redeploy 0.2.20__tar.gz → 0.2.22__tar.gz

{redeploy-0.2.20 → redeploy-0.2.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: redeploy
-Version: 0.2.20
+Version: 0.2.22
 Summary: Infrastructure migration toolkit: detect → plan → apply
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -27,17 +27,17 @@ Requires-Dist: pfix>=0.1.60; extra == "dev"
 
 ## AI Cost Tracking
 
-![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.20-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
-![AI Cost](https://img.shields.io/badge/AI%20Cost-$5.85-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-13.4h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
+![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.22-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![AI Cost](https://img.shields.io/badge/AI%20Cost-$6.15-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-13.6h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
 
-- 🤖 **LLM usage:** $5.8500 (39 commits)
-- 👤 **Human dev:** ~$1337 (13.4h @ $100/h, 30min dedup)
+- 🤖 **LLM usage:** $6.1500 (41 commits)
+- 👤 **Human dev:** ~$1363 (13.6h @ $100/h, 30min dedup)
 
 Generated on 2026-04-21 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
 
 ---
 
-![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.20-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.22-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
 
 Infrastructure migration and device deploy toolkit — VPS, Raspberry Pi kiosk, Podman Quadlet, k3s.
 

{redeploy-0.2.20 → redeploy-0.2.22}/README.md

@@ -3,17 +3,17 @@
 
 ## AI Cost Tracking
 
-![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.20-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
-![AI Cost](https://img.shields.io/badge/AI%20Cost-$5.85-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-13.4h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
+![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.22-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![AI Cost](https://img.shields.io/badge/AI%20Cost-$6.15-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-13.6h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
 
-- 🤖 **LLM usage:** $5.8500 (39 commits)
-- 👤 **Human dev:** ~$1337 (13.4h @ $100/h, 30min dedup)
+- 🤖 **LLM usage:** $6.1500 (41 commits)
+- 👤 **Human dev:** ~$1363 (13.6h @ $100/h, 30min dedup)
 
 Generated on 2026-04-21 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
 
 ---
 
-![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.20-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.22-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
 
 Infrastructure migration and device deploy toolkit — VPS, Raspberry Pi kiosk, Podman Quadlet, k3s.
 

{redeploy-0.2.20 → redeploy-0.2.22}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "redeploy"
-version = "0.2.20"
+version = "0.2.22"
 description = "Infrastructure migration toolkit: detect → plan → apply"
 readme = "README.md"
 requires-python = ">=3.11"

{redeploy-0.2.20 → redeploy-0.2.22}/redeploy/__init__.py

@@ -7,7 +7,7 @@ Public API (stable from 0.2.0, semver guaranteed)::
 
 Everything not listed in ``__all__`` is internal and may change without notice.
 """
-__version__ = "0.2.20"
+__version__ = "0.2.22"
 
