@yadurajfleetos/cli 0.1.7 → 0.1.9

package/dist/commands/down.js

@@ -7,13 +7,30 @@
 import { request, requireFleet, CliError, EXIT } from '../api.js';
 import { c } from '../render.js';
 import { glyph } from '../ui.js';
-async function confirmTeardown(name) {
+/**
+ * Say what teardown actually does before doing it.
+ *
+ * The distinction people get wrong is `down` versus `rm`, so the prompt names it:
+ * the container goes, the service definition stays and can be redeployed. Where
+ * it is running is included because that is the machine whose Docker is about to
+ * change, and it is usually not the one this command is typed on.
+ *
+ * Non-interactive callers are taken as consenting. That is deliberate and is not
+ * how `rm` behaves — stopping a service is undone by deploying it again, so a
+ * scripted `fleet down` in a CI teardown step should not need --yes.
+ */
+async function confirmTeardown(service) {
     if (!process.stdin.isTTY)
         return true;
+    const where = service.current?.nodeName;
+    console.log(`\n  This stops ${c.bold(service.name)}${where ? ` on ${c.bold(where)}` : ''}:` +
+        `\n    ${c.dim('·')} its container is removed from that machine` +
+        `\n    ${c.dim('·')} the service definition is kept, so ${c.cyan('fleet deploy')}${c.dim(' brings it back')}` +
+        `\n  ${c.dim('To delete it outright, use `fleet rm` instead.')}\n`);
     const { createInterface } = await import('node:readline/promises');
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     try {
-        const ans = await rl.question(`  Stop and tear down ${c.bold(name)}? [y/N] `);
+        const ans = await rl.question(`  Stop and tear down ${c.bold(service.name)}? [y/N] `);
         return ans.trim().toLowerCase() === 'y';
     }
     finally {
@@ -22,16 +39,18 @@ async function confirmTeardown(name) {
 }
 export const downCommand = {
     async run(args, flags) {
-        const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+        // Before requireFleet, which reaches the control plane when no fleet is
+        // saved: a missing argument should not need the network to be reported.
         const [name] = args;
         if (!name)
             throw new CliError('usage: fleet down <service> [--yes]', EXIT.usage);
+        const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
         const { body: listBody } = await request('GET', `/fleets/${fleetId}/services`);
         const service = listBody.services.find((s) => s.name === name || s.id === name);
         if (!service) {
             throw new CliError(`No service called "${name}". Known: ${listBody.services.map((s) => s.name).join(', ') || 'none'}`, EXIT.usage);
         }
-        if (!flags.yes && !flags.y && !(await confirmTeardown(service.name))) {
+        if (!flags.yes && !flags.y && !(await confirmTeardown(service))) {
             console.log(c.dim('Teardown cancelled.'));
             return;
         }

package/dist/commands/index.js

@@ -7,11 +7,14 @@ import { doctorCommand } from './doctor.js';
 import { upCommand } from './up.js';
 import { openCommand } from './open.js';
 import { downCommand } from './down.js';
-import { applyCommand, deployCommand, deploymentsCommand, initCommand, logsCommand, restartCommand, rollbackCommand, rescheduleCommand, servicesCommand, validateCommand, whereCommand, } from './services.js';
+import { unpairCommand, agentCommand } from './unpair.js';
+import { secretsCommand } from './secrets.js';
+import { applyCommand, deployCommand, deploymentsCommand, initCommand, logsCommand, removeServiceCommand, restartCommand, rollbackCommand, rescheduleCommand, servicesCommand, validateCommand, whereCommand, } from './services.js';
 export const commands = {
     up: upCommand,
     open: openCommand,
     down: downCommand,
+    rm: removeServiceCommand,
     auth: authCommand,
     config: configCommand,
     use: useCommand,
@@ -31,4 +34,7 @@ export const commands = {
     rollback: rollbackCommand,
     events: eventsCommand,
     alerts: alertsCommand,
+    secrets: secretsCommand,
+    unpair: unpairCommand,
+    agent: agentCommand,
 };

