@yadurajfleetos/cli 0.1.8 → 0.1.9

package/dist/commands/index.js

@@ -8,6 +8,7 @@ import { upCommand } from './up.js';
 import { openCommand } from './open.js';
 import { downCommand } from './down.js';
 import { unpairCommand, agentCommand } from './unpair.js';
+import { secretsCommand } from './secrets.js';
 import { applyCommand, deployCommand, deploymentsCommand, initCommand, logsCommand, removeServiceCommand, restartCommand, rollbackCommand, rescheduleCommand, servicesCommand, validateCommand, whereCommand, } from './services.js';
 export const commands = {
     up: upCommand,
@@ -33,6 +34,7 @@ export const commands = {
     rollback: rollbackCommand,
     events: eventsCommand,
     alerts: alertsCommand,
+    secrets: secretsCommand,
     unpair: unpairCommand,
     agent: agentCommand,
 };

package/dist/commands/secrets.js

@@ -0,0 +1,117 @@
+/**
+ * fleet secrets — the fleet credential store.
+ *
+ * The one rule this command exists to enforce: a secret value never appears in
+ * `argv`. Arguments land in shell history, in `ps` output for every user on the
+ * box, and in CI logs — so `fleet secrets set KEY hunter2` is deliberately not
+ * a supported spelling. The value comes from a pipe or from a prompt with the
+ * echo off, and nothing here ever prints one back.
+ */
+import { request, requireFleet, CliError, EXIT } from '../api.js';
+import { c, table, relativeTime } from '../render.js';
+import { glyph } from '../ui.js';
+import { askSecret, canPrompt } from '../prompt.js';
+const KEY_PATTERN = /^[A-Z_][A-Z0-9_]{0,127}$/;
+/**
+ * Read the value from a pipe when there is one, otherwise ask for it.
+ *
+ * The piped form is what a script or a password manager uses:
+ *   pass show db/url | fleet secrets set DATABASE_URL
+ *
+ * Trailing newlines are stripped because every here-string and every `echo`
+ * adds one, and a credential with an invisible newline on the end fails
+ * authentication somewhere far away from here.
+ */
+async function readValue(key) {
+    if (!process.stdin.isTTY) {
+        const chunks = [];
+        for await (const chunk of process.stdin)
+            chunks.push(Buffer.from(chunk));
+        const piped = Buffer.concat(chunks).toString('utf8').replace(/\r?\n$/, '');
+        if (piped)
+            return piped;
+    }
+    if (!canPrompt()) {
+        throw new CliError(`No value for ${key}. Pipe it in, or run this where there is a terminal to type into:\n` +
+            `  echo -n "value" | fleet secrets set ${key}`, EXIT.usage);
+    }
+    return askSecret(`${key}`, { hint: 'the value is not echoed and is not stored in shell history' });
+}
+async function resolveServiceId(fleetId, name) {
+    const { body } = await request('GET', `/fleets/${fleetId}/services`);
+    const match = body.services.find((s) => s.name === name || s.id === name);
+    if (!match) {
+        throw new CliError(`No service called "${name}". Known: ${body.services.map((s) => s.name).join(', ') || 'none'}`, EXIT.usage);
+    }
+    return match;
+}
+export const secretsCommand = {
+    async run(args, flags) {
+        const [sub, key] = args;
+        const service = typeof flags.service === 'string' ? flags.service : undefined;
+        /* ── list ──────────────────────────────────────────────────── */
+        if (!sub || sub === 'ls' || sub === 'list') {
+            const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+            const { body } = await request('GET', `/fleets/${fleetId}/secrets`);
+            if (flags.json)
+                return console.log(JSON.stringify(body.secrets, null, 2));
+            if (!body.secrets.length) {
+                console.log('No secrets in this fleet.');
+                console.log(c.dim('  set one with `fleet secrets set DATABASE_URL`'));
+                return;
+            }
+            console.log(table(['key', 'scope', 'updated'], body.secrets.map((s) => [
+                s.key,
+                s.scope === 'service' ? `${c.dim('service:')}${s.service ?? '?'}` : c.dim('fleet'),
+                relativeTime(s.updatedAt),
+            ])));
+            console.log(c.dim(`\n  ${body.secrets.length} stored. Values cannot be read back — only replaced.`));
+            return;
+        }
+        /* ── set ───────────────────────────────────────────────────── */
+        if (sub === 'set') {
+            if (!key)
+                throw new CliError('usage: fleet secrets set <KEY> [--service <name>]', EXIT.usage);
+            if (!KEY_PATTERN.test(key)) {
+                throw new CliError(`"${key}" is not a usable environment variable name.\n` +
+                    `  Use upper snake case: A-Z, 0-9 and _, not starting with a digit.`, EXIT.usage);
+            }
+            // A third positional is almost always someone typing the value inline.
+            // Refuse it rather than accepting a credential into shell history.
+            if (args[2]) {
+                throw new CliError('Do not pass the value as an argument — it would be written to your shell history.\n' +
+                    `  Pipe it:   echo -n "value" | fleet secrets set ${key}\n` +
+                    `  Or type it: fleet secrets set ${key}`, EXIT.usage);
+            }
+            const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+            const target = service ? await resolveServiceId(fleetId, service) : null;
+            const value = await readValue(key);
+            const path = target
+                ? `/services/${target.id}/secrets/${encodeURIComponent(key)}`
+                : `/fleets/${fleetId}/secrets/${encodeURIComponent(key)}`;
+            const { body } = await request('PUT', path, { body: { value } });
+            const where = target ? ` for ${c.bold(target.name)}` : '';
+            console.log(`${glyph.ok} ${c.green(body.created ? 'stored' : 'replaced')}  ${c.bold(key)}${where}`);
+            console.log(c.dim('  takes effect on the next deploy of any service that references it'));
+            return;
+        }
+        /* ── rm ────────────────────────────────────────────────────── */
+        if (sub === 'rm' || sub === 'remove' || sub === 'delete') {
+            if (!key)
+                throw new CliError('usage: fleet secrets rm <KEY> [--service <name>]', EXIT.usage);
+            const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+            const target = service ? await resolveServiceId(fleetId, service) : null;
+            const path = target
+                ? `/services/${target.id}/secrets/${encodeURIComponent(key)}`
+                : `/fleets/${fleetId}/secrets/${encodeURIComponent(key)}`;
+            await request('DELETE', path);
+            const where = target ? ` override for ${c.bold(target.name)}` : '';
+            console.log(`${glyph.ok} ${c.yellow('removed')}  ${c.bold(key)}${where}`);
+            console.log(c.dim('  services already running keep the value they started with until redeployed'));
+            return;
+        }
+        throw new CliError('usage: fleet secrets [ls]\n' +
+            '       fleet secrets set <KEY> [--service <name>]\n' +
+            '       fleet secrets rm  <KEY> [--service <name>]', EXIT.usage);
+    },
+};