 # ── Core models ───────────────────────────────────────────────────────────────
 from .models import (  # noqa: F401

redeploy-0.2.22/redeploy/cli/__init__.py

@@ -0,0 +1,107 @@
+"""redeploy CLI — detect | plan | apply | migrate."""
+from __future__ import annotations
+
+import sys
+
+import click
+from loguru import logger
+
+from .. import __version__
+
+
+def _setup_logging(verbose: bool) -> None:
+    logger.remove()
+    level = "DEBUG" if verbose else "INFO"
+    logger.add(
+        sys.stderr,
+        level=level,
+        format="<green>{time:HH:mm:ss}</green> | <level>{level:<7}</level> | {message}",
+    )
+
+
+@click.group()
+@click.version_option(__version__)
+@click.option("-v", "--verbose", is_flag=True)
+@click.pass_context
+def cli(ctx, verbose):
+    """redeploy — Infrastructure migration toolkit: detect → plan → apply"""
+    _setup_logging(verbose)
+    ctx.ensure_object(dict)
+    ctx.obj["verbose"] = verbose
+
+
+# Import all commands from submodules (not from package level)
+from .commands.audit import audit
+from .commands.detect import detect
+from .commands.devices import devices, scan, device_add, device_rm
+from .commands.diagnose import diagnose
+from .commands.diff import diff
+from .commands.export import export_cmd
+from .commands.import_ import import_cmd
+from .commands.inspect import inspect
+from .commands.patterns import patterns
+from .commands.plugin import plugin_cmd
+from .commands.probe import probe
+from .commands.target import target
+from .commands.version import version_cmd
+from .commands.workflow import workflow_cmd
+from .commands.exec_ import exec_cmd, exec_multi_cmd
+from .commands.plan_apply import plan, apply, migrate, run
+from .commands.state import state_cmd
+from .commands.init import init
+from .commands.status import status
+
+# Register commands
+cli.add_command(audit)
+cli.add_command(detect)
+cli.add_command(devices)
+cli.add_command(scan)
+cli.add_command(device_add)
+cli.add_command(device_rm)
+cli.add_command(diagnose)
+cli.add_command(diff)
+cli.add_command(exec_cmd)
+cli.add_command(exec_multi_cmd)
+cli.add_command(export_cmd)
+cli.add_command(import_cmd)
+cli.add_command(init)
+cli.add_command(inspect)
+cli.add_command(patterns)
+cli.add_command(plan)
+cli.add_command(apply)
+cli.add_command(migrate)
+cli.add_command(run)
+cli.add_command(plugin_cmd)
+cli.add_command(probe)
+cli.add_command(state_cmd)
+cli.add_command(status)
+cli.add_command(target)
+cli.add_command(version_cmd)
+cli.add_command(workflow_cmd)
+
+
+# Backward compatibility: _resolve_device for tests
+def _resolve_device(console, device_id: str) -> tuple:
+    """Resolve device from registry or auto-probe. Returns (device, registry) or (None, None)."""
+    from ..discovery import auto_probe
+    from ..models import DeviceRegistry
+
+    reg = DeviceRegistry.load()
+    dev = reg.get(device_id)
+
+    if not dev:
+        console.print(f"[yellow]⚠ {device_id} not in registry — probing…[/yellow]")
+        r = auto_probe(device_id, timeout=8, save=True)
+        if r.reachable:
+            reg = DeviceRegistry.load()
+            dev = reg.get(r.host) or reg.get(r.ip)
+            key_name = __import__('os').path.basename(r.ssh_key) if r.ssh_key else 'agent'
+            console.print(f"  [green]✓[/green] auto-probe OK: {r.host}  strategy={r.strategy}  key={key_name}")
+        else:
+            console.print(f"  [red]✗ probe failed: {r.error}[/red]")
+            console.print("[dim]  Add manually: redeploy device-add HOST --strategy STRATEGY[/dim]")
+
+    return dev, reg
+
+
+__all__ = ["cli", "_resolve_device"]

redeploy-0.2.22/redeploy/cli/commands/__init__.py

@@ -0,0 +1,44 @@
+"""CLI commands package."""
+# Commands are registered in cli/__init__.py
+
+from . import audit
+from . import detect
+from . import devices
+from . import diagnose
+from . import diff
+from . import exec_
+from . import export
+from . import import_
+from . import init
+from . import inspect
+from . import patterns
+from . import plan_apply
+from . import plugin
+from . import probe
+from . import state
+from . import status
+from . import target
+from . import version
+from . import workflow
+
+__all__ = [
+    "audit",
+    "detect",
+    "devices",
+    "diagnose",
+    "diff",
+    "exec_",
+    "export",
+    "import_",
+    "init",
+    "inspect",
+    "patterns",
+    "plan_apply",
+    "plugin",
+    "probe",
+    "state",
+    "status",
+    "target",
+    "version",
+    "workflow",
+]

