@yadurajfleetos/cli 0.2.0 → 0.4.0

package/README.md

@@ -16,7 +16,7 @@ npx @yadurajfleetos/cli --help
 
 ### Build and Install from Source
 ```bash
-git clone https://github.com/YadurajManu/BhaiMerra.git fleet-os
+git clone https://github.com/YadurajManu/fleet-os.git fleet-os
 cd fleet-os/cli
 npm install
 npm run build

package/dist/archive.js

@@ -21,6 +21,25 @@ import { CliError, EXIT } from './api.js';
  * later rather than a slow upload for everybody now.
  */
 const ALWAYS_EXCLUDE = ['.git', 'node_modules', '.DS_Store'];
+/**
+ * Patterns that must never be honoured, however the .dockerignore is written.
+ *
+ * `Dockerfile` in a .dockerignore is standard, recommended practice: a local
+ * `docker build` reads it from the host rather than from the context, so
+ * excluding it avoids shipping it twice. Here the context is built somewhere
+ * else, and the Dockerfile has to travel with it — honouring that line
+ * produces "failed to read dockerfile" on a context that is otherwise perfect.
+ *
+ * A bare `*` is the other one. It is the whitelist idiom, always paired with
+ * `!keep-this` lines, and since negations are not supported it would otherwise
+ * mean "exclude the entire project".
+ */
+function mustNotExclude(pattern) {
+    const p = pattern.replace(/^\.?\//, '').replace(/^\*\*\//, '');
+    if (p === '*' || p === '**' || p === '.')
+        return true;
+    return /^\*?dockerfile/i.test(p);
+}
 /**
  * Read .dockerignore into tar exclusion patterns.
  *
@@ -43,7 +62,8 @@ export async function ignorePatterns(dir) {
         .map((line) => line.trim())
         .filter((line) => line && !line.startsWith('#') && !line.startsWith('!'))
         .map((line) => line.replace(/^\/+/, '').replace(/\/+$/, ''))
-        .filter(Boolean);
+        .filter(Boolean)
+        .filter((line) => !mustNotExclude(line));
     return [...new Set([...ALWAYS_EXCLUDE, ...patterns])];
 }
 /**

package/dist/commands/auth.js

@@ -232,8 +232,58 @@ export const authCommand = {
                 ]));
                 return;
             }
+            /**
+             * Ask for a reset link. The control plane answers 204 for every address,
+             * known or not, so this command cannot be used to discover whether an
+             * account exists either - and says so, rather than implying the mail is
+             * definitely on its way.
+             */
+            case 'forgot': {
+                if (!profile.api) {
+                    profile.api = validApi(await requiredPrompt('control plane URL', { hint: 'e.g. https://fleetapi.example.com' }));
+                }
+                const email = typeof flags.email === 'string' ? flags.email : await requiredPrompt('email');
+                await task('requesting a reset link', async () => {
+                    // auth:false - you cannot be signed in when you have forgotten the password.
+                    await request('POST', '/auth/forgot', { profile, body: { email }, auth: false });
+                });
+                console.log(`\n${glyph.ok} If an account exists for ${c.bold(email)}, a reset link is on its way.`);
+                console.log(c.dim('  The link works once and expires in 30 minutes.'));
+                console.log(c.dim(`\n  fleet auth reset --token <token>   finish it here`));
+                console.log(c.dim('  or open the link in a browser instead'));
+                return;
+            }
+            /**
+             * Finish a reset without a browser. The token comes from the email; the
+             * new password is prompted for rather than passed as a flag, because a
+             * flag lands in shell history.
+             */
+            case 'reset': {
+                if (!profile.api) {
+                    profile.api = validApi(await requiredPrompt('control plane URL'));
+                }
+                const token = typeof flags.token === 'string'
+                    ? flags.token
+                    : await requiredPrompt('reset token', {
+                        hint: 'the token from the reset email, or the token= part of the link',
+                    });
+                const password = await requiredPrompt('new password', { silent: true });
+                if (password.length < 12) {
+                    throw new CliError('Password must be at least 12 characters.', EXIT.usage);
+                }
+                const again = await requiredPrompt('confirm password', { silent: true });
+                if (password !== again)
+                    throw new CliError('Those did not match.', EXIT.usage);
+                await task('setting your new password', async () => {
+                    await request('POST', '/auth/reset', { profile, body: { token, password }, auth: false });
+                });
+                console.log(`\n${glyph.ok} ${c.green('password changed')}`);
+                console.log(c.dim('  Every other session was signed out.'));
+                console.log(c.dim(`\n  fleet auth login   sign in again`));
+                return;
+            }
             default:
-                throw new CliError('usage: fleet auth login|logout|whoami', EXIT.usage);
+                throw new CliError('usage: fleet auth login|logout|whoami|forgot|reset', EXIT.usage);
         }
     },
 };

package/dist/commands/backups.js

@@ -0,0 +1,122 @@
+/**
+ * fleet backup — take a copy of a service's volume, and list what exists.
