ligoj-cli 1.2.0__tar.gz → 1.3.0__tar.gz

{ligoj_cli-1.2.0/ligoj_cli.egg-info → ligoj_cli-1.3.0}/PKG-INFO

@@ -1,13 +1,15 @@
 Metadata-Version: 2.4
 Name: ligoj-cli
-Version: 1.2.0
-Summary: Ligoj CLI
+Version: 1.3.0
+Summary: Command-line client for the Ligoj REST API, with a local dev-environment toolkit
 Author-email: Fabrice Daugan <fdaugan@kloudy.io>
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/ligoj/cli
 Project-URL: Documentation, https://github.com/ligoj/cli/README.md
 Project-URL: Repository, https://github.com/ligoj/cli
 Project-URL: Issues, https://github.com/ligoj/cli/issues
+Keywords: ligoj,cli,rest,api,devops,automation,finops,cloud,provisioning,podman
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -68,6 +70,19 @@ pip install -i https://test.pypi.org/simple/ --extra-index-url https://pypi.org/
 
 For local development from a checkout, see [Development](#development).
 
+## Updating
+
+The CLI updates itself through `uv`:
+
+```bash
+ligoj update                  # upgrade to the latest release (uv tool upgrade)
+ligoj update --target 1.3.0   # pin a specific version (uv tool install --force)
+```
+
+When the CLI was installed with `pipx`/`pip` instead of `uv`, update it with the
+matching command (`pipx upgrade ligoj-cli` / `pip install -U ligoj-cli`) — 
+`ligoj update` reminds you of these when `uv` is not available.
+
 
 # Configuration
 
@@ -1039,7 +1054,7 @@ Input `--from` JSON:
 - JSON can be as list or dict (compact). See sample.
 - The parameters marked as sensitive are encrypted in database of Ligoj.
 
