home-hosted 0.7.11 → 0.7.13

package/dist/cli.js

@@ -4,7 +4,8 @@ import { fileURLToPath } from "node:url";
 import { defineCommand, runCommand } from "citty";
 import path from "node:path";
 import readline from "node:readline";
-import { exec, execFile, spawn, spawnSync } from "node:child_process";
+import { exec, execFile, execFileSync, spawn, spawnSync } from "node:child_process";
+import { Buffer as Buffer$1 } from "node:buffer";
 import os from "node:os";
 import { describeRoute, openAPIRouteHandler, resolver, validator } from "hono-openapi";
 import { createFactory } from "hono/factory";
@@ -13,7 +14,6 @@ import { isDevelopment } from "std-env";
 import { DetailedError } from "@namesmt/utils";
 import { type } from "arktype";
 import crypto, { X509Certificate, createPrivateKey, createPublicKey, randomBytes } from "node:crypto";
-import { Buffer as Buffer$1 } from "node:buffer";
 import { streamSSE } from "hono/streaming";
 import { autoRetry } from "@grammyjs/auto-retry";
 import { Bot } from "grammy";
@@ -306,6 +306,112 @@ var init_runtime = __esmMin((() => {
 	NANNY_COMMAND = "__nanny";
 }));
 //#endregion
+//#region src/helpers/daemon-log.ts
+var daemon_log_exports = /* @__PURE__ */ __exportAll({
+	followLog: () => followLog,
+	readLog: () => readLog,
+	rotateLog: () => rotateLog,
+	tailLog: () => tailLog
+});
+function rotateLog(file) {
+	try {
+		if (fs.statSync(file).size < LOG_ROTATE_BYTES) return;
+		fs.rmSync(`${file}.1`, { force: true });
+		fs.renameSync(file, `${file}.1`);
+	} catch {}
+}
+/**
+* The last `lines` lines, or `''` when there is no log to read.
+*
+* Split on the trailing newline rather than after it: a log file ends with one, so a plain
+* `split('\n').slice(-lines)` counts that empty last element as a line and quietly returns
+* one fewer than asked for.
+*/
+function tailLog(file, lines = 15) {
+	return withoutTrailingBlank(readLogLines(file)).slice(-lines).join("\n");
+}
+function readLogLines(file) {
+	try {
+		return fs.readFileSync(file, "utf8").split("\n");
+	} catch {
+		return [];
+	}
+}
+/** A file ending in a newline splits into a final empty element; it is not a line. */
+function withoutTrailingBlank(lines) {
+	return lines.at(-1) === "" ? lines.slice(0, -1) : lines;
+}
+/**
+* One rotation boundary's worth of lines, oldest first.
+*
+* The current file plus its `.1` ancestor, so `logs` shows what happened just before a
+* rotation rather than starting blank. `lines <= 0` means the whole thing.
+*/
+function readLog(file, lines) {
+	const parts = [];
+	for (const candidate of [`${file}.1`, file]) try {
+		parts.push(fs.readFileSync(candidate, "utf8"));
+	} catch {}
+	const all = withoutTrailingBlank(parts.join("").split("\n"));
+	return lines > 0 ? all.slice(-lines) : all;
+}
+/**
+* Prints the last `lines` of the log, then keeps printing whatever is appended.
+*
+* Polled rather than watched on purpose. `config-watch` documents why: an editor's save
+* replaces the inode, and `fs.watch` is undependable on some filesystems. A foreground
+* command also has to notice the rotation `up` performs, which shows up simply as the file
+* getting *smaller* — and a poll sees that without any special case.
+*
+* Resolves when the caller's signal arrives, so the command exits the way a pager would.