package/dist/commands/nodes.js

@@ -56,8 +56,22 @@ export const nodesCommand = {
                 throw new CliError(`This revokes ${node.name}'s credentials and removes it from the fleet.\n` +
                     `  Anything pinned to it will have nowhere to run. Re-run with --force if that is intended.`, EXIT.usage);
             }
-            await request('DELETE', `/fleets/${fleetId}/nodes/${node.id}`);
+            const { body } = await request('DELETE', `/fleets/${fleetId}/nodes/${node.id}`);
+            if (flags.json)
+                return console.log(JSON.stringify(body, null, 2));
             console.log(`${node.name} removed and its agent credentials revoked`);
+            for (const e of body.evicted ?? []) {
+                if (e.action === 'moved') {
+                    console.log(c.dim(`  ${e.service} → ${e.toNodeName ?? 'another node'}`));
+                }
+                else {
+                    // Pinned and stranded services need saying out loud: the node is
+                    // gone and these did not find a new home.
+                    console.log(c.yellow(`  ${e.service} could not move — ${e.reason ?? e.action}`));
+                }
+            }
+            console.log(c.dim(`  To clean up that machine itself, run ` +
+                `${c.cyan('fleet unpair')}${c.dim(' on it.')}`));
             return;
         }
         throw new CliError('usage: fleet nodes [ls|pair|cordon|uncordon|rm]', EXIT.usage);