-Content of sample [ligoj-ldap.json](docs/nodes/ldap.json) file:
+Content of sample [ligoj-ldap.json](ligojcli/data/nodes/ldap.json) file:
 
 ```json
 [
@@ -1830,16 +1845,22 @@ Artifactory + kind at once) is heavy, so `dev init` also **enforces the podman m
 if it has fewer than **6 vCPU** or **23 GB RAM** it is **stopped, resized up to that minimum, and
 restarted** (a fresh machine is created already sized; a machine that already exceeds the minimum is
 left untouched). On macOS it also checks the tools `dev demo` needs
-later — **Java 21** (installed as the Temurin JDK cask via Homebrew) and **Maven 3.9.6** (installed
-via [SDKMAN](https://sdkman.io), bootstrapped if missing); these two are best-effort and never abort
-`init`. Pass `--skip-prereqs` to skip all these checks. Each service streams live progress and is
+later — **Java 25** (installed as the Temurin JDK cask via Homebrew) and **Maven 3.9.16** (installed
+via [SDKMAN](https://sdkman.io), bootstrapped if missing) — and **Node.js 26** (any newer version is
+accepted; installed via [nvm](https://github.com/nvm-sh/nvm) when absent, and pointed at by
+`nvm alias default` so new terminals pick it up — the already-open shell keeps its version until
+`nvm use 26`). All three are best-effort and never abort `init`. It also runs **`npm install-scripts approve fsevents`** in the app-ui webapp: npm ≥ 11.19
+blocks dependency install scripts until approved per project, and an unapproved `fsevents` silently
+degrades Vite's file watching to slow polling (the approval lands in the webapp's `package.json`
+`allowScripts`; with only an older npm on the machine there is nothing to approve and the step just
+notes it). Pass `--skip-prereqs` to skip all these checks. Each service streams live progress and is
 **idempotent** — a running pod is reused; use `--recreate` to replace it.
 
 | Service      | Pod / release | Default port | Image                                 | What `dev init` configures |
 | ------------ | ------------- | ------------ | ------------------------------------- | -------------------------- |
 | `postgresql` | `ligoj-db`    | `5432`       | `postgres:17`                         | `ligoj/ligoj` user/db (what `ligoj-api` expects), persistent volume `ligoj_db_data` |
-| `openldap`   | `openldap`    | `1389`       | `bitnamilegacy/openldap:latest`       | `Manager` / `dc=sample,dc=com`; generates the admin password if missing; volume `openldap_data` |
-| `keycloak`   | `keycloak`    | `9083`       | `quay.io/keycloak/keycloak:26.6.1`    | **backed by the shared `postgresql`** (dedicated `keycloak` database); realm `ligoj`, LDAP user federation, confidential `ligoj` client; prints Spring Boot properties |
+| `openldap`   | `openldap`    | `1389`       | `bitnamilegacy/openldap:latest`       | `Manager` / `dc=sample,dc=com`; generates the admin password if missing; volume `openldap_data`; installs the **custom schema** (`uidFonctionnel` attribute + `mefiPersonne` auxiliary class, backing the demo node's `people-custom-attributes` / `people-class-create`) — written to the mounted schema dir for a first boot **and** loaded over `ldapi:///` into an already-initialized volume; then seeds the base DIT (OUs + sample users). Waits for bitnami's *final* slapd (its first-boot init runs a temporary one) |
+| `keycloak`   | `keycloak`    | `9083`       | `quay.io/keycloak/keycloak:26.7.3`    | **backed by the shared `postgresql`** (dedicated `keycloak` database); realm `ligoj`, LDAP user federation, confidential `ligoj` client; prints Spring Boot properties |
 | `jenkins`    | `jenkins`     | `8085`       | `jenkins/jenkins:2.570-slim-jdk25`    | volume `jenkins_home`; provisions the admin user and generates an API token |
 | `sonarqube`  | `sonarqube`   | `9000`       | `sonarqube:26.6.0.123539-community`   | **backed by the shared `postgresql`** (dedicated `sonarqube` database); changes the default admin password and creates an API token |
 | `gitlab`     | `gitlab`      | `8929` (+ssh `2289`) | `gitlab/gitlab-ce:latest`     | omnibus CE (single container), trimmed footprint; root password in `[dev]` |
@@ -1863,7 +1884,7 @@ are **read** before a secret is generated, so you stay in control:
 | Service      | Inputs (option · env · `[dev]` key)                                                                 |
 | ------------ | -------------------------------------------------------------------------------------------------- |
 | `postgresql` | `DB_IMAGE`·`db_image`, `DB_PORT`·`db_port`, `POSTGRES_USER`·`db_user`, `POSTGRES_PASSWORD`·`db_password`, `POSTGRES_DB`·`db_name` |
-| `openldap`   | `LDAP_IMAGE`·`ldap_image`, `LDAP_PORT`·`ldap_port`, `LDAP_ADMIN_USERNAME`·`ldap_admin_user`, `LDAP_ROOT`·`ldap_root`, `LDAP_ADMIN_PASSWORD`·`ldap_admin_password`, `LDAP_SCHEMA_DIR`·`ldap_schema_dir` |
+| `openldap`   | `LDAP_IMAGE`·`ldap_image`, `LDAP_PORT`·`ldap_port`, `LDAP_ADMIN_USERNAME`·`ldap_admin_user`, `LDAP_ROOT`·`ldap_root`, `LDAP_ADMIN_PASSWORD`·`ldap_admin_password`, `LDAP_SCHEMA_DIR`·`ldap_schema_dir`; demo people: `DEMO_LDAP_USERS`·`demo_ldap_users` (default `10000`, `0` disables), `DEMO_MAIL_DOMAIN`·`demo_mail_domain` (default: the LDAP root's `dc=` parts, e.g. `sample.com`) |
 | `keycloak`   | `KEYCLOAK_IMAGE`·`keycloak_image`, `KEYCLOAK_PORT`·`keycloak_port`, `KC_BOOTSTRAP_ADMIN_USERNAME`·`keycloak_admin_user`, `KC_BOOTSTRAP_ADMIN_PASSWORD`·`keycloak_admin_password`, `KEYCLOAK_LDAP_URL`·`keycloak_ldap_url`, `KEYCLOAK_DB_PASSWORD`·`keycloak_db_password` (shared-DB role) |
 | `jenkins`    | `JENKINS_IMAGE`·`jenkins_image`, `JENKINS_PORT`·`jenkins_port`, `JENKINS_API_USER`·`jenkins_api_user`, `JENKINS_ADMIN_PASSWORD`·`jenkins_admin_password`, `JENKINS_API_TOKEN`·`jenkins_api_token` |
 | `sonarqube`  | `SONAR_IMAGE`·`sonar_image`, `SONAR_PORT`·`sonar_port`, `SONAR_ADMIN_PASSWORD`·`sonar_admin_password`, `SONAR_DB_PASSWORD`·`sonar_db_password` (shared-DB role) |
@@ -2061,6 +2082,14 @@ ligoj dev demo --list     # just list installed plugins (id, name, version) and
 ligoj dev demo --only plugin-id-ldap plugin-build-jenkins
 ```
 