+*/
+async function followLog(file, lines, write, pollMs = 250) {
+	const initial = readLog(file, lines);
+	if (initial.length > 0) write(`${initial.join("\n")}\n`);
+	let offset = sizeOf(file);
+	let stopped = false;
+	const stop = () => {
+		stopped = true;
+	};
+	process.once("SIGINT", stop);
+	process.once("SIGTERM", stop);
+	try {
+		for (;;) {
+			await new Promise((resolve) => setTimeout(resolve, pollMs));
+			if (stopped) break;
+			const size = sizeOf(file);
+			if (size < offset) offset = 0;
+			if (size === offset) continue;
+			try {
+				const handle = fs.openSync(file, "r");
+				try {
+					const length = size - offset;
+					const buffer = Buffer$1.alloc(length);
+					fs.readSync(handle, buffer, 0, length, offset);
+					write(buffer.toString("utf8").replace(/\n+$/, "\n"));
+				} finally {
+					fs.closeSync(handle);
+				}
+				offset = size;
+			} catch {}
+		}
+	} finally {
+		process.removeListener("SIGINT", stop);
+		process.removeListener("SIGTERM", stop);
+	}
+}
+function sizeOf(file) {
+	try {
+		return fs.statSync(file).size;
+	} catch {
+		return 0;
+	}
+}
+var LOG_ROTATE_BYTES;
+var init_daemon_log = __esmMin((() => {
+	LOG_ROTATE_BYTES = 5242880;
+}));
+//#endregion
 //#region src/helpers/version.ts
 var version_exports = /* @__PURE__ */ __exportAll({
 	appVersion: () => appVersion,
@@ -3193,6 +3299,18 @@ function createControlRoute(deps) {
 		assertLocalCall(c, "start or stop a server");
 		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.stop(c.req.param("id"));
 		return c.json(result, statusForAction(result));
+	}).post("/servers/:id/restart", describeRoute({
+		tags: ["panel"],
+		summary: "Restart one server, without a session (local token required)",
+		responses: {
+			200: { description: "Restarted" },
+			403: { description: "Bad token, or not a local caller" },
+			404: { description: "No such server" }
+		}
+	}), validate("query", workspaceQuerySchema), async (c) => {
+		assertLocalCall(c, "restart a server");
+		const result = await requireWorkspace(deps.panel.requireWorkspace.bind(deps.panel), c.req.valid("query").workspace).supervisor.restart(c.req.param("id"));
+		return c.json(result, statusForAction(result));
 	});
 }
 var init_control = __esmMin((() => {
@@ -6018,7 +6136,7 @@ function createLogsRoute(deps) {
 	});
 }
 var MIN_TAIL, MAX_TAIL, DEFAULT_TAIL, idParam$2, downloadQuery, historyQuery;
-var init_logs = __esmMin((() => {
+var init_logs$1 = __esmMin((() => {
 	init_factory();
 	init_openapi$1();
 	init_validator();
@@ -8372,20 +8490,7 @@ var init_proxy$1 = __esmMin((() => {
 				return;
 			}
 			await this.assertPortsFree(this.config.httpPort, this.config.httpsPort);
-			const result = await this.request("POST", "/load", rendered).catch((error) => {
-				this.lastError = `the engine did not accept the configuration: ${error instanceof Error ? error.message : String(error)}`;
-				throw new DetailedError(this.lastError, {
-					statusCode: 502,
-					code: "ENGINE_UNREACHABLE"
-				});
-			});
-			if (result.status >= 400) {
-				this.lastError = engineMessage(result.body) ?? `the engine rejected the configuration (HTTP ${result.status})`;
-				throw new DetailedError(this.lastError, {
-					statusCode: 400,
-					code: "PROXY_CONFIG_REJECTED"
-				});
-			}
+			await this.postConfiguration(rendered);
 			this.rememberConfig(text);
 			this.rememberApplied(this.config.httpPort, this.config.httpsPort);
 			const swept = this.sweepUnroutedCertificates();
@@ -8431,22 +8536,34 @@ var init_proxy$1 = __esmMin((() => {
 			}
 			return removed;
 		}
-		/** Hands a configuration to the running engine without touching the file on disk. */
-		async loadIntoEngine(rendered) {
+		/**
+		* Posts one rendered configuration to the engine's admin endpoint and reports a refusal.