+ *
+ * A volume is the one thing Fleet cannot reproduce. Everything else here is
+ * derived: an image rebuilds from a commit, a container recreates from a
+ * manifest. The bytes in a database's data directory live on exactly one disk,
+ * and until now there was no way to get a copy of them off it.
+ */
+import { request, requireFleet, CliError, EXIT } from '../api.js';
+import { c, table, relativeTime } from '../render.js';
+import { glyph, task } from '../ui.js';
+export function humanBytes(n) {
+    if (n < 1024)
+        return `${n} B`;
+    const units = ['KB', 'MB', 'GB', 'TB'];
+    let value = n / 1024;
+    let i = 0;
+    while (value >= 1024 && i < units.length - 1) {
+        value /= 1024;
+        i++;
+    }
+    return `${value.toFixed(value >= 10 ? 0 : 1)} ${units[i]}`;
+}
+async function resolveService(fleetId, name) {
+    const { body } = await request('GET', `/fleets/${fleetId}/services`);
+    const match = body.services.find((s) => s.name === name || s.id === name);
+    if (!match) {
+        throw new CliError(`No service called "${name}". Known: ${body.services.map((s) => s.name).join(', ') || 'none'}`, EXIT.usage);
+    }
+    return match;
+}
+const STATUS_TONE = {
+    complete: c.green,
+    running: c.yellow,
+    pending: c.dim,
+    failed: c.red,
+};
+export const backupCommand = {
+    async run(args, flags) {
+        const [name] = args;
+        if (!name)
+            throw new CliError('usage: fleet backup <service>', EXIT.usage);
+        const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+        const service = await resolveService(fleetId, name);
+        const created = await task(`asking ${c.bold(service.name)}'s node for a copy of its volume`, async () => (await request('POST', `/fleets/${fleetId}/services/${service.id}/backups`, { body: {} })).body.backup, { done: (b) => `queued backup of ${b.volumeRef}` });
+        console.log(`\n${glyph.ok} ${c.green('queued')}  ${c.bold(created.id.slice(0, 8))}`);
+        console.log(c.dim('  The node holding the volume performs it on its next poll — a large volume takes a while.'));
+        console.log(c.dim(`\n  fleet backups ${service.name}   watch it finish`));
+    },
+};
+export const backupsCommand = {
+    async run(args, flags) {
+        const [name] = args;
+        if (!name)
+            throw new CliError('usage: fleet backups <service>', EXIT.usage);
+        const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+        const service = await resolveService(fleetId, name);
+        const { body } = await request('GET', `/fleets/${fleetId}/services/${service.id}/backups`);
+        if (flags.json)
+            return console.log(JSON.stringify(body.backups, null, 2));
+        if (!body.backups.length) {
+            if (!service.persistentVolume) {
+                console.log(`"${service.name}" has no volume, so there is nothing to back up.`);
+                console.log(c.dim('  Its image and manifest already describe everything it holds.'));
+                return;
+            }
+            console.log(`No backups of ${c.bold(service.name)} yet.`);
+            console.log(c.dim(`  take one with \`fleet backup ${service.name}\``));
+            return;
+        }
+        console.log(table(['when', 'status', 'size', 'source', 'id'], body.backups.map((b) => [
+            relativeTime(b.createdAt),
+            STATUS_TONE[b.status](b.status),
+            b.sizeBytes ? humanBytes(b.sizeBytes) : c.dim('—'),
+            b.scheduled ? c.dim('scheduled') : c.dim('manual'),
+            c.dim(b.id.slice(0, 8)),
+        ])));
+        // Failures are the half people come here for, and a table cell is too
+        // narrow to say anything useful about one.