package/dist/commands/services.js

@@ -2,7 +2,10 @@ import { readFile, writeFile, access } from 'node:fs/promises';
 import { join } from 'node:path';
 import { request, requireFleet, CliError, EXIT } from '../api.js';
 import { c, table, statusColour, keyValues, relativeTime, mb } from '../render.js';
-import { task, splash, glyph } from '../ui.js';
+import { task, glyph } from '../ui.js';
+import { withLadder } from '../ladder.js';
+import { ask, canPrompt, confirm, selectOrThrow } from '../prompt.js';
+import { DEPLOY_STEPS, follow, phaseWalker, } from '../progress.js';
 const manifestPath = (given) => given ?? 'fleet.yaml';
 async function readManifest(path) {
     try {
@@ -179,16 +182,23 @@ export const deployCommand = {
             console.log(c.dim('Deployment cancelled. Re-run with --yes to skip confirmation.'));
             return;
         }
-        const body = await splash(`deploying ${c.bold(service.name)}${gitSha ? c.dim(` at ${gitSha.slice(0, 7)}`) : ''}`, async () => (await request('POST', `/services/${service.id}/deploy`, { body: { gitSha } })).body, {
-            // What the request involves, not a stage it has reached — the call is a
-            // single synchronous POST and the CLI cannot see inside it.
-            hints: [
-                'scoring every online node on headroom, reliability and load',
-                'building for every architecture an eligible node runs',
-                'the first multi-arch build is the slow one; layers cache after it',
-                'pushing the image to the fleet registry',
-            ],
-            done: (b) => `built and scheduled onto ${c.bold(b.placedOn.name)} ${c.dim(`score ${b.score?.toFixed(3)}`)}`,
+        const body = await withLadder(DEPLOY_STEPS, async (ladder) => {
+            const walker = phaseWalker(ladder);
+            const progress = follow(service.id, (p) => walker.apply(p), {
+                onUnavailable: () => ladder.note(c.dim('live progress unavailable; continuing with the deploy request')),
+            });
+            try {
+                const result = (await request('POST', `/services/${service.id}/deploy`, { body: { gitSha } })).body;
+                walker.finish(`scheduled onto ${result.placedOn.name}`);
+                return result;
+            }
+            finally {
+                await progress.stop();
+            }
+        }, {
+            mark: true,
+            title: `deploying ${service.name}${gitSha ? ` at ${gitSha.slice(0, 7)}` : ''}`,
+            onCancel: `deploy is still running on the control plane; inspect with fleet deployments ${service.name}`,
         });
         if (flags.json)
             return console.log(JSON.stringify(body, null, 2));

package/dist/commands/up.js

@@ -11,7 +11,9 @@ import { readFile, writeFile, access } from 'node:fs/promises';
 import { join } from 'node:path';
 import { request, requireFleet, CliError, EXIT } from '../api.js';
 import { c } from '../render.js';
-import { task, splash, glyph } from '../ui.js';
+import { task, glyph } from '../ui.js';
+import { withLadder } from '../ladder.js';
+import { DEPLOY_STEPS, follow, phaseWalker } from '../progress.js';
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export const upCommand = {
     async run(args, flags) {
@@ -63,14 +65,23 @@ export const upCommand = {
         }
         // ── Step 4: deploy ────────────────────────────────────────────────
         const gitSha = typeof flags.sha === 'string' ? flags.sha : undefined;
-        const deployResult = await splash(`deploying ${c.bold(service.name)}`, async () => (await request('POST', `/services/${service.id}/deploy`, { body: { gitSha } })).body, {
-            hints: [
-                'scoring every online node on headroom, reliability and load',
-                'building for every architecture an eligible node runs',
-                'the first multi-arch build is the slow one; layers cache after it',
-                'pushing the image to the fleet registry',
-            ],
-            done: (b) => `built and scheduled onto ${c.bold(b.placedOn.name)} ${c.dim(`score ${b.score?.toFixed(3)}`)}`,
+        const deployResult = await withLadder(DEPLOY_STEPS, async (ladder) => {
+            const walker = phaseWalker(ladder);
+            const progress = follow(service.id, (p) => walker.apply(p), {
+                onUnavailable: () => ladder.note(c.dim('live progress unavailable; continuing with the deploy request')),
+            });
+            try {
+                const result = (await request('POST', `/services/${service.id}/deploy`, { body: { gitSha } })).body;
+                walker.finish(`scheduled onto ${result.placedOn.name}`);
+                return result;
+            }
+            finally {
+                await progress.stop();
+            }
+        }, {
+            mark: true,
+            title: `deploying ${service.name}`,
+            onCancel: `deploy is still running on the control plane; inspect with fleet deployments ${service.name}`,
         });
         for (const w of deployResult.warnings ?? []) {
             console.log(`${glyph.warn} ${c.yellow('warning')}  ${w}`);

package/dist/index.js

@@ -48,6 +48,9 @@ const GROUPS = [
             ['reschedule <service>', 'Force a service to move'],
             ['restart <service>', 'Replace the current release on its node'],
             ['rollback <service> [release]', 'Restore the previous or selected release'],
+            ['secrets', 'List the fleet secret store'],
+            ['secrets set <KEY>', 'Store a credential; the value is never echoed or logged'],
+            ['secrets rm <KEY>', 'Remove a stored credential'],
             ['nodes cordon <name>', 'Stop scheduling new work onto a node'],
             ['nodes uncordon <name>', 'Allow scheduling again'],
             ['nodes rm <name>', 'Revoke and remove a node'],

