remo-cli 2.2.0rc1__tar.gz → 2.2.0rc3__tar.gz

{remo_cli-2.2.0rc1 → remo_cli-2.2.0rc3}/.devcontainer/devcontainer.json

@@ -16,7 +16,7 @@
         "ghcr.io/eitsupi/devcontainer-features/jq-likes:2": {},
         "ghcr.io/devcontainers-extra/features/starship:1": {},
         "ghcr.io/get2knowio/devcontainer-features/ai-clis:2": {
-            "install": "claudeCode,specifyCli"
+            "install": "claudeCode,specifyCli,copilot,codex"
         },
         "ghcr.io/get2knowio/devcontainer-features/modern-cli-tools:2": {},
         "ghcr.io/get2knowio/devcontainer-features/python-tools:2": {
@@ -41,7 +41,7 @@
         "source=${localEnv:HOME}/.claude,target=/home/vscode/.claude,type=bind,consistency=cached",
 	"source=${localEnv:HOME}/.aws,target=/home/vscode/.aws,type=bind,consistency=cached",
         "source=${localEnv:HOME}/.ssh,target=/home/vscode/.ssh,type=bind,consistency=cached",
-        "source=${localWorkspaceFolder}/../site,target=/workspaces/site,type=bind,consistency=cached",
+        "source=${localWorkspaceFolder}/../site,target=/workspaces/site,type=bind,consistency=cached"
     ],
     "postCreateCommand": "python3 --version && node --version"
 }

remo_cli-2.2.0rc3/.specify/feature.json

@@ -0,0 +1,3 @@
+{
+  "feature_directory": "specs/011-web-adopt"
+}

{remo_cli-2.2.0rc1 → remo_cli-2.2.0rc3}/CLAUDE.md

@@ -13,6 +13,7 @@ See `.specify/memory/constitution.md` for project principles and non-negotiable
 - Flat file (`~/.config/remo/known_hosts`, colon-delimited) (003-python-cli-rewrite)
 - Cross-provider snapshot model (`models/snapshot.py`) + shared helpers in `core/snapshot.py` (name generator, validator, table formatter, destroy-time cleanup hook). No new runtime deps. (005-provider-snapshots)
 - FastAPI/Uvicorn + WebSockets (backend, optional `web` extra), TypeScript/Vite/React + ghostty-web (frontend), Bash (`remo-host` host command templated by Ansible) (010-web-session-interface)
+- Stdlib `urllib.request` CLI setup client + token-gated `/api/v1/setup/*` FastAPI surface; service state in flat files under the writable `REMO_HOME` volume (`web-identity/` keypair + service known_hosts, `~/.config/remo/web-service.json` saved credentials) (011-web-adopt)
 
 - Ansible 2.14+ / YAML + `ansible.builtin`, `community.general` (for zypper module) (001-bootstrap-incus-host)
 
