@yadurajfleetos/cli 0.15.0 → 0.17.0

package/dist/args.js

@@ -45,7 +45,7 @@ export const KNOWN_FLAGS = new Set([
     'fleet', 'api', 'json', 'yes', 'y', 'help', 'h', 'version', 'v', 'no-wait',
     'plan', 'dry-run', 'force',
     // per command
-    'ai', 'all', 'channel', 'deploy', 'email', 'events', 'f', 'follow', 'limit',
+    'ai', 'all', 'apply', 'channel', 'deploy', 'email', 'events', 'f', 'follow', 'limit',
     'name', 'node', 'only', 'out', 'password', 'secret', 'service', 'sha',
     'since', 'terminal', 'to', 'token', 'url',
 ]);

package/dist/commands/doctor.js

@@ -3,6 +3,37 @@ import { loadProfile } from '../config.js';
 import { c, relativeTime } from '../render.js';
 import { glyph, rule, task } from '../ui.js';
 const icon = (state) => state === 'ok' ? glyph.ok : state === 'warn' ? glyph.warn : glyph.fail;
+/**
+ * How full a node's disk is, from the right two numbers.
+ *
+ * It reported 615% used, which is arithmetic that cannot be right and quietly
+ * undermines every other line of the report. The denominator was `node.diskMb`
+ * — and the control plane says, in a comment directly above the field it sends
+ * instead:
+ *
+ *   Capacity. node.diskMb is FREE space and is what the scheduler places
+ *   against, so it is not the denominator for a "used of total" reading.
+ *
+ * Somebody wrote that warning and this divided by the wrong one anyway. Used
+ * over free exceeds 100% the moment a disk is more than half full, which is
+ * why the number looked wild rather than merely wrong.
+ *
+ * An agent too old to report a capacity gets no percentage at all. A missing
+ * figure is a gap somebody can fix; an invented one is a number people act on.
+ */
+export function diskUse(usedMb, totalMb) {
+    if (!totalMb || usedMb === undefined) {
+        return { state: 'ok', detail: 'capacity not reported by this agent' };
+    }
+    const percent = Math.round((usedMb / totalMb) * 100);
+    return {
+        state: percent >= 90 ? 'fail' : percent >= 80 ? 'warn' : 'ok',
+        detail: `${percent}% used · ${Math.round(usedMb / 1024)}GB of ${Math.round(totalMb / 1024)}GB`,
+        remedy: percent >= 80
+            ? 'Free space from Docker images/volumes before the node becomes unschedulable.'
+            : undefined,
+    };
+}
 /**
  * Services that answer on a health path but do not declare one.
  *
@@ -191,7 +222,7 @@ export const doctorCommand = {
             });
             for (const node of result.nodes) {
                 const runtime = node.telemetry?.runtime;
-                const diskPercent = node.diskMb ? Math.round(((node.telemetry?.diskUsedMb ?? 0) / node.diskMb) * 100) : 0;
+                const disk = diskUse(node.telemetry?.diskUsedMb, node.telemetry?.diskTotalMb);
                 // Redis intentionally retains the last heartbeat briefly, but a node
                 // that has stopped reporting must not have old host facts rendered as
                 // current failures. The heartbeat check above is the only actionable
@@ -207,7 +238,7 @@ export const doctorCommand = {
                 }
                 checks.push({ state: runtime?.dockerAvailable ? 'ok' : 'fail', label: `Docker ${node.name}`, detail: runtime?.dockerAvailable ? `available${runtime.dockerVersion ? ` · ${runtime.dockerVersion}` : ''}` : runtime?.dockerError ?? 'No Docker runtime reported', remedy: runtime?.dockerAvailable ? undefined : 'Start Docker, then inspect the local fleet-agent log.' });
                 checks.push({ state: runtime?.registryStatus === 'ok' ? 'ok' : runtime?.registryStatus === 'failed' ? 'fail' : 'warn', label: `registry ${node.name}`, detail: runtime?.registryStatus === 'ok' ? 'latest real image pull succeeded' : runtime?.registryError ?? 'not tested by a real image pull yet', remedy: runtime?.registryStatus === 'ok' ? undefined : 'Use a LAN-reachable REGISTRY_URL, then restart a service to run an authenticated pull.' });
-                checks.push({ state: diskPercent >= 90 ? 'fail' : diskPercent >= 80 ? 'warn' : 'ok', label: `disk ${node.name}`, detail: `${diskPercent}% used`, remedy: diskPercent >= 80 ? 'Free space from Docker images/volumes before the node becomes unschedulable.' : undefined });
+                checks.push({ ...disk, label: `disk ${node.name}` });
                 if (runtime?.lastReconcileError)
                     checks.push({ state: 'fail', label: `reconcile ${node.name}`, detail: runtime.lastReconcileError, remedy: 'Run `fleet logs <service> --follow` and inspect the deployment history.' });
             }