+        const failed = body.backups.filter((b) => b.status === 'failed' && b.failureReason);
+        for (const b of failed.slice(0, 3)) {
+            console.log(`\n${glyph.warn} ${c.yellow(b.id.slice(0, 8))}  ${b.failureReason.split('\n')[0].slice(0, 160)}`);
+        }
+        const complete = body.backups.filter((b) => b.status === 'complete');
+        if (complete.length) {
+            const total = complete.reduce((sum, b) => sum + (b.sizeBytes ?? 0), 0);
+            console.log(c.dim(`\n  ${complete.length} complete, ${humanBytes(total)} stored.`));
+        }
+    },
+};
+export const restoreCommand = {
+    async run(args, flags) {
+        const [name, which] = args;
+        if (!name)
+            throw new CliError('usage: fleet restore <service> [backup-id]', EXIT.usage);
+        const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+        const service = await resolveService(fleetId, name);
+        const { body } = await request('GET', `/fleets/${fleetId}/services/${service.id}/backups`);
+        const complete = body.backups.filter((b) => b.status === 'complete');
+        if (!complete.length) {
+            throw new CliError(`No completed backup of "${service.name}" to restore. \`fleet backups ${service.name}\` shows what exists.`, EXIT.usage);
+        }
+        // Named by prefix, or the most recent — which is what "restore it" almost
+        // always means, and typing a uuid from a table is nobody's idea of a good
+        // recovery experience.
+        const target = which
+            ? complete.find((b) => b.id === which || b.id.startsWith(which))
+            : complete[0];
+        if (!target) {
+            throw new CliError(`No completed backup of "${service.name}" starting with "${which}".`, EXIT.usage);
+        }
+        console.log(`\n  Restoring ${c.bold(service.name)} from ${c.bold(target.id.slice(0, 8))}` +
+            ` ${c.dim(`(${relativeTime(target.createdAt)}, ${target.sizeBytes ? humanBytes(target.sizeBytes) : 'unknown size'})`)}`);
+        console.log(c.dim('  The archive is written into the volume, over whatever is there now.\n' +
+            '  The service must be stopped: writing a data directory underneath a\n' +
+            '  running process corrupts it, so this is refused while it serves.\n'));
+        const started = await task('queueing the restore', async () => (await request('POST', `/fleets/${fleetId}/backups/${target.id}/restore`, { body: {} })).body.restore, { done: () => 'queued' });
+        console.log(`\n${glyph.ok} ${c.green('queued')}  ${c.bold(started.id.slice(0, 8))}`);
+        console.log(c.dim('  The node writes it into the volume on its next poll.'));
+        console.log(c.dim(`\n  fleet deploy ${service.name}   bring it back up once the restore lands`));
+    },
+};

package/dist/commands/doctor.js

@@ -3,12 +3,48 @@ import { loadProfile } from '../config.js';
 import { c, relativeTime } from '../render.js';
 import { glyph, rule, task } from '../ui.js';
 const icon = (state) => state === 'ok' ? glyph.ok : state === 'warn' ? glyph.warn : glyph.fail;
+/**
+ * A build failure carries the whole buildx transcript. One summary line
+ * belongs in a health report; `fleet deployments` is where the rest lives.
+ */
+function firstLine(text) {
+    const line = text.split('\n').find((l) => l.trim()) ?? text;
+    return line.length > 160 ? `${line.slice(0, 157)}…` : line;
+}
+/**
+ * Statuses an edge returns when it could not reach the origin at all.
+ * Cloudflare's 52x range and 530 mean the tunnel is down; 502/503/504 mean the
+ * same thing from any reverse proxy.
+ */
+const ORIGIN_UNREACHABLE = new Set([502, 503, 504, 520, 521, 522, 523, 524, 525, 526, 527, 530]);
+/**
+ * Is the service reachable through the ingress?
+ *
+ * That question is not "did it return 200". An API with no route at `/` answers
+ * 404, and a 404 from the *application* is proof the whole chain works —
+ * ingress, tunnel, agent, container. Reporting that as a failure sends people
+ * to check DNS and node health when nothing is wrong, which is exactly what it
+ * did for an API whose /health returned 200 the whole time.
+ *
+ * What does indicate a broken path is the edge answering on the origin's
+ * behalf, or nothing answering at all.