redeploy-0.2.22/redeploy/cli/commands/audit.py

@@ -0,0 +1,126 @@
+"""audit command — Show deploy audit log."""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import click
+from rich.console import Console
+from rich.table import Table
+
+
+@click.command()
+@click.option(
+    "-n", "--last", default=20, show_default=True,
+    help="Number of most-recent entries to show"
+)
+@click.option("--host", default=None, help="Filter by host (substring match)")
+@click.option("--app", default=None, help="Filter by app name")
+@click.option("--failed", "only_failed", is_flag=True, help="Show only failed deployments")
+@click.option("--ok", "only_ok", is_flag=True, help="Show only successful deployments")
+@click.option("--log", default=None, type=click.Path(), help="Custom audit log path")
+@click.option("--json", "as_json", is_flag=True, help="Output raw JSONL")
+@click.option(
+    "--report", "show_report", default=None,
+    help="Show full DeployReport for entry N (1-based)"
+)
+@click.option("--clear", "do_clear", is_flag=True, help="Truncate audit log (irreversible)")
+def audit(last, host, app, only_failed, only_ok, log, as_json, show_report, do_clear):
+    """Show deploy audit log from ~/.config/redeploy/audit.jsonl.
+
+    \b
+    Examples:
+        redeploy audit
+        redeploy audit --last 50 --failed
+        redeploy audit --app myapp --host prod
+        redeploy audit --report 1
+        redeploy audit --clear
+    """
+    import json as _json
+    from ...observe import DeployAuditLog, DeployReport
+
+    console = Console()
+    log_path = Path(log) if log else None
+    audit_log = DeployAuditLog(path=log_path)
+
+    if do_clear:
+        if not audit_log.path.exists():
+            console.print("[dim]Audit log is already empty.[/dim]")
+            return
+        click.confirm(f"Truncate {audit_log.path}?", abort=True)
+        audit_log.clear()
+        console.print(f"[green]✓[/green] Audit log cleared: {audit_log.path}")
+        return
+
+    ok_filter = None
+    if only_failed:
+        ok_filter = False
+    elif only_ok:
+        ok_filter = True
+
+    entries = audit_log.filter(host=host, app=app, ok=ok_filter)
+    entries = entries[-last:]
+
+    if not entries:
+        console.print("[dim]No audit entries found.[/dim]")
+        console.print(f"  Log: {audit_log.path}")
+        return
+
+    if show_report:
+        try:
+            idx = int(show_report) - 1
+            entry = entries[idx]
+        except (ValueError, IndexError):
+            console.print(
+                f"[red]Entry {show_report} not found (1–{len(entries)} available)[/red]"
+            )
+            sys.exit(1)
+        console.print(DeployReport(entry).text())
+        return
+
+    if as_json:
+        for e in entries:
+            print(_json.dumps(e.to_dict(), ensure_ascii=False))
+        return
+
+    t = Table(show_header=True, box=None, padding=(0, 2))
+    t.add_column("#", style="dim", width=3)
+    t.add_column("Time", style="dim")
+    t.add_column("Host")
+    t.add_column("App", style="bold")
+    t.add_column("Strategy", style="cyan")
+    t.add_column("Result")
+    t.add_column("Steps", style="dim")
+    t.add_column("Elapsed", style="dim")
+
+    for i, e in enumerate(entries, 1):
+        ts = e.ts[11:16] if len(e.ts) >= 16 else e.ts
+        date = e.ts[:10] if len(e.ts) >= 10 else ""
+        strategy = f"{e.from_strategy}→{e.to_strategy}"
+        if e.ok:
+            result = "[green]ok[/green]"
+        else:
+            result = "[red]FAIL[/red]"
+        if e.dry_run:
+            result += " [dim](dry)[/dim]"
+        steps_str = f"{e.steps_ok}/{e.steps_total}"
+        if e.steps_failed:
+            steps_str += f" [red]✗{e.steps_failed}[/red]"
+        elapsed = f"{e.elapsed_s:.1f}s"
+        t.add_row(
+            str(i),
+            f"{date} {ts}",
+            e.host,
+            e.app,
+            strategy,
+            result,
+            steps_str,
+            elapsed,
+        )
+
+    console.print(t)
+    console.print(
+        f"\n  [dim]{len(entries)} entr{'y' if len(entries) == 1 else 'ies'}"
+        f"  •  {audit_log.path}[/dim]"
+    )
+    console.print("  [dim]Tip: --report N  for full step breakdown[/dim]")

