@yadurajfleetos/cli 0.6.0 → 0.8.0

package/dist/commands/index.js

@@ -10,7 +10,7 @@ import { downCommand } from './down.js';
 import { unpairCommand, agentCommand } from './unpair.js';
 import { secretsCommand } from './secrets.js';
 import { backupCommand, backupsCommand, restoreCommand } from './backups.js';
-import { applyCommand, deployCommand, deploymentsCommand, initCommand, importCommand, logsCommand, removeServiceCommand, restartCommand, rollbackCommand, rescheduleCommand, servicesCommand, validateCommand, whereCommand, } from './services.js';
+import { applyCommand, deployCommand, deploymentsCommand, initCommand, importCommand, explainCommand, logsCommand, removeServiceCommand, restartCommand, rollbackCommand, rescheduleCommand, servicesCommand, validateCommand, whereCommand, } from './services.js';
 export const commands = {
     up: upCommand,
     open: openCommand,
@@ -22,6 +22,7 @@ export const commands = {
     doctor: doctorCommand,
     init: initCommand,
     import: importCommand,
+    explain: explainCommand,
     validate: validateCommand,
     apply: applyCommand,
     status: statusCommand,

package/dist/commands/services.js

@@ -40,6 +40,35 @@ export const applyCommand = {
     async run(args, flags) {
         const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
         const manifest = await readManifest(manifestPath(args[0]));
+        // --dry-run used to be accepted and ignored, so `fleet apply --dry-run`
+        // applied. `fleet init` prints that exact command as the safe way to check
+        // its output, which made the one command the tool recommends for looking
+        // before you leap the command that leapt. The control plane has always had
+        // an endpoint for this, labelled "validate without touching anything"; the
+        // CLI simply never called it.
+        if (flags['dry-run'] || flags.plan) {
+            const { body } = await request('POST', `/fleets/${fleetId}/services/validate`, { body: { manifest } });
+            if (flags.json)
+                return console.log(JSON.stringify(body, null, 2));
+            if (!body.valid) {
+                for (const issue of body.issues ?? []) {
+                    console.log(`${glyph.fail} ${c.red('invalid')}  ${issue}`);
+                }
+                throw new CliError('The manifest was not applied.', EXIT.usage);
+            }
+            console.log(`${glyph.ok} ${c.green('valid')}  fleet ${c.bold(body.fleet ?? '?')}`);
+            for (const svc of body.services ?? []) {
+                // arch is empty when the manifest does not constrain it, which is the
+                // common case; printing a trailing separator for nothing reads like a
+                // value failed to load.
+                const facts = [svc.placement, `${svc.ramMb}Mi`, svc.arch?.join(', ')].filter(Boolean);
+                console.log(`  ${c.bold(svc.name)}  ${c.dim(facts.join(' · '))}`);
+            }
+            for (const w of body.warnings ?? []) {
+                console.log(`${glyph.warn} ${c.yellow('warning')}  ${w}`);
+            }
+            return console.log(c.dim('\nnothing was changed. Drop --dry-run to apply.'));
+        }
         const body = await task(`applying ${manifestPath(args[0])}`, async () => (await request('POST', `/fleets/${fleetId}/services`, {
             body: { manifest, project: projectNameFor(process.cwd()) },
         })).body, {
@@ -386,6 +415,55 @@ export const logsCommand = {
         }
     },
 };
+/**
+ * A second opinion on the draft, when --ai is given.
+ *
+ * Opt-in, because it sends a description of the repository to whatever
+ * provider the control plane is configured with, and that should never be a
+ * surprise. Never fatal: the draft is what `init` produced without it, so any
+ * failure here leaves the user exactly where they would have been anyway.
+ *
+ * The changes are printed rather than applied silently. A manifest that
+ * appeared with different ports and no explanation is worse than one with a
+ * mistake in it -- at least the mistake is yours to find.
+ */
+async function reviewed(draft, flags) {
+    const { repoMap } = await import('../repomap.js');
+    const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+    let out;
+    try {
+        const map = await repoMap();
+        out = (await task('reading the repository for a second opinion', async () => request('POST', `/fleets/${fleetId}/manifest/assist`, {
+            body: { draft, repoMap: map },
+        }), { done: () => 'reviewed' })).body;
+    }
+    catch (err) {
+        console.log(`${glyph.warn} ${c.yellow('review skipped')}  ${err instanceof Error ? err.message : 'the control plane could not be reached'}`);
+        return draft;
+    }
+    if (out.status === 'disabled') {
+        console.log(`${glyph.warn} ${c.yellow('review skipped')}  ${out.reason}`);
+        return draft;
+    }
+    if (out.status === 'rate_limited') {
+        console.log(`${glyph.warn} ${c.yellow('review skipped')}  ${out.limit} reviews a day is the limit; it resets in ${Math.ceil(out.resetsInSec / 3600)}h.`);
+        return draft;
+    }
+    if (out.status === 'kept_draft') {
+        // Worth saying out loud: silence here would read as "the review agreed".
+        console.log(`${glyph.warn} ${c.yellow('kept the draft')}  ${out.reason}`);
+        return draft;
+    }
+    if (!out.changed) {
+        console.log(`${glyph.ok} ${c.green('reviewed')}  ${c.dim('nothing to change')}`);
+        return out.manifest;
+    }
+    console.log(`${glyph.ok} ${c.green('reviewed')}  ${c.dim(out.model)}`);