+ */
 async function reach(url) {
     try {
         const response = await fetch(url, { redirect: 'manual', signal: AbortSignal.timeout(8_000) });
-        return response.status >= 200 && response.status < 400
-            ? { ok: true, detail: `HTTPS answered ${response.status}` }
-            : { ok: false, detail: `HTTPS answered ${response.status}` };
+        const status = response.status;
+        if (ORIGIN_UNREACHABLE.has(status)) {
+            return { ok: false, detail: `HTTPS answered ${status} — the edge could not reach the container` };
+        }
+        if (status >= 200 && status < 400) {
+            return { ok: true, detail: `HTTPS answered ${status}` };
+        }
+        if (status < 500) {
+            // The application answered. It has an opinion about the request, which
+            // means everything in front of it is working.
+            return { ok: true, detail: `HTTPS answered ${status} — reachable; the app has no route there` };
+        }
+        return { ok: false, detail: `HTTPS answered ${status} — reachable, but the app is erroring` };
     }
     catch (error) {
         return { ok: false, detail: error instanceof Error ? error.message : String(error) };
@@ -93,12 +129,24 @@ export const doctorCommand = {
                     checks.push({ state: 'fail', label: `reconcile ${node.name}`, detail: runtime.lastReconcileError, remedy: 'Run `fleet logs <service> --follow` and inspect the deployment history.' });
             }
         }
-        const failed = result.deploymentHistory.flatMap(({ service, deployments }) => deployments.filter((deployment) => deployment.status === 'failed' || deployment.failureReason).slice(0, 1).map((deployment) => ({ service: service.name, deployment })));
+        // Only the *current* deployment of each service can be a current problem.
+        // Scanning the whole history meant a service that failed once and then
+        // deployed successfully still reported the old failure, so a healthy fleet
+        // showed a wall of buildx output from a build that had since been redone.
+        const failed = result.deploymentHistory.flatMap(({ service, deployments }) => {
+            const latest = deployments[0];
+            if (!latest)
+                return [];
+            const isFailure = latest.status === 'failed' || Boolean(latest.failureReason);
+            return isFailure ? [{ service: service.name, deployment: latest }] : [];
+        });
         checks.push(failed.length
             ? {
                 state: 'fail',
                 label: 'deployments',
-                detail: failed.map(({ service, deployment }) => `${service}: ${deployment.failureReason ?? deployment.status}`).join('; '),
+                detail: failed
+                    .map(({ service, deployment }) => `${service}: ${firstLine(deployment.failureReason ?? deployment.status)}`)
+                    .join('; '),
                 remedy: 'Run `fleet deployments <service>` for history and `fleet logs <service> --follow` for the current container tail.',
             }
             : { state: 'ok', label: 'deployments', detail: result.services.length ? 'No recorded deployment failures.' : 'No services declared yet.' });

package/dist/commands/index.js

@@ -9,6 +9,7 @@ import { openCommand } from './open.js';
 import { downCommand } from './down.js';
 import { unpairCommand, agentCommand } from './unpair.js';
 import { secretsCommand } from './secrets.js';
+import { backupCommand, backupsCommand, restoreCommand } from './backups.js';
 import { applyCommand, deployCommand, deploymentsCommand, initCommand, logsCommand, removeServiceCommand, restartCommand, rollbackCommand, rescheduleCommand, servicesCommand, validateCommand, whereCommand, } from './services.js';
 export const commands = {
     up: upCommand,
@@ -35,6 +36,9 @@ export const commands = {
     events: eventsCommand,
     alerts: alertsCommand,
     secrets: secretsCommand,
+    backup: backupCommand,
+    backups: backupsCommand,
+    restore: restoreCommand,
     unpair: unpairCommand,
     agent: agentCommand,
 };

package/dist/commands/secrets.js

@@ -7,10 +7,22 @@
  * a supported spelling. The value comes from a pipe or from a prompt with the
  * echo off, and nothing here ever prints one back.
  */
+import { readFile } from 'node:fs/promises';
 import { request, requireFleet, CliError, EXIT } from '../api.js';
 import { c, table, relativeTime } from '../render.js';
 import { glyph } from '../ui.js';
 import { askSecret, canPrompt } from '../prompt.js';
+import { parseDotenv } from '../dotenv.js';
+import { declaredSecrets } from '../plan.js';
+/** The manifest in the working directory, if there is one to read. */
+async function declaredSecretsNearby() {
+    try {
+        return declaredSecrets(await readFile('fleet.yaml', 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
 const KEY_PATTERN = /^[A-Z_][A-Z0-9_]{0,127}$/;
 /**
  * Read the value from a pipe when there is one, otherwise ask for it.