package/dist/commands/fix.js

@@ -1,6 +1,7 @@
-import { readFile, writeFile } from 'node:fs/promises';
-import { parseDocument } from 'yaml';
 import { CliError, EXIT, request, requireFleet } from '../api.js';
+import { editManifest, restoreManifest } from '../manifest-edit.js';
+import { localSource } from '../source.js';
+import { checkEdit, applyEdit, revertEdit } from '../source-edit.js';
 import { c } from '../render.js';
 import { glyph, rule } from '../ui.js';
 import { confirm } from '../prompt.js';
@@ -19,6 +20,69 @@ async function statusOf(fleetId, name) {
     const { body } = await request('GET', `/fleets/${fleetId}/services`);
     return body.services.find((s) => s.name === name)?.current?.status ?? 'not running';
 }
+/**
+ * Change one line of a service's source, deploy it, and put it back if that
+ * made things worse.
+ *
+ * The furthest this reaches into somebody's work, so it is the most guarded
+ * thing here. `checkEdit` refuses anything it could not undo — a file outside
+ * the service's build context, one git does not track, one already carrying
+ * uncommitted work, a line that is absent or appears twice — and the undo is
+ * `git checkout`, which is exact rather than a best effort.
+ */
+async function applySourceEdit(fleetId, edit, flags) {
+    const root = process.cwd();
+    const check = await checkEdit(root, edit);
+    if (!check.ok) {
+        console.log(`\n${glyph.warn} ${c.bold('This one has to be done by hand')}`);
+        console.log(`  ${edit.service} · ${edit.file}`);
+        console.log(`  ${c.dim(edit.why)}`);
+        console.log(`  ${c.dim(check.reason)}`);
+        return console.log();
+    }
+    console.log(`\n${glyph.info} ${c.bold('proposed')}  ${edit.file}:${check.line}  ${c.dim(edit.service)}`);
+    console.log(`  ${c.dim('-')} ${edit.find.trim()}`);
+    console.log(`  ${c.dim('+')} ${edit.replace.trim()}`);
+    console.log(`  ${c.dim(edit.why)}\n`);
+    if (!flags.yes && !flags.y) {
+        const ok = await confirm(`Change this line and redeploy ${edit.service}?`);
+        if (!ok)
+            return console.log(`  ${c.dim('left alone')}\n`);
+    }
+    const wasRunning = (await statusOf(fleetId, edit.service)) === 'running';
+    await applyEdit(check.path, edit);
+    console.log(`${glyph.ok} ${edit.file} updated`);
+    const { body: svc } = await request('GET', `/fleets/${fleetId}/services`);
+    const target = svc.services.find((s) => s.name === edit.service);
+    if (!target) {
+        await revertEdit(root, check.path);
+        console.log(`${glyph.warn} "${edit.service}" is not in this fleet — ${edit.file} put back\n`);
+        return;
+    }
+    console.log(`${glyph.pending} deploying…`);
+    try {
+        await request('POST', `/services/${target.id}/deploy`, { body: {} });
+        await awaitRunning(target, { timeoutMs: 240_000 });
+    }
+    catch (err) {
+        // Judged against where it started, like a manifest change: one already down
+        // and still down has not been made worse, and reverting there would take
+        // away a change that may well be right.
+        if (wasRunning) {
+            await revertEdit(root, check.path);
+            console.log(`${glyph.warn} ${edit.service} was running before and did not come back — ${edit.file} put back`);
+            console.log(`  ${c.dim(`Deploy the previous source with: fleet up ${edit.service}`)}\n`);
+            return;
+        }
+        console.log(`${glyph.warn} still not running — ${err.message}`);
+        console.log(`  ${c.dim('The edit was kept: it was already down, so this did not make it worse.')}`);
+        console.log(`  ${c.dim(`undo it with: git checkout ${edit.file} && fleet up ${edit.service}`)}\n`);
+        return;
+    }
+    console.log(`${glyph.ok} ${edit.service} is running`);
+    console.log(`\n  ${c.dim('review the change:')} git diff`);
+    console.log(`  ${c.dim('undo it:')} git checkout ${edit.file} && fleet up ${edit.service}\n`);
+}
 export const fixCommand = {
     async run(args, flags) {
         const service = args[0];
@@ -27,8 +91,16 @@ export const fixCommand = {
         const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
         console.log(`\n${rule(`fix · ${service}`)}`);
         console.log(`${glyph.pending} looking…`);
+        // Source travels with the question. `fix` already requires a project
+        // directory, so the files are right here — and the control plane, which
+        // deletes every build context the moment a build ends, never has to hold
+        // any of it.
+        const source = await localSource(process.cwd());
         const { body: found } = await request('POST', `/fleets/${fleetId}/diagnose`, {
-            body: { question: `Why is the "${service}" service not working as it should?` },
+            body: {
+                question: `Why is the "${service}" service not working as it should?`,
+                ...(Object.keys(source).length ? { source } : {}),
+            },
         });
         if (found.status !== 'ok') {
             throw new CliError(found.status === 'disabled' ? found.reason : `inconclusive — ${found.reason}`, EXIT.failure);
@@ -38,6 +110,14 @@ export const fixCommand = {
             console.log(`  ${c.bold(f.claim)}`);
             console.log(`    ${c.dim(f.evidence)}`);
         }
+        // A source edit, when the manifest cannot carry the change.
+        //
+        // Offered only after the manifest options are exhausted: a manifest is
+        // Fleet's to alter and a repository is not, so the same fault fixed either
+        // way should be fixed in the manifest.
+        if (!found.fix && found.edit) {
+            return await applySourceEdit(fleetId, found.edit, flags);
+        }
         const fix = found.fix;
         if (!fix) {
             // Most investigations do not end in one exact manifest change, and this
@@ -67,26 +147,22 @@ export const fixCommand = {
         }
         // Read before writing, and keep the original in memory: this is what makes
         // the change reversible without a second file on disk.
+        //
+        // The same editor `fleet tune` uses. Two implementations of "write one
+        // field into fleet.yaml" would drift — one would learn to keep the comments
+        // and the other would not, and nobody would notice until a manifest came
+        // back stripped of the only explanation it carried.
         const path = 'fleet.yaml';
-        const before = await readFile(path, 'utf8').catch(() => {
-            throw new CliError(`No fleet.yaml here. Run this from the project directory.`, EXIT.usage);
-        });
-        const doc = parseDocument(before);
-        if (!doc.hasIn(['services', fix.service])) {
-            throw new CliError(`fleet.yaml has no service named "${fix.service}"`, EXIT.failure);
-        }
-        // Edited as a document, so the comments `fleet init` wrote survive. A
-        // round trip through parse and re-serialise would take them out, and they
-        // are the only explanation a generated manifest carries.
-        if (fix.value === null)
-            doc.deleteIn(['services', fix.service, fix.field]);
-        else
-            doc.setIn(['services', fix.service, fix.field], shape(fix.field, fix.value));
         const wasRunning = (await statusOf(fleetId, fix.service)) === 'running';
-        await writeFile(path, String(doc));
+        const { applied, refused, before } = await editManifest(path, [
+            { service: fix.service, field: fix.field, value: shape(fix.field, fix.value), why: fix.why },
+        ]);
+        if (!applied.length) {
+            throw new CliError(refused[0]?.reason ?? `nothing could be applied to ${path}`, EXIT.failure);
+        }
         console.log(`${glyph.ok} fleet.yaml updated`);
         const restore = async (why) => {
-            await writeFile(path, before);
+            await restoreManifest(path, before);
             console.log(`${glyph.warn} ${why} — fleet.yaml put back`);
             console.log(`  ${c.dim(`Deploy the previous manifest with: fleet up ${fix.service}`)}\n`);
         };

