56,8 +56,22 @@ export const nodesCommand = {
                 throw new CliError(`This revokes ${node.name}'s credentials and removes it from the fleet.\n` +
                     `  Anything pinned to it will have nowhere to run. Re-run with --force if that is intended.`, EXIT.usage);
             }
-            await request('DELETE', `/fleets/${fleetId}/nodes/${node.id}`);
+            const { body } = await request('DELETE', `/fleets/${fleetId}/nodes/${node.id}`);
+            if (flags.json)
+                return console.log(JSON.stringify(body, null, 2));
             console.log(`${node.name} removed and its agent credentials revoked`);
+            for (const e of body.evicted ?? []) {
+                if (e.action === 'moved') {
+                    console.log(c.dim(`  ${e.service} → ${e.toNodeName ?? 'another node'}`));
+                }
+                else {
+                    // Pinned and stranded services need saying out loud: the node is
+                    // gone and these did not find a new home.
+                    console.log(c.yellow(`  ${e.service} could not move — ${e.reason ?? e.action}`));
+                }
+            }
+            console.log(c.dim(`  To clean up that machine itself, run ` +
+                `${c.cyan('fleet unpair')}${c.dim(' on it.')}`));
             return;
         }
         throw new CliError('usage: fleet nodes [ls|pair|cordon|uncordon|rm]', EXIT.usage);

package/dist/commands/services.js

@@ -53,7 +53,13 @@ export const applyCommand = {
     },
 };
 export const servicesCommand = {
-    async run(_args, flags) {
+    async run(args, flags) {
+        // `fleet services rm <name>` is the same action as `fleet rm <name>`;
+        // both spellings exist because one reads as a subcommand of the noun and
+        // the other as the short form an operator reaches for under pressure.
+        if (args[0] === 'rm' || args[0] === 'remove' || args[0] === 'delete') {
+            return removeServiceCommand.run(args.slice(1), flags);
+        }
         const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
         const { body } = await request('GET', `/fleets/${fleetId}/services`);
         if (flags.json)
@@ -363,3 +369,52 @@ export const initCommand = {
         console.log(c.dim(`\n  …or just run: fleet up`));
     },
 };
+/**
+ * fleet rm <service> / fleet services rm <service> — permanently undeploy.
+ *
+ * Distinct from `fleet down`, which stops the workload but keeps the service
+ * definition so it can be redeployed. This removes the definition too, which
+ * is not recoverable from the control plane, so the confirmation is required
+ * rather than best-effort: a non-interactive caller must pass --yes explicitly
+ * instead of having silence taken as consent.
+ */
+export const removeServiceCommand = {
+    async run(args, flags) {
+        // Before requireFleet, which reaches the control plane when no fleet is
+        // saved: a missing argument is a usage error and should not depend on the
+        // network being up to say so.
+        const [name] = args;
+        if (!name)
+            throw new CliError('usage: fleet rm <service> [--yes]', EXIT.usage);
+        const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+        const service = await findService(fleetId, name);
+        const confirmed = flags.yes === true || flags.y === true;
+        if (!confirmed) {
+            if (!process.stdin.isTTY) {
+                throw new CliError(`Deleting "${service.name}" is permanent. Re-run with --yes to confirm.`, EXIT.usage);
+            }
+            const { createInterface } = await import('node:readline/promises');
+            const rl = createInterface({ input: process.stdin, output: process.stdout });
+            try {
+                console.log(`\n  This permanently deletes ${c.bold(service.name)} from the fleet:` +
+                    `\n    ${c.dim('·')} its containers are removed from the node it runs on` +
+                    `\n    ${c.dim('·')} its deployment history and URL are released` +
+                    `\n  ${c.dim('To stop it without deleting it, use `fleet down` instead.')}\n`);
+                const ans = await rl.question(`  Type the service name to confirm [${c.dim(service.name)}]: `);
+                if (ans.trim() !== service.name) {
+                    console.log(c.dim('Delete cancelled.'));
+                    return;
+                }
+            }
+            finally {
+                rl.close();
+            }
+        }
+        const { body } = await request('DELETE', `/services/${service.id}`);
+        if (flags.json)
+            return console.log(JSON.stringify(body, null, 2));
+        console.log(`${glyph.ok} ${c.red('deleted')}  ${c.bold(body.service)}`);
+        if (body.note)
+            console.log(c.dim(`  ${body.note}`));
+    },
+};