@@ -95,6 +107,99 @@ export const secretsCommand = {
             console.log(c.dim('  takes effect on the next deploy of any service that references it'));
             return;
         }
+        /* ── import ────────────────────────────────────────────────── */
+        if (sub === 'import') {
+            // Reading and choosing happen before anything touches the network, so
+            // `--dry-run` works on a plane, and a typo in a filename is not reported
+            // only after a sign-in prompt.
+            const file = key ?? '.env';
+            let source;
+            try {
+                source = await readFile(file, 'utf8');
+            }
+            catch {
+                throw new CliError(`Cannot read "${file}".\n` +
+                    `  usage: fleet secrets import [file]   (defaults to .env)`, EXIT.usage);
+            }
+            const parsed = parseDotenv(source);
+            for (const skip of parsed.skipped) {
+                console.log(`${glyph.warn} ${c.yellow('skipped')}  line ${skip.line}: ${skip.reason}`);
+            }
+            for (const warning of parsed.warnings) {
+                console.log(`${glyph.warn} ${c.yellow('warning')}  ${warning}`);
+            }
+            if (!parsed.entries.length) {
+                throw new CliError(`No usable assignments in "${file}".`, EXIT.usage);
+            }
+            // Which of them to send. The default is what the manifest declares,
+            // because a .env is half configuration and the store is only for the
+            // other half.
+            const only = typeof flags.only === 'string' ? flags.only.split(',').map((k) => k.trim()) : null;
+            let chosen;
+            let basis;
+            if (only) {
+                const missing = only.filter((k) => !parsed.entries.some((e) => e.key === k));
+                if (missing.length) {
+                    throw new CliError(`Not in ${file}: ${missing.join(', ')}`, EXIT.usage);
+                }
+                chosen = parsed.entries.filter((e) => only.includes(e.key));
+                basis = '--only';
+            }
+            else if (flags.all) {
+                chosen = parsed.entries;
+                basis = '--all';
+            }
+            else {
+                const declared = await declaredSecretsNearby();
+                if (!declared) {
+                    throw new CliError(`No fleet.yaml here to say which keys are secrets.\n` +
+                        `  Pick them:      fleet secrets import ${file} --only KEY,OTHER_KEY\n` +
+                        `  Or send it all: fleet secrets import ${file} --all`, EXIT.usage);
+                }
+                chosen = parsed.entries.filter((e) => declared.has(e.key));
+                basis = 'fleet.yaml';
+                // Named in the manifest but absent from the file: the deploy will be
+                // refused for a missing secret later, so say it now.
+                for (const [name, wanted] of declared) {
+                    if (!parsed.entries.some((e) => e.key === name)) {
+                        console.log(`${glyph.warn} ${c.yellow('missing')}  ${c.bold(name)} is declared by ${wanted.join(', ')} but is not in ${file}`);
+                    }
+                }
+            }
+            if (!chosen.length) {
+                throw new CliError(`Nothing in "${file}" matches ${basis === 'fleet.yaml' ? 'the secrets fleet.yaml declares' : basis}.\n` +
+                    `  Send everything with --all, or name keys with --only KEY,OTHER_KEY`, EXIT.usage);
+            }
+            if (flags['dry-run']) {
+                const scope = service ? ` for ${c.bold(service)}` : '';
+                console.log(`\n  ${c.dim(`would store from ${file}${scope}, chosen by ${basis}`)}\n`);
+                for (const entry of chosen)
+                    console.log(`  ${c.bold(entry.key)} ${c.dim(`(line ${entry.line})`)}`);
+                console.log(c.dim(`\n  ${chosen.length} key(s). No values are shown, here or ever.`));
+                return;
+            }
+            const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+            const target = service ? await resolveServiceId(fleetId, service) : null;
+            const where = target ? ` for ${c.bold(target.name)}` : '';
+            let stored = 0;