package/dist/commands/secrets.js

@@ -0,0 +1,117 @@
+/**
+ * fleet secrets — the fleet credential store.
+ *
+ * The one rule this command exists to enforce: a secret value never appears in
+ * `argv`. Arguments land in shell history, in `ps` output for every user on the
+ * box, and in CI logs — so `fleet secrets set KEY hunter2` is deliberately not
+ * a supported spelling. The value comes from a pipe or from a prompt with the
+ * echo off, and nothing here ever prints one back.
+ */
+import { request, requireFleet, CliError, EXIT } from '../api.js';
+import { c, table, relativeTime } from '../render.js';
+import { glyph } from '../ui.js';
+import { askSecret, canPrompt } from '../prompt.js';
+const KEY_PATTERN = /^[A-Z_][A-Z0-9_]{0,127}$/;
+/**
+ * Read the value from a pipe when there is one, otherwise ask for it.
+ *
+ * The piped form is what a script or a password manager uses:
+ *   pass show db/url | fleet secrets set DATABASE_URL
+ *
+ * Trailing newlines are stripped because every here-string and every `echo`
+ * adds one, and a credential with an invisible newline on the end fails
+ * authentication somewhere far away from here.
+ */
+async function readValue(key) {
+    if (!process.stdin.isTTY) {
+        const chunks = [];
+        for await (const chunk of process.stdin)
+            chunks.push(Buffer.from(chunk));
+        const piped = Buffer.concat(chunks).toString('utf8').replace(/\r?\n$/, '');
+        if (piped)
+            return piped;
+    }
+    if (!canPrompt()) {
+        throw new CliError(`No value for ${key}. Pipe it in, or run this where there is a terminal to type into:\n` +
+            `  echo -n "value" | fleet secrets set ${key}`, EXIT.usage);
+    }
+    return askSecret(`${key}`, { hint: 'the value is not echoed and is not stored in shell history' });
+}
+async function resolveServiceId(fleetId, name) {
+    const { body } = await request('GET', `/fleets/${fleetId}/services`);
+    const match = body.services.find((s) => s.name === name || s.id === name);
+    if (!match) {
+        throw new CliError(`No service called "${name}". Known: ${body.services.map((s) => s.name).join(', ') || 'none'}`, EXIT.usage);
+    }
+    return match;
+}
+export const secretsCommand = {
+    async run(args, flags) {
+        const [sub, key] = args;
+        const service = typeof flags.service === 'string' ? flags.service : undefined;
+        /* ── list ──────────────────────────────────────────────────── */
+        if (!sub || sub === 'ls' || sub === 'list') {
+            const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+            const { body } = await request('GET', `/fleets/${fleetId}/secrets`);
+            if (flags.json)
+                return console.log(JSON.stringify(body.secrets, null, 2));
+            if (!body.secrets.length) {
+                console.log('No secrets in this fleet.');
+                console.log(c.dim('  set one with `fleet secrets set DATABASE_URL`'));
+                return;
+            }
+            console.log(table(['key', 'scope', 'updated'], body.secrets.map((s) => [
+                s.key,
+                s.scope === 'service' ? `${c.dim('service:')}${s.service ?? '?'}` : c.dim('fleet'),
+                relativeTime(s.updatedAt),
+            ])));
+            console.log(c.dim(`\n  ${body.secrets.length} stored. Values cannot be read back — only replaced.`));
+            return;
+        }
+        /* ── set ───────────────────────────────────────────────────── */
+        if (sub === 'set') {
+            if (!key)
+                throw new CliError('usage: fleet secrets set <KEY> [--service <name>]', EXIT.usage);
+            if (!KEY_PATTERN.test(key)) {
+                throw new CliError(`"${key}" is not a usable environment variable name.\n` +
+                    `  Use upper snake case: A-Z, 0-9 and _, not starting with a digit.`, EXIT.usage);
+            }
+            // A third positional is almost always someone typing the value inline.
+            // Refuse it rather than accepting a credential into shell history.
+            if (args[2]) {
+                throw new CliError('Do not pass the value as an argument — it would be written to your shell history.\n' +
+                    `  Pipe it:   echo -n "value" | fleet secrets set ${key}\n` +
+                    `  Or type it: fleet secrets set ${key}`, EXIT.usage);
+            }
+            const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+            const target = service ? await resolveServiceId(fleetId, service) : null;
+            const value = await readValue(key);
+            const path = target
+                ? `/services/${target.id}/secrets/${encodeURIComponent(key)}`
+                : `/fleets/${fleetId}/secrets/${encodeURIComponent(key)}`;
+            const { body } = await request('PUT', path, { body: { value } });
+            const where = target ? ` for ${c.bold(target.name)}` : '';
+            console.log(`${glyph.ok} ${c.green(body.created ? 'stored' : 'replaced')}  ${c.bold(key)}${where}`);
+            console.log(c.dim('  takes effect on the next deploy of any service that references it'));
+            return;
+        }
+        /* ── rm ────────────────────────────────────────────────────── */
+        if (sub === 'rm' || sub === 'remove' || sub === 'delete') {
+            if (!key)
+                throw new CliError('usage: fleet secrets rm <KEY> [--service <name>]', EXIT.usage);
+            const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+            const target = service ? await resolveServiceId(fleetId, service) : null;
+            const path = target
+                ? `/services/${target.id}/secrets/${encodeURIComponent(key)}`
+                : `/fleets/${fleetId}/secrets/${encodeURIComponent(key)}`;
+            await request('DELETE', path);
+            const where = target ? ` override for ${c.bold(target.name)}` : '';
+            console.log(`${glyph.ok} ${c.yellow('removed')}  ${c.bold(key)}${where}`);
+            console.log(c.dim('  services already running keep the value they started with until redeployed'));
+            return;
+        }
+        throw new CliError('usage: fleet secrets [ls]\n' +
+            '       fleet secrets set <KEY> [--service <name>]\n' +
+            '       fleet secrets rm  <KEY> [--service <name>]', EXIT.usage);
+    },
+};