+    for (const note of out.notes)
+        console.log(c.dim(`  · ${note}`));
+    console.log(c.dim(`  ${out.usage.used}/${out.usage.limit} reviews used today`));
+    return out.manifest;
+}
 export const initCommand = {
     async run(args, flags) {
         const { detect, manifestTemplate } = await import('../detect.js');
@@ -409,15 +487,26 @@ export const initCommand = {
         const { discover, manifestFromDiscovery } = await import('../discover.js');
         const found = await discover();
         if (found.services.length > 1 || found.databases.length) {
-            const { manifest, questions } = manifestFromDiscovery(found, {
+            const drafted = manifestFromDiscovery(found, {
                 fleet: typeof flags.fleet === 'string' ? flags.fleet : undefined,
                 node: typeof flags.node === 'string' ? flags.node : undefined,
             });
+            const questions = drafted.questions;
+            const manifest = flags.ai ? await reviewed(drafted.manifest, flags) : drafted.manifest;
             await writeFile(path, manifest);
             console.log(`${c.green('created')} ${path}`);
             if (found.layout)
                 console.log(c.dim(`  ${found.layout}`));
             for (const s of found.services) {
+                // A manifest saying `build: ./web` against a directory with no
+                // Dockerfile is a deploy that fails at the first step. detect() has
+                // already worked out what the file should contain; writing it is the
+                // difference between a manifest and something that runs.
+                if (s.detection.dockerfile && !s.detection.hasDockerfile) {
+                    const target = join(process.cwd(), s.dir, 'Dockerfile');
+                    await writeFile(target, s.detection.dockerfile);
+                    console.log(`${c.green('created')} ${s.dir}/Dockerfile  ${c.dim(`(${s.detection.label}, port ${s.detection.port})`)}`);
+                }
                 console.log(c.dim(`  · ${s.name}  ${s.dir}  ${s.detection.label}`));
             }
             for (const db of found.databases) {
@@ -561,3 +650,78 @@ export const importCommand = {
         }
     },
 };
+/**
+ * Ask why a deployment failed.
+ *
+ * The wall of Docker output is still there underneath — this adds a reading of
+ * it, it does not replace the evidence. Printed at the moment of failure is the
+ * point; `fleet explain` exists for when you have come back to it later.
+ */
+export const explainCommand = {
+    async run(args, flags) {
+        const id = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+        let deploymentId = typeof flags.deploy === 'string' ? flags.deploy : '';
+        if (!deploymentId) {
+            const name = args[0];
+            if (!name)
+                throw new CliError('name a service, or pass --deploy <id>', EXIT.usage);
+            const service = await findService(id, name);
+            const { body } = await request('GET', `/services/${service.id}/deployments`);
+            // The most recent failure, which is what someone asking "why did that
+            // fail" means — not the most recent deployment, which may since have
+            // succeeded.
+            const failed = body.deployments.find((d) => d.status === 'failed');
+            if (!failed) {
+                throw new CliError(`"${name}" has no failed deployment to explain.`, EXIT.usage);
+            }
+            deploymentId = failed.id;
+        }
+        const out = await task('reading the failure', () => request('POST', `/fleets/${id}/deployments/${deploymentId}/explain`));
+        printExplanation(out.body);
+    },
+};
+/** Shared by `fleet explain` and by a deploy that just failed. */
+export function printExplanation(r) {
+    if (r.status === 'ok') {
+        console.log();
+        for (const line of wrapText(r.summary ?? '', 76))
+            console.log(`  ${line}`);
+        if (r.steps?.length) {
+            console.log();
+            r.steps.forEach((step, i) => console.log(`  ${c.dim(`${i + 1}.`)} ${step}`));
+        }
+        const seen = (r.hits ?? 1) > 1 ? `seen ${r.hits}× before` : 'first time this failure has been seen';
+        console.log(`\n  ${c.dim(`${r.cached ? 'cached' : 'explained'} · ${seen}`)}`);
+        if (r.usage)
+            console.log(`  ${c.dim(`${r.usage.used}/${r.usage.limit} explanations used today`)}`);
+        return;
+    }
+    if (r.status === 'rate_limited') {
+        const hours = Math.ceil((r.resetsInSec ?? 0) / 3600);
+        console.log(`\n  ${c.yellow('daily limit reached')} ${c.dim(`— ${r.limit} explanations a day, resets in ${hours}h.`)}`);
+        console.log(c.dim('  Answers already generated are still free to read.'));
+        return;
+    }
+    // disabled / not_worth_it / failed all carry a reason worth printing as-is.
+    if (r.reason)
+        console.log(`\n  ${c.dim(r.reason)}`);
+}
+/** Wrap to a width, on spaces, so a paragraph reads in a terminal. */
+function wrapText(text, width) {
+    const out = [];
+    for (const paragraph of text.split('\n')) {
+        let line = '';
+        for (const word of paragraph.split(/\s+/).filter(Boolean)) {
+            if (line && line.length + word.length + 1 > width) {
+                out.push(line);
+                line = word;
+            }
+            else {
+                line = line ? `${line} ${word}` : word;
+            }
+        }
+        if (line)
+            out.push(line);
+    }
+    return out;
+}