+**Idempotent by design.** Every demo step checks before it creates: projects (`project_get` first),
+subscriptions (an existing subscription of the node on the project with the same parameters is
+reused, never duplicated), nodes (upsert), tool resources (Jenkins job, GitLab/Harbor project,
+Nexus/Artifactory repository, Sonar user/project — "already exists" is treated as success), and
+the LDAP people/groups (fixed seeds + `ldapadd -c`). Running `dev demo` twice in a row leaves the
+same data in place.
+
+
 It (1) checks Ligoj is up via `/manage/health`, (2) lists the installed plugins with
 [`plugin list`](#plugin), (3) runs the demo registered for each one, then (4) creates the demo
 projects and their [link subscriptions](#demo-projects-and-link-subscriptions). Connection values
@@ -2071,12 +2100,12 @@ Each plugin's demo lives in its own module under `ligojcli/dev_demo/`:
 
 | Plugin artifact               | What the demo does                                                                      |
 | ----------------------------- | --------------------------------------------------------------------------------------- |
-| `plugin-id-ldap`              | Upserts the `service:id:ldap:local` node (from [docs/nodes/ldap.local.json](docs/nodes/ldap.local.json), with the live URL / bind DN / password), makes it the primary IAM, restarts the context, then creates the reference OUs, company/group container scopes and technical groups |
+| `plugin-id-ldap`              | Upserts the `service:id:ldap:local` node (from [ligojcli/data/nodes/ldap.local.json](ligojcli/data/nodes/ldap.local.json), with the live URL / bind DN / password), makes it the primary IAM (and sets the identity display options `service:id:visual-id-name=customAttributes.uidFonctionnel`, `service:id:visual-id-label=Matricule`, `service:id:user-display=${firstName} ${lastName}`), sets the people display configurations — `service:id:user-display` = `${firstName} ${lastName}`, `service:id:visual-id-name` = `customAttributes.<first custom attribute>` (`uidFonctionnel`, shown as the user's identifier instead of the uid) and `service:id:visual-id-label` = `Matricule` — restarts the context, creates the reference OUs, company/group container scopes and technical groups, then **seeds 10 000 demo people** straight into LDAP (`ldapadd` inside the pod, ~35 s; a re-run is idempotent): unique random first/last names from an international pool (accented names are base64-encoded in the LDIF), mail `first.last@<domain>`, a unique **9-character uppercase alphanumeric `uid`**, password `ligoj-user`, spread over `ou=department1…5` under `people-internal-dn` (created when missing, discovered as companies). When the node declares **`people-custom-attributes`**, every user also gets each such attribute set to its mail, with the **`people-class-create`** objectClass that allows it (`uidFonctionnel` / `mefiPersonne` by default). Then **100 demo groups** (`<domain>-<team>`, e.g. `billing-core`, under the Project scope `ou=project,ou=groups`) with **50 % of the people in no group, 40 % in one, 10 % in two** (never an empty group). Both the people and the memberships come from **fixed seeds**, so a re-run regenerates the *same* entries and `ldapadd -c` reports them as already present — never 10K new users. The `id-ldap-data` cache is invalidated afterwards so they show up immediately. Count/domain: `demo_ldap_users`, `demo_mail_domain` |
 | `plugin-build-jenkins`        | Upserts the `service:build:jenkins:local` node (url / user / api-token)                  |
 | `plugin-scm-gitlab`           | Upserts the `service:scm:gitlab:local` node (url / user / auth-key)                      |
 | `plugin-registry-harbor`      | Upserts the `service:registry:harbor:local` node (url / user / password)                |
-| `plugin-registry-nexus`       | Upserts the `service:registry:nexus:local` node (from [docs/nodes/nexus.local.json](docs/nodes/nexus.local.json), with the live url / user / password) |
-| `plugin-registry-artifactory` | Upserts the `service:registry:artifactory:local` node (from [docs/nodes/artifactory.local.json](docs/nodes/artifactory.local.json), with the live url / user / password) |
+| `plugin-registry-nexus`       | Upserts the `service:registry:nexus:local` node (from [ligojcli/data/nodes/nexus.local.json](ligojcli/data/nodes/nexus.local.json), with the live url / user / password) |
+| `plugin-registry-artifactory` | Upserts the `service:registry:artifactory:local` node (from [ligojcli/data/nodes/artifactory.local.json](ligojcli/data/nodes/artifactory.local.json), with the live url / user / password) |
 | `plugin-prov-aws`             | Upserts the `service:prov:aws:local` node from the `[dev]` AWS credentials — `aws_access_key_id`, `aws_secret_access_key`, `aws_account_id` (all required) |
 | `plugin-prov-azure`           | Upserts the `service:prov:azure:local` node from the `[dev]` Azure service principal — `azure_tenant_id`, `azure_subscription_id`, `azure_application_id`, `azure_client_secret` (required) and `azure_resource_group` (optional) |
 