+            let replaced = 0;
+            for (const entry of chosen) {
+                const path = target
+                    ? `/services/${target.id}/secrets/${encodeURIComponent(entry.key)}`
+                    : `/fleets/${fleetId}/secrets/${encodeURIComponent(entry.key)}`;
+                const { body } = await request('PUT', path, { body: { value: entry.value } });
+                if (body.created)
+                    stored++;
+                else
+                    replaced++;
+                console.log(`${glyph.ok} ${c.green(body.created ? 'stored' : 'replaced')}  ${c.bold(entry.key)}${where}`);
+            }
+            const untouched = parsed.entries.length - chosen.length;
+            console.log(c.dim(`\n  ${stored} stored, ${replaced} replaced` +
+                (untouched ? `; ${untouched} other key(s) in ${file} left alone` : '')));
+            console.log(c.dim('  takes effect on the next deploy of any service that references them'));
+            return;
+        }
         /* ── rm ────────────────────────────────────────────────────── */
         if (sub === 'rm' || sub === 'remove' || sub === 'delete') {
             if (!key)
@@ -112,6 +217,10 @@ export const secretsCommand = {
         }
         throw new CliError('usage: fleet secrets [ls]\n' +
             '       fleet secrets set <KEY> [--service <name>]\n' +
-            '       fleet secrets rm  <KEY> [--service <name>]', EXIT.usage);
+            '       fleet secrets rm  <KEY> [--service <name>]\n' +
+            '       fleet secrets import [file] [--all | --only A,B] [--service <name>] [--dry-run]\n' +
+            '\n' +
+            '  import reads a .env (default: ./.env) and stores the keys fleet.yaml\n' +
+            '  declares as secrets. --all sends every key in the file instead.', EXIT.usage);
     },
 };

package/dist/commands/services.js

@@ -6,7 +6,7 @@ import { task, glyph } from '../ui.js';
 import { withLadder } from '../ladder.js';
 import { ask, canPrompt, confirm, selectOrThrow } from '../prompt.js';
 import { DEPLOY_STEPS, follow, phaseWalker, } from '../progress.js';
-import { planFromManifest } from '../plan.js';
+import { planFromManifest, projectNameFor } from '../plan.js';
 import { uploadContext, humanBytes } from '../archive.js';
 const manifestPath = (given) => given ?? 'fleet.yaml';
 async function readManifest(path) {
@@ -40,10 +40,12 @@ export const applyCommand = {
     async run(args, flags) {
         const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
         const manifest = await readManifest(manifestPath(args[0]));
-        const body = await task(`applying ${manifestPath(args[0])}`, async () => (await request('POST', `/fleets/${fleetId}/services`, { body: { manifest } })).body, {
+        const body = await task(`applying ${manifestPath(args[0])}`, async () => (await request('POST', `/fleets/${fleetId}/services`, {
+            body: { manifest, project: projectNameFor(process.cwd()) },
+        })).body, {
             done: (b) => b.created.length || b.updated.length
-                ? `applied ${b.created.length + b.updated.length} service(s)`
-                : 'no changes',
+                ? `applied ${b.created.length + b.updated.length} service(s) to project ${b.project}`
+                : `no changes in project ${b.project}`,
         });
         if (flags.json)
             return console.log(JSON.stringify(body, null, 2));
@@ -71,14 +73,29 @@ export const servicesCommand = {
             return console.log(JSON.stringify(body.services, null, 2));
         if (!body.services.length)
             return console.log('No services. Run `fleet apply` with a fleet.yaml.');
-        console.log(table(['service', 'url', 'placement', 'node', 'sha', 'status'], body.services.map((s) => [
-            s.name + (s.persistentVolume ? c.dim(' ⛁') : ''),
-            s.domain ?? s.hostname ?? c.dim('—'),
-            s.placementPolicy,
-            s.current?.nodeName ?? c.dim('—'),
-            s.current?.gitSha?.slice(0, 7) ?? c.dim('—'),
-            s.current ? statusColour(s.current.status) : c.dim('not deployed'),
-        ])));
+        // Grouped by project. A fleet.yaml describes a stack, and listing its
+        // services flat among somebody else's is how four related things came to
+        // look like four unrelated ones.
