@yadurajfleetos/cli 0.10.2 → 0.11.0

package/dist/api.js

@@ -24,17 +24,27 @@ export async function request(method, path, opts = {}) {
     if (opts.auth !== false && !profile.accessToken) {
         throw new CliError('Not signed in. Run `fleet auth login` first.', EXIT.usage);
     }
+    // A POST with nothing to send still needs a content type.
+    //
+    // Fastify answers 415 to a POST that arrives without one, so every bodyless
+    // POST from this CLI failed before reaching its route — including `fleet
+    // alerts test`, the command the CLI itself recommends for checking alerts
+    // work before an incident. Sending an empty object costs two bytes and makes
+    // the request well-formed, rather than leaving each such route to remember
+    // to accept a shape nothing sends.
+    const writes = method === 'POST' || method === 'PUT' || method === 'PATCH';
+    const payload = opts.raw ? opts.raw.data : writes || opts.body ? JSON.stringify(opts.body ?? {}) : undefined;
     const send = async (token) => fetch(profile.api.replace(/\/+$/, '') + path, {
         method,
         headers: {
             ...(token ? { authorization: `Bearer ${token}` } : {}),
             ...(opts.raw
                 ? { 'content-type': opts.raw.contentType }
-                : opts.body
+                : payload !== undefined
                     ? { 'content-type': 'application/json' }
                     : {}),
         },
-        body: opts.raw ? opts.raw.data : opts.body ? JSON.stringify(opts.body) : undefined,
+        body: payload,
         signal: AbortSignal.timeout(20 * 60_000),
     });
     let res;

package/dist/commands/doctor.js

@@ -29,6 +29,38 @@ const ORIGIN_UNREACHABLE = new Set([502, 503, 504, 520, 521, 522, 523, 524, 525,
  * What does indicate a broken path is the edge answering on the origin's
  * behalf, or nothing answering at all.
  */
+/**
+ * Whether this fleet can tell anybody something went wrong.
+ *
+ * A fleet with no alert rules fails silently, and the only way to find out is
+ * an outage. This one had none while its services went down four times in an
+ * afternoon: the empty state existed, and lived inside `fleet alerts`, a
+ * subcommand you only run once you already suspect the answer.
+ *
+ * Separated from the command so both outcomes can be tested without a control
+ * plane — the one that matters is the warning, and it is the one a live check
+ * against a working fleet never exercises.
+ */
+export function alertCheck(rules) {
+    const live = rules.filter((r) => r.enabled);
+    if (live.length) {
+        return {
+            state: 'ok',
+            label: 'alerts',
+            detail: `${live.length} rule(s): ${[...new Set(live.map((r) => r.channelType))].join(', ')}`,
+        };
+    }
+    return {
+        state: 'warn',
+        label: 'alerts',
+        // Disabled and absent are different mistakes: one was set up and turned
+        // off, the other never existed, and the person reading needs to know which.
+        detail: rules.length
+            ? 'Every alert rule is disabled — failures will pass unreported.'
+            : 'No alert rules. A node going down or a deploy failing will tell nobody.',
+        remedy: 'Add one with `fleet alerts add --channel email --to you@example.com`, then prove it with `fleet alerts test`.',
+    };
+}
 async function reach(url) {
     try {
         const response = await fetch(url, { redirect: 'manual', signal: AbortSignal.timeout(8_000) });
@@ -60,13 +92,14 @@ export const doctorCommand = {
         const profile = await loadProfile();
         const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
         const result = await task('checking Fleet health', async () => {
-            const [identity, fleet, nodes, services, github, health] = await Promise.all([
+            const [identity, fleet, nodes, services, github, health, alerts] = await Promise.all([
                 request('GET', '/auth/me'),
                 request('GET', `/fleets/${fleetId}`),
                 request('GET', `/fleets/${fleetId}/nodes`),
                 request('GET', `/fleets/${fleetId}/services`),
                 request('GET', `/fleets/${fleetId}/github/status`),
                 request('GET', '/healthz'),
+                request('GET', `/fleets/${fleetId}/alert-rules`),
             ]);
             const deploymentHistory = await Promise.all(services.body.services.map(async (service) => ({
                 service,
@@ -76,7 +109,7 @@ export const doctorCommand = {
                 .map((service) => ({ name: service.name, hostname: service.domain ?? service.hostname }))
                 .filter((service) => Boolean(service.hostname));
             const ingress = await Promise.all(urls.map(async (service) => ({ ...service, ...(await reach(`https://${service.hostname}`)) })));
-            return { identity: identity.body, fleet: fleet.body, nodes: nodes.body.nodes, services: services.body.services, github: github.body, health: health.body, deploymentHistory, ingress };
+            return { identity: identity.body, fleet: fleet.body, nodes: nodes.body.nodes, services: services.body.services, github: github.body, health: health.body, alerts: alerts.body.rules, deploymentHistory, ingress };
         });
         const checks = [
             { state: 'ok', label: 'control plane', detail: profile.api },
@@ -171,6 +204,7 @@ export const doctorCommand = {
                 detail: result.github.error ?? 'Not configured; public repositories can still deploy.',
                 remedy: 'Set GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY, restart the control plane, then connect repositories in Dashboard → Settings.',
             });
+        checks.push(alertCheck(result.alerts));
         checks.push({ state: 'ok', label: 'control-plane version', detail: result.health.version ?? 'version not reported' });
         if (flags.json)
             return console.log(JSON.stringify({ fleetId, checks }, null, 2));