@@ -2146,7 +2175,11 @@ linking.
 
 Finally, `dev demo` fills the tools with real data so the demo project has something to show. This
 step is **heavy** (image pulls, two Maven builds, a Sonar analysis and two git mirrors — several
-minutes) and runs on a full `dev demo` (it is skipped when you pass `--only`). The tools are seeded
+minutes) and runs on a full `dev demo` (it is skipped when you pass `--only`). **Only the tools
+of the plugins actually installed in Ligoj are seeded** — a tool whose plugin is absent (say GitLab
+without `plugin-scm-gitlab`) is never contacted, and the run prints which seeders it skipped and
+why. The Maven step narrows the same way: it deploys to Nexus and/or Artifactory and runs the Sonar
+analysis only for the ones whose plugin is installed. The tools are seeded
 in parallel, best-effort — a failing tool logs a warning and never aborts the rest:
 
 | Tool | Data seeded |
@@ -2194,6 +2227,8 @@ stack you actually debug: IntelliJ IDEA plus the two Ligoj Spring Boot apps and
 
 | Component       | Started by `dev debug`                                  | Endpoint / path |
 | --------------- | ------------------------------------------------------- | --------------- |
+| PostgreSQL      | the `ligoj-db` pod (`podman pod start`, machine too)    | `localhost:5432` |
+| OpenLDAP        | the `openldap` pod (`podman pod start`)                 | `localhost:1389` |
 | IntelliJ IDEA   | `open -a "IntelliJ IDEA" <project>` (if stopped)        | `~/git/ligoj` |
 | `ligoj-api`     | the **dedicated launcher app**, in Debug mode           | `http://localhost:8081/ligoj-api` |
 | `ligoj-ui`      | the **dedicated launcher app**, in Debug mode           | `http://localhost:8080/ligoj` |
@@ -2201,19 +2236,56 @@ stack you actually debug: IntelliJ IDEA plus the two Ligoj Spring Boot apps and
 
 ```bash
 ligoj dev debug init       # compile the dedicated launcher app (one-time; re-run after renaming a config)
-ligoj dev debug start      # open IntelliJ + Debug-launch the API/UI + start Vite (only those stopped)
+ligoj dev debug start      # start the ligoj-db + openldap pods + IntelliJ + API/UI/Vite, then open the app in the browser
+ligoj dev debug start --no-browser   # same without opening the browser
 ligoj dev debug status     # show what is running (process) and reachable (port), no changes
-ligoj dev debug stop       # stop the API/UI/Vite apps (IntelliJ stays open to protect unsaved work)
-ligoj dev debug restart    # stop then start the apps
+ligoj dev debug stop       # stop the API/UI/Vite apps AND the two pods (IntelliJ stays open)
+ligoj dev debug restart    # stop then start the apps (the pods are left running)
 ligoj dev debug start -w 60 # same live '--wait' as the other dev commands (0 = no wait)
+ligoj dev debug start vite   # start ONLY the Vite dev server (nothing else is touched)
+ligoj dev debug stop vite    # stop ONLY Vite; 'restart vite' bounces it (pods, IDE, Java apps untouched)
 ```
 