package/dist/commands/services.js

@@ -8,6 +8,7 @@ import { ask, canPrompt, confirm, selectOrThrow } from '../prompt.js';
 import { DEPLOY_STEPS, follow, phaseWalker, } from '../progress.js';
 import { planFromManifest, projectNameFor } from '../plan.js';
 import { uploadContext, humanBytes } from '../archive.js';
+import { localSource } from '../source.js';
 const manifestPath = (given) => given ?? 'fleet.yaml';
 async function readManifest(path) {
     try {
@@ -331,6 +332,24 @@ export const rescheduleCommand = {
         console.log(`${c.green('moved')} ${service.name} → ${c.bold(body.movedTo.name)}`);
     },
 };
+/**
+ * A building row, with what the builder is actually doing.
+ *
+ * Every field here has been travelling from buildx through Redis to the API for
+ * a while and stopping there, so this shows what already exists rather than
+ * measuring anything new. Emulation is called out because it is the usual
+ * answer to "why is this taking twenty minutes".
+ */
+function buildStatus(status, progress) {
+    const parts = [statusColour(status)];
+    if (progress.step && progress.ofSteps)
+        parts.push(c.dim(`${progress.step}/${progress.ofSteps}`));
+    if (progress.platform)
+        parts.push(c.dim(progress.platform));
+    if (progress.emulated)
+        parts.push(c.yellow('emulated'));
+    return parts.join(' ');
+}
 export const deploymentsCommand = {
     async run(args, flags) {
         const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
@@ -345,8 +364,10 @@ export const deploymentsCommand = {
             relativeTime(d.startedAt),
             d.gitSha?.slice(0, 7) ?? c.dim('—'),
             d.nodeName ?? c.dim('—'),
-            statusColour(d.status),
-            d.failureReason ?? '',
+            // "building" alone reads as stuck. The step counter is what tells a
+            // reader the difference between a slow build and a hung one.
+            d.progress ? buildStatus(d.status, d.progress) : statusColour(d.status),
+            d.failureReason ?? (d.progress?.detail ? c.dim(d.progress.detail) : ''),
         ])));
     },
 };
@@ -590,12 +611,19 @@ async function answerQuestions(questions, flags) {
 export const diagnoseCommand = {
     async run(args, flags) {
         const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+        const source = await localSource(process.cwd());
         const question = args.join(' ').trim();
         if (!question) {
             throw new CliError('usage: fleet diagnose "<what is wrong>"\n' +
                 '   eg: fleet diagnose "why is backend returning 502?"', EXIT.usage);
         }
-        const { body } = await task('looking', async () => request('POST', `/fleets/${fleetId}/diagnose`, { body: { question } }), 
+        const { body } = await task('looking', async () => request('POST', `/fleets/${fleetId}/diagnose`, {
+            // Source when there is a manifest here to read it from, and nothing
+            // when there is not. `diagnose` runs from anywhere on purpose, so
+            // this is the one lookup that is sometimes unavailable — the tool
+            // says so rather than pretending it looked.
+            body: { question, ...(Object.keys(source).length ? { source } : {}) },
+        }), 
         // What it looked at, so the wait is legible rather than a spinner.
         { done: (r) => ('calls' in r.body ? `looked at ${r.body.calls.length} thing(s)` : 'done') });
         if (flags.json)