package/dist/commands/services.js

@@ -462,7 +462,7 @@ async function theOnlyNode(flags) {
  * appeared with different ports and no explanation is worse than one with a
  * mistake in it -- at least the mistake is yours to find.
  */
-async function reviewed(draft, flags) {
+async function reviewed(draft, flags, services) {
     const { repoMap } = await import('../repomap.js');
     const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
     // The second pass is a different, smaller question.
@@ -473,14 +473,27 @@ async function reviewed(draft, flags) {
     // just given was discarded. Applying an answer needs the manifest it applies
     // to and the answer, not the evidence that produced it: the model has
     // already read the repository and written its conclusions down.
-    const review = (base, map, answers) => task(answers ? 'applying your answers' : 'reading the repository for a second opinion', async () => request('POST', `/fleets/${fleetId}/manifest/assist`, {
-        body: { draft: base, repoMap: map, ...(answers ? { answers } : {}) },
+    const review = (base, map, answers, parts) => task(answers ? 'applying your answers' : 'reading the repository for a second opinion', async () => request('POST', `/fleets/${fleetId}/manifest/assist`, {
+        body: {
+            draft: base,
+            repoMap: map,
+            ...(answers ? { answers } : {}),
+            ...(parts ? { parts } : {}),
+        },
     }), { done: () => (answers ? 'done' : 'reviewed') });
     let map;
     let out;
     try {
         map = await repoMap();
-        out = (await review(draft, map)).body;
+        // Evidence per service, so each is reviewed at full depth rather than
+        // every service being trimmed to fit one request. The whole-repository
+        // map still goes along: a service is judged partly by what surrounds it,
+        // and the tree is how the model knows what else exists.
+        const parts = await Promise.all(services.map(async (svc) => ({
+            service: svc.name,
+            map: await repoMap(join(process.cwd(), svc.dir)),
+        })));
+        out = (await review(draft, map, undefined, parts)).body;
     }
     catch (err) {
         console.log(`${glyph.warn} ${c.yellow('review skipped')}  ${err instanceof Error ? err.message : 'the control plane could not be reached'}`);
@@ -596,7 +609,9 @@ export const initCommand = {
                     (found.databases.length ? await theOnlyNode(flags) : undefined),
             });
             const questions = drafted.questions;
-            const manifest = flags.ai ? await reviewed(drafted.manifest, flags) : drafted.manifest;
+            const manifest = flags.ai
+                ? await reviewed(drafted.manifest, flags, found.services.map((s) => ({ name: s.name, dir: s.dir })))
+                : drafted.manifest;
             await writeFile(path, manifest);
             console.log(`${c.green('created')} ${path}`);
             if (found.layout)

