Roadmap relationship
Outcome
Make advertised server, database, Git, container, config, firewall, team, upgrade, and generation commands execute real provider/driver operations—or explicitly report unsupported capability—while sharing the same implementation with the dashboard/API.
Current gap
A wide set of CLI surfaces currently print intended actions while containing TODOs: server lifecycle/cron/workers/firewall/SSL/monitoring/snapshots/update/security, database lifecycle/migrations/users/slow queries, Git connections/deploy/webhooks, container build/push/deploy, config env/secrets, firewall rules, team IAM, upgrade, and generation preview. This undermines CLI trust and creates divergent dashboard paths.
User experience
- Commands run a preflight and concise plan, identify provider/target/environment, indicate unsupported capabilities before mutation, and support structured JSON output.
- Long operations enqueue and print/watch an operation ID; non-interactive mode has deterministic exit codes and no hidden prompts.
- Destructive commands require exact target plus
--yespolicy appropriate to CI; dry-run/plan is available where meaningful. - Errors include failed step, sanitized provider code/request ID, retryability, and next action.
- Dashboard buttons invoke the same service method and display identical plan/progress/result.
Scope
- Inventory every command marked TODO/placeholder/mock and classify as implement, alias to an existing real path, deprecate, or remove in the next major release.
- Define driver capability interfaces for compute lifecycle, remote exec, services, workers/schedules, firewall, TLS, metrics, snapshots, package update/hardening, data lifecycle, Git source, image build/registry/deploy, and config/secret operations.
- Route implementations through application services, durable jobs, authorization, audit, and standardized output/errors.
- Add
cloud capabilitiesand per-command plan/JSON contracts. - Update help/docs to distinguish stable, experimental, unsupported-provider, and deprecated behavior.
Technical direction
- Keep provider-specific API calls inside adapters and reuse existing AWS/Hetzner/shared-driver primitives instead of shelling out to AWS SDK/CLI.
- Use idempotency and observed-state preconditions for create/update/delete/reboot/restore operations.
- Generate typed result schemas consumed by table and JSON renderers.
- Gate registration of commands or subcommands based on implementation maturity only where static help remains understandable.
Safety and operability
- No placeholder command may return success after doing nothing.
- Termination, restore, firewall lockout, TLS replacement, credential deletion, and package upgrade require dedicated preflight/confirmation and recovery guidance.
- Remote commands use constrained templates or an explicitly privileged exec capability.
- Secrets never appear in command history, argv, structured output, or audit payloads.
Acceptance criteria
- Every current TODO-bearing public command is implemented, intentionally deprecated, or exits non-zero with a precise unsupported explanation.
- At least AWS and Hetzner/shared-box paths pass the common driver contract for their declared capabilities.
- Dashboard/API/CLI calls for the same operation produce the same operation result schema.
- Help and docs contain no claim that a no-op placeholder performs a real action.
Verification
- Automated scan preventing new TODO/no-op public commands without an explicit experimental guard.
- Driver contract, idempotency, error mapping, plan/dry-run, JSON schema, and exit-code tests.
- End-to-end representative server create/reboot/snapshot, DB backup, Git deploy, and container deploy flows.
Non-goals
- Artificial feature parity across providers that do not expose the same operation.
- Removing experimental APIs without deprecation.
- Implementing unrelated asset image optimization.