package/dist/commands/tune.js

@@ -1,26 +1,38 @@
 import { request, requireFleet } from '../api.js';
 import { c } from '../render.js';
 import { glyph, rule } from '../ui.js';
-import { asQuantity, tuneRam, MIN_OBSERVATION_HOURS } from '../tune.js';
+import { confirm } from '../prompt.js';
+import { editManifest } from '../manifest-edit.js';
+import { asQuantity, tuneHealth, tuneRam, MIN_OBSERVATION_HOURS, } from '../tune.js';
 /**
- * Reservations, checked against what the services actually used.
+ * The manifest, checked against what the services actually did.
  *
- * It proposes and never applies. Every number here is the system inferring
- * something about a machine, and the lesson of every inference this project has
- * shipped is that one leaving its evidence needs a person between it and the
- * manifest — a review once invented a node from a compose service name, and
- * once replaced a `build:` with `image: nginx:alpine` and served the welcome
- * page over somebody's site. Both were caught by a guardrail. A person reading
- * a diff is the cheapest guardrail there is.
+ * Two measured facts, in one place because they are the same kind of thing: a
+ * number a repository could not have told anyone, that Fleet found out by
+ * running the program. How much memory it uses, and which path it answers on.
+ *
+ * Both used to end as advice — a line telling the reader to go and edit
+ * `fleet.yaml` themselves, about something this already knew. `--apply` writes
+ * them, with a confirmation and through the same guarded editor `fleet fix`
+ * uses.
+ *
+ * It proposes and it asks. Every number here is the system inferring something
+ * about a machine, and the lesson of every inference this project has shipped
+ * is that one leaving its evidence needs a person between it and the manifest —
+ * a review once invented a node from a compose service name, and once replaced
+ * a `build:` with `image: nginx:alpine` and served the welcome page over
+ * somebody's site. Both were caught by a guardrail. A person reading a diff is
+ * the cheapest guardrail there is.
  */
 export const tuneCommand = {
     async run(_args, flags) {
         const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
         const { body } = await request('GET', `/fleets/${fleetId}/services`);
         const advice = body.services.map((s) => tuneRam(s));
+        const health = body.services.map((s) => tuneHealth(s)).filter((h) => h !== null);
         if (flags.json)
-            return console.log(JSON.stringify({ fleetId, advice }, null, 2));
-        console.log(`\n${rule('tune · reservations against measured use')}`);
+            return console.log(JSON.stringify({ fleetId, advice, health }, null, 2));
+        console.log(`\n${rule('tune · the manifest against what was measured')}`);
         const advised = advice.filter((a) => a.verdict === 'advise');
         const tight = advice.filter((a) => a.verdict === 'tight');
         const waiting = advice.filter((a) => a.verdict === 'too-soon' || a.verdict === 'no-data');
@@ -43,18 +55,62 @@ export const tuneCommand = {
                 console.log(`${glyph.info} ${c.dim(a.name.padEnd(18))} ${c.dim('not measured yet')}`);
             }
         }
-        if (advised.length) {
-            console.log(`\n  ${c.dim('edit fleet.yaml, then')} fleet up`);
-            for (const a of advised) {
-                if (a.verdict !== 'advise')
-                    continue;
-                console.log(`  ${c.dim(`${a.name}:`)} resources: { ram: ${asQuantity(a.to)} }`);
-            }
+        for (const h of health) {
+            console.log(`${glyph.warn} ${c.bold(h.name.padEnd(18))} answers 2xx on ${c.bold(h.path)} but declares no health check`);
         }
-        if (!advised.length && !tight.length) {
-            console.log(`\n  ${c.dim(waiting.length === advice.length
+        // One list, because to the manifest they are the same edit.
+        const edits = [
+            ...advised.flatMap((a) => a.verdict === 'advise'
+                ? [
+                    {
+                        service: a.name,
+                        field: 'resources',
+                        value: { ram: asQuantity(a.to), cpu: 0.5 },
+                        why: `peaks at ${a.peak}MB against ${asQuantity(a.from)} reserved`,
+                    },
+                ]
+                : []),
+            ...health.map((h) => ({
+                service: h.name,
+                field: 'health',
+                value: { path: h.path },
+                why: `measured answering 2xx on ${h.path}`,
+            })),
+        ];
+        if (!edits.length && !tight.length) {
+            console.log(`\n  ${c.dim(waiting.length === advice.length && !health.length
                 ? 'Nothing has been watched long enough to advise on yet.'
-                : 'Every measured reservation is about right.')}`);
+                : 'Every measured setting is about right.')}`);
+            return console.log();
+        }
+        if (!edits.length)
+            return console.log();
+        if (!flags.apply) {
+            console.log(`\n  ${c.dim('write these with')} fleet tune --apply`);
+            for (const e of edits) {
+                console.log(`  ${c.dim(`${e.service}:`)} ${e.field}: ${JSON.stringify(e.value)}`);
+            }
+            return console.log();
+        }
+        console.log();
+        for (const e of edits) {
+            console.log(`  ${e.service}.${e.field} → ${JSON.stringify(e.value)}  ${c.dim(e.why)}`);
+        }
+        if (!flags.yes && !flags.y) {
+            const ok = await confirm(`\nWrite ${edits.length} change(s) to fleet.yaml?`);
+            if (!ok)
+                return console.log(`  ${c.dim('left alone')}\n`);
+        }
+        const { applied, refused } = await editManifest('fleet.yaml', edits);
+        for (const r of refused) {
+            console.log(`${glyph.warn} ${r.edit.service}.${r.edit.field} — ${r.reason}`);
+        }
+        if (applied.length) {
+            console.log(`${glyph.ok} fleet.yaml updated — ${applied.length} change(s)`);
+            // Not deployed here on purpose. `tune` changes settings that only take
+            // effect on the next rollout, and quietly restarting somebody's fleet
+            // because they asked for a manifest edit is a surprise nobody wants.
+            console.log(`\n  ${c.dim('review it, then')} fleet up`);
         }
         console.log();
     },