+        const byProject = new Map();
+        for (const s of body.services) {
+            const key = s.project || 'default';
+            const group = byProject.get(key) ?? [];
+            group.push(s);
+            byProject.set(key, group);
+        }
+        for (const [project, group] of [...byProject].sort((a, b) => a[0].localeCompare(b[0]))) {
+            const running = group.filter((s) => s.current?.status === 'running').length;
+            const ram = group.reduce((sum, s) => sum + s.requestRamMb, 0);
+            console.log(`\n${c.bold(project)}  ${c.dim(`${running}/${group.length} running · ${mb(ram)}`)}`);
+            console.log(table(['service', 'url', 'placement', 'node', 'sha', 'status'], group.map((s) => [
+                s.name + (s.persistentVolume ? c.dim(' ⛁') : ''),
+                s.domain ?? s.hostname ?? c.dim('—'),
+                s.placementPolicy,
+                s.current?.nodeName ?? c.dim('—'),
+                s.current?.gitSha?.slice(0, 7) ?? c.dim('—'),
+                s.current ? statusColour(s.current.status) : c.dim('not deployed'),
+            ])));
+        }
     },
 };
 async function findService(fleetId, name) {

package/dist/commands/up.js

@@ -14,7 +14,7 @@ import { c } from '../render.js';
 import { task, glyph } from '../ui.js';
 import { withLadder } from '../ladder.js';
 import { DEPLOY_STEPS, follow, phaseWalker } from '../progress.js';
-import { planFromManifest, deployOrder } from '../plan.js';
+import { planFromManifest, deployOrder, projectNameFor } from '../plan.js';
 import { uploadContext, humanBytes } from '../archive.js';
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export const upCommand = {
@@ -46,10 +46,12 @@ export const upCommand = {
         }
         // ── Step 2: read and apply the manifest ───────────────────────────
         const manifest = await readFile(manifestPath, 'utf8');
-        const applyResult = await task(`applying ${manifestPath}`, async () => (await request('POST', `/fleets/${fleetId}/services`, { body: { manifest } })).body, {
+        const applyResult = await task(`applying ${manifestPath}`, async () => (await request('POST', `/fleets/${fleetId}/services`, {
+            body: { manifest, project: projectNameFor(process.cwd()) },
+        })).body, {
             done: (b) => b.created.length || b.updated.length
-                ? `applied ${b.created.length + b.updated.length} service(s)`
-                : 'no changes',
+                ? `applied ${b.created.length + b.updated.length} service(s) to project ${b.project}`
+                : `no changes in project ${b.project}`,
         });
         for (const w of applyResult.warnings) {
             console.log(`${glyph.warn} ${c.yellow('warning')}  ${w}`);

package/dist/dotenv.js

@@ -0,0 +1,103 @@
+/**
+ * Reading a .env file.
+ *
+ * Deliberately not a general dotenv implementation. This one feeds a
+ * credential store, which changes the trade-offs: a value that is silently
+ * altered on the way in fails authentication somewhere far away from here,
+ * with nothing to point back at this file. So the rules are narrow, and
+ * anything ambiguous is reported rather than guessed at.
+ */
+/** The same shape the control plane accepts as an environment variable name. */
+const KEY_PATTERN = /^[A-Z_][A-Z0-9_]{0,127}$/;
+export function parseDotenv(source) {
+    const entries = [];
+    const skipped = [];
+    const warnings = [];
+    const seen = new Set();
+    const lines = source.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const line = i + 1;
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        // `export FOO=bar` is common in files meant to be sourced by a shell.
+        const withoutExport = trimmed.replace(/^export\s+/, '');
+        const eq = withoutExport.indexOf('=');
+        if (eq < 1) {
+            skipped.push({ line, text: trimmed, reason: 'not a KEY=VALUE assignment' });
+            continue;
+        }
+        const key = withoutExport.slice(0, eq).trim();
+        if (!KEY_PATTERN.test(key)) {
+            skipped.push({ line, text: key, reason: 'not a usable environment variable name' });
+            continue;
+        }
+        const rest = withoutExport.slice(eq + 1);
+        let value;
+        const quote = rest.trimStart()[0];
+        if (quote === '"' || quote === "'") {
+            const body = rest.trimStart();
+            const end = findClosingQuote(body, quote);
+            if (end < 0) {
+                // A multi-line value, or a typo. Either way, do not guess where it ends.
+                skipped.push({ line, text: key, reason: `unterminated ${quote === '"' ? 'double' : 'single'} quote` });
+                continue;
+            }
+            const inner = body.slice(1, end);
+            // Single quotes are literal, as in a shell. Double quotes take the usual
+            // escapes so a value can contain a newline.
+            value = quote === "'" ? inner : unescape(inner);
+        }
+        else {
+            value = rest.trim();
+            // A '#' after whitespace is a comment in most dotenv readers and part of
+            // the password in some. Truncating a credential is the worse mistake, so
+            // this keeps the whole value and says so.