package/dist/commands/services.js

@@ -2,7 +2,10 @@ import { readFile, writeFile, access } from 'node:fs/promises';
 import { join } from 'node:path';
 import { request, requireFleet, CliError, EXIT } from '../api.js';
 import { c, table, statusColour, keyValues, relativeTime, mb } from '../render.js';
-import { task, splash, glyph } from '../ui.js';
+import { task, glyph } from '../ui.js';
+import { withLadder } from '../ladder.js';
+import { ask, canPrompt, confirm, selectOrThrow } from '../prompt.js';
+import { DEPLOY_STEPS, follow, phaseWalker, } from '../progress.js';
 const manifestPath = (given) => given ?? 'fleet.yaml';
 async function readManifest(path) {
     try {
@@ -53,7 +56,13 @@ export const applyCommand = {
     },
 };
 export const servicesCommand = {
-    async run(_args, flags) {
+    async run(args, flags) {
+        // `fleet services rm <name>` is the same action as `fleet rm <name>`;
+        // both spellings exist because one reads as a subcommand of the noun and
+        // the other as the short form an operator reaches for under pressure.
+        if (args[0] === 'rm' || args[0] === 'remove' || args[0] === 'delete') {
+            return removeServiceCommand.run(args.slice(1), flags);
+        }
         const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
         const { body } = await request('GET', `/fleets/${fleetId}/services`);
         if (flags.json)
@@ -173,16 +182,23 @@ export const deployCommand = {
             console.log(c.dim('Deployment cancelled. Re-run with --yes to skip confirmation.'));
             return;
         }
-        const body = await splash(`deploying ${c.bold(service.name)}${gitSha ? c.dim(` at ${gitSha.slice(0, 7)}`) : ''}`, async () => (await request('POST', `/services/${service.id}/deploy`, { body: { gitSha } })).body, {
-            // What the request involves, not a stage it has reached — the call is a
-            // single synchronous POST and the CLI cannot see inside it.
-            hints: [
-                'scoring every online node on headroom, reliability and load',
-                'building for every architecture an eligible node runs',
-                'the first multi-arch build is the slow one; layers cache after it',
-                'pushing the image to the fleet registry',
-            ],
-            done: (b) => `built and scheduled onto ${c.bold(b.placedOn.name)} ${c.dim(`score ${b.score?.toFixed(3)}`)}`,
+        const body = await withLadder(DEPLOY_STEPS, async (ladder) => {
+            const walker = phaseWalker(ladder);
+            const progress = follow(service.id, (p) => walker.apply(p), {
+                onUnavailable: () => ladder.note(c.dim('live progress unavailable; continuing with the deploy request')),
+            });
+            try {
+                const result = (await request('POST', `/services/${service.id}/deploy`, { body: { gitSha } })).body;
+                walker.finish(`scheduled onto ${result.placedOn.name}`);
+                return result;
+            }
+            finally {
+                await progress.stop();
+            }
+        }, {
+            mark: true,
+            title: `deploying ${service.name}${gitSha ? ` at ${gitSha.slice(0, 7)}` : ''}`,
+            onCancel: `deploy is still running on the control plane; inspect with fleet deployments ${service.name}`,
         });
         if (flags.json)
             return console.log(JSON.stringify(body, null, 2));
@@ -363,3 +379,52 @@ export const initCommand = {
         console.log(c.dim(`\n  …or just run: fleet up`));
     },
 };
+/**
+ * fleet rm <service> / fleet services rm <service> — permanently undeploy.
+ *
+ * Distinct from `fleet down`, which stops the workload but keeps the service
+ * definition so it can be redeployed. This removes the definition too, which
+ * is not recoverable from the control plane, so the confirmation is required
+ * rather than best-effort: a non-interactive caller must pass --yes explicitly
+ * instead of having silence taken as consent.
+ */
+export const removeServiceCommand = {
+    async run(args, flags) {
+        // Before requireFleet, which reaches the control plane when no fleet is
+        // saved: a missing argument is a usage error and should not depend on the
+        // network being up to say so.
+        const [name] = args;
+        if (!name)
+            throw new CliError('usage: fleet rm <service> [--yes]', EXIT.usage);
+        const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+        const service = await findService(fleetId, name);
+        const confirmed = flags.yes === true || flags.y === true;
+        if (!confirmed) {
+            if (!process.stdin.isTTY) {
+                throw new CliError(`Deleting "${service.name}" is permanent. Re-run with --yes to confirm.`, EXIT.usage);
+            }
+            const { createInterface } = await import('node:readline/promises');
+            const rl = createInterface({ input: process.stdin, output: process.stdout });
+            try {
+                console.log(`\n  This permanently deletes ${c.bold(service.name)} from the fleet:` +
+                    `\n    ${c.dim('·')} its containers are removed from the node it runs on` +
+                    `\n    ${c.dim('·')} its deployment history and URL are released` +
+                    `\n  ${c.dim('To stop it without deleting it, use `fleet down` instead.')}\n`);
+                const ans = await rl.question(`  Type the service name to confirm [${c.dim(service.name)}]: `);
+                if (ans.trim() !== service.name) {
+                    console.log(c.dim('Delete cancelled.'));
+                    return;
+                }
+            }
+            finally {
+                rl.close();
+            }
+        }
+        const { body } = await request('DELETE', `/services/${service.id}`);
+        if (flags.json)
+            return console.log(JSON.stringify(body, null, 2));
+        console.log(`${glyph.ok} ${c.red('deleted')}  ${c.bold(body.service)}`);
+        if (body.note)
+            console.log(c.dim(`  ${body.note}`));
+    },
+};