package/dist/commands/up.js

@@ -188,6 +188,27 @@ async function deployOne(service, opts) {
             // is measured in tens of minutes, not minutes.
             const deadline = Date.now() + 45 * 60_000;
             while (Date.now() < deadline) {
+                // What the builder is doing, rather than a hint about what it might
+                // be doing. Every field here has been reaching /progress since the
+                // phase writer was added and nothing asked for it, so this loop sat
+                // cycling generic advice past a reader who could have been told the
+                // step number. Failures are swallowed: this is a label, and losing it
+                // must not end a deploy that is going fine.
+                const line = await request('GET', `/services/${service.id}/progress`)
+                    .then((r) => r.body)
+                    .catch(() => null);
+                if (line && ['queued', 'building', 'pushing'].includes(line.status)) {
+                    const parts = [line.status];
+                    if (line.step && line.ofSteps)
+                        parts.push(`${line.step}/${line.ofSteps}`);
+                    if (line.platform)
+                        parts.push(line.platform);
+                    if (line.emulated)
+                        parts.push('emulated');
+                    s.update(`${c.bold(service.name)} · ${parts.join(' · ')}`);
+                    if (line.detail)
+                        s.hints([line.detail]);
+                }
                 const { body } = await request('GET', `/fleets/${opts.fleetId}/services`);
                 const current = body.services.find((s) => s.id === service.id)?.current;
                 if (current?.status === 'running')

package/dist/detect.js

@@ -45,11 +45,12 @@ const hasDep = (pkg, name) => {
     return Boolean(deps?.[name] || devDeps?.[name]);
 };
 // ── Dockerfile templates ────────────────────────────────────────────────
-const NEXTJS_DOCKERFILE = `# --- Build ---
+const NEXTJS_DOCKERFILE = `# syntax=docker/dockerfile:1
+# --- Build ---
 FROM node:22-alpine AS builder
 WORKDIR /app
 COPY package*.json ./
-RUN npm ci
+RUN --mount=type=cache,target=/root/.npm npm ci
 COPY . .
 RUN npm run build
 
@@ -63,11 +64,12 @@ COPY --from=builder /app/public ./public
 EXPOSE 3000
 CMD ["node", "server.js"]
 `;
-const VITE_DOCKERFILE = `# --- Build ---
+const VITE_DOCKERFILE = `# syntax=docker/dockerfile:1
+# --- Build ---
 FROM node:22-alpine AS builder
 WORKDIR /app
 COPY package*.json ./
-RUN npm ci
+RUN --mount=type=cache,target=/root/.npm npm ci
 COPY . .
 RUN npm run build
 