+`start vite` needs the webapp dependencies installed (`npm install` in `app-ui/src/main/webapp`):
+without them the command says so at once instead of waiting for a port that never opens, and a
+Vite process that exits right after launch is reported with the tail of its log
+(`~/.ligoj/dev/debug/vite.log`). Only Vite can be driven alone: the Java apps are started together
+by the launcher app, which starts every run configuration that is not running.
+
+**Browser.** Once the wait completes, `start` opens the application in your browser — the **Vite**
+dev server (`http://localhost:5173/ligoj/`, live reload) when it answers, else the UI server
+(`http://localhost:8080/ligoj`); nothing is opened when neither is up yet or with `--no-browser`
+/ `--wait 0`.
+
+**Backing services first.** `start` brings the **dev PostgreSQL** (`ligoj-db` pod) and **OpenLDAP**
+(`openldap` pod) up before anything else — `ligoj-api` cannot boot without the DB, and the LDAP
+identity backend should be there too — starting the podman machine when it is down. A service already
+answering on its port is a no-op; a pod that was **never created** only warns (run
+`ligoj dev init --only <service>`) so the IDE stack still launches. Symmetrically, **`dev debug stop`
+also stops both pods** (skipped quietly when podman itself is down); `restart` only bounces the apps
+and leaves the pods running.
+
 **Why `init` / the launcher app.** IntelliJ has no headless "run this configuration" command, and
 scripting its UI needs the broad macOS **Accessibility** permission (control any app + read the
 screen). Instead of granting that to your whole terminal, `dev debug init` compiles a tiny dedicated
 app (default `~/Applications/Ligoj Debug.app`) that drives IntelliJ's *Run ▶ Debug…* chooser for
 `ligoj-api` / `ligoj-ui` (skipping any already running). You grant Accessibility to **that app only**
 — the first `dev debug start` triggers the macOS prompt — and can then revoke your terminal's grant.
+
+**Granting (and re-granting) Accessibility.** The grant is keyed on the app's signature, so every
+re-`init` (and some macOS updates) invalidates it — and a broken grant fails *silently*: `Ligoj
+Debug` launches and stays open, IntelliJ comes to the front, but the run configurations never start
+(`dev debug start` now names this cause when it happens). The reliable order, also printed by
+`dev debug init`:
+
+1. In **System Settings ▸ Privacy & Security ▸ Accessibility**, **remove** any existing
+   `Ligoj Debug` / `applet` row (`−`) — toggling a **stale** row does nothing;
+2. launch the app once (`open ~/Applications/Ligoj\ Debug.app` or `dev debug start`) and approve the
+   *"control this computer"* prompt — beware, it can sit **hidden behind windows or on another
+   display/Space**, unanswered, looking like nothing happened;
+3. the row reappears ticked. To force a clean re-prompt: `tccutil reset Accessibility
+   org.ligoj.dev.debug`, then redo 1–2.
+
 When `dev debug start` launches a **cold** IntelliJ, the launcher first **waits (up to 180 s) for the
 IDE to become UI-ready** — its *Run* menu populated, i.e. the project frame is up — before sending any
 keystroke, so a not-yet-started IDE no longer drops the Debug commands. Because that logic is baked
@@ -2275,19 +2347,32 @@ build` runs that build for every **live** plugin — the ones installed in the r
 # Rebuild the frontend of every live plugin (in parallel)
 ligoj dev plugin build
 
-# Build only specific plugins (skips the live lookup, so Ligoj need not be running)
+# Build EVERY locally checked-out plugin that has a ui/ (no Ligoj instance needed)
+ligoj dev plugin build --all
+
+# Build only specific plugins (also skips the live lookup)
 ligoj dev plugin build --only plugin-ui plugin-id
 