package/dist/commands/unpair.js

@@ -0,0 +1,189 @@
+/**
+ * fleet unpair — take *this* machine out of a fleet, from the machine itself.
+ *
+ * The counterpart to `fleet nodes rm`, which is run by an operator elsewhere.
+ * This one has to be run on the host because only the host can stop its own
+ * daemon, remove its own containers, and delete its own credential file.
+ *
+ * Order matters and is the whole point of the command:
+ *
+ *   1. read local state — the node id is needed before the file is deleted
+ *   2. stop the agent, and disable it so a reboot does not resurrect it
+ *   3. tell the control plane, which reschedules the workloads elsewhere
+ *   4. remove the local containers
+ *   5. wipe the credential
+ *
+ * The agent is stopped first because it reconciles on a timer: with it still
+ * running, containers removed in step 4 are recreated seconds later, and its
+ * runtime check may relaunch Docker underneath you.
+ */
+import { rm, access, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { exec } from 'node:child_process';
+import { promisify } from 'node:util';
+import { request, CliError, EXIT } from '../api.js';
+import { c } from '../render.js';
+import { glyph } from '../ui.js';
+const execAsync = promisify(exec);
+async function exists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Where the agent keeps its state, mirroring state.DefaultPath() in the agent
+ * and the STATE_DIR logic in scripts/install.sh. These are per-platform and
+ * genuinely different — guessing /var/lib/fleet-os everywhere would report a
+ * successful wipe while leaving the credential on disk.
+ */
+function stateDir() {
+    const override = process.env.FLEET_STATE_DIR;
+    if (override)
+        return override;
+    if (process.platform === 'win32')
+        return join(homedir(), '.fleet-os');
+    if (process.platform === 'darwin')
+        return join(homedir(), 'Library', 'Application Support', 'fleet-os');
+    return '/var/lib/fleet-os';
+}
+/** Best-effort shell step: report what happened, never abort the teardown. */
+async function step(label, fn) {
+    process.stdout.write(`  ${glyph.info} ${label}… `);
+    try {
+        const detail = await fn();
+        console.log(detail ? c.dim(detail) : c.green('done'));
+    }
+    catch (err) {
+        console.log(c.yellow(`skipped — ${err.message.split('\n')[0]}`));
+    }
+}
+async function confirm(state) {
+    const who = state?.name ? c.bold(state.name) : 'this machine';
+    console.log(`  This removes ${who} from its fleet:\n` +
+        `    ${c.dim('·')} the background agent is stopped and disabled\n` +
+        `    ${c.dim('·')} Fleet containers on this host are removed\n` +
+        `    ${c.dim('·')} its credentials are deleted and revoked\n` +
+        `  ${c.dim('Services running here are rescheduled onto other nodes where possible.')}\n`);
+    if (!process.stdin.isTTY)
+        return false;
+    const { createInterface } = await import('node:readline/promises');
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const ans = await rl.question('  Unpair this machine? [y/N] ');
+        return ans.trim().toLowerCase() === 'y';
+    }
+    finally {
+        rl.close();
+    }
+}
+export const unpairCommand = {
+    async run(_args, flags) {
+        console.log(`\n  ${c.bold('Unpair this machine')}\n`);
+        const dir = stateDir();
+        const statePath = join(dir, 'agent.json');
+        // 1. Read the identity before anything destroys it.
+        let state = null;
+        if (await exists(statePath)) {
+            try {
+                state = JSON.parse(await readFile(statePath, 'utf8'));
+            }
+            catch {
+                console.log(c.dim(`  ${glyph.warn} ${statePath} is unreadable — continuing with local cleanup only`));
+            }
+        }
+        if (!state && !flags.force && !flags.f) {
+            throw new CliError(`No agent state at ${statePath} — this machine does not look paired.\n` +
+                `  Re-run with --force to clean up anyway.`, EXIT.usage);
+        }
+        const confirmed = flags.yes === true || flags.y === true;
+        if (!confirmed && !(await confirm(state))) {
+            console.log(c.dim('Unpair cancelled.'));
+            return;
+        }
+        const isWindows = process.platform === 'win32';
+        const isMac = process.platform === 'darwin';
+        // 2. Stop the agent first. Both the systemd unit (Restart=always) and the
+        //    launchd job restart the process on their own, so stopping without
+        //    disabling buys about five seconds.
+        await step('Stopping the Fleet agent', async () => {
+            if (isWindows) {
+                await execAsync('taskkill /IM fleet-agent.exe /F').catch(() => { });
+                return 'stopped';
+            }
+            if (isMac) {
+                const plist = join(homedir(), 'Library', 'LaunchAgents', 'dev.fleet-os.agent.plist');
+                if (await exists(plist)) {
+                    await execAsync(`launchctl unload ${JSON.stringify(plist)}`).catch(() => { });