package/dist/commands/up.js

@@ -63,6 +63,7 @@ export const upCommand = {
         // deploying one service of it and leaving the rest was never what anybody
         // wanted — it just meant typing the command again in the right order.
         const targets = args[0] ? [args[0]] : deployOrder(planned);
+        const isDatabase = new Set(planned.filter((p) => p.database).map((p) => p.name));
         if (!targets.length) {
             throw new CliError('The manifest declares no services to deploy.', EXIT.usage);
         }
@@ -74,12 +75,27 @@ export const upCommand = {
             }
             return service;
         });
-        if (resolved.length > 1) {
-            console.log(`\n  ${c.dim('deploying')} ${resolved.map((s) => c.bold(s.name)).join(c.dim(' → '))}\n`);
+        // A database that is already serving is left alone.
+        //
+        // Redeploying one replaces a running container for no reason, and every
+        // service that talks to it loses its connections while it restarts. It is
+        // in the plan so that a database which is *not* running comes back — which
+        // is the case that used to need `fleet up db` by name — not so that every
+        // deploy of the stack restarts the database underneath it. Naming it
+        // explicitly still redeploys it.
+        const skipped = args[0]
+            ? []
+            : resolved.filter((s) => isDatabase.has(s.name) && s.current?.status === 'running');
+        const toDeploy = resolved.filter((s) => !skipped.includes(s));
+        for (const s of skipped) {
+            console.log(`  ${c.dim('already running')}  ${c.bold(s.name)}`);
+        }
+        if (toDeploy.length > 1) {
+            console.log(`\n  ${c.dim('deploying')} ${toDeploy.map((s) => c.bold(s.name)).join(c.dim(' → '))}\n`);
         }
         const gitSha = typeof flags.sha === 'string' ? flags.sha : undefined;
         const deployed = [];
-        for (const service of resolved) {
+        for (const service of toDeploy) {
             const url = await deployOne(service, {
                 fleetId,
                 gitSha,
@@ -148,11 +164,18 @@ async function deployOne(service, opts) {
     if (opts.wait) {
         await task(`waiting for ${c.bold(service.name)} to come up`, async (s) => {
             s.hints([
+                'the image is built on the control plane, for every architecture in the fleet',
+                'building for a different architecture than the control plane is emulated, and slow',
                 'the agent picks up desired state on its next poll',
                 "a cold image pull takes as long as the node's uplink does",
                 'a service with a health check goes running once it passes, not before',
             ]);
-            const deadline = Date.now() + 180_000;
+            // Long, because this now covers the build as well as the rollout.
+            // The control plane answers as soon as a node is chosen and keeps
+            // building afterwards, so this is the window in which a multi-arch
+            // build has to finish - and an arm64 build emulated on an amd64 host
+            // is measured in tens of minutes, not minutes.
+            const deadline = Date.now() + 45 * 60_000;
             while (Date.now() < deadline) {
                 const { body } = await request('GET', `/fleets/${opts.fleetId}/services`);
                 const current = body.services.find((s) => s.id === service.id)?.current;