redeploy-0.2.22/redeploy/cli/commands/detect.py

@@ -0,0 +1,118 @@
+"""detect command — Probe infrastructure and produce infra.yaml."""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import click
+from rich.console import Console
+from rich.table import Table
+
+from ..core import run_detect_workflow
+from ..display import (
+    print_infrastructure_summary,
+    print_docker_services,
+    print_k3s_pods,
+    print_conflicts,
+)
+
+
+@click.command()
+@click.option("--host", default=None, help="SSH host (user@ip) or 'local'")
+@click.option(
+    "--app",
+    default=None,
+    show_default=True,
+    help="Application name (default from redeploy.yaml)",
+)
+@click.option("--domain", default=None, help="Public domain for HTTP health checks")
+@click.option(
+    "-o",
+    "--output",
+    default="infra.yaml",
+    show_default=True,
+    type=click.Path(),
+    help="Output file for InfraState",
+)
+@click.option(
+    "--workflow",
+    "run_workflow",
+    is_flag=True,
+    help="Run full multi-host workflow (detect + template scoring)",
+)
+@click.option(
+    "--scan", "scan_subnet", default=None, help="Subnet to scan for devices (used with --workflow)"
+)
+@click.option(
+    "--no-deep", is_flag=True, help="Workflow: skip deep SSH probe (faster, less accurate)"
+)
+@click.option(
+    "--save-yaml",
+    default=None,
+    type=click.Path(),
+    help="Workflow: save generated manifest to file",
+)
+@click.option(
+    "--format",
+    "output_fmt",
+    default="yaml",
+    type=click.Choice(["yaml", "css"]),
+    help="Output format for generated manifest (yaml or css)",
+)
+@click.pass_context
+def detect(
+    ctx, host, app, domain, output, run_workflow, scan_subnet, no_deep, save_yaml, output_fmt
+):
+    """Probe infrastructure and produce infra.yaml.
+
+    With --workflow: multi-host detection with template scoring.
+    Reads hosts from redeploy.yaml / redeploy.css environments + registry + --scan.
+
+    \b
+    Examples:
+        redeploy detect --host pi@192.168.188.108
+        redeploy detect --workflow
+        redeploy detect --workflow --format css --save-yaml redeploy.css
+        redeploy detect --workflow --scan 192.168.188.0/24
+        redeploy detect --workflow --no-deep
+    """
+    from ...models import ProjectManifest
+    from ...detect import Detector
+
+    console = Console()
+    manifest = ProjectManifest.find_and_load(Path.cwd())
+    app_name = app or (manifest.app if manifest else "app")
+
+    if run_workflow or scan_subnet:
+        run_detect_workflow(
+            console,
+            hosts=[host] if host else [],
+            manifest=manifest,
+            app=app_name,
+            scan_subnet=scan_subnet,
+            deep=not no_deep,
+            save_yaml=save_yaml,
+            fmt=output_fmt,
+        )
+        return
+
+    if not host:
+        console.print("[red]✗ --host required (or use --workflow)[/red]")
+        sys.exit(1)
+
+    out_path = Path(output)
+    domain = domain or (manifest.domain if manifest else None)
+
+    try:
+        d = Detector(host=host, app=app_name, domain=domain)
+        state = d.run()
+        d.save(state, out_path)
+    except ConnectionError as e:
+        console.print(f"[red]✗ {e}[/red]")
+        sys.exit(1)
+
+    print_infrastructure_summary(console, state, host)
+    print_docker_services(console, state)
+    print_k3s_pods(console, state)
+    print_conflicts(console, state)
+    console.print(f"\n[dim]Saved to {out_path}[/dim]")