package/dist/ladder.js

@@ -0,0 +1,290 @@
+/**
+ * A progress ladder: several named steps sharing one redraw region, each
+ * settling in place as it completes.
+ *
+ * This exists because a stack of independent spinners cannot answer the only
+ * question an operator has during a four-minute deploy — where am I. Completed
+ * steps stay on screen, the active step carries the clock, and the steps still to
+ * come are listed from the start, so the shape of the whole operation is legible
+ * before it has finished.
+ *
+ * The two rules from ui.ts still hold. Everything here goes to stderr, so `--json`
+ * on stdout stays pipeable into jq. And every animated form has a plain-line
+ * transcript equivalent, so a CI log reads as a sequence of events rather than as
+ * a smear of cursor escapes.
+ */
+import { c, cursor, glyphs, truncate } from './render.js';
+import { MARK_HEIGHT, markFrame, PEER_COUNT } from './mark.js';
+import { animated, claimRegion, duration, elapsed, glyph, hookCursorRestore, isQuiet, releaseRegion, setInterruptHandler, tickFor, width, } from './ui.js';
+const err = process.stderr;
+/**
+ * The live ladder, if there is one. Prompts need to find it in order to step
+ * aside for it; threading it through every call site instead would mean every
+ * command that can prompt has to know whether it is inside a ladder.
+ */
+let current = null;
+export const activeLadder = () => current;
+const screenRows = () => err.rows || process.stdout.rows || 24;
+export function ladder(steps, opts = {}) {
+    const rows = steps.map((step) => ({ ...step, state: 'todo' }));
+    const at = (key) => rows.find((row) => row.key === key);
+    // The mark is the first thing to go when the terminal is short: the steps carry
+    // the information, the mesh only carries the brand.
+    const withMark = Boolean(opts.mark) && screenRows() >= MARK_HEIGHT + rows.length + 5;
+    // One spare row for the detail line that appears under the active step.
+    const height = (withMark ? MARK_HEIGHT + 1 : 0) + rows.length + 1;
+    const indent = withMark ? '  ' : '';
+    const owner = {};
+    // claimRegion mutates, so it stays last: a ladder that is too tall to redraw
+    // must not take ownership on its way to the transcript fallback.
+    const live = animated() && !isQuiet() && screenRows() >= height + 2 && claimRegion(owner);
+    const tick = tickFor(height);
+    let ticks = 0;
+    let phase = 0;
+    let painted = [];
+    let timer;
+    let closed = false;
+    let lastTranscriptDetail = 0;
+    const took = (row) => row.state === 'active' ? elapsed(row.startedAt ?? Date.now()) : duration(row.took ?? 0);
+    const render = (row, spin) => {
+        const marker = row.state === 'active'
+            ? c.signal(spin)
+            : row.state === 'done'
+                ? glyph.ok
+                : row.state === 'fail'
+                    ? glyph.fail
+                    : glyph.pending;
+        const dimmed = row.state === 'todo' || row.state === 'skip';
+        const label = dimmed ? c.dim(row.label) : row.label;
+        const summary = row.summary ? `  ${c.dim(row.summary)}` : '';
+        return `${marker} ${label}${summary}${took(row)}`;
+    };
+    const frame = () => {
+        const spin = glyphs.frames[ticks % glyphs.frames.length];
+        const body = rows.flatMap((row) => {
+            const out = [`${indent}${render(row, spin)}`];
+            if (row.state === 'active' && row.detail)
+                out.push(`${indent}  ${c.dim(`${glyphs.branch} ${row.detail}`)}`);
+            return out;
+        });
+        const head = withMark
+            ? [
+                ...markFrame(phase).map((line, i) => `  ${line}${i === 2 && opts.title ? `    ${c.bold(opts.title)}` : ''}`),
+                '',
+            ]
+            : [];
+        return [...head, ...body].map((line) => truncate(line, width()));
+    };
+    /**
+     * Rewrite only the rows that moved, batched into a single write. A full repaint
+     * of a nine-row region twelve times a second is visible as flicker over SSH,
+     * and most frames change one row.
+     */
+    const paint = (lines) => {
+        if (!lines.length)
+            return;
+        if (painted.length !== lines.length) {
+            // The row count changed, so a partial rewrite would orphan rows below.
+            err.write((painted.length ? cursor.up(painted.length) + '\r' + cursor.clearBelow() : '') +
+                lines.join('\n') +
+                '\n');
+            painted = lines;
+            return;
+        }
+        let first = -1;
+        let last = -1;
+        for (let i = 0; i < lines.length; i++) {
+            if (lines[i] !== painted[i]) {
+                if (first < 0)
+                    first = i;
+                last = i;
+            }
+        }
+        // Nothing moved: leave the terminal completely alone.
+        if (first < 0)
+            return;
+        let out = cursor.up(lines.length - first);
+        for (let i = first; i <= last; i++) {
+            if (lines[i] !== painted[i])
+                out += cursor.clearLine() + lines[i];
+            out += '\n';
+        }
+        // Back to where the region ends, without a newline that could scroll it.
+        const below = lines.length - 1 - last;
+        if (below > 0)
+            out += cursor.down(below);
+        err.write(out);
+        painted = lines;
+    };
+    const erase = () => {
+        if (!painted.length)
+            return;
+        err.write(cursor.up(painted.length) + '\r' + cursor.clearBelow());
+        painted = [];
+    };
+    const advance = () => {
+        ticks += 1;
+        // Scale the pulse by the tick so it travels at the same speed on a slow link.
+        phase = (phase + 0.25 * (tick / 80)) % PEER_COUNT;
+        paint(frame());
+    };
+    const start = () => {
+        timer = setInterval(advance, tick);
+        timer.unref?.();
+    };
+    /** One transcript line per transition — the same rule the spinner follows. */
+    const transcript = (line) => {
+        if (!isQuiet())
+            err.write(`${line}\n`);
+    };
+    const api = {
+        begin(key, label) {
+            const row = at(key);
+            if (!row)
+                return;
+            if (label)
+                row.label = label;
+            row.state = 'active';
+            row.startedAt = Date.now();
+            row.detail = undefined;
+            if (live)
+                paint(frame());
+            else
+                transcript(`${c.dim(glyphs.stepActive)} ${row.label}…`);
+        },
+        detail(key, text) {
+            const row = at(key);
+            if (!row || row.state !== 'active' || row.detail === text)
+                return;
+            row.detail = text;
+            if (live) {
+                paint(frame());
+                return;
+            }
+            // Without a redraw region every sub-step would be its own line, and a build
+            // emits hundreds. Keep a captured log alive without flooding it.
+            if (Date.now() - lastTranscriptDetail < 10_000)
+                return;
+            lastTranscriptDetail = Date.now();
+            transcript(`  ${c.dim(`${glyphs.branch} ${text}`)}`);
+        },
+        done(key, summary) {
+            const row = at(key);
+            if (!row)
+                return;
+            row.took = Date.now() - (row.startedAt ?? Date.now());
+            row.state = 'done';
+            row.summary = summary;
+            row.detail = undefined;
+            if (live)
+                paint(frame());
+            else
+                transcript(`${glyph.ok} ${row.label}${summary ? ` — ${summary}` : ''}${took(row)}`);
+        },
+        skip(key, why) {
+            const row = at(key);
+            if (!row)
+                return;
+            row.state = 'skip';
+            row.summary = why ?? 'skipped';
+            row.detail = undefined;
+            if (live)
+                paint(frame());
+            else
+                transcript(`${glyph.pending} ${c.dim(`${row.label} — ${row.summary}`)}`);
+        },
+        fail(key, why) {
+            const row = at(key);
+            if (!row)
+                return;
+            row.took = Date.now() - (row.startedAt ?? Date.now());
+            row.state = 'fail';
+            row.summary = why;
+            row.detail = undefined;
+            if (live)
+                paint(frame());
+            else
+                transcript(`${glyph.fail} ${row.label}${why ? ` — ${why}` : ''}${took(row)}`);
+        },
+        failActive(why) {
+            for (const row of rows)
+                if (row.state === 'active')
+                    api.fail(row.key, why);
+        },
+        note(line) {
+            if (!live) {
+                transcript(line);
+                return;
+            }
+            erase();
+            err.write(`${line}\n`);
+            paint(frame());
+        },
+        suspend() {
+            if (!live)
+                return;
+            clearInterval(timer);
+            erase();
+            err.write(cursor.show());
+            releaseRegion(owner);
+        },
+        resume() {
+            if (!live || closed || !claimRegion(owner))
+                return;
+            err.write(cursor.hide());
+            paint(frame());
+            start();
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            clearInterval(timer);
+            setInterruptHandler(null);
+            releaseRegion(owner);
+            if (current === api)
+                current = null;
+            if (!live)
+                return;
+            erase();
+            // Reprint the settled steps as static lines so scrollback keeps the summary.
+            // The mesh does not survive: a frozen loading animation in scrollback says
+            // nothing that a settled step list does not say better.
+            const settled = rows
+                .filter((row) => row.state !== 'todo')
+                .map((row) => truncate(render(row, glyphs.stepActive), width()));
+            err.write((settled.length ? `${settled.join('\n')}\n` : '') + cursor.show());
+        },
+    };
+    if (live) {
+        current = api;
+        hookCursorRestore();
+        setInterruptHandler(() => {
+            erase();
+            if (opts.onCancel)
+                err.write(`${glyph.warn} ${opts.onCancel}\n`);
+        });
+        err.write(cursor.hide());
+        paint(frame());
+        start();
+    }
+    return api;
+}
+/**
+ * Run work under a ladder, closing it on either outcome. Whichever step was in
+ * flight when the work threw is marked failed, so the transcript shows where it
+ * stopped rather than only that it stopped.
+ */
+export async function withLadder(steps, run, opts = {}) {
+    const l = ladder(steps, opts);
+    try {
+        return await run(l);
+    }
+    catch (error) {
+        l.failActive(error instanceof Error ? error.message : undefined);
+        throw error;
+    }
+    finally {
+        l.close();
+    }
+}