package/dist/compose.js

@@ -4,6 +4,14 @@ import { safeDatabaseName } from './dbnames.js';
 const ENGINE_IMAGES = {
     postgres: 'postgres',
     postgis: 'postgres',
+    // Postgres by another name. pgvector in particular is what anything doing
+    // embeddings runs, and leaving it unrecognised turned a managed database
+    // back into a container the reader has to look after themselves.
+    pgvector: 'postgres',
+    'ankane/pgvector': 'postgres',
+    'pgvector/pgvector': 'postgres',
+    'supabase/postgres': 'postgres',
+    'bitnami/postgresql': 'postgres',
     'timescale/timescaledb': 'postgres',
     mysql: 'mysql',
     mariadb: 'mariadb',

package/dist/detect.js

@@ -135,7 +135,7 @@ export async function detect(cwd = process.cwd()) {
             framework: 'unknown',
             label: 'existing Dockerfile',
             port,
-            healthPath: '/',
+            healthPath: null,
             dockerfile: null,
             hasDockerfile: true,
         };
@@ -175,7 +175,7 @@ export async function detect(cwd = process.cwd()) {
                 framework: 'node',
                 label: 'Node.js API',
                 port: 3000,
-                healthPath: '/health',
+                healthPath: null,
                 dockerfile: NODE_DOCKERFILE,
                 hasDockerfile: false,
             };
@@ -209,7 +209,7 @@ export async function detect(cwd = process.cwd()) {
             framework: 'python',
             label: isFastapi ? 'Python (FastAPI)' : isDjango ? 'Python (Django)' : isFlask ? 'Python (Flask)' : 'Python',
             port: 8000,
-            healthPath: '/health',
+            healthPath: null,
             dockerfile: pythonDF,
             hasDockerfile: false,
         };
@@ -223,7 +223,7 @@ export async function detect(cwd = process.cwd()) {
             framework: 'go',
             label: 'Go',
             port: 8080,
-            healthPath: '/healthz',
+            healthPath: null,
             dockerfile: GO_DOCKERFILE(moduleName),
             hasDockerfile: false,
         };
@@ -234,7 +234,7 @@ export async function detect(cwd = process.cwd()) {
             framework: 'rust',
             label: 'Rust',
             port: 8080,
-            healthPath: '/healthz',
+            healthPath: null,
             dockerfile: RUST_DOCKERFILE,
             hasDockerfile: false,
         };
@@ -255,7 +255,7 @@ export async function detect(cwd = process.cwd()) {
         framework: 'unknown',
         label: 'unknown project',
         port: 3000,
-        healthPath: '/',
+        healthPath: null,
         dockerfile: null,
         hasDockerfile: false,
     };