package/dist/commands/unpair.js

@@ -0,0 +1,189 @@
+/**
+ * fleet unpair — take *this* machine out of a fleet, from the machine itself.
+ *
+ * The counterpart to `fleet nodes rm`, which is run by an operator elsewhere.
+ * This one has to be run on the host because only the host can stop its own
+ * daemon, remove its own containers, and delete its own credential file.
+ *
+ * Order matters and is the whole point of the command:
+ *
+ *   1. read local state — the node id is needed before the file is deleted
+ *   2. stop the agent, and disable it so a reboot does not resurrect it
+ *   3. tell the control plane, which reschedules the workloads elsewhere
+ *   4. remove the local containers
+ *   5. wipe the credential
+ *
+ * The agent is stopped first because it reconciles on a timer: with it still
+ * running, containers removed in step 4 are recreated seconds later, and its
+ * runtime check may relaunch Docker underneath you.
+ */
+import { rm, access, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { exec } from 'node:child_process';
+import { promisify } from 'node:util';
+import { request, CliError, EXIT } from '../api.js';
+import { c } from '../render.js';
+import { glyph } from '../ui.js';
+const execAsync = promisify(exec);
+async function exists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Where the agent keeps its state, mirroring state.DefaultPath() in the agent
+ * and the STATE_DIR logic in scripts/install.sh. These are per-platform and
+ * genuinely different — guessing /var/lib/fleet-os everywhere would report a
+ * successful wipe while leaving the credential on disk.
+ */
+function stateDir() {
+    const override = process.env.FLEET_STATE_DIR;
+    if (override)
+        return override;
+    if (process.platform === 'win32')
+        return join(homedir(), '.fleet-os');
+    if (process.platform === 'darwin')
+        return join(homedir(), 'Library', 'Application Support', 'fleet-os');
+    return '/var/lib/fleet-os';
+}
+/** Best-effort shell step: report what happened, never abort the teardown. */
+async function step(label, fn) {
+    process.stdout.write(`  ${glyph.info} ${label}… `);
+    try {
+        const detail = await fn();
+        console.log(detail ? c.dim(detail) : c.green('done'));
+    }
+    catch (err) {
+        console.log(c.yellow(`skipped — ${err.message.split('\n')[0]}`));
+    }
+}
+async function confirm(state) {
+    const who = state?.name ? c.bold(state.name) : 'this machine';
+    console.log(`  This removes ${who} from its fleet:\n` +
+        `    ${c.dim('·')} the background agent is stopped and disabled\n` +
+        `    ${c.dim('·')} Fleet containers on this host are removed\n` +
+        `    ${c.dim('·')} its credentials are deleted and revoked\n` +
+        `  ${c.dim('Services running here are rescheduled onto other nodes where possible.')}\n`);
+    if (!process.stdin.isTTY)
+        return false;
+    const { createInterface } = await import('node:readline/promises');
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const ans = await rl.question('  Unpair this machine? [y/N] ');
+        return ans.trim().toLowerCase() === 'y';
+    }
+    finally {
+        rl.close();
+    }
+}
+export const unpairCommand = {
+    async run(_args, flags) {
+        console.log(`\n  ${c.bold('Unpair this machine')}\n`);
+        const dir = stateDir();
+        const statePath = join(dir, 'agent.json');
+        // 1. Read the identity before anything destroys it.
+        let state = null;
+        if (await exists(statePath)) {
+            try {
+                state = JSON.parse(await readFile(statePath, 'utf8'));
+            }
+            catch {
+                console.log(c.dim(`  ${glyph.warn} ${statePath} is unreadable — continuing with local cleanup only`));
+            }
+        }
+        if (!state && !flags.force && !flags.f) {
+            throw new CliError(`No agent state at ${statePath} — this machine does not look paired.\n` +
+                `  Re-run with --force to clean up anyway.`, EXIT.usage);
+        }
+        const confirmed = flags.yes === true || flags.y === true;
+        if (!confirmed && !(await confirm(state))) {
+            console.log(c.dim('Unpair cancelled.'));
+            return;
+        }
+        const isWindows = process.platform === 'win32';
+        const isMac = process.platform === 'darwin';
+        // 2. Stop the agent first. Both the systemd unit (Restart=always) and the