+		*
+		* The three call sites used to spell this out themselves, and one of them forgot to record
+		* `lastError` — which is what `status()` shows as the proxy's state, so a configuration the
+		* engine refused could leave the panel reporting the proxy as healthy. Keeping both the
+		* message and the state in one place is the point.
+		*/
+		async postConfiguration(rendered) {
 			const result = await this.request("POST", "/load", rendered).catch((error) => {
-				throw new DetailedError(`the engine did not accept the configuration: ${error instanceof Error ? error.message : String(error)}`, {
+				this.lastError = `the engine did not accept the configuration: ${error instanceof Error ? error.message : String(error)}`;
+				throw new DetailedError(this.lastError, {
 					statusCode: 502,
 					code: "ENGINE_UNREACHABLE"
 				});
 			});
 			if (result.status >= 400) {
-				const message = engineMessage(result.body) ?? `the engine rejected the configuration (HTTP ${result.status})`;
-				throw new DetailedError(message, {
+				this.lastError = engineMessage(result.body) ?? `the engine rejected the configuration (HTTP ${result.status})`;
+				throw new DetailedError(this.lastError, {
 					statusCode: 400,
 					code: "PROXY_CONFIG_REJECTED"
 				});
 			}
 		}
+		/** Hands a configuration to the running engine without touching the file on disk. */
+		async loadIntoEngine(rendered) {
+			await this.postConfiguration(rendered);
+		}
 		/** Advances `previous.json` only for a configuration the engine accepted. */
 		rememberConfig(text) {
 			if (fs.existsSync(this.options.configPath)) writeFileAtomic(this.options.previousConfigPath, fs.readFileSync(this.options.configPath, "utf8"), { mode: 384 });
@@ -8511,14 +8628,7 @@ var init_proxy$1 = __esmMin((() => {
 			});
 			const current = fs.existsSync(this.options.configPath) ? fs.readFileSync(this.options.configPath, "utf8") : null;
 			const previous = fs.readFileSync(this.options.previousConfigPath, "utf8");
-			const result = await this.request("POST", "/load", JSON.parse(previous));
-			if (result.status >= 400) {
-				this.lastError = engineMessage(result.body) ?? `the engine rejected the configuration (HTTP ${result.status})`;
-				throw new DetailedError(this.lastError, {
-					statusCode: 400,
-					code: "PROXY_CONFIG_REJECTED"
-				});
-			}
+			await this.postConfiguration(JSON.parse(previous));
 			writeFileAtomic(this.options.configPath, previous, { mode: 384 });
 			if (current === null) fs.rmSync(this.options.previousConfigPath, { force: true });
 			else writeFileAtomic(this.options.previousConfigPath, current, { mode: 384 });
@@ -10314,7 +10424,7 @@ var init_app = __esmMin((() => {
 	init_ddns$1();
 	init_events();
 	init_health();
-	init_logs();
+	init_logs$1();
 	init_metrics();
 	init_notifications$1();
 	init_proxy();
@@ -14021,7 +14131,20 @@ async function swapUsedPercent() {
 	}
 	return 0;
 }
-/** `/proc/meminfo` counts cache as available, which `os.freemem()` does not. */
+/**
+* Memory used, as a percentage of what the machine actually has.
+*
+* The definition matters more than the arithmetic, and it differs per platform:
+*
+* - Linux: `/proc/meminfo`'s `MemAvailable` already excludes cache, because Linux counts
+*   page cache as reclaimable. `os.freemem()` happens to read the same value here.
+* - macOS: **`os.freemem()` is wrong for this.** libuv reports `host_statistics64`'s
+*   `free_count` alone, while macOS keeps as much RAM as it can in *inactive* and
+*   speculative* pages — file cache it drops on demand. A perfectly healthy Mac therefore
+*   reads as 90%+ used, which is the report a user brought back from a 0.7.3 panel. Read
+*   `vm_stat` and count what macOS itself counts as available.
