bod-cli 0.9.1 → 0.10.1

package/.cursor/skills/using-bod-cli/SKILL.md

@@ -124,6 +124,16 @@ Open an app in the default browser. Resolves the URL from the app's domain.
 bod open my-api               # opens https://my-api.bodify.example.com
 ```
 
+### `bod host <path> [--slug <s>] [--app <appId>]`
+Publish a file or folder to a public CDN URL (`https://serve.bod.ee/s/<slug>/…`). Handles create → upload → finalize and prints the live URL. Ephemeral (48h) unless `--app` links it to an app (then persistent). See the **bod-serve** skill for the full flow.
+
+```bash
+bod host ./dist                    # a static site → live URL
+bod host ./clip.mp3                # a single file (video/audio/pdf/image)
+bod host ./dist --slug my-site     # reuse/update an existing slug
+bod host ./assets --app my-api     # persistent app assets
+```
+
 ### `bod env list|set|unset <app>`
 Manage environment variables.
 

package/CLAUDE.md

@@ -33,7 +33,7 @@ src/
     ├── rollback.ts     # bod rollback [app]
     ├── apps.ts         # bod apps list|status
     ├── logs.ts         # bod logs <app> [-f]
-    ├── env.ts          # bod env list|set|unset (set supports -f .env)
+    ├── env.ts          # bod env list|set|unset; scoped by <app>/--global/--group (+ --env); set supports -f .env
     ├── open.ts         # bod open <app>
     ├── add.ts          # bod add <pkg>
     └── remove.ts       # bod remove <pkg>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bod-cli",
-  "version": "0.9.1",
+  "version": "0.10.1",
   "type": "module",
   "bin": {
     "bod": "./src/cli.ts"

package/src/cli.ts

@@ -13,6 +13,7 @@ import addCmd from './commands/add'
 import removeCmd from './commands/remove'
 import openCmd from './commands/open'
 import serveCmd from './commands/serve'
+import hostCmd from './commands/host'
 import sshCmd from './commands/ssh'
 import publishCmd from './commands/publish'
 import dbCmd from './commands/db'
@@ -46,6 +47,7 @@ const subCommands = {
   remove: removeCmd,
   open: openCmd,
   serve: serveCmd,
+  host: hostCmd,
   ssh: sshCmd,
   publish: publishCmd,
   db: dbCmd,
@@ -108,7 +110,8 @@ const main = defineCommand({
         // Commands with subcommands need a default, commands with required positionals need prompting
         const interactiveArgs = await getInteractiveArgs(command)
         if (interactiveArgs === null) continue // user cancelled
-        await runCommand(subCommands[command as keyof typeof subCommands], { rawArgs: interactiveArgs })
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- citty's CommandDef union isn't assignable to itself across a heterogeneous subCommands map
+        await runCommand(subCommands[command as keyof typeof subCommands] as any, { rawArgs: interactiveArgs })
       } catch (e) {
         if ((e as Error).name === 'ExitPromptError') continue
         console.error(`Error: ${(e as Error).message}`)

package/src/commands/env.ts

@@ -7,7 +7,7 @@ import { printTable } from '../utils/output'
 import { resolveAppId, resolveAppName } from '../utils/resolve'
 
 // --- Bodify global secrets store types (mirror the agent /secrets API contract) ---
-interface Scope { app?: string; env?: string }
+interface Scope { app?: string; env?: string; group?: string }
 interface MaskedEntry { scope: Scope; masked: string; updatedAt: number; updatedBy?: string }
 interface MaskedVar { key: string; description?: string; createdAt: number; updatedAt: number; entries: MaskedEntry[] }
 interface ResolvedEnv { environment?: string; values: Record<string, string> }
@@ -33,22 +33,42 @@ function parseDotEnv(content: string): Record<string, string> {
   return env
 }
 
-/** Build a secrets scope from the app arg + flags. `--global` drops the app axis. */
-function buildScope(app: string | undefined, env: string | undefined, global: boolean): Scope {
+/** Build a secrets scope from the app arg + flags. `--global` drops the app axis;
+ *  `--group` scopes to a named group (apps that inherit it) instead of one app. */
+function buildScope(app: string | undefined, env: string | undefined, global: boolean, group?: string): Scope {
   const scope: Scope = {}
-  if (!global && app) scope.app = app
+  if (group) scope.group = group
+  else if (!global && app) scope.app = app
   if (env) scope.env = env
   return scope
 }
 
-/** Guard: --global and a positional <app> are mutually exclusive. */
-function assertScopeFlags(app: string | undefined, global: boolean) {
-  if (global && app) {
-    console.error(chalk.red('Pass either <app> or --global, not both.'))