+        //    launchd job restart the process on their own, so stopping without
+        //    disabling buys about five seconds.
+        await step('Stopping the Fleet agent', async () => {
+            if (isWindows) {
+                await execAsync('taskkill /IM fleet-agent.exe /F').catch(() => { });
+                return 'stopped';
+            }
+            if (isMac) {
+                const plist = join(homedir(), 'Library', 'LaunchAgents', 'dev.fleet-os.agent.plist');
+                if (await exists(plist)) {
+                    await execAsync(`launchctl unload ${JSON.stringify(plist)}`).catch(() => { });
+                    await rm(plist, { force: true }).catch(() => { });
+                }
+                await execAsync('pkill -f fleet-agent').catch(() => { });
+                return 'launchd job unloaded and removed';
+            }
+            // Linux: disable as well as stop, or the unit comes back on reboot. The
+            // unit is a system unit installed with sudo, so it takes sudo to remove.
+            await execAsync('systemctl disable --now fleet-agent').catch(() => execAsync('sudo -n systemctl disable --now fleet-agent')).catch(() => execAsync('pkill -f fleet-agent'));
+            return 'systemd unit stopped and disabled';
+        });
+        // 3. Tell the control plane, so services running here are rescheduled onto
+        //    other nodes *before* the local containers go away. Uses the operator's
+        //    CLI session: node removal is an owner action, and an agent token
+        //    deliberately cannot delete its own node.
+        if (state?.node_id && state?.fleet_id) {
+            await step('Removing this node from the fleet', async () => {
+                const { body } = await request('DELETE', `/fleets/${state.fleet_id}/nodes/${state.node_id}`);
+                const moved = body.evicted?.filter((e) => e.action === 'moved').length ?? 0;
+                const held = body.evicted?.filter((e) => e.action !== 'moved') ?? [];
+                const parts = [`removed as ${body.removed?.name ?? state.name ?? 'node'}`];
+                if (moved)
+                    parts.push(`${moved} service(s) rescheduled`);
+                if (held.length)
+                    parts.push(`${held.length} could not move (${held.map((h) => h.service).join(', ')})`);
+                return parts.join(', ');
+            });
+        }
+        else {
+            console.log(c.dim(`  ${glyph.warn} No node id in local state — skipping control plane removal.`) +
+                c.dim(`\n     Remove it from another machine with: `) +
+                c.cyan('fleet nodes rm <name> --force'));
+        }
+        // 4. Remove the local containers. Only Fleet's own: the name filter matches
+        //    what the agent creates, and anything else on this host is not ours.
+        await step('Removing Fleet containers', async () => {
+            const { stdout } = await execAsync('docker ps -aq --filter "name=fleet-"');
+            const ids = stdout.trim().split('\n').filter(Boolean);
+            if (!ids.length)
+                return 'none running';
+            await execAsync(`docker rm -f ${ids.join(' ')}`);
+            return `${ids.length} removed`;
+        });
+        // 5. Wipe the credential last, so a failure earlier on leaves the machine
+        //    in a state this command can be run against again.
+        await step(`Wiping credentials in ${dir}`, async () => {
+            if (!(await exists(dir)))
+                return 'nothing to remove';
+            await rm(dir, { recursive: true, force: true });
+            return 'deleted';
+        });
+        console.log(`\n${glyph.ok} ${c.green(c.bold('This machine is unpaired'))}`);
+        console.log(c.dim('  Docker is left running and is yours to stop or start as you like.'));
+        console.log(c.dim('  To pair it again: ') + c.cyan('fleet nodes pair') + c.dim(' on your control plane\n'));
+    },
+};
+/**
+ * `fleet agent <sub>` — host-local operations, grouped under the thing they act
+ * on. Only unpair for now; `fleet unpair` is the shorter spelling of the same
+ * action, since it is the one people reach for.
+ */
+export const agentCommand = {
+    async run(args, flags) {
+        const [sub, ...rest] = args;
+        if (sub === 'unpair')
+            return unpairCommand.run(rest, flags);
+        throw new CliError('usage: fleet agent unpair [--yes]', EXIT.usage);
+    },
+};