+* - Windows: `os.freemem()` is the free physical page count, which is the ordinary reading.
+*/
 function memoryInfo() {
 	try {
 		const info = fs.readFileSync("/proc/meminfo", "utf8");
@@ -14036,14 +14159,81 @@ function memoryInfo() {
 		};
 	} catch {
 		const total = os.totalmem();
-		const free = os.freemem();
+		const available = availableMemoryBytes(process.platform, os.freemem());
 		return {
-			memoryUsedPercent: total > 0 ? (total - free) / total * 100 : 0,
+			memoryUsedPercent: total > 0 && available !== null ? Math.max(0, Math.min(100, (total - available) / total * 100)) : 0,
 			swapUsedPercent: 0
 		};
 	}
 }
 /**
+* Which "available memory" reading a platform's fallback should use.
+*
+* Split out from `memoryInfo` because the branch it decides is otherwise unreachable off
+* macOS: Linux answers from `/proc/meminfo` first, so the fallback never runs there and no
+* Linux test can prove which reader was chosen. Taking the platform and the OS reading as
+* arguments makes the decision testable on any runner, which matters — using the wrong
+* reader here is the whole macOS bug.
+*/
+function availableMemoryBytes(platform, osFree, vmStat) {
+	if (platform !== "darwin") return osFree;
+	return macAvailableBytes(vmStat);
+}
+/**
+* What macOS counts as available: free + inactive + speculative pages.
+*
+* `vm_stat` reports pages, so the page size is needed — and it is not always 4096 (Apple
+* silicon uses 16384 for the physical page size, and `vm_stat` has printed a `page size of`
+* header since macOS 11). Both are handled: the header when it is there, `getpagesize` when
+* it is not.
+*
+* Returns `null` when the reading cannot be taken, so the caller reports "unknown" rather
+* than inventing a percentage.
+*/
+function macAvailableBytes(vmStat) {
+	try {
+		const text = vmStat ?? execFileSync("vm_stat", {
+			timeout: 3e3,
+			encoding: "utf8"
+		});
+		const pageSize = Number.parseInt(/page size of (\d+) bytes/.exec(text)?.[1] ?? "", 10);
+		const pages = (label) => {
+			const found = new RegExp(`^${label}:\\s+(\\d+)`, "m").exec(text)?.[1];
+			return Number.parseInt(found ?? "", 10);
+		};
+		const size = Number.isFinite(pageSize) && pageSize > 0 ? pageSize : getPageSize();
+		if (!Number.isFinite(size) || size <= 0) return null;
+		let totalPages = 0;
+		let sawAny = false;
+		for (const label of [
+			"Pages free",
+			"Pages inactive",
+			"Pages speculative",
+			"Pages purgeable"
+		]) {
+			const value = pages(label);
+			if (Number.isFinite(value)) {
+				totalPages += value;
+				sawAny = true;
+			}
+		}
+		return sawAny ? totalPages * size : null;
+	} catch {
+		return null;
+	}
+}
+/** The OS page size, without adding a dependency for one sysconf. */
+function getPageSize() {
+	try {
+		return Number.parseInt(execFileSync("getconf", ["PAGESIZE"], {
+			timeout: 3e3,
+			encoding: "utf8"
+		}).trim(), 10);
+	} catch {
+		return NaN;
+	}
+}
+/**
 * Best-effort CPU temperature from Linux thermal zones / hwmon. macOS and
 * Windows expose no unprivileged sensor, so those platforms report null and the
 * UI simply hides the reading.