package/dist/discover.js

@@ -31,6 +31,17 @@ const readJson = async (p) => {
 const IGNORED = new Set([
     'node_modules', '.git', 'dist', 'build', 'target', 'vendor', '.next',
     'coverage', '__pycache__', '.venv', 'venv', 'tmp', '.turbo', '.cache',
+    // Parts of a project rather than projects of their own.
+    //
+    // These are picked up by the immediate-children fallback, which exists for
+    // repositories that keep their services in plain top-level folders. A Vite
+    // app has src/ next to package.json, and the fallback happily proposed
+    // deploying it: a second service, built from the source directory of the
+    // first, serving raw .ts and .html instead of the built site — while the
+    // real build sat one level up. `src` is never a deployable unit on its own,
+    // and neither are the rest of these.
+    'src', 'public', 'static', 'assets', 'test', 'tests', '__tests__',
+    'migrations', 'fixtures', 'examples',
 ]);
 /**
  * Dependencies that mean "this service talks to a database".
@@ -180,7 +191,18 @@ async function expand(root, globs) {
     }
     return [...dirs];
 }
-/** Conventional layouts, for repositories that declare no workspaces. */
+/**
+ * Candidate directories for a repository that declares no workspaces.
+ *
+ * Two shapes, because both are common and neither is declared anywhere. The
+ * first is a parent holding many packages - apps/, services/, packages/. The
+ * second is simply a few directories at the top level: backend/ beside
+ * landing_page/, or api/ beside web/. Looking only for the first meant a
+ * perfectly ordinary two-app repository was read as one unrecognised project.
+ *
+ * Only immediate children are considered. Walking deeper finds vendored
+ * copies, fixtures and examples, and proposes deploying them.
+ */
 async function conventionalDirs(root) {
     const dirs = [];
     for (const parent of ['apps', 'services', 'packages']) {
@@ -194,6 +216,18 @@ async function conventionalDirs(root) {
             /* not this layout */
         }
     }
+    if (dirs.length)
+        return dirs;
+    try {
+        for (const entry of await readdir(root, { withFileTypes: true })) {
+            if (!entry.isDirectory() || IGNORED.has(entry.name) || entry.name.startsWith('.'))
+                continue;
+            dirs.push(entry.name);
+        }
+    }
+    catch {
+        /* unreadable root is the caller's problem */
+    }
     return dirs;
 }
 /**
@@ -235,7 +269,7 @@ export async function discover(root = process.cwd()) {
     else {
         const conventional = await conventionalDirs(root);
         if (conventional.length) {
-            layout = 'apps/ and services/ directories';
+            layout = 'directories that look like services';
             candidates = conventional;
             notes.push(`no workspace file, but ${conventional.length} directories look like services`);
         }
@@ -310,10 +344,25 @@ export function manifestFromDiscovery(d, opts = {}) {
         lines.push(`  ${s.name}:`);
         lines.push(`    build: ${s.dir}`);
         lines.push('    placement: flexible');
-        if (s.detection.port !== 80)
-            lines.push(`    container_port: ${s.detection.port}`);
+        // Always written, never omitted as "the default". Leaving it out does not
+        // mean 80: an unset container port becomes 8080 on the node, so an nginx
+        // image serving 80 got its traffic forwarded to a closed port and answered
+        // 502 while every status in the system said running.
+        lines.push(`    container_port: ${s.detection.port}`);
         lines.push(`    resources: { ram: ${s.ramMb}Mi, cpu: 0.5 }`);
-        lines.push(`    health: { path: ${s.detection.healthPath} }`);
+        // Only where the framework genuinely answers at the path. A guessed one
+        // that is wrong does not fall back to "no check" — it fails for ever and
+        // the deploy never leaves "deploying", while the service runs correctly.
+        if (s.detection.healthPath) {
+            lines.push(`    health: { path: ${s.detection.healthPath} }`);
+        }
+        else {
+            lines.push('    # No health check: container state decides whether this');
+            lines.push('    # is up. Add one once you know a path that returns 2xx —');
+            lines.push('    #   health: { path: /healthz }');
+            lines.push('    # Note the probe runs from the node, not inside the');
+            lines.push('    # container, so the image needs nothing installed for it.');
+        }
         if (s.gpu) {
             lines.push('    gpu: true');
             questions.push(`${s.name}: ${s.gpu}, so it asks for a GPU — remove "gpu: true" if it runs on CPU.`);