@@ -77,32 +79,57 @@ COPY --from=builder /app/dist /usr/share/nginx/html
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]
 `;
-const NODE_DOCKERFILE = `FROM node:22-alpine
+const NODE_DOCKERFILE = `# syntax=docker/dockerfile:1
+FROM node:22-alpine
 WORKDIR /app
 COPY package*.json ./
-RUN npm ci --omit=dev
+RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev
 COPY . .
 EXPOSE 3000
 CMD ["node", "src/index.js"]
 `;
-const PYTHON_DOCKERFILE = (entry, usesPoetry) => `FROM python:3.12-slim
+/**
+ * `--mount=type=cache` rather than `--no-cache-dir`.
+ *
+ * The two look interchangeable and are opposites. `--no-cache-dir` tells pip to
+ * keep no wheel cache *inside the layer*, which keeps the image small and makes
+ * every rebuild download and recompile from nothing. A BuildKit cache mount
+ * lives outside the image entirely — it is not a layer, so it adds nothing to
+ * the final size — and survives between builds, so a rebuild that changes only
+ * application source reuses every wheel it already has.
+ *
+ * That is the difference between a two-minute rebuild and a twenty-minute one
+ * for anything with `cryptography` or `psycopg2` in it, and more again when the
+ * build is emulated.
+ *
+ * The syntax line is required: `RUN --mount` is a Dockerfile frontend feature,
+ * and without it an older builder fails on the flag rather than ignoring it.
+ */
+const PYTHON_DOCKERFILE = (entry, usesPoetry) => `# syntax=docker/dockerfile:1
+FROM python:3.12-slim
 WORKDIR /app
 ${usesPoetry
     ? `COPY pyproject.toml poetry.lock* ./
-RUN pip install --no-cache-dir poetry && poetry config virtualenvs.create false && poetry install --no-interaction --no-ansi --no-dev`
+RUN --mount=type=cache,target=/root/.cache/pip \\
+    --mount=type=cache,target=/root/.cache/pypoetry \\
+    pip install poetry && poetry config virtualenvs.create false && poetry install --no-interaction --no-ansi --no-dev`
     : `COPY requirements*.txt ./
-RUN pip install --no-cache-dir -r requirements.txt`}
+RUN --mount=type=cache,target=/root/.cache/pip \\
+    pip install -r requirements.txt`}
 COPY . .
 EXPOSE 8000
 CMD ["python", "-m", "${entry}"]
 `;
-const GO_DOCKERFILE = (module) => `# --- Build ---
+const GO_DOCKERFILE = (module) => `# syntax=docker/dockerfile:1
+# --- Build ---
 FROM golang:1.24-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum* ./
-RUN go mod download
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
 COPY . .
-RUN CGO_ENABLED=0 go build -o /server .
+RUN --mount=type=cache,target=/go/pkg/mod \\
+    --mount=type=cache,target=/root/.cache/go-build \\
+    CGO_ENABLED=0 go build -o /server .
 
 # --- Run ---
 FROM alpine:3.21
@@ -110,13 +137,21 @@ COPY --from=builder /server /server
 EXPOSE 8080
 CMD ["/server"]
 `;
-const RUST_DOCKERFILE = `# --- Build ---
+const RUST_DOCKERFILE = `# syntax=docker/dockerfile:1
+# --- Build ---
 FROM rust:1.87-slim AS builder
 WORKDIR /app
 COPY Cargo.toml Cargo.lock* ./
-RUN mkdir src && echo 'fn main(){}' > src/main.rs && cargo build --release && rm -rf src
+RUN --mount=type=cache,target=/usr/local/cargo/registry \\
+    mkdir src && echo 'fn main(){}' > src/main.rs && cargo build --release && rm -rf src
 COPY . .
-RUN cargo build --release
+# Only the registry is cached, deliberately. A cache mount on /app/target would
+# speed the compile up and put the binary somewhere the runtime stage cannot
+# copy from: a mount is not part of the image, so "COPY --from=builder
+# /app/target/release/*" would find an empty directory and the image would
+# build cleanly and contain nothing.
+RUN --mount=type=cache,target=/usr/local/cargo/registry \\
+    cargo build --release
 
 # --- Run ---
 FROM debian:bookworm-slim

package/dist/manifest-edit.js

@@ -0,0 +1,66 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { parseDocument } from 'yaml';
+import { CliError, EXIT } from './api.js';
+/**
+ * Fields the CLI will write. Deliberately the same set the control plane's
+ * review is allowed to touch, and for the same reasons — see
+ * `control-plane/src/ai/edits.ts`, which is the authority. Duplicated rather
+ * than imported because the two do not share a package, and a copy that drifts
+ * open is caught by the server refusing the edit anyway.
+ */
+const WRITABLE = new Set([
+    'container_port',
+    'health',
+    'resources',
+    'placement',
+    'replicas',
+    'env',
+    'command',
+]);
+/**
+ * Apply edits to a manifest file in place.
+ *
+ * Edited as a document rather than parsed and re-serialised, so the comments
+ * survive. A generated manifest's comments are the only thing explaining why it
+ * looks the way it does, and a round trip through `parse`/`stringify` silently
+ * removes every one of them.
+ *
+ * A service can live under `services:` or `databases:`; both are looked at,
+ * because to everything downstream a database is a service and a reader
+ * correcting one should not have to know which block the tool expects.
+ */
+export async function editManifest(path, edits) {
+    const before = await readFile(path, 'utf8').catch(() => {
+        throw new CliError(`No ${path} here. Run this from the project directory.`, EXIT.usage);
+    });
+    const doc = parseDocument(before);
+    const applied = [];
+    const refused = [];
+    for (const edit of edits) {
+        if (!WRITABLE.has(edit.field)) {
+            refused.push({ edit, reason: `"${edit.field}" is not a field this may write` });
+            continue;
+        }
+        const block = doc.hasIn(['services', edit.service])
+            ? 'services'
+            : doc.hasIn(['databases', edit.service])
+                ? 'databases'
+                : null;
+        if (!block) {
+            refused.push({ edit, reason: `no service or database named "${edit.service}"` });
+            continue;
+        }
+        if (edit.value === null)
+            doc.deleteIn([block, edit.service, edit.field]);
+        else
+            doc.setIn([block, edit.service, edit.field], edit.value);
+        applied.push(edit);
+    }
+    if (applied.length)
+        await writeFile(path, String(doc));
+    return { applied, refused, before };
+}
+/** Put a manifest back, after a change that made things worse. */
+export async function restoreManifest(path, before) {
+    await writeFile(path, before);
+}

