feat: Retrieves auth token from image

This allows using a private registry for an image.
To use it, you have to run docker login on your local machine before
running abra deploy.

.drone.yml

@@ -3,12 +3,12 @@ kind: pipeline
 name: coopcloud.tech/abra
 steps:
   - name: make check
-    image: golang:1.22
+    image: golang:1.24
     commands:
       - make check
 
   - name: make test
-    image: golang:1.22
+    image: golang:1.24
     environment:
       CATL_URL: https://git.coopcloud.tech/toolshed/recipes-catalogue-json.git
     commands:
@@ -60,7 +60,31 @@ steps:
       - make check
       - make test
 
-  - name: integration test
+  - name: on-demand integration test
+    image: appleboy/drone-ssh
+    settings:
+      host:
+        - int.coopcloud.tech
+      username: abra
+      key:
+        from_secret: abra_int_private_key
+      port: 22
+      command_timeout: 60m
+      script_stop: true
+      request_pty: true
+      script:
+        - |
+          wget https://git.coopcloud.tech/toolshed/abra/raw/branch/main/scripts/tests/run-ci-int -O run-ci-int
+          chmod +x run-ci-int
+          sh run-ci-int
+    when:
+      ref:
+        - refs/heads/int-*
+    depends_on:
+      - make check
+      - make test
+
+  - name: nightly integration test
     image: appleboy/drone-ssh
     settings:
       host:
@@ -87,3 +111,8 @@ steps:
 volumes:
   - name: deps
     temp: {}
+
+trigger:
+  action:
+    exclude:
+      - synchronized

Dockerfile

@@ -1,5 +1,5 @@
 # Build image
-FROM golang:1.22-alpine AS build
+FROM golang:1.24-alpine AS build
 
 ENV GOPRIVATE=coopcloud.tech
 

Makefile

@@ -2,7 +2,7 @@ ABRA         := ./cmd/abra
 KADABRA      := ./cmd/kadabra
 COMMIT       := $(shell git rev-list -1 HEAD)
 GOPATH       := $(shell go env GOPATH)
-GOVERSION    := 1.22
+GOVERSION    := 1.24
 LDFLAGS      := "-X 'main.Commit=$(COMMIT)'"
 DIST_LDFLAGS := $(LDFLAGS)" -s -w"
 GCFLAGS      := "all=-l -B"

cli/app/cmd.go

@@ -183,7 +183,7 @@ does not).`,
 		if err := internal.RunCmdRemote(
 			cl,
 			app,
-			requestTTY,
+			disableTTY,
 			app.Recipe.AbraShPath,
 			targetServiceName, cmdName, parsedCmdArgs, remoteUser); err != nil {
 			log.Fatal(err)
@@ -238,7 +238,7 @@ func parseCmdArgs(args []string, isLocal bool) (bool, string) {
 var (
 	local      bool
 	remoteUser string
-	requestTTY bool
+	disableTTY bool
 )
 
 func init() {
@@ -259,11 +259,11 @@ func init() {
 	)
 
 	AppCmdCommand.Flags().BoolVarP(
-		&requestTTY,
+		&disableTTY,
 		"tty",
-		"t",
+		"T",
 		false,
-		"request remote TTY",
+		"disable remote TTY",
 	)
 
 	AppCmdCommand.Flags().BoolVarP(

cli/app/cp.go

@@ -18,7 +18,7 @@ import (
 	"coopcloud.tech/abra/pkg/log"
 	"coopcloud.tech/abra/pkg/upstream/container"
 	"github.com/docker/cli/cli/command"
-	"github.com/docker/docker/api/types"
+	containertypes "github.com/docker/docker/api/types/container"
 	dockerClient "github.com/docker/docker/client"
 	"github.com/docker/docker/errdefs"
 	"github.com/docker/docker/pkg/archive"
@@ -33,7 +33,7 @@ var AppCpCommand = &cobra.Command{
   abra app cp 1312.net myfile.txt app:/
 