package/dist/mark.js

@@ -6,14 +6,28 @@
  * The mark is a fixed character grid rather than a string per state, because
  * the loading animation lights individual spokes and needs to address cells.
  */
-import { c, colourDepth, rgb } from './render.js';
-const GRID = [
-    '  ○     ○     ○  ',
-    '   ╲    │    ╱   ',
-    '○───────◉───────○',
-    '   ╱    │    ╲   ',
-    '  ○     ○     ○  ',
-];
+import { c, colourDepth, rgb, unicode } from './render.js';
+/**
+ * Both grids are deliberately the same 17×5 shape. Every cell coordinate below,
+ * and the cursor arithmetic in the progress UI above, is written against those
+ * dimensions — an ASCII fallback of a different size would silently break the
+ * redraw rather than merely look plainer.
+ */
+const GRID = unicode
+    ? [
+        '  ○     ○     ○  ',
+        '   ╲    │    ╱   ',
+        '○───────◉───────○',
+        '   ╱    │    ╲   ',
+        '  ○     ○     ○  ',
+    ]
+    : [
+        '  o     o     o  ',
+        '   \\    |    /   ',
+        'o-------@-------o',
+        '   /    |    \\   ',
+        '  o     o     o  ',
+    ];
 export const MARK_WIDTH = 17;
 export const MARK_HEIGHT = GRID.length;
 /** Where the hub sits. Always lit — a fleet with no control plane is not a fleet. */
@@ -82,6 +96,8 @@ export function markFrame(phase) {
 /** The resting mark: hub live, peers quiet. */
 export const mark = () => markFrame(-1);
 const WORDMARK = ['█▀▀ █   █▀▀ █▀▀ ▀█▀', '█▀  █   █▀  █▀   █ ', '▀   ▀▀▀ ▀▀▀ ▀▀▀  ▀ '];
+/** The hub, read back out of the grid so the two glyph sets cannot drift. */
+const hubGlyph = GRID[HUB[0]][HUB[1]];
 /**
  * Mark and wordmark side by side, with the tagline tucked under the wordmark so
  * the block stays rectangular. Falls back to a single line when the terminal is
@@ -91,11 +107,15 @@ export function banner(subtitle) {
     // `columns` is 0, not undefined, on some pseudo-terminals — `??` would miss it.
     const columns = process.stdout.columns || 80;
     if (columns < 46)
-        return `${c.signal('◉')} ${c.bold('fleet')}${subtitle ? c.dim(`  ${subtitle}`) : ''}`;
+        return `${c.signal(hubGlyph)} ${c.bold('fleet')}${subtitle ? c.dim(`  ${subtitle}`) : ''}`;
     // The wordmark sits against the middle three rows of the mark; the tagline
     // takes the last. Every mark row is exactly MARK_WIDTH visible columns, so a
     // fixed gutter aligns them without measuring around the colour codes.
-    const right = ['', ...WORDMARK.map(c.bold), subtitle ? c.dim(subtitle) : ''];
+    // Without block glyphs the drawn wordmark is unreadable, so ASCII terminals
+    // get the name set once against the hub row instead of a row of mojibake.
+    const right = unicode
+        ? ['', ...WORDMARK.map(c.bold), subtitle ? c.dim(subtitle) : '']
+        : ['', '', c.bold('F L E E T'), subtitle ? c.dim(subtitle) : '', ''];
     return mark()
         .map((line, i) => `  ${line}${right[i] ? `    ${right[i]}` : ''}`.trimEnd())
         .join('\n');