+/** Citty binds the FIRST positional to `app`, but under --global/--group there is no
+ *  app — the leading positional is really the next one (KEY=VALUE / key). Shift it back
+ *  so `app` is undefined and `rest` holds the real positionals. Returns the genuine app
+ *  only when no scope flag was passed. */
+function resolvePositionals(app: string | undefined, rest: (string | undefined)[], global: boolean, group?: string) {
+  if (global || group) return { app: undefined, rest: [app, ...rest].filter((p): p is string => p !== undefined) }
+  return { app, rest: rest.filter((p): p is string => p !== undefined) }
+}
+
+/** Guard: <app>, --global and --group are mutually exclusive (they pick the scope's
+ *  primary axis). --env is orthogonal and combines with any of them. */
+function assertScopeFlags(app: string | undefined, global: boolean, group?: string) {
+  const picked = [app && '<app>', global && '--global', group && '--group'].filter(Boolean)
+  if (picked.length > 1) {
+    console.error(chalk.red(`Pass only one of ${picked.join(', ')} — they are mutually exclusive.`))
     process.exit(1)
   }
 }
 
+/** Human label for a scope's primary axis (+ optional env). */
+function renderScope(scope: Scope): string {
+  const base = scope.app ? `app:${scope.app}` : scope.group ? `group:${scope.group}` : scope.env ? `env:${scope.env}` : 'all'
+  // env already shown as the base when it's the only axis; otherwise append it.
+  return (scope.app || scope.group) && scope.env ? `${base}/${scope.env}` : base
+}
+
 /** Quote a dotenv value if it contains characters that would break a bare assignment. */
 function quoteDotEnvValue(value: string): string {
   if (/[\s"'#=$`\\]/.test(value) || value === '') {
@@ -58,33 +78,32 @@ function quoteDotEnvValue(value: string): string {
 }
 
 const listCmd = defineCommand({
-  meta: { name: 'list', description: 'List env vars. Per-app: resolved KEY=VALUE. --global: all variables with scopes (masked).' },
+  meta: { name: 'list', description: 'List env vars. Per-app: resolved KEY=VALUE. --global/--group: variables in that scope (masked).' },
   args: {
     app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
     env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
     global: { type: 'boolean', alias: 'g', description: 'List all variables across scopes (masked)' },
+    group: { type: 'string', description: 'List masked entries scoped to a group; excludes <app>/--global' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
 
-    if (args.global) {
+    assertScopeFlags(args.app, !!args.global, args.group)
+
+    if (args.global || args.group) {
       const vars = await client.get<MaskedVar[]>('/secrets/vars')
-      if (!vars.length) {
-        console.log(chalk.dim('No variables set.'))
-        return
-      }
       const rows: Record<string, unknown>[] = []
       for (const v of vars) {
         for (const e of v.entries) {
-          const scope = e.scope.app
-            ? `app:${e.scope.app}${e.scope.env ? `/${e.scope.env}` : ''}`
-            : e.scope.env
-              ? `env:${e.scope.env}`
-              : 'all'
-          rows.push({ key: v.key, scope, value: e.masked })
+          if (args.group && e.scope.group !== args.group) continue
+          rows.push({ key: v.key, scope: renderScope(e.scope), value: e.masked })
         }
       }
+      if (!rows.length) {
+        console.log(chalk.dim(args.group ? `No variables scoped to group:${args.group}.` : 'No variables set.'))
+        return
+      }
       printTable(rows, ['key', 'scope', 'value'])
       return
     }
@@ -103,22 +122,26 @@ const listCmd = defineCommand({
 })
 
 const setCmd = defineCommand({
-  meta: { name: 'set', description: 'Set a secret (KEY=VALUE or -f .env). Scoped to <app>, --global, and/or --env.' },
+  meta: { name: 'set', description: 'Set a secret (KEY=VALUE or -f .env). Scoped to <app>, --global, --group, and/or --env.' },
   args: {
     app: { type: 'positional', description: 'App name (or reads from bodify.yaml; omit with --global)', required: false },
     pair: { type: 'positional', description: 'KEY=VALUE', required: false },
     file: { type: 'string', alias: 'f', description: 'Path to .env file (bulk import)' },
     env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
     global: { type: 'boolean', alias: 'g', description: 'Shared var (no app); broadens reach' },
+    group: { type: 'string', description: 'Scope to a group (apps that inherit it); excludes <app>/--global' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
 
-    // --global has no app; otherwise resolve the app NAME (server resolves name→id).