@@ -14991,6 +15181,7 @@ function stateSignature(state) {
 		state.host.alerts.join(","),
 		state.backups.files.length,
 		state.backups.entries.length,
+		`${state.ui.custom}:${state.ui.meta?.name ?? ""}:${state.ui.meta?.version ?? ""}`,
 		state.proxy === void 0 ? "" : [
 			state.proxy.config.enabled,
 			state.proxy.status.state,
@@ -16446,21 +16637,6 @@ function toUpFlags(args) {
 		printConfig: args.printConfig === true
 	};
 }
-/** One rotation is enough for a console log. */
-function rotateLog(file) {
-	try {
-		if (fs.statSync(file).size < LOG_ROTATE_BYTES) return;
-		fs.rmSync(`${file}.1`, { force: true });
-		fs.renameSync(file, `${file}.1`);
-	} catch {}
-}
-function tailLog(file, lines = 15) {
-	try {
-		return fs.readFileSync(file, "utf8").split("\n").slice(-lines).join("\n").trimEnd();
-	} catch {
-		return "";
-	}
-}
 async function runUp(flags, entry) {
 	const { runControlPlane } = await Promise.resolve().then(() => (init_src(), src_exports));
 	if (flags.foreground || flags.printConfig) {
@@ -16545,14 +16721,14 @@ function upCommand(entry) {
 		}
 	});
 }
-var DEFAULT_PORT$1, LOG_ROTATE_BYTES, upArgs;
+var DEFAULT_PORT$1, upArgs;
 var init_up = __esmMin((() => {
 	init_args();
 	init_io();
+	init_daemon_log();
 	init_runtime();
 	init_version();
 	DEFAULT_PORT$1 = 3999;
-	LOG_ROTATE_BYTES = 5242880;
 	upArgs = {
 		config: {
 			type: "string",
@@ -16698,17 +16874,107 @@ var init_down = __esmMin((() => {
 	});
 }));
 //#endregion
+//#region src/cli/server.ts
+var server_exports = /* @__PURE__ */ __exportAll({
+	restartServerCommand: () => restartServerCommand,
+	runServerAction: () => runServerAction,
+	startCommand: () => startCommand,
+	stopCommand: () => stopCommand
+});
+async function runServerAction(action, id, workspace) {
+	const { clearRuntime, isProcessAlive, readRuntime, requestControl } = await Promise.resolve().then(() => (init_daemon(), daemon_exports));
+	const runtime = readRuntime();
+	if (runtime === null || !isProcessAlive(runtime.pid)) {
+		if (runtime !== null) clearRuntime();
+		fail("home-hosted is not running — start it with `home-hosted up`");
+	}
+	const query = workspace === void 0 || workspace.length === 0 ? "" : `?workspace=${encodeURIComponent(workspace)}`;
+	const answer = await requestControl(runtime, `/_hh/servers/${encodeURIComponent(id)}/${action}${query}`);
+	if (answer === null) fail(`the control panel is not answering on ${runtime.probeUrl}`);
+	const body = answer.body ?? {};
+	if (body.ok !== true) {
+		const reason = body.error ?? body.message;
+		if (reason !== void 0) fail(reason);
+		if (answer.status === 404) fail(`the panel on ${runtime.url} is home-hosted ${runtime.version}, which does not know this command — restart it on this release`);
+		fail(`the panel answered ${answer.status}`);
+	}
+	const verb = action === "start" ? "started" : action === "stop" ? "stopped" : "restarted";
+	process.stdout.write(`${green(verb)} ${workspace === void 0 ? "" : `${workspace}/`}${id}\n`);
+}
+function serverCommand(action) {
+	return defineCommand({
+		meta: {
+			name: action,
+			description: DESCRIPTION[action]
+		},
+		args: {
+			id: {
+				type: "positional",
+				required: false,
+				description: "the server id from the workspace's servers.config.json"
+			},
+			workspace: {
+				type: "string",
+				alias: "w",
+				description: "the workspace to act in (default: the panel's default workspace)"
+			}
+		},
+		run: async ({ args }) => {
+			const id = typeof args.id === "string" ? args.id.trim() : "";
+			if (id.length === 0) fail(`${action} needs a server id — see \`home-hosted status\` or the workspace's servers.config.json`);
+			await runServerAction(action, id, typeof args.workspace === "string" ? args.workspace.trim() : void 0);
+		}
+	});
+}
+var DESCRIPTION, startCommand, stopCommand, restartServerCommand;
+var init_server = __esmMin((() => {
+	init_io();
+	DESCRIPTION = {
+		start: "start one server (the panel keeps running)",
+		stop: "stop one server (the panel keeps running)",
+		restart: "restart one server (the panel keeps running)"
+	};
+	startCommand = serverCommand("start");
+	stopCommand = serverCommand("stop");
+	restartServerCommand = serverCommand("restart");
+}));
+//#endregion
 //#region src/cli/restart.ts
 var restart_exports = /* @__PURE__ */ __exportAll({ restartCommand: () => restartCommand });
-/** `restart` is `down`, then `up` with exactly the flags it was given. */
+/**
+* `restart` restarts the panel (`down`, then `up`) — or, given a server id, just that entry.