   # copy that file back to your current working directory locally
-  abra app cp 1312.net app:/myfile.txt`,
+  abra app cp 1312.net app:/myfile.txt ./`,
 	Args: cobra.ExactArgs(3),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
@@ -134,7 +134,7 @@ func CopyToContainer(cl *dockerClient.Client, containerID, srcPath, dstPath stri
 		if err != nil {
 			return err
 		}
-		if _, err := container.RunExec(dcli, cl, containerID, &types.ExecConfig{
+		if _, err := container.RunExec(dcli, cl, containerID, &containertypes.ExecOptions{
 			AttachStderr: true,
 			AttachStdin:  true,
 			AttachStdout: true,
@@ -162,7 +162,7 @@ func CopyToContainer(cl *dockerClient.Client, containerID, srcPath, dstPath stri
 	}
 
 	log.Debugf("copy %s from local to %s on container", srcPath, dstPath)
-	copyOpts := types.CopyToContainerOptions{AllowOverwriteDirWithFile: false, CopyUIDGID: false}
+	copyOpts := containertypes.CopyToContainerOptions{AllowOverwriteDirWithFile: false, CopyUIDGID: false}
 	if err := cl.CopyToContainer(context.Background(), containerID, dstPath, content, copyOpts); err != nil {
 		return err
 	}
@@ -173,7 +173,7 @@ func CopyToContainer(cl *dockerClient.Client, containerID, srcPath, dstPath stri
 		if err != nil {
 			return err
 		}
-		if _, err := container.RunExec(dcli, cl, containerID, &types.ExecConfig{
+		if _, err := container.RunExec(dcli, cl, containerID, &containertypes.ExecOptions{
 			AttachStderr: true,
 			AttachStdin:  true,
 			AttachStdout: true,

cli/app/deploy.go

@@ -3,6 +3,7 @@ package app
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/app"
@@ -46,7 +47,8 @@ checkout as-is. Recipe commit hashes are also supported as values for
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
 		args []string,
-		toComplete string) ([]string, cobra.ShellCompDirective) {
+		toComplete string,
+	) ([]string, cobra.ShellCompDirective) {
 		switch l := len(args); l {
 		case 0:
 			return autocomplete.AppNameComplete()
@@ -63,10 +65,8 @@ checkout as-is. Recipe commit hashes are also supported as values for
 	},
 	Run: func(cmd *cobra.Command, args []string) {
 		var (
-			deployWarnMessages   []string
-			toDeployVersion      string
-			isChaosCommit        bool
-			toDeployChaosVersion = config.CHAOS_DEFAULT
+			deployWarnMessages []string
+			toDeployVersion    string
 		)
 
 		app := internal.ValidateApp(args)
@@ -79,10 +79,6 @@ checkout as-is. Recipe commit hashes are also supported as values for
 			log.Fatal(err)
 		}
 
-		if err := lint.LintForErrors(app.Recipe); err != nil {
-			log.Fatal(err)
-		}
-
 		cl, err := client.New(app.Server)
 		if err != nil {
 			log.Fatal(err)
@@ -99,46 +95,20 @@ checkout as-is. Recipe commit hashes are also supported as values for
 			log.Fatalf("%s is already deployed", app.Name)
 		}
 
-		if len(args) == 2 && args[1] != "" {
-			toDeployVersion = args[1]
-		}
-
-		if !deployMeta.IsDeployed &&
-			toDeployVersion == "" &&
-			app.Recipe.EnvVersion != "" && !internal.IgnoreEnvVersion {
-			log.Debugf("new deployment, choosing .env version: %s", app.Recipe.EnvVersion)
-			toDeployVersion = app.Recipe.EnvVersion
-		}
-
-		if !internal.Chaos && toDeployVersion == "" {
-			if err := getLatestVersionOrCommit(app, &toDeployVersion); err != nil {
-				log.Fatal(err)
-			}
-		}
-
-		if internal.Chaos {
-			if err := getChaosVersion(app, &toDeployVersion, &toDeployChaosVersion); err != nil {
-				log.Fatal(err)
-			}
+		toDeployVersion, err = getDeployVersion(args, deployMeta, app)
+		if err != nil {
+			log.Fatal(fmt.Errorf("get deploy version: %s", err))
 		}
 
 		if !internal.Chaos {
-			isChaosCommit, err = app.Recipe.EnsureVersion(toDeployVersion)
+			_, err = app.Recipe.EnsureVersion(toDeployVersion)
 			if err != nil {
-				log.Fatal(err)
+				log.Fatalf("ensure recipe: %s", err)
 			}
+		}
 
-			if isChaosCommit {
-				log.Debugf("assuming chaos commit: %s", toDeployVersion)
-
-				internal.Chaos = true
-				toDeployChaosVersion = toDeployVersion
-
-				toDeployVersion, err = app.Recipe.GetVersionLabelLocal()
-				if err != nil {
-					log.Fatal(err)
-				}
-			}
+		if err := lint.LintForErrors(app.Recipe); err != nil {
+			log.Fatal(err)
 		}
 
 		if err := validateSecrets(cl, app); err != nil {
@@ -171,18 +141,14 @@ checkout as-is. Recipe commit hashes are also supported as values for
 			log.Fatal(err)
 		}
 