package/dist/compose.js

@@ -1,6 +1,6 @@
 import { parse as parseYaml } from 'yaml';
 import { safeDatabaseName } from './dbnames.js';
-import { injectedUrl, pointsAt } from './dburl.js';
+import { pointsAt } from './dburl.js';
 /** Images Fleet manages as databases rather than as plain containers. */
 const ENGINE_IMAGES = {
     postgres: 'postgres',
@@ -310,10 +310,17 @@ export function composeToFleet(source, opts = {}) {
             if (target) {
                 const [composeName, fleetName] = target;
                 const engine = dbEngines.get(composeName);
-                const url = engine ? injectedUrl(fleetName, engine) : null;
-                if (url) {
-                    plain.push([k, url]);
-                    notes.push(`${name}: ${k} now points at the managed ${engine} — it named the compose service "${composeName}", which Fleet runs as "${fleetName}" with a password it generates.`);
+                if (engine) {
+                    // A reference, not a computed URL.
+                    //
+                    // This used to build the connection string here, which meant the CLI
+                    // carrying a copy of the control plane's engine table — ports,
+                    // schemes, default users — kept honest by a test that caught it
+                    // getting postgres's user wrong. The control plane resolves this at
+                    // apply time from the table it owns, so the copy is gone and the
+                    // manifest says what it means rather than a value that has to match.
+                    plain.push([k, `\${db:${fleetName}.url}`]);
+                    notes.push(`${name}: ${k} now points at the managed ${engine} — it named the compose service "${composeName}", which Fleet runs as "${fleetName}" and fills in when the manifest is applied.`);
                     continue;
                 }
             }

package/dist/dburl.js

@@ -1,5 +1,5 @@
 /**
- * The connection URL Fleet will inject for a managed database.
+ * Recognising a connection string that names a managed database.
  *
  * `uses: [db]` gives a service DATABASE_URL and friends. An imported compose
  * file usually has its own variable for the same thing — MONGODB_URI,
@@ -15,35 +15,6 @@
  * in the control plane that reads this file and fails when the two disagree,
  * which is the only thing that makes duplicating it acceptable.
  */
-/** Mirrors ENGINES in control-plane/src/manifest/databases.ts. */
-export const ENGINE_WIRE = {
-    postgres: { scheme: 'postgres', port: 5432, defaultUser: 'postgres', usesPassword: true, usesDatabase: true },
-    mysql: { scheme: 'mysql', port: 3306, defaultUser: 'app', usesPassword: true, usesDatabase: true },
-    mariadb: { scheme: 'mysql', port: 3306, defaultUser: 'app', usesPassword: true, usesDatabase: true },
-    redis: { scheme: 'redis', port: 6379, defaultUser: '', usesPassword: false, usesDatabase: false },
-    mongo: { scheme: 'mongodb', port: 27017, defaultUser: 'app', usesPassword: true, usesDatabase: true },
-};
-/** Mirrors passwordRefFor: the secret name a database's password lives under. */
-export const passwordRefFor = (name) => `${name.toUpperCase().replace(/[^A-Z0-9]+/g, '_')}_PASSWORD`;
-/**
- * The URL a service will see, written the way the manifest can carry it.
- *
- * The password is a `${secret:NAME}` reference rather than a value: it is
- * generated by the control plane and never known here, and a manifest is a
- * file people commit.
- */
-export function injectedUrl(dbName, engine) {
-    const spec = ENGINE_WIRE[engine];
-    if (!spec)
-        return null;
-    const auth = spec.usesPassword
-        ? `${encodeURIComponent(spec.defaultUser)}:\${secret:${passwordRefFor(dbName)}}@`
-        : '';
-    // `database` defaults to the declaration's own name, and the host is that
-    // same name: containers resolve each other by service name on the node.
-    const path = spec.usesDatabase ? `/${dbName}` : '';
-    return `${spec.scheme}://${auth}${dbName}:${spec.port}${path}`;
-}
 /** Does this value look like a connection URL aimed at `host`? */
 export function pointsAt(value, host) {
     // Scheme-relative on purpose: an app may hold a mongodb+srv:// or a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadurajfleetos/cli",
-  "version": "0.10.2",
+  "version": "0.11.0",
   "description": "Fleet OS command-line interface for deploying and orchestrating services on user-owned hardware",
   "type": "module",
   "license": "MIT",