+*
+* The id is optional on purpose. `restart` already meant the panel, and it still does when
+* called the way it always was; adding a positional would have been a hard error before this
+* ("Unexpected argument 'web'"), so nothing existing changes meaning. The per-server case is
+* what the UI's Restart button has always done and the shell could not.
+*/
 function restartCommand(entry) {
 	return defineCommand({
 		meta: {
 			name: "restart",
-			description: "down, then up"
+			description: "down then up — or one server, given an id"
+		},
+		args: {
+			...upArgs,
+			id: {
+				type: "positional",
+				required: false,
+				description: "restart just this server instead of the panel"
+			},
+			workspace: {
+				type: "string",
+				alias: "w",
+				description: "the workspace to act in (default: the panel's default workspace)"
+			}
 		},
-		args: upArgs,
 		run: async ({ args }) => {
+			const id = typeof args.id === "string" ? args.id.trim() : "";
+			if (id.length > 0) {
+				await runServerAction("restart", id, typeof args.workspace === "string" ? args.workspace.trim() : void 0);
+				return;
+			}
+			if (args.workspace !== void 0) fail("restart --workspace needs a server id — `home-hosted restart <id> --workspace <id>`");
 			await runDown();
 			await runUp(toUpFlags(args), entry);
 		}
@@ -16716,6 +16982,8 @@ function restartCommand(entry) {
 }
 var init_restart = __esmMin((() => {
 	init_down();
+	init_io();
+	init_server();
 	init_up();
 }));
 //#endregion
@@ -16798,61 +17066,80 @@ var init_status = __esmMin((() => {
 	});
 }));
 //#endregion
-//#region src/cli/server.ts
-var server_exports = /* @__PURE__ */ __exportAll({
-	runServerAction: () => runServerAction,
-	startCommand: () => startCommand,
-	stopCommand: () => stopCommand
+//#region src/cli/logs.ts
+var logs_exports = /* @__PURE__ */ __exportAll({
+	logsArgs: () => logsArgs,
+	logsCommand: () => logsCommand,
+	runLogs: () => runLogs
 });
-async function runServerAction(action, id, workspace) {
-	const { clearRuntime, isProcessAlive, readRuntime, requestControl } = await Promise.resolve().then(() => (init_daemon(), daemon_exports));
-	const runtime = readRuntime();
-	if (runtime === null || !isProcessAlive(runtime.pid)) {
-		if (runtime !== null) clearRuntime();
-		fail("home-hosted is not running — start it with `home-hosted up`");
+/** `all` or a negative count means the whole log; a bad number is not worth a hard failure. */
+function parseLines(raw) {
+	if (raw === void 0) return DEFAULT_LINES;
+	if (raw.trim().toLowerCase() === "all") return 0;
+	const parsed = Number.parseInt(raw, 10);
+	if (!Number.isFinite(parsed)) return DEFAULT_LINES;
+	return parsed < 0 ? 0 : parsed;
+}
+async function runLogs(input) {
+	const { daemonLogPath } = await Promise.resolve().then(() => (init_paths(), paths_exports));
+	const { readLog } = await Promise.resolve().then(() => (init_daemon_log(), daemon_log_exports));
+	const lines = parseLines(input.lines);
+	if (input.follow === true) {
+		const { followLog } = await Promise.resolve().then(() => (init_daemon_log(), daemon_log_exports));
+		await followLog(daemonLogPath, lines === 0 ? DEFAULT_LINES : lines, (chunk) => process.stdout.write(chunk));
+		return;
 	}
-	const query = workspace === void 0 || workspace.length === 0 ? "" : `?workspace=${encodeURIComponent(workspace)}`;