package/dist/commands/up.js

@@ -11,7 +11,9 @@ import { readFile, writeFile, access } from 'node:fs/promises';
 import { join } from 'node:path';
 import { request, requireFleet, CliError, EXIT } from '../api.js';
 import { c } from '../render.js';
-import { task, splash, glyph } from '../ui.js';
+import { task, glyph } from '../ui.js';
+import { withLadder } from '../ladder.js';
+import { DEPLOY_STEPS, follow, phaseWalker } from '../progress.js';
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export const upCommand = {
     async run(args, flags) {
@@ -63,14 +65,23 @@ export const upCommand = {
         }
         // ── Step 4: deploy ────────────────────────────────────────────────
         const gitSha = typeof flags.sha === 'string' ? flags.sha : undefined;
-        const deployResult = await splash(`deploying ${c.bold(service.name)}`, async () => (await request('POST', `/services/${service.id}/deploy`, { body: { gitSha } })).body, {
-            hints: [
-                'scoring every online node on headroom, reliability and load',
-                'building for every architecture an eligible node runs',
-                'the first multi-arch build is the slow one; layers cache after it',
-                'pushing the image to the fleet registry',
-            ],
-            done: (b) => `built and scheduled onto ${c.bold(b.placedOn.name)} ${c.dim(`score ${b.score?.toFixed(3)}`)}`,
+        const deployResult = await withLadder(DEPLOY_STEPS, async (ladder) => {
+            const walker = phaseWalker(ladder);
+            const progress = follow(service.id, (p) => walker.apply(p), {
+                onUnavailable: () => ladder.note(c.dim('live progress unavailable; continuing with the deploy request')),
+            });
+            try {
+                const result = (await request('POST', `/services/${service.id}/deploy`, { body: { gitSha } })).body;
+                walker.finish(`scheduled onto ${result.placedOn.name}`);
+                return result;
+            }
+            finally {
+                await progress.stop();
+            }
+        }, {
+            mark: true,
+            title: `deploying ${service.name}`,
+            onCancel: `deploy is still running on the control plane; inspect with fleet deployments ${service.name}`,
         });
         for (const w of deployResult.warnings ?? []) {
             console.log(`${glyph.warn} ${c.yellow('warning')}  ${w}`);

package/dist/index.js

@@ -43,13 +43,18 @@ const GROUPS = [
         'operating',
         [
             ['down <service>', 'Stop and tear down a service deployment'],
+            ['rm <service>', 'Permanently delete a service from the fleet'],
             ['validate [file]', 'Check a fleet.yaml without applying it'],
             ['reschedule <service>', 'Force a service to move'],
             ['restart <service>', 'Replace the current release on its node'],
             ['rollback <service> [release]', 'Restore the previous or selected release'],
+            ['secrets', 'List the fleet secret store'],
+            ['secrets set <KEY>', 'Store a credential; the value is never echoed or logged'],
+            ['secrets rm <KEY>', 'Remove a stored credential'],
             ['nodes cordon <name>', 'Stop scheduling new work onto a node'],
             ['nodes uncordon <name>', 'Allow scheduling again'],
             ['nodes rm <name>', 'Revoke and remove a node'],
+            ['unpair', 'Remove this machine from its fleet, run on the machine'],
             ['alerts', 'List, add, and test alert rules'],
             ['auth login|logout|whoami', 'Sign in to a control plane'],
         ],