+            if (/\s#/.test(value)) {
+                warnings.push(`${key} (line ${line}) contains " #" and was stored whole, comment included. ` +
+                    `Quote the value if part of it is a comment.`);
+            }
+        }
+        if (seen.has(key)) {
+            // Later wins, as a shell would do, but a duplicate is worth saying aloud:
+            // two different values for one key is rarely intentional.
+            warnings.push(`${key} appears more than once; the value on line ${line} is the one used.`);
+            const previous = entries.findIndex((e) => e.key === key);
+            entries.splice(previous, 1);
+        }
+        seen.add(key);
+        entries.push({ key, value, line });
+    }
+    return { entries, skipped, warnings };
+}
+/** Index of the closing quote, skipping ones that are escaped. */
+function findClosingQuote(body, quote) {
+    for (let i = 1; i < body.length; i++) {
+        if (body[i] === '\\' && quote === '"') {
+            i++;
+            continue;
+        }
+        if (body[i] === quote)
+            return i;
+    }
+    return -1;
+}
+function unescape(input) {
+    return input.replace(/\\(.)/g, (_, ch) => {
+        switch (ch) {
+            case 'n':
+                return '\n';
+            case 'r':
+                return '\r';
+            case 't':
+                return '\t';
+            case '\\':
+                return '\\';
+            case '"':
+                return '"';
+            default:
+                return `\\${ch}`;
+        }
+    });
+}

package/dist/index.js

@@ -50,13 +50,18 @@ const GROUPS = [
             ['rollback <service> [release]', 'Restore the previous or selected release'],
             ['secrets', 'List the fleet secret store'],
             ['secrets set <KEY>', 'Store a credential; the value is never echoed or logged'],
+            ['secrets import [.env]', 'Store the secrets fleet.yaml declares, read from a .env file'],
             ['secrets rm <KEY>', 'Remove a stored credential'],
+            ['backup <service>', "Copy a service's volume off the node holding it"],
+            ['backups <service>', 'List backups, newest first'],
+            ['restore <service> [id]', 'Write a backup back into the volume; service must be stopped'],
             ['nodes cordon <name>', 'Stop scheduling new work onto a node'],
             ['nodes uncordon <name>', 'Allow scheduling again'],
             ['nodes rm <name>', 'Revoke and remove a node'],
             ['unpair', 'Remove this machine from its fleet, run on the machine'],
             ['alerts', 'List, add, and test alert rules'],
             ['auth login|logout|whoami', 'Sign in to a control plane'],
+            ['auth forgot|reset', 'Recover an account you are locked out of'],
         ],
     ],
 ];

package/dist/plan.js

@@ -7,6 +7,23 @@
  * whose database is not up yet fails its health check like any other outage.
  */
 import { parse as parseYaml } from 'yaml';
+/**
+ * What to call this manifest's services collectively when it does not say.
+ *
+ * The directory name, which is what Compose does and what a person would
+ * answer if asked "which project is this". Normalised to the same shape a
+ * service name has to be, so the server never rejects a name it derived.
+ */
+export function projectNameFor(dir) {
+    const base = dir.split('/').filter(Boolean).pop() ?? 'default';
+    const slug = base
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 48)
+        .replace(/-+$/, '');
+    return slug || 'default';
+}
 /**
  * Read the manifest the way the control plane will.
  *
@@ -28,6 +45,32 @@ export function planFromManifest(source) {
         };
     });
 }
+/**
+ * Which secrets the manifest says it needs, and which services want each.
+ *
+ * A .env holds a mix — half configuration, half credentials — and only the
+ * credentials belong in the secret store. The manifest already draws that line
+ * by declaring `secrets:`, so importing can honour it rather than asking
+ * somebody to re-draw it at the command line.
+ */
+export function declaredSecrets(source) {
+    const doc = parseYaml(source);
+    const services = doc?.services;
+    const declared = new Map();
+    if (!services || typeof services !== 'object')
+        return declared;
+    for (const [name, raw] of Object.entries(services)) {
+        const body = (raw ?? {});
+        if (!Array.isArray(body.secrets))
+            continue;
+        for (const key of body.secrets) {
+            if (typeof key !== 'string')
+                continue;
+            declared.set(key, [...(declared.get(key) ?? []), name]);
+        }
+    }
+    return declared;
+}
 /**
  * Order services so a dependency is deployed before whatever depends on it.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadurajfleetos/cli",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Fleet OS command-line interface for deploying and orchestrating services on user-owned hardware",
   "type": "module",
   "license": "MIT",