 # Limit parallelism
 ligoj dev plugin build --jobs 2
 ```
 
+Two flags select what to build, and both work **offline**, straight from the working copies — like
+`dev plugin renovate --all`, they never query the Ligoj API:
+
+- **`--all` / `-A`** — every directory under the plugins dir that has a `ui/package.json`. Because it
+  reads the checkouts rather than the running instance, it also covers plugins that are not (or not
+  yet) installed in Ligoj.
+- **`--only` / `-O`** — an explicit artifact list.
+
+They are mutually exclusive. With **neither**, the set comes from the running Ligoj (`system/plugin`),
+so the instance must be reachable — the error names both escapes if it isn't.
+
 Dependencies are installed automatically on first build (`npm ci` when a `package-lock.json` is
 present, otherwise `npm install`) before `npm run build`. Builds run in parallel (default
 `min(4, CPUs)`, `--jobs` to change) and each plugin is reported `OK` / `FAILED` independently — one
 failing frontend never aborts the others. The plugins directory is `LIGOJ_PLUGINS_DIR` /
-`[dev] ligoj_plugins_dir` (default `~/git/ligoj-plugins`), and `npm` must be on the `PATH`. Without
-`--only`, Ligoj must be reachable so the live plugin set can be listed.
+`[dev] ligoj_plugins_dir` (default `~/git/ligoj-plugins`), and `npm` must be on the `PATH`.
 
 ## Renovate a plugin's dependencies (`dev plugin renovate`)
 
@@ -2299,9 +2384,15 @@ in the working tree for you to review:
   latest local `org.ligoj.api:parent` release; override with `--parent-version`). A current version
   newer than the target is left alone; the project's own `<version>` is never touched.
 - **`package.json`** — re-pins only the npm dependency constraints that are **also** declared by the
-  host UI to the host's versions (none added/removed; `scripts` and non-shared deps untouched).
-- **`package-lock.json`** — regenerated from `package.json` (`npm install --package-lock-only`) so the
-  plugin's `npm ci` stays in sync.
+  host UI to the host's versions (none added/removed; `scripts` and non-shared deps untouched), and
+  **merges the host's `allowScripts` entries in** (the npm ≥ 11.19 install-script approvals, e.g.
+  `fsevents` — plugin-specific approvals are kept, host entries win on conflict).
+- **`package-lock.json`** — regenerated **and advanced** via `npm update --package-lock-only`: every
+  dependency (direct and transitive) moves to the newest version its semver range allows, while the
+  lockfile stays in sync with `package.json` for `npm ci` (constraints themselves are not touched).
+  `updated` is reported only when something **effectively** moved
+  (`package.json` text or lockfile bytes) — re-running moments later shows every plugin as
+  up-to-date and ends with `N analyzed, 0 updated, N up-to-date, 0 error(s)`.
 
 ```bash
 # Renovate the plugin in the current directory
@@ -2310,16 +2401,97 @@ ligoj dev plugin renovate
 # A specific plugin (artifact under LIGOJ_PLUGINS_DIR, or a path)
 ligoj dev plugin renovate plugin-km
 