package/dist/progress.js

@@ -0,0 +1,188 @@
+/**
+ * Following a deploy.
+ *
+ * `POST /services/:id/deploy` is a single request that can take minutes: it builds
+ * for every architecture in the fleet, pushes to the registry, allocates a port
+ * and hands the container to an agent. The control plane now walks the deployment
+ * row through those phases and publishes the build's own sub-step alongside it
+ * (control-plane/src/api/deploy-progress.ts), so the CLI can poll for them while
+ * it waits on the request it already has in flight, and show where the work has
+ * actually got to instead of guessing.
+ *
+ * Progress is decoration, never the result: a poll that fails is swallowed and the
+ * deploy carries on. Only `awaitRunning`, where a poll *is* the mechanism, treats
+ * a persistently unreachable control plane as an error.
+ */
+import { request, CliError, EXIT } from './api.js';
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** A failure reason can be a build log tail; a one-line error gets one line of it. */
+export const firstLine = (text) => text.split('\n')[0].trim().slice(0, 200);
+export async function fetchProgress(serviceId) {
+    const { body } = await request('GET', `/services/${serviceId}/progress`);
+    return body.progress;
+}
+/**
+ * The build's sub-step as one line. `linux/arm64` is shortened because the arch is
+ * the informative half and the redraw region is narrow.
+ */
+export function progressLine(p) {
+    if (!p.detail)
+        return undefined;
+    const counter = p.step && p.ofSteps ? `${p.step}/${p.ofSteps} ` : '';
+    const platform = p.platform ? `${p.platform.replace(/^linux\//, '')} ` : '';
+    return `${counter}${platform}${p.detail}`;
+}
+/**
+ * Poll `/progress` in the background while something else is being awaited.
+ *
+ * The shape is the device-flow race in auth.ts: the answer comes from one promise
+ * while a second keeps the display honest until it lands. `stop()` interrupts the
+ * sleep rather than waiting it out, so the last frame is not held back by a poll
+ * interval that is no longer needed.
+ */
+export function follow(serviceId, sink, opts = {}) {
+    const interval = opts.intervalMs ?? 800;
+    let stopped = false;
+    let misses = 0;
+    let wake = null;
+    const rest = (ms) => new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        wake = () => {
+            clearTimeout(timer);
+            resolve();
+        };
+    });
+    const loop = (async () => {
+        while (!stopped) {
+            await rest(interval);
+            if (stopped)
+                return;
+            try {
+                const progress = await fetchProgress(serviceId);
+                misses = 0;
+                if (progress)
+                    sink(progress);
+            }
+            catch {
+                // A control plane that predates the endpoint answers 404 every time, so
+                // give up rather than spend the whole build asking again.
+                if (++misses >= 3) {
+                    opts.onUnavailable?.();
+                    return;
+                }
+            }
+        }
+    })();
+    return {
+        stop: async () => {
+            stopped = true;
+            wake?.();
+            await loop.catch(() => { });
+        },
+    };
+}
+/** Ladder steps for a deploy, in the order the control plane reports them. */
+export const DEPLOY_STEPS = [
+    { key: 'place', label: 'choosing a node' },
+    { key: 'build', label: 'building the image' },
+    { key: 'push', label: 'pushing to the fleet registry' },
+    { key: 'schedule', label: 'scheduling onto the node' },
+    { key: 'health', label: 'waiting for the container' },
+];
+/** Which ladder step each server-reported phase corresponds to. */
+const STEP_OF = {
+    queued: 0,
+    building: 1,
+    pushing: 2,
+    scheduling: 3,
+    deploying: 4,
+    running: 5,
+};
+/**
+ * Drive a ladder from the server's phases.
+ *
+ * Forward only: a poll can arrive out of order, and re-beginning a step would
+ * restart its clock. Steps the deploy never entered are marked skipped rather than
+ * done — a service deployed from a prebuilt image goes straight from `queued` to
+ * `scheduling`, and settling build and push as complete would claim work that
+ * never happened.
+ */
+export function phaseWalker(l, steps = DEPLOY_STEPS) {
+    let at = 0;
+    l.begin(steps[0].key);
+    const advance = (target, summary) => {
+        if (target <= at)
+            return;
+        for (let i = at; i < target; i++) {
+            if (i === at)
+                l.done(steps[i].key, summary);
+            else
+                l.skip(steps[i].key, 'not needed');
+        }
+        at = target;
+        if (target < steps.length)
+            l.begin(steps[target].key);
+    };
+    return {
+        advance,
+        finish: (summary) => advance(steps.length, summary),
+        get at() {
+            return at;
+        },
+        apply(p) {
+            if (p.status === 'failed') {
+                l.failActive(p.failureReason ? firstLine(p.failureReason) : undefined);
+                return;
+            }
+            const target = STEP_OF[p.status];
+            if (target !== undefined) {
+                // Which node was chosen is the one summary worth carrying over from a
+                // poll, and it belongs on the step that decided it.
+                advance(target, at === 0 ? (p.nodeName ?? undefined) : undefined);
+            }
+            const line = progressLine(p);
+            if (line && at < steps.length)
+                l.detail(steps[at].key, line);
+        },
+    };
+}
+/**
+ * Follow a service to `running`.
+ *
+ * The deploy request returns once the image exists and a node has been chosen; the
+ * container actually starting is the agent's job and happens afterwards, so the
+ * CLI follows it to a conclusion rather than reporting "scheduled" and leaving the
+ * operator to guess. One indexed row per poll, not the whole service list.
+ */
+export async function awaitRunning(service, opts = {}) {
+    const deadline = Date.now() + (opts.timeoutMs ?? 180_000);
+    let misses = 0;
+    while (Date.now() < deadline) {
+        let progress = null;
+        try {
+            progress = await fetchProgress(service.id);
+            misses = 0;
+        }
+        catch (err) {
+            // Here a poll is the mechanism, not decoration. Reporting a timeout when
+            // the control plane simply stopped answering would blame the wrong thing.
+            if (++misses >= 5)
+                throw err;
+        }
+        if (progress?.status === 'running')
+            return;
+        if (progress?.status === 'failed') {
+            const why = progress.failureReason ? `: ${firstLine(progress.failureReason)}` : '';
+            throw new CliError(`"${service.name}" did not start${why}. \`fleet deployments ${service.name}\` has the detail.`, EXIT.healthCheckFailed);
+        }
+        if (progress?.status === 'pinned_unavailable') {
+            throw new CliError(`"${service.name}" is pinned to a node that is not available. ` +
+                `\`fleet where ${service.name}\` explains why.`, EXIT.noEligibleNode);
+        }
+        if (progress)
+            opts.onProgress?.(progress);
+        await sleep(2000);
+    }
+    throw new CliError(`"${service.name}" was scheduled but has not reported running. ` +
+        `\`fleet deployments ${service.name}\` has the detail.`, EXIT.healthCheckFailed);
+}