-    assertScopeFlags(args.app, !!args.global)
-    const appName = args.global ? undefined : resolveAppName(args.app)
-    const scope = buildScope(appName, args.env, !!args.global)
+    // Under --global/--group the leading positional is the pair, not an app — shift it.
+    const { app, rest } = resolvePositionals(args.app, [args.pair], !!args.global, args.group)
+    // Real conflict: a scope flag AND a surplus leading positional (a true <app>) before the pair.
+    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group)
+    const pair = (args.global || args.group) ? rest[0] : args.pair
+    const appName = args.global || args.group ? undefined : resolveAppName(app)
+    const scope = buildScope(appName, args.env, !!args.global, args.group)
 
     if (args.file) {
       const f = Bun.file(args.file)
@@ -139,13 +162,13 @@ const setCmd = defineCommand({
       return
     }
 
-    if (!args.pair || !args.pair.includes('=')) {
+    if (!pair || !pair.includes('=')) {
       console.error(chalk.red('Format: bod env set <app> KEY=VALUE  or  bod env set <app> -f .env  (use --global for a shared var)'))
       process.exit(1)
     }
-    const eqIdx = args.pair.indexOf('=')
-    const key = args.pair.slice(0, eqIdx)
-    const value = args.pair.slice(eqIdx + 1)
+    const eqIdx = pair.indexOf('=')
+    const key = pair.slice(0, eqIdx)
+    const value = pair.slice(eqIdx + 1)
     await client.put(`/secrets/vars/${encodeURIComponent(key)}`, { value, scope })
     console.log(chalk.green(`✓ Set ${key}`))
   },
@@ -155,22 +178,31 @@ const unsetCmd = defineCommand({
   meta: { name: 'unset', description: 'Remove one scoped entry of a secret. Use `rm` to delete the whole variable.' },
   args: {
     app: { type: 'positional', description: 'App name (or reads from bodify.yaml; omit with --global)', required: false },
-    key: { type: 'positional', description: 'Variable name', required: true },
+    key: { type: 'positional', description: 'Variable name', required: false },
     env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
     global: { type: 'boolean', alias: 'g', description: 'Target the shared (no-app) entry' },
+    group: { type: 'string', description: 'Target a group-scoped entry; excludes <app>/--global' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
 
-    assertScopeFlags(args.app, !!args.global)
-    const appName = args.global ? undefined : resolveAppName(args.app)
+    // Under --global/--group the leading positional is the key, not an app — shift it.
+    const { app, rest } = resolvePositionals(args.app, [args.key], !!args.global, args.group)
+    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group)
+    const key = (args.global || args.group) ? rest[0] : args.key
+    if (!key) {
+      console.error(chalk.red('Variable name required: bod env unset <app> KEY  (use --global/--group for shared entries)'))
+      process.exit(1)
+    }
+    const appName = args.global || args.group ? undefined : resolveAppName(app)
     const qs: string[] = []
     if (appName) qs.push(`app=${encodeURIComponent(appName)}`)
+    if (args.group) qs.push(`group=${encodeURIComponent(args.group)}`)
     if (args.env) qs.push(`env=${encodeURIComponent(args.env)}`)
     const suffix = qs.length ? `?${qs.join('&')}` : ''
-    await client.del(`/secrets/vars/${encodeURIComponent(args.key)}/entry${suffix}`)
-    console.log(chalk.green(`✓ Removed ${args.key}`))
+    await client.del(`/secrets/vars/${encodeURIComponent(key)}/entry${suffix}`)
+    console.log(chalk.green(`✓ Removed ${key}`))
   },
 })
 

package/src/commands/host.ts

@@ -0,0 +1,93 @@
+import { defineCommand } from 'citty'
+import chalk from 'chalk'
+import { statSync, readdirSync, readFileSync, existsSync } from 'fs'
+import { join, relative, basename, extname } from 'path'
+import { loadConfig, getResolvedInstance } from '../config'
+
+const MIME: Record<string, string> = {
+  '.html': 'text/html; charset=utf-8', '.htm': 'text/html; charset=utf-8',
+  '.css': 'text/css; charset=utf-8', '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8', '.json': 'application/json',
+  '.map': 'application/json', '.xml': 'application/xml', '.txt': 'text/plain; charset=utf-8',
+  '.svg': 'image/svg+xml', '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif', '.webp': 'image/webp', '.avif': 'image/avif', '.ico': 'image/x-icon',
+  '.mp4': 'video/mp4', '.webm': 'video/webm', '.mov': 'video/quicktime',
+  '.mp3': 'audio/mpeg', '.wav': 'audio/wav', '.ogg': 'audio/ogg', '.m4a': 'audio/mp4',
+  '.pdf': 'application/pdf', '.wasm': 'application/wasm',
+  '.woff': 'font/woff', '.woff2': 'font/woff2', '.ttf': 'font/ttf', '.otf': 'font/otf',
+}
+function mimeFor(path: string): string { return MIME[extname(path).toLowerCase()] ?? 'application/octet-stream' }
+
+// Collect { rel, abs } for a file or (recursively) a directory. Skips dotfiles + node_modules.