+                    await rm(plist, { force: true }).catch(() => { });
+                }
+                await execAsync('pkill -f fleet-agent').catch(() => { });
+                return 'launchd job unloaded and removed';
+            }
+            // Linux: disable as well as stop, or the unit comes back on reboot. The
+            // unit is a system unit installed with sudo, so it takes sudo to remove.
+            await execAsync('systemctl disable --now fleet-agent').catch(() => execAsync('sudo -n systemctl disable --now fleet-agent')).catch(() => execAsync('pkill -f fleet-agent'));
+            return 'systemd unit stopped and disabled';
+        });
+        // 3. Tell the control plane, so services running here are rescheduled onto
+        //    other nodes *before* the local containers go away. Uses the operator's
+        //    CLI session: node removal is an owner action, and an agent token
+        //    deliberately cannot delete its own node.
+        if (state?.node_id && state?.fleet_id) {
+            await step('Removing this node from the fleet', async () => {
+                const { body } = await request('DELETE', `/fleets/${state.fleet_id}/nodes/${state.node_id}`);
+                const moved = body.evicted?.filter((e) => e.action === 'moved').length ?? 0;
+                const held = body.evicted?.filter((e) => e.action !== 'moved') ?? [];
+                const parts = [`removed as ${body.removed?.name ?? state.name ?? 'node'}`];
+                if (moved)
+                    parts.push(`${moved} service(s) rescheduled`);
+                if (held.length)
+                    parts.push(`${held.length} could not move (${held.map((h) => h.service).join(', ')})`);
+                return parts.join(', ');
+            });
+        }
+        else {
+            console.log(c.dim(`  ${glyph.warn} No node id in local state — skipping control plane removal.`) +
+                c.dim(`\n     Remove it from another machine with: `) +
+                c.cyan('fleet nodes rm <name> --force'));
+        }
+        // 4. Remove the local containers. Only Fleet's own: the name filter matches
+        //    what the agent creates, and anything else on this host is not ours.
+        await step('Removing Fleet containers', async () => {
+            const { stdout } = await execAsync('docker ps -aq --filter "name=fleet-"');
+            const ids = stdout.trim().split('\n').filter(Boolean);
+            if (!ids.length)
+                return 'none running';
+            await execAsync(`docker rm -f ${ids.join(' ')}`);
+            return `${ids.length} removed`;
+        });
+        // 5. Wipe the credential last, so a failure earlier on leaves the machine
+        //    in a state this command can be run against again.
+        await step(`Wiping credentials in ${dir}`, async () => {
+            if (!(await exists(dir)))
+                return 'nothing to remove';
+            await rm(dir, { recursive: true, force: true });
+            return 'deleted';
+        });
+        console.log(`\n${glyph.ok} ${c.green(c.bold('This machine is unpaired'))}`);
+        console.log(c.dim('  Docker is left running and is yours to stop or start as you like.'));
+        console.log(c.dim('  To pair it again: ') + c.cyan('fleet nodes pair') + c.dim(' on your control plane\n'));
+    },
+};
+/**
+ * `fleet agent <sub>` — host-local operations, grouped under the thing they act
+ * on. Only unpair for now; `fleet unpair` is the shorter spelling of the same
+ * action, since it is the one people reach for.
+ */
+export const agentCommand = {
+    async run(args, flags) {
+        const [sub, ...rest] = args;
+        if (sub === 'unpair')
+            return unpairCommand.run(rest, flags);
+        throw new CliError('usage: fleet agent unpair [--yes]', EXIT.usage);
+    },
+};

package/dist/index.js

@@ -43,6 +43,7 @@ const GROUPS = [
         'operating',
         [
             ['down <service>', 'Stop and tear down a service deployment'],
+            ['rm <service>', 'Permanently delete a service from the fleet'],
             ['validate [file]', 'Check a fleet.yaml without applying it'],
             ['reschedule <service>', 'Force a service to move'],
             ['restart <service>', 'Replace the current release on its node'],
@@ -50,6 +51,7 @@ const GROUPS = [
             ['nodes cordon <name>', 'Stop scheduling new work onto a node'],
             ['nodes uncordon <name>', 'Allow scheduling again'],
             ['nodes rm <name>', 'Revoke and remove a node'],
+            ['unpair', 'Remove this machine from its fleet, run on the machine'],
             ['alerts', 'List, add, and test alert rules'],
             ['auth login|logout|whoami', 'Sign in to a control plane'],
         ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadurajfleetos/cli",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Fleet OS command-line interface for deploying and orchestrating services on user-owned hardware",
   "type": "module",
   "license": "MIT",