-# Every plugin under LIGOJ_PLUGINS_DIR
+# Every plugin under LIGOJ_PLUGINS_DIR, 3 at a time (live one-line-per-plugin report)
 ligoj dev plugin renovate --all
+
+# More parallelism
+ligoj dev plugin renovate --all --jobs 6
 ```
 
+With more than one plugin the work runs in **parallel** (`--jobs` workers, default **3**) and every
+plugin gets **exactly one output line**. While in flight a plugin shows in a small live footer (at
+most `--jobs` rows, `… renovating (n/total done)`, rewritten in place); on completion that row is
+replaced by the plugin's permanent result line — colored, with emoji on a color terminal (`⏳`/`✅`/`💤`/`❌`; plain `…`/`✓`/`↷`/`✗` with `--no-color`) — `✓` changed with a short summary
+(`parent 4.3.0→4.3.2 · 2 dep(s) · allowScripts+2 · lockfile`), `↷` up-to-date, or `✗` error (failing
+plugins get their npm output printed after the run, and their `package.json` edit is reverted).
+Keeping the live region no taller than the worker count is what makes the rendering reliable on any
+terminal height — a full one-row-per-plugin block would scroll and duplicate. Piped output prints one
+final line per plugin instead. A **single** plugin keeps the verbose report with each dependency
+re-pin on its own line.
+
 The host UI referential is `LIGOJ_HOST_PACKAGE_JSON` (default
 `~/git/ligoj/app-ui/src/main/webapp/package.json`, override with `--host-package-json`), the plugins
 root is `LIGOJ_PLUGINS_DIR` / `--plugins-dir` (default `~/git/ligoj-plugins`), and `npm` must be on the
 `PATH`. A plugin must be an `org.ligoj.api:plugin-parent` project — anything else is skipped (with
 `--all`) or reported as an error (when named).
 
+## Deploy a plugin to a Ligoj instance (`dev plugin deploy`)
+
+`dev plugin deploy <plugin> [<plugin> ...]` builds one or more plugins and installs them on a
+running Ligoj — the fast inner loop for plugin development against a real instance:
+
+1. **build** — `mvn clean package` (tests skipped) in each plugin checkout, **all builds before any
+   upload**, so a failed build aborts the deploy before the instance receives anything. The jar is
+   **code-signed** when `~/.ligoj/code-signing.p12` exists and its password is available
+   (`LIGOJ_SIGN_STOREPASS`, else the macOS keychain entry `ligoj.release.sign-storepass`); otherwise
+   it is built unsigned, with a warning (`--skip-build` reuses the jars already in `target/`);
+2. **upload** — every jar, exactly what `ligoj plugin upload --from <jar> --force` does, so a
+   same-version (`-SNAPSHOT`) redeploy replaces the installed jar;
+3. **restart + wait** — the Ligoj context is restarted **once for the whole set** and the command
+   waits until the restart has actually **completed**: the API is observed going *down* and then
+   *up* again (a restart is asynchronous — an immediate "UP" would be the old context), and every
+   plugin is confirmed in the installed list with its version. `--wait N` bounds the wait;
+   `--wait 0` returns right after the restart request.
+
+The three steps are announced as they start. The builds run in parallel (`--jobs`, default 3) with
+**one live line per plugin** (same rendering as `dev plugin renovate`: ⏳ building, then ✅ built
+with its duration and jar size, or ❌ the Maven error — whose log tail is printed after the
+report). The uploads are numbered. A **summary** then lists every plugin with its installed
+version, followed by the totals: build, upload and restart durations, installed count and errors.
+A plugin missing from the installed list after the restart makes the command fail.
+
+Before building, the target is probed with an authenticated `GET session` (available to every
+user), falling over to `GET system/plugin` — the call the deploy relies on anyway — when the session
+view answers an error. Neither is the `/manage/health` actuator, which a hosted front such as a SaaS
+behind a CDN does not expose. The command stops with a one-line error, and no build, when the
+instance is unreachable, answers an error to both probes, **or rejects the profile's credentials**
+(401/403) — the latter names the `api_user`/`api_key` entries to check.
+
+The **target instance comes from the active profile** — endpoint and credentials — which is the `dev`
+profile by default (like every `dev` command) and any other via the global option:
+
+```bash
+ligoj dev plugin deploy plugin-km                       # build + deploy to the dev profile's Ligoj
+ligoj dev plugin deploy plugin-km plugin-km-confluence  # several plugins, ONE restart for all of them
+ligoj --profile staging dev plugin deploy plugin-km     # ... to the 'staging' profile's instance
+ligoj dev plugin deploy ~/git/my-plugin --skip-build    # a path, reusing the existing target/ jar
+```
+
+`<plugin>` is an artifact under `LIGOJ_PLUGINS_DIR` (`~/git/ligoj-plugins`, `--plugins-dir` to change)
+or a path to the checkout.
+
+## Pull the plugin checkouts (`dev plugin pull`)
+
+`dev plugin pull` runs `git pull --ff-only` in every plugin checkout under the plugins dir (every
+sub-directory holding a `.git`), or only in the plugins named on the command line, three at a time
+by default:
+
+```bash
+ligoj dev plugin pull                        # every git checkout under ~/git/ligoj-plugins
+ligoj dev plugin pull plugin-km plugin-bt    # only these (artifact names, or paths)
+ligoj dev plugin pull --jobs 6               # more parallel pulls
+```
+
+Each plugin gets **one report line**, live while it runs (same rendering as `dev plugin renovate`):
+✅ *updated* with the branch and the number of new commits, 💤 *up-to-date* or *skipped*, or ❌ the
+git error. Pulls are **fast-forward only**: local commits are never merged over or rewritten — a
+diverged branch is reported as an error and left untouched for you to resolve, while a detached
+HEAD or a branch without upstream is skipped (nothing to pull, not an error). Submodule checkouts
+(a `.git` *file*) are pulled like plain clones. Credential prompts are disabled, so a repository
+needing an interactive login fails instead of hanging. The exit status is non-zero when any pull
+failed. The plugins dir comes from `--plugins-dir`, else `LIGOJ_PLUGINS_DIR` / the profile's
+`ligoj_plugins_dir`, else `~/git/ligoj-plugins`.
+
 ## Build the app container images (`dev package`)
 
 `dev package` builds the two Ligoj application container images **locally**, straight from the
@@ -2361,12 +2533,13 @@ the release helper (`commands/release.sh`).
 While `dev debug` runs the apps from your IDE, `dev test` runs the **released Docker images**
 (`ligoj/ligoj-api` + `ligoj/ligoj-ui`) against the local dev stack — the quickest way to smoke-test a
 published build. It starts both containers in the background, waits until **both are healthy**, then
-opens the UI in your browser at `http://localhost:<ui-port>/ligoj/`:
+opens the UI in your browser at `http://localhost:<ui-port><context>/` (default context `/ligoj`):
 
