uplink-cli 0.1.28 → 0.1.29

package/cli/src/index.ts

@@ -6,6 +6,7 @@ import { adminCommand } from "./subcommands/admin";
 import { menuCommand } from "./subcommands/menu";
 import { tunnelCommand } from "./subcommands/tunnel";
 import { signupCommand } from "./subcommands/signup";
+import { systemCommand } from "./subcommands/system";
 import { readFileSync } from "fs";
 import { join } from "path";
 
@@ -27,6 +28,7 @@ program.addCommand(devCommand);
 program.addCommand(adminCommand);
 program.addCommand(tunnelCommand);
 program.addCommand(signupCommand);
+program.addCommand(systemCommand);
 program.addCommand(menuCommand);
 
 // Global pre-action hook to apply shared options

package/cli/src/subcommands/system.ts

@@ -0,0 +1,74 @@
+import { Command } from "commander";
+import { apiRequest } from "../http";
+
+type SystemStatus = {
+  hasInternalSecret: boolean;
+  relayReachable: boolean;
+  relayConnectedCount: number;
+  tlsMode: string;
+  wildcardDomains: string[];
+  askEndpoint: { path: string; protected: boolean; note?: string };
+};
+
+function formatBoolean(value: boolean) {
+  return value ? "yes" : "no";
+}
+
+async function fetchStatus(): Promise<SystemStatus> {
+  return (await apiRequest("GET", "/v1/admin/system/status")) as SystemStatus;
+}
+
+export const systemCommand = new Command("system")
+  .description("System diagnostics (admin)")
+  .addCommand(
+    new Command("status")
+      .description("Show system status for relay/TLS wiring")
+      .option("--json", "Output raw JSON")
+      .action(async (opts) => {
+        const status = await fetchStatus();
+        if (opts.json) {
+          console.log(JSON.stringify(status, null, 2));
+          return;
+        }
+
+        console.log([
+          "System Status",
+          "-------------",
+          `Internal secret configured: ${formatBoolean(status.hasInternalSecret)}`,
+          `Relay reachable:            ${formatBoolean(status.relayReachable)}`,
+          `Relay connected tunnels:    ${status.relayConnectedCount}`,
+          `TLS mode:                   ${status.tlsMode}`,
+          `Wildcard domains:           ${status.wildcardDomains.join(", ")}`,
+          `Ask endpoint:               ${status.askEndpoint.path} (${status.askEndpoint.protected ? "protected" : "unprotected"})`,
+          status.askEndpoint.note ? `Note: ${status.askEndpoint.note}` : "",
+        ].filter(Boolean).join("\n"));
+      })
+  )
+  .addCommand(
+    new Command("explain")
+      .description("Explain missing/unsafe settings")
+      .action(async () => {
+        const status = await fetchStatus();
+        const issues: string[] = [];
+
+        if (!status.hasInternalSecret) {
+          issues.push("- RELAY_INTERNAL_SECRET is missing. Set it for backend + relay to protect internal endpoints.");
+        }
+        if (!status.relayReachable) {
+          issues.push("- Relay unreachable via /internal/connected-tokens. Check relay service and secret header.");
+        }
+        if (status.askEndpoint && !status.askEndpoint.protected) {
+          issues.push("- Ask endpoint is not protected; ensure RELAY_INTERNAL_SECRET is set.");
+        }
+
+        console.log("System Explain");
+        console.log("--------------");
+        if (issues.length === 0) {
+          console.log("No critical issues detected. TLS mode:", status.tlsMode);
+          return;
+        }
+        console.log("Issues:");
+        issues.forEach((i) => console.log(i));
+      })
+  );
+

package/docs/PRODUCT.md

@@ -277,6 +277,15 @@ See [DEPLOYMENT.md](docs/deployment/DEPLOYMENT.md) for production setup.
 
 ---
 
+## TLS and Internal Secrets
+
+- **Primary TLS**: wildcard DNS-01 (Cloudflare) for `*.x.uplink.spot` and `*.uplink.spot`.
+- **Optional on-demand TLS**: backend ask endpoint `/internal/allow-tls` (protected by `RELAY_INTERNAL_SECRET`) for future custom domains.
+- **Required secrets**: set `RELAY_INTERNAL_SECRET`, `TUNNEL_DOMAIN`, `ALIAS_DOMAIN` in `/opt/agentcloud/.env` on servers; relay and backend services load from that file.
+- **Diagnostics**: `uplink system status` (admin) checks relay reachability, internal secret, TLS mode.
+
+---
+
 ## Roadmap
 
 Based on the CLI-first philosophy, planned expansions:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uplink-cli",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "description": "Expose localhost to the internet in seconds. Interactive terminal UI, permanent custom domains, zero config. A modern ngrok alternative.",
   "keywords": [
     "tunnel",