redeploy-0.2.22/redeploy/cli/commands/devices.py

@@ -0,0 +1,216 @@
+"""devices, scan, device-add, device-rm commands — Device management."""
+from __future__ import annotations
+
+import sys
+from datetime import datetime
+from pathlib import Path
+
+import click
+from rich.console import Console
+from rich.table import Table
+
+
+@click.command()
+@click.option("--tag", default=None, help="Filter by tag")
+@click.option("--strategy", default=None, help="Filter by strategy")
+@click.option("--reachable", is_flag=True, help="Show only recently-seen devices")
+@click.option("--json", "as_json", is_flag=True, help="Output as JSON")
+def devices(tag, strategy, reachable, as_json):
+    """List known devices from ~/.config/redeploy/devices.yaml.
+
+    \b
+    Example:
+        redeploy devices
+        redeploy devices --tag kiosk
+        redeploy devices --reachable
+    """
+    import json as _json
+    from ...models import DeviceRegistry
+
+    console = Console()
+    reg = DeviceRegistry.load()
+    devs = reg.devices
+
+    if tag:
+        devs = [d for d in devs if tag in d.tags]
+    if strategy:
+        devs = [d for d in devs if d.strategy == strategy]
+    if reachable:
+        devs = [d for d in devs if d.is_reachable]
+
+    if as_json:
+        print(
+            _json.dumps(
+                [d.model_dump(mode="json") for d in devs],
+                indent=2,
+                default=str,
+            )
+        )
+        return
+
+    if not devs:
+        console.print("[dim]No devices found. Run:[/dim]  redeploy scan")
+        return
+
+    t = Table(show_header=True, box=None, padding=(0, 2))
+    t.add_column("ID", style="bold")
+    t.add_column("Host")
+    t.add_column("Strategy", style="cyan")
+    t.add_column("App")
+    t.add_column("Tags", style="dim")
+    t.add_column("Last seen", style="dim")
+    t.add_column("SSH", style="dim")
+
+    for d in devs:
+        seen = d.last_seen.strftime("%m-%d %H:%M") if d.last_seen else "never"
+        ssh = "[green]✓[/green]" if d.last_ssh_ok else "[red]✗[/red]"
+        t.add_row(
+            d.id,
+            d.host,
+            d.strategy,
+            d.app or "—",
+            ",".join(d.tags) or "—",
+            seen,
+            ssh,
+        )
+    console.print(t)
+    console.print(
+        f"\n  [dim]{len(devs)} device(s)  •  registry: {DeviceRegistry.default_path()}[/dim]"
+    )
+
+
+@click.command()
+@click.option(
+    "--subnet", default=None,
+    help="CIDR to scan, e.g. 192.168.1.0/24 (auto-detect if omitted)"
+)
+@click.option(
+    "--user", "ssh_users", multiple=True, default=None,
+    help="SSH user(s) to try (repeatable). Default: current user + root + pi + ubuntu"
+)
+@click.option("--port", "ssh_port", default=22, show_default=True, help="SSH port")
+@click.option("--ping", is_flag=True, help="Active ICMP ping sweep (sends packets)")
+@click.option("--no-mdns", is_flag=True, help="Disable mDNS discovery")
+@click.option(
+    "--timeout", default=5, show_default=True, help="Per-host SSH timeout (seconds)"
+)
+@click.option("--no-save", is_flag=True, help="Do not save results to registry")
+def scan(subnet, ssh_users, ssh_port, ping, no_mdns, timeout, no_save):
+    """Discover SSH-accessible devices on the local network.
+
+    Sources (passive by default, zero packets unless --ping):
+      known_hosts  — parse ~/.ssh/known_hosts
+      arp          — read ARP/neighbor cache
+      mdns         — query _ssh._tcp via avahi-browse
+      ping sweep   — ICMP /24 sweep (--ping flag required)
+
+    Results are saved to ~/.config/redeploy/devices.yaml (chmod 600).
+
+    \b
+    Example:
+        redeploy scan