package/dist/index.js

@@ -17,6 +17,7 @@ const GROUPS = [
         [
             ['up [service]', 'Deploy the whole fleet.yaml, in dependency order'],
             ['init', 'Read the repository — monorepo, databases, secrets — and write a fleet.yaml'],
+            ['init --ai', 'The same, then have the control plane review the draft against the repository'],
             ['import [file]', 'Convert a docker-compose.yml into a fleet.yaml'],
             ['config show', 'Show the saved control plane and selected fleet'],
             ['use <fleet>', 'Select the default fleet for later commands'],
@@ -25,6 +26,7 @@ const GROUPS = [
             ['doctor', 'Check the control plane, nodes, services, ingress, and GitHub'],
             ['apply [file]', 'Apply a fleet.yaml to the fleet'],
             ['deploy <service>', 'Build, schedule, and roll out'],
+            ['explain <service>', 'Read a failed deploy and say what to do about it'],
         ],
     ],
     [

package/dist/plan.js

@@ -33,10 +33,7 @@ export function projectNameFor(dir) {
  */
 export function planFromManifest(source) {
     const doc = parseYaml(source);
-    const services = doc?.services;
-    if (!services || typeof services !== 'object')
-        return [];
-    return Object.entries(services).map(([name, raw]) => {
+    const services = Object.entries(doc?.services ?? {}).map(([name, raw]) => {
         const body = (raw ?? {});
         return {
             name,
@@ -44,6 +41,21 @@ export function planFromManifest(source) {
             affinity: Array.isArray(body.affinity) ? body.affinity.filter((a) => typeof a === 'string') : [],
         };
     });
+    // Databases are deployed too.
+    //
+    // They used to be left out entirely, on the reasoning that applying the
+    // manifest creates them. It does — once. After that a database whose
+    // deployment has failed is never revived, because nothing puts it back in
+    // the plan: `fleet up` walked the whole stack, skipped it, and reported
+    // success while the database it depended on stayed dead and every service
+    // using it crash-looped. Recovering needed `fleet up db` by name, which is
+    // knowledge the command should not require.
+    const databases = Object.keys(doc?.databases ?? {}).map((name) => ({
+        name,
+        affinity: [],
+        database: true,
+    }));
+    return [...databases, ...services];
 }
 /**
  * Which secrets the manifest says it needs, and which services want each.