@@ -27,7 +28,7 @@ src/remo_cli/              # Python CLI package (src layout, hatchling build)
 │   ├── shell.py           # remo shell
 │   ├── cp.py              # remo cp
 │   ├── init_cmd.py        # remo init
-│   ├── web.py             # remo web {serve,check} — lazy-imports remo_cli.web.* (NFR-008)
+│   ├── web.py             # remo web {serve,check,adopt,push} — serve/check lazy-import remo_cli.web.* (NFR-008); adopt/push use core/web_adopt only
 │   └── providers/         # Provider CLI groups
 │       ├── incus.py       # remo incus {create,destroy,update,list,sync,bootstrap}
 │       ├── hetzner.py     # remo hetzner {create,destroy,update,list,sync}
@@ -45,6 +46,7 @@ src/remo_cli/              # Python CLI package (src layout, hatchling build)
 │   ├── known_hosts.py     # Flat-file host registry
 │   ├── ssh.py             # build_ssh_base_cmd(), SSH options, terminal reset, timezone
 │   ├── remo_host_client.py  # Versioned remo-host protocol client (shared by CLI + web)
+│   ├── web_adopt.py       # Workstation-side adoption/push engine (stdlib HTTP, keyscan trust verify, authorized_keys mgmt, --via tunnel)
 │   ├── ansible_runner.py  # Ansible playbook subprocess
 │   ├── picker.py          # InquirerPy fuzzy picker
 │   ├── rsync.py           # File transfer
@@ -52,7 +54,8 @@ src/remo_cli/              # Python CLI package (src layout, hatchling build)
 │   └── init.py            # remo init logic
 ├── web/                    # remo-web service — FastAPI; optional `web` extra, lazily imported
 │   ├── app.py               # FastAPI factory: routers, Host/Origin+CSP middleware, serves built SPA
-│   ├── config.py             # WebSettings (REMO_WEB_* env vars, see docs/web-session-interface.md)
+│   ├── config.py             # WebSettings (REMO_WEB_* env vars incl. api_token, see docs/web-session-interface.md)
+│   ├── state.py              # ConfigurationState detection (unconfigured/adopted/mount_configured/broken) + service identity generation
 │   ├── discovery.py          # Concurrent per-instance discovery via remo-host + SSH
 │   ├── ssh_master.py         # Per-instance SSH ControlMaster lifecycle
 │   ├── terminal.py           # PTY + `ssh -tt … remo-host sessions attach`, resize/backpressure
@@ -64,6 +67,7 @@ src/remo_cli/              # Python CLI package (src layout, hatchling build)
 │   ├── models.py               # Service-only entities: TerminalAttachment, WsToken, SshMaster
 │   └── api/
 │       ├── hosts.py            # GET /api/v1/hosts, /sessions, POST /discovery/refresh
+│       ├── setup.py            # Token-gated /api/v1/setup/{status,identity,registry,verify} (011-web-adopt)
 │       └── terminals.py        # POST/GET/DELETE /api/v1/terminals, WS /api/v1/terminals/{id}
 └── models/
     ├── host.py             # KnownHost dataclass
@@ -182,10 +186,9 @@ Provider SDKs (boto3, hcloud) are lazy-imported with clear error messages if mis
 - Ansible 2.14+ / YAML: Follow standard conventions plus Constitution principles
 
 ## Recent Changes
+- 011-web-adopt: Added CLI-to-web adoption — unconfigured boot with service-scoped ed25519 identity, token-gated `/api/v1/setup/*` (REMO_WEB_API_TOKEN, fail-closed), `remo web adopt`/`remo web push` (registry mirror + workstation-verified host keys + idempotent `remo-web@<id>` authorized_keys entries), AwaitingAdoption SPA page.
 - 010-web-session-interface: Added remo-web Docker service (FastAPI + React/ghostty-web) brokering browser terminal sessions across all Remo-managed instances via a new remo-host SSH command; web extra + remo web {serve,check} CLI group.
 - 005-provider-snapshots: Added cross-provider snapshot CLI (`remo <P> snapshot {create,list,restore,delete}`) + destroy-time cleanup hook across Incus / Proxmox / AWS / Hetzner.
-- 003-python-cli-rewrite: Added Python 3.11+ + Click (CLI framework), InquirerPy (interactive picker), boto3 (AWS, optional), hcloud (Hetzner, optional)
-- 002-incus-container-support: Added Ansible 2.14+ / YAML + `ansible.builtin`, `community.general` (existing), Incus CLI (local)
 
 
 <!-- MANUAL ADDITIONS START -->

{remo_cli-2.2.0rc1 → remo_cli-2.2.0rc3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: remo-cli
-Version: 2.2.0rc1
+Version: 2.2.0rc3
 Summary: Remote development environment CLI
 License-Expression: MIT
 License-File: LICENSE
@@ -357,11 +357,19 @@ uv run remo web serve --host 127.0.0.1 --port 8080   # local dev
 ```
 
 For a home-lab install, use Docker Compose — see [`docker/compose.example.yml`](docker/compose.example.yml)
-for a ready-to-adapt file (read-only registry + SSH material mounts, tmpfs runtime dir, healthcheck,
-non-root/read-only hardening).
-
-Full architecture, security model, Compose walkthrough, credentials/SSM setup, discovery states,
-terminal limits, troubleshooting, and upgrade notes: **[docs/web-session-interface.md](docs/web-session-interface.md)**.
+for a ready-to-adapt file covering both deployment modes (tmpfs runtime dir, healthcheck,
+non-root/read-only hardening in either case):
+
+- **Bind-mount mode**: mount your existing registry and SSH key read-only — the container runs with
+  your identity, on the same box as your config.
+- **Adopted mode**: mount nothing. The container generates its own SSH identity in a writable state
+  volume, and a single `remo web adopt` from your workstation pushes your registry and authorizes
+  that identity on every instance — your personal private key never leaves the workstation
+  (`remo web push` re-syncs later changes).
+
+Full architecture, security model, Compose walkthrough, adoption workflow, credentials/SSM setup,
+discovery states, terminal limits, troubleshooting, and upgrade notes:
+**[docs/web-session-interface.md](docs/web-session-interface.md)**.
 
 ---
 

{remo_cli-2.2.0rc1 → remo_cli-2.2.0rc3}/README.md

@@ -331,11 +331,19 @@ uv run remo web serve --host 127.0.0.1 --port 8080   # local dev
 ```
 