package/dist/prompt.js

@@ -0,0 +1,205 @@
+/**
+ * Interactive prompts.
+ *
+ * One implementation each, because four hand-rolled versions of "are you sure"
+ * drifted into four different answers to the questions that actually matter: what
+ * happens when stdin is not a terminal, whether silence counts as consent, and
+ * whether a typed password can end up in the scrollback.
+ *
+ * Prompts write to stderr, like the rest of the progress UI, so a command that
+ * both asks a question and emits `--json` stays pipeable into jq.
+ */
+import { createInterface } from 'node:readline/promises';
+import { c, cursor, glyphs, truncate, unicode } from './render.js';
+import { CliError, EXIT } from './api.js';
+import { activeLadder } from './ladder.js';
+import { glyph, width } from './ui.js';
+const err = process.stderr;
+/** Asking a question needs somewhere to read the answer from and somewhere to show it. */
+export const canPrompt = () => Boolean(process.stdin.isTTY && err.isTTY);
+/**
+ * A ladder owns the cursor while it is live, so it has to stand down for the
+ * duration of a prompt rather than redraw over the question being asked.
+ */
+async function withTerminal(run) {
+    const live = activeLadder();
+    live?.suspend();
+    try {
+        return await run();
+    }
+    finally {
+        live?.resume();
+    }
+}
+/**
+ * A yes/no question.
+ *
+ * The two policies are deliberately separate knobs, because for the destructive
+ * commands they genuinely differ: `fleet deploy` and `fleet down` want Enter to
+ * mean *no* at a keyboard — an accidental return should not roll out a build —
+ * while a scripted CI step that pipes no stdin should still proceed without
+ * needing `--yes`. `ifNoTerminal` defaults to `default` when a caller has no such
+ * split, and `fleet rm` sets neither: it refuses both ways.
+ */
+export async function confirm(question, opts = {}) {
+    const fallback = opts.default ?? false;
+    if (!canPrompt())
+        return opts.ifNoTerminal ?? fallback;
+    return withTerminal(async () => {
+        const rl = createInterface({ input: process.stdin, output: err });
+        try {
+            const answer = (await rl.question(`  ${question} ${c.dim(fallback ? '[Y/n]' : '[y/N]')} `))
+                .trim()
+                .toLowerCase();
+            if (!answer)
+                return fallback;
+            return answer === 'y' || answer === 'yes';
+        }
+        finally {
+            rl.close();
+        }
+    });
+}
+/** A free-text answer. Empty input is rejected rather than silently accepted. */
+export async function ask(label, opts = {}) {
+    if (!canPrompt())
+        throw new CliError(`${label.trim()} is required, and there is no terminal to ask on.`, EXIT.usage);
+    return withTerminal(async () => {
+        if (opts.hint)
+            err.write(`${c.dim(`  ${opts.hint}`)}\n`);
+        const rl = createInterface({ input: process.stdin, output: err });
+        try {
+            const value = (await rl.question(`  ${c.dim(label.padEnd(18))}`)).trim();
+            if (!value)
+                throw new CliError(`${label.trim()} is required.`, EXIT.usage);
+            return value;
+        }
+        finally {
+            rl.close();
+        }
+    });
+}
+/**
+ * The same, with the echo suppressed. A password or token must not survive in the
+ * terminal scrollback or in a screen recording, which rules out letting readline
+ * echo it and clearing the line afterwards.
+ */
+export async function askSecret(label, opts = {}) {
+    if (!canPrompt())
+        throw new CliError(`${label.trim()} is required, and there is no terminal to ask on.`, EXIT.usage);
+    return withTerminal(async () => {
+        if (opts.hint)
+            err.write(`${c.dim(`  ${opts.hint}`)}\n`);
+        const rl = createInterface({ input: process.stdin, output: err });
+        try {
+            err.write(`  ${c.dim(label.padEnd(18))}`);
+            // The prompt is written directly, then readline's own echo is disabled, so
+            // nothing typed after this point reaches the terminal at all.
+            const internal = rl;
+            internal._writeToOutput = () => { };
+            const value = (await rl.question('')).trim();
+            err.write('\n');
+            if (!value)
+                throw new CliError(`${label.trim()} is required.`, EXIT.usage);
+            return value;
+        }
+        finally {
+            rl.close();
+        }
+    });
+}
+const KEY = {
+    up: ['\x1b[A', '\x1bOA', 'k'],
+    down: ['\x1b[B', '\x1bOB', 'j'],
+    enter: ['\r', '\n'],
+    cancel: ['\x03', 'q', '\x1b'],
+};
+/**
+ * An arrow-key picker. Callers must check `canPrompt()` first and raise their own
+ * error otherwise: the message a script sees when it forgets `--fleet` is part of
+ * that command's contract, and this function does not know what it should say.
+ */
+export async function select(title, choices) {
+    if (!choices.length)
+        throw new CliError('Nothing to choose from.', EXIT.usage);
+    if (!canPrompt())
+        throw new CliError('No interactive terminal to choose on.', EXIT.usage);
+    return withTerminal(() => new Promise((resolve) => {
+        let index = 0;
+        let painted = 0;
+        const pad = Math.max(...choices.map((choice) => choice.label.length));
+        const keys = unicode ? '↑↓ move · enter select · q cancel' : 'up/down move, enter select, q cancel';
+        const draw = () => {
+            const lines = [
+                `  ${c.bold(title)}`,
+                ...choices.map((choice, i) => {
+                    const pointer = i === index ? c.signal(glyphs.pointer) : ' ';
+                    const label = i === index ? c.signal(choice.label.padEnd(pad)) : choice.label.padEnd(pad);
+                    return `  ${pointer} ${label}${choice.hint ? `  ${c.dim(choice.hint)}` : ''}`;
+                }),
+                c.dim(`    ${keys}`),
+            ].map((line) => truncate(line, width()));
+            err.write((painted ? cursor.up(painted) + '\r' + cursor.clearBelow() : '') +
+                lines.join('\n') +
+                '\n');
+            painted = lines.length;
+        };
+        const stdin = process.stdin;
+        const wasRaw = Boolean(stdin.isRaw);
+        const teardown = () => {
+            stdin.off('data', onData);
+            stdin.setRawMode?.(wasRaw);
+            stdin.pause();
+            // `ESC[0A` is read as up-one by most terminals, so an unpainted list
+            // must not try to move at all.
+            if (painted)
+                err.write(cursor.up(painted) + '\r' + cursor.clearBelow());
+            err.write(cursor.show());
+            painted = 0;
+        };
+        function onData(chunk) {
+            // A chunk carries a whole escape sequence, or several keys at once.
+            const key = chunk.toString();
+            if (KEY.cancel.includes(key)) {
+                teardown();
+                err.write(`${glyph.pending} ${c.dim('cancelled')}\n`);
+                // In raw mode ^C arrives as a byte, not a signal, so the exit code
+                // has to be produced here or the shell sees a clean exit.
+                process.exit(key === '\x03' ? 130 : EXIT.ok);
+            }
+            if (KEY.enter.includes(key)) {
+                const chosen = choices[index];
+                teardown();
+                err.write(`${glyph.ok} ${c.bold(title)}  ${chosen.label}\n`);
+                resolve(chosen.value);
+                return;
+            }
+            if (KEY.up.includes(key))
+                index = (index - 1 + choices.length) % choices.length;
+            else if (KEY.down.includes(key))
+                index = (index + 1) % choices.length;
+            else if (/^[1-9]$/.test(key) && Number(key) <= choices.length)
+                index = Number(key) - 1;
+            else
+                return;
+            draw();
+        }
+        err.write(cursor.hide());
+        draw();
+        stdin.setEncoding('utf8');
+        stdin.setRawMode?.(true);
+        stdin.on('data', onData);
+        stdin.resume();
+    }));
+}
+/**
+ * Offer a picker when a name did not match, and otherwise raise the error the
+ * command would have raised anyway. Used by the three lookups that previously
+ * only listed the valid names and left the operator to retype one.
+ */
+export async function selectOrThrow(title, choices, error) {
+    if (!canPrompt() || !choices.length)
+        throw error;
+    err.write(`${glyph.warn} ${error.message.split('\n')[0]}\n`);
+    return select(title, choices);
+}