package/dist/repomap.js

@@ -0,0 +1,121 @@
+import { readdir, readFile, stat } from 'node:fs/promises';
+import { join, relative } from 'node:path';
+/**
+ * What a repository says about itself, small enough to read.
+ *
+ * `discover()` reads a repository with rules and produces a draft. This is the
+ * same repository as evidence: the tree, the files that declare dependencies
+ * and ports, and the first lines of anything already describing how to run it.
+ * The two go together — the draft says what was concluded, this says what it
+ * was concluded from, and a reviewer needs both.
+ *
+ * Deliberately not source code. A manifest is decided by package manifests,
+ * Dockerfiles, compose files and entry points; shipping the whole tree would
+ * cost tokens, leak more than anyone intended, and bury the three files that
+ * actually answer the question.
+ */
+/** Never read: build output, dependencies, and anything that is not evidence. */
+const SKIP = new Set([
+    'node_modules', '.git', 'dist', 'build', 'target', 'vendor', '.next', '.nuxt',
+    'coverage', '__pycache__', '.venv', 'venv', '.turbo', '.cache', 'tmp', '.DS_Store',
+]);
+/**
+ * Files worth quoting, and how much of each.
+ *
+ * Entry points get a small window because the useful part — a listen() call, a
+ * route prefix, a PORT default — is near the top or in the last few lines, and
+ * the middle of a server file is business logic nobody needs to see.
+ */
+const EVIDENCE = [
+    { name: /^package\.json$/, lines: 60 },
+    { name: /^(requirements|requirements-prod)\.txt$/, lines: 40 },
+    { name: /^(pyproject\.toml|Pipfile|go\.mod|Cargo\.toml|Gemfile)$/, lines: 40 },
+    { name: /^Dockerfile(\..+)?$/, lines: 40 },
+    { name: /^(docker-)?compose\.ya?ml$/, lines: 60 },
+    { name: /^\.env\.(example|sample|template)$/, lines: 40 },
+    { name: /^(main|server|app|index)\.(js|ts|mjs|py|go|rb)$/, lines: 40 },
+    { name: /^(vite|next|nuxt|astro|svelte)\.config\.(js|ts|mjs)$/, lines: 25 },
+    { name: /^README(\.md)?$/, lines: 20 },
+];
+const MAX_DEPTH = 3;
+const MAX_TREE_ENTRIES = 300;
+/** Comfortably inside the endpoint's limit, with room for the draft. */
+const MAX_TOTAL_CHARS = 48_000;
+function windowOf(text, lines) {
+    const all = text.split('\n');
+    if (all.length <= lines)
+        return text.trimEnd();
+    // Head and tail: a server file declares its framework at the top and starts
+    // listening at the bottom, and the port is usually in the second half.
+    const head = all.slice(0, Math.ceil(lines * 0.7)).join('\n');
+    const tail = all.slice(-Math.floor(lines * 0.3)).join('\n');
+    return `${head}\n…\n${tail}`.trimEnd();
+}
+/** The tree, breadth-first so the interesting top levels survive the cap. */
+async function tree(root) {
+    const out = [];
+    let frontier = [{ dir: root, depth: 0 }];
+    while (frontier.length && out.length < MAX_TREE_ENTRIES) {
+        const next = [];
+        for (const { dir, depth } of frontier) {
+            let entries;
+            try {
+                entries = await readdir(dir, { withFileTypes: true });
+            }
+            catch {
+                continue;
+            }
+            for (const e of entries) {
+                if (e.name.startsWith('.') && e.name !== '.env.example')
+                    continue;
+                if (SKIP.has(e.name))
+                    continue;
+                const full = join(dir, e.name);
+                const rel = relative(root, full) || e.name;
+                if (out.length >= MAX_TREE_ENTRIES)
+                    break;
+                out.push(e.isDirectory() ? `${rel}/` : rel);
+                if (e.isDirectory() && depth + 1 < MAX_DEPTH)
+                    next.push({ dir: full, depth: depth + 1 });
+            }
+        }
+        frontier = next;
+    }
+    return out.sort();
+}
+/** Build the evidence bundle for a repository root. */
+export async function repoMap(root = process.cwd()) {
+    const paths = await tree(root);
+    const sections = [
+        '## Tree',
+        paths.join('\n'),
+    ];
+    let budget = MAX_TOTAL_CHARS - sections.join('\n').length;
+    for (const rel of paths) {
+        if (rel.endsWith('/'))
+            continue;
+        const base = rel.split('/').pop() ?? rel;
+        const rule = EVIDENCE.find((e) => e.name.test(base));
+        if (!rule)
+            continue;
+        const full = join(root, rel);
+        try {
+            const info = await stat(full);
+            // A megabyte of lockfile-shaped JSON is not evidence.
+            if (info.size > 512 * 1024)
+                continue;
+            const text = await readFile(full, 'utf8');
+            const block = `\n## ${rel}\n${windowOf(text, rule.lines)}`;
+            // Stop cleanly at the budget rather than sending a truncated file that
+            // reads as though the repository itself is malformed.
+            if (block.length > budget)
+                break;
+            sections.push(block);
+            budget -= block.length;
+        }
+        catch {
+            // Unreadable is not fatal; it is simply not evidence.
+        }
+    }
+    return sections.join('\n');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadurajfleetos/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Fleet OS command-line interface for deploying and orchestrating services on user-owned hardware",
   "type": "module",
   "license": "MIT",