+        redeploy scan --ping --subnet 192.168.1.0/24
+        redeploy scan --user pi --user ubuntu --timeout 8
+    """
+    from ...discovery import discover, update_registry
+    from ...models import DeviceRegistry
+
+    console = Console()
+    console.print("[bold]redeploy scan[/bold]  discovering devices...")
+
+    users = list(ssh_users) if ssh_users else None
+    found = discover(
+        subnet=subnet,
+        ssh_users=users,
+        ssh_port=ssh_port,
+        ping=ping,
+        mdns=not no_mdns,
+        probe_ssh=True,
+        timeout=timeout,
+    )
+
+    ssh_ok = [h for h in found if h.ssh_ok]
+    console.print(f"  found {len(found)} host(s), {len(ssh_ok)} SSH-accessible\n")
+
+    t = Table(show_header=True, box=None, padding=(0, 2))
+    t.add_column("IP")
+    t.add_column("Hostname", style="dim")
+    t.add_column("MAC", style="dim")
+    t.add_column("SSH user", style="cyan")
+    t.add_column("Source", style="dim")
+    for h in found:
+        ssh_col = f"[green]{h.ssh_user}[/green]" if h.ssh_ok else "[red]✗[/red]"
+        t.add_row(h.ip, h.hostname or "—", h.mac or "—", ssh_col, h.source)
+    console.print(t)
+
+    if not no_save and ssh_ok:
+        reg = update_registry(found, save=True)
+        console.print(
+            f"\n  [dim]registry updated → {DeviceRegistry.default_path()}[/dim]"
+        )
+        console.print(f"  [dim]{len(reg.devices)} device(s) total[/dim]")
+    elif not ssh_ok:
+        console.print("\n  [dim]No SSH-accessible devices — nothing saved.[/dim]")
+
+
+@click.command("device-add")
+@click.argument("host")
+@click.option("--id", "device_id", default=None, help="Device ID (default: host)")
+@click.option("--name", default="", help="Human-friendly label")
+@click.option("--tag", "tags", multiple=True, help="Tag (repeatable)")
+@click.option(
+    "--strategy", default="docker_full", show_default=True,
+    type=click.Choice(["docker_full", "podman_quadlet", "native_kiosk", "docker_kiosk", "k3s", "systemd"]),
+    help="Deploy strategy"
+)
+@click.option("--app", default="", help="Application name")
+@click.option("--port", "ssh_port", default=22, show_default=True)
+@click.option("--key", "ssh_key", default=None, help="Path to SSH private key")
+def device_add(host, device_id, name, tags, strategy, app, ssh_port, ssh_key):
+    """Add or update a device in the registry.
+
+    \b
+    Example:
+        redeploy device-add pi@192.168.1.42 --tag kiosk --strategy native_kiosk --app kiosk-app
+        redeploy device-add root@10.0.0.5 --tag prod --strategy docker_full --app myapp
+    """
+    from ...models import DeviceRegistry, KnownDevice
+
+    console = Console()
+    reg = DeviceRegistry.load()
+
+    did = device_id or host
+    dev = reg.get(did) or KnownDevice(id=did, host=host)
+    dev.host = host
+    if name:
+        dev.name = name
+    if tags:
+        dev.tags = list(tags)
+    dev.strategy = strategy
+    if app:
+        dev.app = app
+    dev.ssh_port = ssh_port
+    if ssh_key:
+        dev.ssh_key = ssh_key
+    dev.source = "manual"
+
+    reg.upsert(dev)
+    reg.save()
+    console.print(
+        f"[green]✓[/green] device [bold]{did}[/bold] saved → {DeviceRegistry.default_path()}"
+    )
+
+
+@click.command("device-rm")
+@click.argument("device_id")
+def device_rm(device_id):
+    """Remove a device from the registry."""
+    from ...models import DeviceRegistry
+
+    console = Console()
+    reg = DeviceRegistry.load()
+    if reg.remove(device_id):
+        reg.save()
+        console.print(f"[green]✓[/green] removed {device_id}")
+    else:
+        console.print(f"[yellow]⚠ not found: {device_id}[/yellow]")