 For a home-lab install, use Docker Compose — see [`docker/compose.example.yml`](docker/compose.example.yml)
-for a ready-to-adapt file (read-only registry + SSH material mounts, tmpfs runtime dir, healthcheck,
-non-root/read-only hardening).
-
-Full architecture, security model, Compose walkthrough, credentials/SSM setup, discovery states,
-terminal limits, troubleshooting, and upgrade notes: **[docs/web-session-interface.md](docs/web-session-interface.md)**.
+for a ready-to-adapt file covering both deployment modes (tmpfs runtime dir, healthcheck,
+non-root/read-only hardening in either case):
+
+- **Bind-mount mode**: mount your existing registry and SSH key read-only — the container runs with
+  your identity, on the same box as your config.
+- **Adopted mode**: mount nothing. The container generates its own SSH identity in a writable state
+  volume, and a single `remo web adopt` from your workstation pushes your registry and authorizes
+  that identity on every instance — your personal private key never leaves the workstation
+  (`remo web push` re-syncs later changes).
+
+Full architecture, security model, Compose walkthrough, adoption workflow, credentials/SSM setup,
+discovery states, terminal limits, troubleshooting, and upgrade notes:
+**[docs/web-session-interface.md](docs/web-session-interface.md)**.
 
 ---
 

{remo_cli-2.2.0rc1 → remo_cli-2.2.0rc3}/docker/Dockerfile

@@ -60,8 +60,14 @@ WORKDIR /app
 #   curl           - AWS CLI/SSM plugin install below, and the container
 #                    healthcheck (compose.example.yml) at runtime
 #   unzip          - AWS CLI v2 install below
+#   gosu           - drops from root to the unprivileged `remo` user in the
+#                    entrypoint AFTER self-healing filesystem permissions
+#                    (see docker/entrypoint.sh). Unlike `su`, it stays PID 1
+#                    with correct signal semantics and adds no setuid-binary
+#                    surface. Packaged for both amd64 and arm64 in Debian, so
+#                    the multi-arch build is unaffected.
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends openssh-client curl unzip && \
+    apt-get install -y --no-install-recommends openssh-client curl unzip gosu && \
     rm -rf /var/lib/apt/lists/*
 
 # Install AWS CLI v2 (needed for SSM proxy), arch-selected via $TARGETARCH.
@@ -85,10 +91,10 @@ RUN if [ "$TARGETARCH" = "arm64" ]; then SM_ARCH="arm64"; else SM_ARCH="64bit";
 # Non-root user (UID/GID 1000 to match compose.example.yml `user: "1000:1000"`).
 RUN useradd -u 1000 -m -s /bin/bash remo
 
-# Install remo-cli[web] system-wide (as root, before USER remo) from the
-# wheel built in stage 2 — avoids needing build tools in this final layer
-# and avoids `pip install --user` (so no PATH fix-up is needed; `remo` /
-# `remo web` land directly on the system PATH for the `remo` user).
+# Install remo-cli[web] system-wide (as root) from the wheel built in stage 2
+# — avoids needing build tools in this final layer and avoids `pip install
+# --user` (so no PATH fix-up is needed; `remo` / `remo web` land directly on
+# the system PATH for the `remo` user the entrypoint drops to).
 COPY --from=wheel-builder /build/wheels/*.whl /tmp/
 RUN pip install --no-cache-dir "$(ls /tmp/*.whl)[web]" && \
     rm /tmp/*.whl
@@ -118,6 +124,19 @@ ENV REMO_WEB_FRONTEND_DIST_DIR=/app/frontend-dist
 # default, FR-052), same as any other containerized service.
 ENV REMO_WEB_BIND_HOST=0.0.0.0
 