package/dist/render.js

@@ -10,6 +10,59 @@ export const colourDepth = !useColour
     : /truecolor|24bit/i.test(process.env.COLORTERM ?? '')
         ? 2
         : 1;
+/**
+ * Whether the terminal can be trusted with braille, box-drawing and block
+ * glyphs. This is a separate question from colour: a terminal that renders
+ * `⠋` as a replacement box makes the CLI look broken, whereas plain ASCII only
+ * looks plain. So the guess errs toward ASCII and takes overrides in both
+ * directions — `FLEET_ASCII=1` forces the fallback, `FLEET_UNICODE=1` forces the
+ * glyphs on for the many Linux shells that simply never set a locale.
+ */
+export const unicode = process.env.FLEET_ASCII
+    ? false
+    : process.env.FLEET_UNICODE
+        ? true
+        : process.env.TERM === 'dumb'
+            ? false
+            : /utf-?8/i.test(`${process.env.LC_ALL ?? ''} ${process.env.LC_CTYPE ?? ''} ${process.env.LANG ?? ''}`) ||
+                Boolean(process.env.WT_SESSION) ||
+                Boolean(process.env.TERM_PROGRAM);
+/**
+ * One vocabulary, chosen once, so no caller ever branches on `unicode`. Every
+ * entry is a single terminal cell wide in both sets — the progress UI redraws in
+ * place and a two-cell glyph would shift everything after it.
+ */
+export const glyphs = unicode
+    ? {
+        frames: ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'],
+        ok: '✔',
+        fail: '✖',
+        warn: '▲',
+        info: '›',
+        pending: '·',
+        stepActive: '◆',
+        stepTodo: '○',
+        pointer: '❯',
+        barFill: '█',
+        barEmpty: '░',
+        branch: '└',
+        rule: '─',
+    }
+    : {
+        frames: ['-', '\\', '|', '/'],
+        ok: 'v',
+        fail: 'x',
+        warn: '!',
+        info: '>',
+        pending: '.',
+        stepActive: '>',
+        stepTodo: '.',
+        pointer: '>',
+        barFill: '#',
+        barEmpty: '.',
+        branch: '\\',
+        rule: '-',
+    };
 const ESC = '\x1b[';
 const wrap = (code) => (s) => (useColour ? `${ESC}${code}m${s}${ESC}0m` : s);
 /** Truecolour when the terminal has it, otherwise the supplied fallback. */
@@ -32,6 +85,10 @@ export const cursor = {
     hide: () => `${ESC}?25l`,
     show: () => `${ESC}?25h`,
     up: (n) => `${ESC}${n}A`,
+    // Moving down with a control sequence rather than a newline matters at the
+    // bottom of the screen: `\n` there scrolls the region out from under the
+    // cursor arithmetic, `ESC[nB` cannot.
+    down: (n) => `${ESC}${n}B`,
     clearLine: () => `\r${ESC}2K`,
     clearBelow: () => `${ESC}0J`,
 };