package/dist/source-edit.js

@@ -0,0 +1,87 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { resolve, relative, join } from 'node:path';
+import { parse as parseYaml } from 'yaml';
+const run = promisify(execFile);
+/** Where a service's build context is, according to the local manifest. */
+export async function buildContextOf(root, service) {
+    try {
+        const doc = parseYaml(await readFile(join(root, 'fleet.yaml'), 'utf8'));
+        return doc?.services?.[service]?.build ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+async function git(root, args) {
+    try {
+        const { stdout } = await run('git', args, { cwd: root });
+        return { ok: true, out: stdout };
+    }
+    catch (err) {
+        return { ok: false, out: err.stdout ?? '' };
+    }
+}
+/**
+ * Everything that must be true before a line of somebody's source is touched.
+ *
+ * Separated from applying it so the answer can be shown before anything
+ * happens, and so each refusal can be tested without a repository being
+ * modified to find out.
+ */
+export async function checkEdit(root, edit) {
+    const context = await buildContextOf(root, edit.service);
+    if (!context) {
+        return { ok: false, reason: `fleet.yaml does not say where "${edit.service}" is built from` };
+    }
+    const base = resolve(root, context);
+    const path = resolve(base, edit.file);
+    // Inside the service's own build context, and nowhere else. A path is checked
+    // after resolving, so `../` cannot walk out of it.
+    const within = relative(base, path);
+    if (within.startsWith('..') || within.startsWith('/')) {
+        return { ok: false, reason: `${edit.file} is outside ${context}, which is all this service may change` };
+    }
+    let text;
+    try {
+        text = await readFile(path, 'utf8');
+    }
+    catch {
+        return { ok: false, reason: `${edit.file} does not exist in ${context}` };
+    }
+    const occurrences = text.split(edit.find).length - 1;
+    if (occurrences === 0) {
+        return { ok: false, reason: `that line is not in ${edit.file} — it may have been quoted from memory` };
+    }
+    if (occurrences > 1) {
+        return {
+            ok: false,
+            reason: `that line appears ${occurrences} times in ${edit.file}, so a replacement could hit the wrong one`,
+        };
+    }
+    // Undoable, which is the condition on all of this. A file git does not track,
+    // or one already carrying uncommitted work, cannot be restored by checking it
+    // out — and losing somebody's unsaved change to fix a hostname is not a trade
+    // worth offering.
+    const tracked = await git(root, ['ls-files', '--error-unmatch', path]);
+    if (!tracked.ok) {
+        return { ok: false, reason: `${edit.file} is not tracked by git, so this could not be undone` };
+    }
+    const dirty = await git(root, ['status', '--porcelain', '--', path]);
+    if (dirty.out.trim()) {
+        return { ok: false, reason: `${edit.file} has uncommitted changes — commit or stash them first, so this can be undone` };
+    }
+    const line = text.slice(0, text.indexOf(edit.find)).split('\n').length;
+    return { ok: true, path, line };
+}
+/** Apply a checked edit. Call `checkEdit` first; this trusts it. */
+export async function applyEdit(path, edit) {
+    const text = await readFile(path, 'utf8');
+    await writeFile(path, text.replace(edit.find, edit.replace));
+}
+/** Put a file back exactly as git has it. */
+export async function revertEdit(root, path) {
+    const out = await git(root, ['checkout', '--', path]);
+    return out.ok;
+}