-USER remo
-
+# Pin HOME to the `remo` user's home so config-path resolution
+# (core/config.py `Path.home()` / REMO_HOME) is identical whether the
+# entrypoint is running its root-side healing pass or the dropped-to `remo`
+# process — otherwise root's ambient HOME (/root) would resolve the config
+# dir to a different path than the app later reads.
+ENV HOME=/home/remo
+
+# NOTE: intentionally NO `USER remo` here. The image starts as root so the
+# entrypoint can self-heal ownership on a bind-mounted, root-owned config dir
+# and on the /run/remo-ssh tmpfs (which a container *restart* remounts
+# root-owned) BEFORE dropping — via gosu — to the unprivileged `remo` user.
+# The app still ends up running as non-root `remo`; the drop just happens at
+# runtime in the entrypoint instead of at image-build time. A deployer that
+# sets an explicit `--user`/`user:` starts non-root, and the entrypoint skips
+# healing (best-effort) and execs directly. See docker/entrypoint.sh.
 ENTRYPOINT ["/app/docker/entrypoint.sh"]

{remo_cli-2.2.0rc1 → remo_cli-2.2.0rc3}/docker/compose.example.yml

@@ -117,3 +117,116 @@ services:
       retries: 3
       start_period: 10s
     restart: unless-stopped
+
+  # ---------------------------------------------------------------------------
+  # Adopted mode (011-web-adopt) — an ALTERNATIVE to `remo-web` above; run one
+  # or the other, not both (they publish the same host port).
+  #
+  # When to use which:
+  #
+  #   - `remo-web` (above, bind-mount mode): you are happy to mount your
+  #     existing registry and SSH material read-only into the container. The
+  #     service boots fully configured with YOUR key; nothing else to do.
+  #     Upgrading to this release changes nothing about that mode (SC-005).
+  #
+  #   - `remo-web-adopted` (below): nothing from your workstation is mounted.
+  #     The service boots UNCONFIGURED with an empty named state volume,
+  #     generates its own service-scoped SSH identity there on first start
+  #     (under web-identity/, comment `remo-web@<deployment-id>`), and waits
+  #     in a stable "awaiting adoption" state (GET /api/v1/ready -> 200
+  #     `{"status": "unconfigured"}`). Complete setup from a workstation with
+  #     a working remo CLI:
+  #
+  #       remo web adopt http://<docker-host>:8080
+  #
+  #     which pushes your registry + instance host keys and authorizes the
+  #     service's OWN public key on each instance — your personal private key
+  #     never leaves the workstation. Later registry changes are re-pushed
+  #     with `remo web push`.
+  #
+  # This service carries `profiles: ["adopted"]` so a plain `docker compose
+  # up` still starts only the bind-mount service above. Start this one with:
+  #
+  #   docker compose --profile adopted up -d
+  remo-web-adopted:
+    profiles: ["adopted"]
+    # Same image (and the same optional `build:` override) as `remo-web`
+    # above — the mode is chosen purely by what is mounted, not by the image.
+    image: ghcr.io/get2knowio/remo-web:latest
+    ports:
+      # Adoption traffic (the token-gated /api/v1/setup/* calls made by
+      # `remo web adopt`) arrives over this same port. Loopback-only means
+      # the workstation running the CLI must be the Docker host itself —
+      # otherwise bind a LAN IP here deliberately, or keep loopback and run
+      # `remo web adopt --via <docker-host>` to tunnel over SSH.
+      - "127.0.0.1:8080:8080"
+    environment:
+      # REQUIRED for adopted mode: while this is unset/empty the setup API
+      # does not exist at all (every /api/v1/setup/* request gets a plain
+      # 404), so adoption is impossible. Generate a strong random value,
+      # e.g.:
+      #
+      #   openssl rand -hex 24
+      #
+      # and pass the same value to the CLI via $REMO_API_TOKEN (or the
+      # interactive prompt) when running `remo web adopt`.
+      - "REMO_WEB_API_TOKEN=replace-me--generate-with--openssl-rand-hex-24"
+      # The REMO_WEB_ALLOWED_HOSTS / REMO_WEB_ALLOWED_ORIGINS notes on the
+      # service above apply here unchanged.
+    volumes:
+      # A writable named state volume at REMO_HOME — the ONLY volume in this
+      # mode (no registry mount, no ~/.ssh mounts; presence of those is what
+      # puts the service in mount-configured mode instead). It holds the
+      # pushed registry, per-instance host keys, and the service identity
+      # keypair. Deleting the volume resets the service to unconfigured with
+      # a NEW identity on next boot; it revokes nothing on the instances —
+      # remove the old `remo-web@<deployment-id>` authorized_keys line there.
+      - "remo-web-state:/home/remo/.config/remo"
+    # A PLAIN, option-less tmpfs — no `rw,mode=1777` pin needed anymore. The
+    # image starts as root and its entrypoint re-heals ownership on
+    # /run/remo-ssh on EVERY start, so the well-known Docker quirk (an
+    # option-less tmpfs is remounted root-owned 0755 by a container *restart*)
+    # no longer breaks the startup runtime-dir check on the second boot.
+    tmpfs:
+      - "/run/remo-ssh"
+    read_only: true
+    # NOTE: no `user:` pin here (unlike the bind-mount service above). This
+    # service starts as ROOT so the entrypoint can self-heal ownership on the
+    # state volume (Docker seeds a fresh named volume root-owned; a bind-mount
+    # host dir is root-owned too) before dropping — via gosu — to the
+    # unprivileged `remo` user. The app STILL runs as non-root `remo`; only
+    # the brief healing pass runs as root. See docker/entrypoint.sh.
+    security_opt:
+      - "no-new-privileges:true"
+    # Drop everything, then add back ONLY the capabilities the heal-then-drop
+    # entrypoint needs while it is root: CHOWN (fix ownership of the state
+    # dir/tmpfs), DAC_OVERRIDE (traverse/write a dir owned by another uid),
+    # FOWNER (defensive — chmod/utime on files owned by another uid),
+    # SETUID+SETGID (gosu drops to the `remo` uid).
+    # The dropped-to `remo` process holds NONE of these effectively — dropping
+    # uid clears the permitted/effective sets — so the security posture is
+    # unchanged from a plain non-root run; `no-new-privileges` does not block
+    # gosu (dropping privileges is always allowed).
+    cap_drop:
+      - "ALL"
+    cap_add:
+      - "CHOWN"
+      - "DAC_OVERRIDE"
+      - "FOWNER"
+      - "SETUID"
+      - "SETGID"
+    healthcheck:
+      # /api/v1/ready answers 200 for BOTH `ready` and `unconfigured` — a
+      # container awaiting adoption is healthy and must not crash-loop or
+      # flap the healthcheck while it waits (SC-006).
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/api/v1/ready"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    restart: unless-stopped
+
+volumes:
+  # Adopted-mode state (see `remo-web-adopted`). Created on first
+  # `--profile adopted` start; harmless if you only use bind-mount mode.
+  remo-web-state:

remo_cli-2.2.0rc3/docker/entrypoint.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# docker/entrypoint.sh
+#
+# Container entrypoint for `remo web` (010-web-session-interface, US4;
+# 011-web-adopt).
+#
+# Self-healing permissions model ("start as root, fix perms, drop
+# privileges"). The image starts as root (no `USER remo` in the Dockerfile)
+# so this script can, when it is UID 0, repair ownership on:
+#
+#   * the config dir ($REMO_HOME, default $HOME/.config/remo) — a deployer
+#     that BIND-MOUNTS this dir gets it owned root:root, so the non-root
+#     `remo` process could not create web-identity/ there (adopted mode,
+#     011-web-adopt) and would fail with EACCES on first boot. Docker seeds a
+#     fresh NAMED volume root-owned too, so the same fix covers that path.
+#   * the SSH ControlMaster runtime dir (/run/remo-ssh) — an option-less
+#     tmpfs is remounted root-owned 0755 (unwritable to `remo`) by a container
+#     RESTART, which otherwise fails the startup runtime-dir check on every
+#     boot after the first. Re-healing it on EVERY start makes restarts behave
+#     like the first boot without the deployer pinning `rw,mode=1777`.
+#
+# After healing, it drops to the unprivileged `remo` user via `gosu` and
+# re-execs itself; that second pass takes the non-root branch below (the gate
+# + serve). `gosu` keeps us as PID 1 with correct signal semantics (SIGTERM
+# reaches uvicorn for graceful shutdown) and, unlike a setuid `su`, adds no
+# privilege-escalation surface — compatible with `no-new-privileges:true`.
+#
+# Healing is BEST-EFFORT and never hard-fails startup: a read-only config
+# mount (mount-configured mode) legitimately cannot be chowned, and a deployer
+# may drop CAP_CHOWN. `remo web check` (below) is the real gate on whether the
+# resulting filesystem is actually usable. If the container is started with an
+# explicit non-root `--user`/`user:`, this script is never UID 0, so it skips
+# healing entirely and just runs the gate + serve.
+#
+# The `remo web check --skip-instance-checks` gate runs unguarded under
+# `set -e`: a non-zero exit from the CONFIG gate aborts before `exec remo web
+# serve`, so the container fails fast on genuinely bad config/mounts and never
+# starts serving. `--skip-instance-checks` is deliberate: the startup gate
+# validates only config/mounts/executables, NOT per-instance reachability. A
+# registered instance that is merely powered off or unreachable must NOT
+# prevent the whole service from starting (FR-006/US1); under `restart:
+# unless-stopped` (compose.example.yml), gating on reachability would
+# crash-loop the container whenever any single instance is down. Full
+# per-instance diagnostics remain available via `remo web check` (no flag),
+# and readiness is (correctly) config-only via GET /api/v1/ready.
+#
+# 011-web-adopt (SC-006): *unconfigured* is a PASSING state for this gate. A
+# fresh writable state volume with no registry/key material yet makes `remo
+# web check` report "awaiting adoption" and exit 0, so an adopted-mode
+# container boots cleanly (no crash loop) while it waits for adoption. Only
+# genuinely broken configuration still aborts here.
+
+set -euo pipefail
+
+# Target uid/gid to drop to. Defaults to the image's baked-in `remo` user
+# (1000:1000); override PUID/PGID for a bind-mount host whose directory owner
+# is some other uid/gid.
+PUID="${PUID:-1000}"
+PGID="${PGID:-1000}"
+
+# Paths that must be writable by the dropped-to user. CONFIG_DIR mirrors
+# core/config.py's REMO_HOME resolution; CONTROL_DIR mirrors
+# WebSettings.ssh_control_dir (REMO_WEB_SSH_CONTROL_DIR, default /run/remo-ssh).
+CONFIG_DIR="${REMO_HOME:-${HOME:-/home/remo}/.config/remo}"
+CONTROL_DIR="${REMO_WEB_SSH_CONTROL_DIR:-/run/remo-ssh}"
+
+if [ "$(id -u)" -eq 0 ]; then
+    # Root (the image default): self-heal, then drop. Every step is
+    # best-effort (`|| true`) so a read-only mount or a dropped CAP_CHOWN can
+    # never abort startup — `remo web check` below is the authority.
+    mkdir -p "$CONFIG_DIR" 2>/dev/null || true
+    mkdir -p "$CONTROL_DIR" 2>/dev/null || true
+    chown -R "$PUID:$PGID" "$CONFIG_DIR" 2>/dev/null || true
+    # chmod BEFORE chown so it runs while root still owns the tmpfs (no
+    # CAP_FOWNER needed). 1777 (sticky, world-writable) already lets the
+    # dropped-to user create control sockets, so the chown that follows is
+    # belt-and-suspenders — harmless if it can't change ownership.
+    chmod 1777 "$CONTROL_DIR" 2>/dev/null || true
+    chown "$PUID:$PGID" "$CONTROL_DIR" 2>/dev/null || true
+    # Re-exec this same script as the unprivileged user; the second pass falls
+    # through to the gate + serve below.
+    exec gosu "$PUID:$PGID" "$0" "$@"
+fi
+
+# Unprivileged: either dropped from root above, or started with an explicit
+# non-root `user:` (healing skipped, by design).
+remo web check --skip-instance-checks
+exec remo web serve