-	const answer = await requestControl(runtime, `/_hh/servers/${encodeURIComponent(id)}/${action}${query}`);
-	if (answer === null) fail(`the control panel is not answering on ${runtime.probeUrl}`);
-	const body = answer.body ?? {};
-	if (body.ok !== true) {
-		const reason = body.error ?? body.message;
-		if (reason !== void 0) fail(reason);
-		if (answer.status === 404) fail(`the panel on ${runtime.url} is home-hosted ${runtime.version}, which does not know this command — restart it on this release`);
-		fail(`the panel answered ${answer.status}`);
+	const output = readLog(daemonLogPath, lines);
+	if (input.json === true) {
+		process.stdout.write(`${JSON.stringify({
+			path: daemonLogPath,
+			lines: output
+		}, null, 2)}\n`);
+		return;
+	}
+	if (output.length === 0) {
+		process.stdout.write(`${dim(`no output yet — ${daemonLogPath}`)}\n`);
+		return;
 	}
-	process.stdout.write(`${green(action === "start" ? "started" : "stopped")} ${workspace === void 0 ? "" : `${workspace}/`}${id}\n`);
+	process.stdout.write(`${bold(daemonLogPath)}\n`);
+	for (const line of output) process.stdout.write(`${line}\n`);
 }
-function serverCommand(action) {
-	return defineCommand({
+var logsArgs, DEFAULT_LINES, logsCommand;
+var init_logs = __esmMin((() => {
+	init_io();
+	logsArgs = {
+		lines: {
+			type: "string",
+			description: "how many lines to show (default 50, `all` for everything)"
+		},
+		follow: {
+			type: "boolean",
+			description: "keep printing as the panel writes (like tail -f)"
+		},
+		json: {
+			type: "boolean",
+			description: "print machine-readable JSON"
+		}
+	};
+	DEFAULT_LINES = 50;
+	logsCommand = defineCommand({
 		meta: {
-			name: action,
-			description: action === "start" ? "start one server (the panel keeps running)" : "stop one server (the panel keeps running)"
+			name: "logs",
+			description: "show the panel's own console output"
 		},
-		args: {
-			id: {
-				type: "positional",
-				required: false,
-				description: "the server id from the workspace's servers.config.json"
-			},
-			workspace: {
-				type: "string",
-				alias: "w",
-				description: "the workspace to act in (default: the panel's default workspace)"
+		args: logsArgs,
+		async run({ args }) {
+			try {
+				await runLogs({
+					lines: args.lines,
+					follow: args.follow,
+					json: args.json
+				});
+			} catch (error) {
+				fail(error instanceof Error ? error.message : String(error));
 			}
-		},
-		run: async ({ args }) => {
-			const id = typeof args.id === "string" ? args.id.trim() : "";
-			if (id.length === 0) fail(`${action} needs a server id — see \`home-hosted status\` or the workspace's servers.config.json`);
-			await runServerAction(action, id, typeof args.workspace === "string" ? args.workspace.trim() : void 0);
 		}
 	});
-}
-var startCommand, stopCommand;
-var init_server = __esmMin((() => {
-	init_io();
-	startCommand = serverCommand("start");
-	stopCommand = serverCommand("stop");
 }));
 //#endregion
 //#region src/cli/set-password.ts
@@ -17971,8 +18258,9 @@ var HEADER = "home-hosted — a control panel for the processes on your home ser
 var SYNOPSIS = {
 	"up": "home-hosted up [options]",
 	"down": "home-hosted down",
-	"restart": "home-hosted restart [options]",
+	"restart": "home-hosted restart [<id>] [options]",