package/dist/source.js

@@ -0,0 +1,146 @@
+import { readdir, readFile, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { parse as parseYaml } from 'yaml';
+/**
+ * The few files a service is built from, for an investigation to read.
+ *
+ * The blind spot this closes. A service failed because `vote/app.py` hardcodes
+ * `Redis(host="redis")` while the manifest names that database `cache`. The
+ * diagnosis traced it correctly — unhealthy, then a Redis connection failure in
+ * the logs — and stopped at "check the cache service", because every lookup it
+ * has reads the database, a node's heartbeat, or a build-context listing, and
+ * the answer was in none of them.
+ *
+ * Sent by the CLI rather than read by the control plane, which is the whole
+ * design. The control plane deletes an uploaded build context the moment a
+ * build ends, on purpose: customer source is held only for as long as it takes
+ * to build it. A `source` lookup that read from the server would have to break
+ * that. This way the source exists in one request, for the length of one
+ * investigation, and is never written down.
+ *
+ * The cost is that it only works from a project directory. That is honest —
+ * `fleet fix` already requires one, and a diagnosis run from elsewhere simply
+ * reports that it has no source rather than pretending.
+ */
+/** Never read: build output, dependencies, and anything that is not evidence. */
+const SKIP = new Set([
+    'node_modules', '.git', 'dist', 'build', 'target', 'vendor', '.next', '.nuxt',
+    'coverage', '__pycache__', '.venv', 'venv', '.turbo', '.cache', 'tmp',
+]);
+/**
+ * What is worth reading, in the order it is worth reading.
+ *
+ * An entry point first, because that is where a program says what it connects
+ * to — the hostname, the port, the environment variable it reads. Then the
+ * dependency manifest, which says what it is. The Dockerfile last: the build
+ * context listing already covers most of what it would tell us.
+ */
+const EVIDENCE = [
+    /^(main|app|server|index|program)\.(py|js|ts|mjs|go|rb|cs|java)$/i,
+    /^(package\.json|requirements\.txt|pyproject\.toml|go\.mod|Cargo\.toml|Gemfile|.*\.csproj)$/i,
+    /^\.env\.(example|sample|template)$/,
+    /^Dockerfile(\..+)?$/,
+];
+/**
+ * How much of one service to send.
+ *
+ * Small on purpose. This lands in a loop whose whole conversation is resent
+ * every turn against a token budget that took real work to fit inside — the
+ * compaction, the deadline and the step budget all exist because that budget
+ * is tight. A generous source dump would undo all three.
+ */
+const MAX_PER_FILE = 2_000;
+const MAX_PER_SERVICE = 4_000;
+/** The head of a file: a program declares its connections near the top. */
+function head(text, limit) {
+    return text.length <= limit ? text.trimEnd() : `${text.slice(0, limit)}\n… (truncated)`;
+}
+async function filesIn(dir) {
+    const found = [];
+    const walk = async (at, depth) => {
+        if (depth > 2)
+            return;
+        let entries;
+        try {
+            entries = await readdir(at, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (e.name.startsWith('.') && !e.name.startsWith('.env.'))
+                continue;
+            if (SKIP.has(e.name))
+                continue;
+            const full = join(at, e.name);
+            if (e.isDirectory())
+                await walk(full, depth + 1);
+            else if (EVIDENCE.some((r) => r.test(e.name)))
+                found.push(full);
+        }
+    };
+    await walk(dir, 0);
+    // Evidence order, so a truncated bundle keeps the entry point rather than
+    // whichever file the filesystem happened to return first.
+    return found.sort((a, b) => {
+        const rank = (p) => EVIDENCE.findIndex((r) => r.test(p.split('/').pop() ?? '')) ?? EVIDENCE.length;
+        return rank(a) - rank(b);
+    });
+}
+/** One service's source evidence, or null when there is nothing to read. */
+export async function sourceFor(root, buildContext) {
+    const dir = join(root, buildContext);
+    try {
+        if (!(await stat(dir)).isDirectory())
+            return null;
+    }
+    catch {
+        return null;
+    }
+    const parts = [];
+    let budget = MAX_PER_SERVICE;
+    for (const file of await filesIn(dir)) {
+        if (budget <= 0)
+            break;
+        try {
+            const info = await stat(file);
+            if (info.size > 256 * 1024)
+                continue;
+            const text = head(await readFile(file, 'utf8'), Math.min(MAX_PER_FILE, budget));
+            const rel = file.slice(dir.length + 1);
+            const block = `--- ${rel}\n${text}`;
+            parts.push(block);
+            budget -= block.length;
+        }
+        catch {
+            // Unreadable is not fatal; it is simply not evidence.
+        }
+    }
+    return parts.length ? parts.join('\n\n') : null;
+}
+/**
+ * Source for every service the local manifest builds, keyed by service name.
+ *
+ * Every service, because the investigation chooses which one it wants and the
+ * CLI cannot know in advance. Only what it asks for is ever put in front of the
+ * model, so the cost of the others is bytes on one request rather than tokens
+ * on every turn.
+ */
+export async function localSource(root, manifestPath = 'fleet.yaml') {
+    let doc;
+    try {
+        doc = parseYaml(await readFile(join(root, manifestPath), 'utf8')) ?? {};
+    }
+    catch {
+        return {};
+    }
+    const out = {};
+    for (const [name, svc] of Object.entries(doc.services ?? {})) {
+        if (!svc?.build)
+            continue;
+        const found = await sourceFor(root, svc.build);
+        if (found)
+            out[name] = found;
+    }
+    return out;
+}

package/dist/tune.js

@@ -59,3 +59,28 @@ export function tuneRam(svc, now = Date.now()) {
 export function asQuantity(mb) {
     return mb % 1024 === 0 ? `${mb / 1024}Gi` : `${mb}Mi`;
 }
+/**
+ * The health check a service should declare, from what it was measured
+ * answering.
+ *
+ * The gap this closes: the node sweeps candidate paths after every deploy and
+ * records exactly which ones returned 2xx, and until now that reached one line
+ * of advice telling a person to go and type it into the manifest. Fleet knew
+ * the answer and asked for it back.
+ *
+ * Only for a service that declares no check. One that declares a path has an
+ * operator's decision behind it, and overwriting that with a measurement would
+ * be the tool deciding it knows better about a choice it cannot see the reason
+ * for.
+ */
+export function tuneHealth(svc) {
+    if (!svc.healthDisabled)
+        return null;
+    if (!svc.discoveredHealth?.length)
+        return null;
+    // The first 2xx-3xx, in the order the node tried them: a dedicated endpoint
+    // before "/", because a check that renders the whole application every ten
+    // seconds is the worse of two working answers.
+    const path = svc.discoveredHealth.find((c) => c.status >= 200 && c.status < 400)?.path;
+    return path ? { name: svc.name, path } : null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadurajfleetos/cli",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Fleet OS command-line interface for deploying and orchestrating services on user-owned hardware",
   "type": "module",
   "license": "MIT",