 ```bash
 ligoj dev test start                       # run both, wait for health, open the browser
 ligoj dev test stop                        # stop and remove both containers
 ligoj dev test start --tag 4.0.2-SNAPSHOT-101 --port 8089 --api-port 8088
+ligoj dev test start --context /ligoj2     # serve the UI under /ligoj2 (CONTEXT_URL; '/' = root)
 ligoj dev test start --no-browser --no-wait          # start detached, don't wait or open the browser
 ligoj dev test -h                          # full option + '-D' reference (mirrors ligoj/DOC.md)
 
@@ -2390,7 +2563,7 @@ add the driver to your build. Pass an explicit `--api …` group to take full co
 **Networking** adapts to the runtime: **docker/Linux** uses `--network=host` (the API reaches the dev DB
 on `localhost`); **podman-machine** publishes ports (`-p <port>:<port>`) so the mac can reach
 `localhost:<port>`, and the containers reach the machine host — the other container and the dev DB — via
-`host.containers.internal`. Override with `--net host|publish`.
+`host.containers.internal`; in publish mode both apps are also told to bind on all interfaces (`SERVER_HOST=0.0.0.0` — the images default to loopback, unreachable through a port mapping). Override with `--net host|publish`.
 
 Every option resolves from the CLI flag, then the environment, then `~/.ligoj/config` / `~/.ligoj/credentials`:
 
@@ -2398,6 +2571,7 @@ Every option resolves from the CLI flag, then the environment, then `~/.ligoj/co
 | ------ | ------- | ----------------- |
 | `--port` (UI port, also the browser port) | `8089` | `LIGOJ_UI_PORT` / `ligoj_ui_port` |
 | `--api-port` (UI `ENDPOINT` + API exposed port) | `8088` | `LIGOJ_API_PORT` / `ligoj_api_port` |
+| `--context` (UI context path, the image's `CONTEXT_URL`) | `/ligoj` | `LIGOJ_UI_CONTEXT` / `ligoj_ui_context` |
 | `--home` (`LIGOJ_HOME`) | `~/.ligoj` | `LIGOJ_HOME` / `ligoj_home` |
 | `--tag` / `--api-tag` / `--ui-tag` | newest **local** build, else latest published | `LIGOJ_TEST_TAG` / `ligoj_test_tag` |
 | `--runtime` | `docker` if present, else `podman` | `LIGOJ_TEST_RUNTIME` / `ligoj_test_runtime` |