 	"status": "home-hosted status [--json]",
+	"logs": "home-hosted logs [--lines <n>] [--follow] [--json]",
 	"start": "home-hosted start <id> [--workspace <id>]",
 	"stop": "home-hosted stop <id> [--workspace <id>]",
 	"set-password": "home-hosted set-password",
@@ -17986,8 +18274,9 @@ var SYNOPSIS = {
 var SUMMARIES = {
 	"up": "start it in the background (detached)",
 	"down": "stop it, and everything it supervises",
-	"restart": "down, then up",
+	"restart": "down then up — or one server, given an id",
 	"status": "is it running, where, and how to reach it",
+	"logs": "show the panel's own console output",
 	"start": "start one server, leaving the panel up",
 	"stop": "stop one server, leaving the panel up",
 	"set-password": "set the panel password without the API",
@@ -18016,10 +18305,26 @@ var STATUS_SECTION = {
 	heading: "Options for status",
 	lines: [["--json", "print machine-readable JSON"]]
 };
+var LOGS_SECTION = {
+	heading: "Options for logs",
+	lines: [
+		["--lines <n>", "how many lines to show (default 50, `all` for everything)"],
+		["--follow", "keep printing as the panel writes (like tail -f)"],
+		["--json", "print machine-readable JSON"]
+	]
+};
 var SERVER_SECTION = {
 	heading: "Arguments for start/stop",
 	lines: [["<id>", "the server id from servers.config.json"]]
 };
+var RESTART_SECTION = {
+	heading: "Options for restart",
+	lines: [
+		["<id>", "restart just this server, leaving the panel up (optional)"],
+		["-w, --workspace <id>", "the workspace to act in, with an id"],
+		...UP_SECTION.lines
+	]
+};
 var SET_PASSWORD_SECTION = {
 	heading: "Options for set-password",
 	lines: [["--clear", "remove the password, which disables authentication"]]
@@ -18138,6 +18443,8 @@ var USAGE = [
 var UP_COMMANDS = /* @__PURE__ */ new Set(["up", "restart"]);
 var SECTIONS = {
 	"status": STATUS_SECTION,
+	"logs": LOGS_SECTION,
+	"restart": RESTART_SECTION,
 	"start": SERVER_SECTION,
 	"stop": SERVER_SECTION,
 	"set-password": SET_PASSWORD_SECTION,
@@ -18155,7 +18462,7 @@ var SECTIONS = {
 function commandHelp(command) {
 	const synopsis = SYNOPSIS[command];
 	if (synopsis === void 0) return USAGE;
-	const section = UP_COMMANDS.has(command) ? UP_SECTION : SECTIONS[command];
+	const section = SECTIONS[command] ?? (UP_COMMANDS.has(command) ? UP_SECTION : void 0);
 	const options = section === void 0 ? dim("no options") : renderSection(section);
 	return [
 		dim(HEADER),
@@ -18186,6 +18493,7 @@ var COMMANDS = {
 	"down": () => Promise.resolve().then(() => (init_down(), down_exports)).then((module) => module.downCommand),
 	"restart": () => Promise.resolve().then(() => (init_restart(), restart_exports)).then((module) => module.restartCommand(CLI_ENTRY)),
 	"status": () => Promise.resolve().then(() => (init_status(), status_exports)).then((module) => module.statusCommand),
+	"logs": () => Promise.resolve().then(() => (init_logs(), logs_exports)).then((module) => module.logsCommand),
 	"start": () => Promise.resolve().then(() => (init_server(), server_exports)).then((module) => module.startCommand),
 	"stop": () => Promise.resolve().then(() => (init_server(), server_exports)).then((module) => module.stopCommand),
 	"set-password": () => Promise.resolve().then(() => (init_set_password(), set_password_exports)).then((module) => module.setPasswordCommand),