+function collect(root: string): Array<{ rel: string; abs: string }> {
+  const st = statSync(root)
+  if (st.isFile()) return [{ rel: basename(root), abs: root }]
+  const out: Array<{ rel: string; abs: string }> = []
+  const walk = (dir: string) => {
+    for (const name of readdirSync(dir)) {
+      if (name.startsWith('.') || name === 'node_modules') continue
+      const abs = join(dir, name)
+      const s = statSync(abs)
+      if (s.isDirectory()) walk(abs)
+      else out.push({ rel: relative(root, abs).split('\\').join('/'), abs })
+    }
+  }
+  walk(root)
+  return out
+}
+
+export default defineCommand({
+  meta: { name: 'host', description: 'Publish a file or folder to the web (serve.bod.ee) and get a CDN URL' },
+  args: {
+    path: { type: 'positional', description: 'File or directory to publish', required: true },
+    slug: { type: 'string', description: 'Reuse/update an existing site slug' },
+    app: { type: 'string', description: 'Link to a Bodify app id → persistent (else ephemeral, 48h)' },
+  },
+  async run({ args }) {
+    const root = args.path
+    if (!existsSync(root)) { console.error(chalk.red(`Path not found: ${root}`)); process.exit(1) }
+
+    const files = collect(root)
+    if (!files.length) { console.error(chalk.red('No files to publish')); process.exit(1) }
+
+    const { url, apiKey, name: instanceName } = getResolvedInstance(loadConfig())
+    const auth: Record<string, string> = apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
+    const totalBytes = files.reduce((n, f) => n + statSync(f.abs).size, 0)
+    console.log(chalk.dim(`Publishing ${files.length} file(s), ${(totalBytes / 1024).toFixed(1)} KB to ${instanceName}...`))
+
+    // 1. Create the site + presigned uploads.
+    const manifest = files.map(f => ({ path: f.rel, contentType: mimeFor(f.rel), size: statSync(f.abs).size }))
+    const createRes = await fetch(`${url}/api/v1/publish`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...auth },
+      body: JSON.stringify({ files: manifest, slug: args.slug, appId: args.app }),
+    })
+    if (!createRes.ok) { console.error(chalk.red(`Publish failed: ${createRes.status} ${await createRes.text()}`)); process.exit(1) }
+    const site = await createRes.json() as {
+      slug: string; siteUrl: string; expiresAt?: number
+      upload: { uploads: Array<{ path: string; url: string | null; key: string }>; finalizeUrl: string }
+    }
+
+    // 2. Upload each file — presigned PUT (R2) or direct-to-agent PUT (local provider).
+    const byPath = new Map(files.map(f => [f.rel, f.abs]))
+    for (const u of site.upload.uploads) {
+      const abs = byPath.get(u.path)!
+      const data = new Uint8Array(readFileSync(abs))
+      const ct = mimeFor(u.path)
+      const target = u.url ?? `${url}/api/v1/upload/${site.slug}/${u.path.split('/').map(encodeURIComponent).join('/')}`
+      const putRes = await fetch(target, {
+        method: 'PUT',
+        headers: { 'Content-Type': ct, ...(u.url ? {} : auth) },
+        body: data,
+      })
+      if (!putRes.ok) { console.error(chalk.red(`Upload failed for ${u.path}: ${putRes.status} ${await putRes.text()}`)); process.exit(1) }
+    }
+
+    // 3. Finalize.
+    const finRes = await fetch(`${url}${site.upload.finalizeUrl}`, { method: 'POST', headers: { ...auth } })
+    if (!finRes.ok) { console.error(chalk.red(`Finalize failed: ${finRes.status} ${await finRes.text()}`)); process.exit(1) }
+
+    console.log(chalk.green(`✓ Live: ${site.siteUrl}`))
+    console.log(chalk.dim(`  slug: ${site.slug}${args.app ? `  (persistent, app ${args.app})` : site.expiresAt ? `  (expires ${new Date(site.expiresAt).toISOString()})` : ''}`))
+  },
+})