package/dist/ui.js

@@ -6,29 +6,86 @@
  * fallback, so output captured by CI or a log file reads as a transcript rather
  * than as a smear of cursor escapes.
  */
-import { c, cursor, truncate, visibleLength } from './render.js';
+import { c, cursor, glyphs, truncate, visibleLength } from './render.js';
 import { MARK_HEIGHT, markFrame, PEER_COUNT } from './mark.js';
 const err = process.stderr;
 /** `columns` reads 0 on some pseudo-terminals, so `??` is not enough. */
-const width = () => Math.max(1, (err.columns || process.stdout.columns || 80) - 1);
-/** Animate only where it can be erased again. */
-export const animated = () => Boolean(err.isTTY) && !process.env.CI && !process.env.FLEET_NO_ANIMATION;
-const FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+export const width = () => Math.max(1, (err.columns || process.stdout.columns || 80) - 1);
+/**
+ * `--quiet` drops progress entirely: no frames, no settled lines. Errors still
+ * print, because a command that failed silently is worse than a noisy one.
+ */
+let quiet = false;
+export const setQuiet = (value) => {
+    quiet = value;
+};
+export const isQuiet = () => quiet;
+/**
+ * Animate only where it can be erased again. `FLEET_ANIMATION` overrides the
+ * detection in both directions for recordings and for terminals the heuristics
+ * read wrongly; `FLEET_NO_ANIMATION` keeps working as it always has.
+ */
+export const animated = () => {
+    if (quiet)
+        return false;
+    if (process.env.FLEET_ANIMATION === '0')
+        return false;
+    if (process.env.FLEET_ANIMATION === '1')
+        return true;
+    return Boolean(err.isTTY) && !process.env.CI && !process.env.FLEET_NO_ANIMATION;
+};
+const FRAMES = glyphs.frames;
 const TICK = 80;
+/**
+ * Redrawing in place is slower to watch over a long link than locally, and a
+ * tall region costs proportionally more per frame. Neither is worth 12 frames a
+ * second.
+ */
+export const tickFor = (height) => process.env.SSH_CONNECTION || process.env.SSH_TTY || height > 10 ? 200 : TICK;
 export const glyph = {
-    ok: c.signal('✔'),
-    fail: c.red('✖'),
-    warn: c.yellow('▲'),
-    info: c.cyan('›'),
-    pending: c.dim('·'),
+    ok: c.signal(glyphs.ok),
+    fail: c.red(glyphs.fail),
+    warn: c.yellow(glyphs.warn),
+    info: c.cyan(glyphs.info),
+    pending: c.dim(glyphs.pending),
 };
-/** Elapsed time, shown only once it is long enough to be worth knowing. */
-const elapsed = (startedAt) => {
-    const seconds = (Date.now() - startedAt) / 1000;
+/** A duration, shown only once it is long enough to be worth knowing. */
+export const duration = (ms) => {
+    const seconds = ms / 1000;
     return seconds < 2 ? '' : c.dim(` ${seconds.toFixed(seconds < 10 ? 1 : 0)}s`);
 };
+/** Time since a start point. Ticks up while a step is in flight. */
+export const elapsed = (startedAt) => duration(Date.now() - startedAt);
+/**
+ * Exactly one thing may own an in-place redraw region at a time. Two writers
+ * moving the cursor relative to their own idea of where it is do not produce
+ * half-correct output, they produce shredded output — so the second writer stays
+ * quiet rather than fighting for the rows.
+ */
+let regionOwner = null;
+export const claimRegion = (owner) => {
+    if (regionOwner)
+        return false;
+    regionOwner = owner;
+    return true;
+};
+export const releaseRegion = (owner) => {
+    if (regionOwner === owner)
+        regionOwner = null;
+};
+export const regionActive = () => regionOwner !== null;
+/**
+ * Run while a ^C is being handled, before the process leaves. This is how the
+ * live region gets erased and how a command says what it left running — killing
+ * the CLI does not kill a build that is already underway on the control plane,
+ * and pretending otherwise is the misleading part.
+ */
+let onInterrupt = null;
+export const setInterruptHandler = (fn) => {
+    onInterrupt = fn;
+};
 let restoreCursorHooked = false;
-function hookCursorRestore() {
+export function hookCursorRestore() {
     if (restoreCursorHooked)
         return;
     restoreCursorHooked = true;
@@ -37,11 +94,33 @@ function hookCursorRestore() {
     process.on('exit', restore);
     for (const signal of ['SIGINT', 'SIGTERM']) {
         process.on(signal, () => {
+            try {
+                onInterrupt?.();
+            }
+            catch {
+                // A failing teardown must not stop the cursor being restored.
+            }
             restore();
             process.exit(signal === 'SIGINT' ? 130 : 143);
         });
     }
 }
+/** A spinner that reports nothing: `--quiet`, or a region already owned. */
+const silentSpinner = (label) => {
+    let text = label;
+    return {
+        update: (next) => {
+            text = next;
+        },
+        hints: () => { },
+        note: () => { },
+        succeed: () => { },
+        fail: () => { },
+        stop: () => {
+            void text;
+        },
+    };
+};
 export function spinner(label) {
     const startedAt = Date.now();
     let text = label;
@@ -49,6 +128,9 @@ export function spinner(label) {
     let frame = 0;
     let timer;
     let done = false;
+    // A ladder already owns the cursor; a second writer would shred both.
+    if (quiet || regionActive())
+        return silentSpinner(label);
     if (!animated()) {
         err.write(`${label}…\n`);
         return {
@@ -65,18 +147,21 @@ export function spinner(label) {
             stop: () => { },
         };
     }
+    const owner = {};
+    claimRegion(owner);
     hookCursorRestore();
     err.write(cursor.hide());
-    const clear = () => err.write(cursor.clearLine());
     const draw = () => {
         // A hint every third of a spinner cycle: long enough to read, short enough
         // that the line is visibly alive during a multi-minute build.
         const hint = hintLines.length
             ? hintLines[Math.floor((Date.now() - startedAt) / 3200) % hintLines.length]
             : undefined;
-        clear();
-        err.write(truncate(`${c.signal(FRAMES[frame % FRAMES.length])} ${text}${elapsed(startedAt)}` +
-            (hint ? c.dim(`  ${hint}`) : ''), width()));
+        // One write per frame. Clearing and drawing separately doubles the syscalls
+        // and can be seen as a flicker on a slow link.
+        err.write(cursor.clearLine() +
+            truncate(`${c.signal(FRAMES[frame % FRAMES.length])} ${text}${elapsed(startedAt)}` +
+                (hint ? c.dim(`  ${hint}`) : ''), width()));
         frame++;
     };
     draw();
@@ -87,8 +172,8 @@ export function spinner(label) {
             return;
         done = true;
         clearInterval(timer);
-        clear();
-        err.write(`${mark} ${final ?? text}${elapsed(startedAt)}\n${cursor.show()}`);
+        releaseRegion(owner);
+        err.write(cursor.clearLine() + `${mark} ${final ?? text}${elapsed(startedAt)}\n` + cursor.show());
     };
     return {
         update: (next) => {
@@ -99,8 +184,7 @@ export function spinner(label) {
             hintLines = lines;
         },
         note: (line) => {
-            clear();
-            err.write(`${line}\n`);
+            err.write(cursor.clearLine() + `${line}\n`);
             draw();
         },
         succeed: (final) => settle(glyph.ok, final),
@@ -110,8 +194,8 @@ export function spinner(label) {
                 return;
             done = true;
             clearInterval(timer);
-            clear();
-            err.write(cursor.show());
+            releaseRegion(owner);
+            err.write(cursor.clearLine() + cursor.show());
         },
     };
 }
@@ -198,13 +282,14 @@ export async function splash(label, run, opts = {}) {
 export function rule(label) {
     const width = Math.min(process.stdout.columns ?? 80, 72);
     if (!label)
-        return c.dim('─'.repeat(width));
-    const line = '─'.repeat(Math.max(0, width - visibleLength(label) - 3));
-    return `${c.dim('──')} ${c.bold(label)} ${c.dim(line)}`;
+        return c.dim(glyphs.rule.repeat(width));
+    const line = glyphs.rule.repeat(Math.max(0, width - visibleLength(label) - 3));
+    return `${c.dim(glyphs.rule.repeat(2))} ${c.bold(label)} ${c.dim(line)}`;
 }
 /** A horizontal meter. Used for headroom, where the shape matters more than the number. */
 export function bar(fraction, width = 12) {
-    const filled = Math.round(Math.max(0, Math.min(1, fraction)) * width);
-    const colour = fraction > 0.85 ? c.red : fraction > 0.65 ? c.yellow : c.signal;
-    return colour('█'.repeat(filled)) + c.dim('░'.repeat(width - filled));
+    const clamped = Math.max(0, Math.min(1, fraction));
+    const filled = Math.round(clamped * width);
+    const colour = clamped > 0.85 ? c.red : clamped > 0.65 ? c.yellow : c.signal;
+    return colour(glyphs.barFill.repeat(filled)) + c.dim(glyphs.barEmpty.repeat(width - filled));
 }

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@yadurajfleetos/cli",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Fleet OS command-line interface for deploying and orchestrating services on user-owned hardware",
   "type": "module",
   "license": "MIT",
   "bin": {
-    "fleet": "./dist/index.js"
+    "fleet": "dist/index.js"
   },
   "files": [
     "dist",