-		toDeployChaosVersionLabel := toDeployChaosVersion
-		if app.Recipe.Dirty {
-			toDeployChaosVersionLabel = formatter.AddDirtyMarker(toDeployChaosVersionLabel)
-		}
-
 		appPkg.ExposeAllEnv(stackName, compose, app.Env)
 		appPkg.SetRecipeLabel(compose, stackName, app.Recipe.Name)
 		appPkg.SetChaosLabel(compose, stackName, internal.Chaos)
 		if internal.Chaos {
-			appPkg.SetChaosVersionLabel(compose, stackName, toDeployChaosVersionLabel)
+			appPkg.SetChaosVersionLabel(compose, stackName, toDeployVersion)
 		}
 		appPkg.SetUpdateLabel(compose, stackName, app.Env)
+		appPkg.SetVersionLabel(compose, stackName, toDeployVersion)
 
 		envVars, err := appPkg.CheckEnv(app)
 		if err != nil {
@@ -214,19 +180,12 @@ checkout as-is. Recipe commit hashes are also supported as values for
 			deployedVersion = deployMeta.Version
 		}
 
-		toWriteVersion := toDeployVersion
-		if internal.Chaos || isChaosCommit {
-			toWriteVersion = toDeployChaosVersion
-		}
-
 		if err := internal.DeployOverview(
 			app,
-			deployWarnMessages,
 			deployedVersion,
-			deployMeta.ChaosVersion,
 			toDeployVersion,
-			toDeployChaosVersion,
-			toWriteVersion,
+			"",
+			deployWarnMessages,
 		); err != nil {
 			log.Fatal(err)
 		}
@@ -238,7 +197,25 @@ checkout as-is. Recipe commit hashes are also supported as values for
 
 		log.Debugf("set waiting timeout to %d second(s)", stack.WaitTimeout)
 
-		if err := stack.RunDeploy(cl, deployOpts, compose, app.Name, internal.DontWaitConverge); err != nil {
+		serviceNames, err := appPkg.GetAppServiceNames(app.Name)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		f, err := app.Filters(true, false, serviceNames...)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if err := stack.RunDeploy(
+			cl,
+			deployOpts,
+			compose,
+			app.Name,
+			app.Server,
+			internal.DontWaitConverge,
+			f,
+		); err != nil {
 			log.Fatal(err)
 		}
 
@@ -250,53 +227,28 @@ checkout as-is. Recipe commit hashes are also supported as values for
 			}
 		}
 
-		if err := app.WriteRecipeVersion(toWriteVersion, false); err != nil {
+		if err := app.WriteRecipeVersion(toDeployVersion, false); err != nil {
 			log.Fatalf("writing recipe version failed: %s", err)
 		}
 	},
 }
 
-func getChaosVersion(app app.App, toDeployVersion, toDeployChaosVersion *string) error {
-	var err error
-	*toDeployChaosVersion, err = app.Recipe.ChaosVersion()
-	if err != nil {
-		return err
-	}
-
-	*toDeployVersion, err = app.Recipe.GetVersionLabelLocal()
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func getLatestVersionOrCommit(app app.App, toDeployVersion *string) error {
+func getLatestVersionOrCommit(app app.App) (string, error) {
 	versions, err := app.Recipe.Tags()
 	if err != nil {
-		return err
+		return "", err
 	}
 
 	if len(versions) > 0 && !internal.Chaos {
-		*toDeployVersion = versions[len(versions)-1]
-
-		log.Debugf("choosing %s as version to deploy", *toDeployVersion)
-
-		if _, err := app.Recipe.EnsureVersion(*toDeployVersion); err != nil {
-			return err
-		}
-
-		return nil
+		return versions[len(versions)-1], nil
 	}
 
 	head, err := app.Recipe.Head()
 	if err != nil {
-		return err
+		return "", err
 	}
 
-	*toDeployVersion = formatter.SmallSHA(head.String())
-
-	return nil
+	return formatter.SmallSHA(head.String()), nil
 }
 
 // validateArgsAndFlags ensures compatible args/flags.
@@ -323,6 +275,46 @@ func validateSecrets(cl *dockerClient.Client, app app.App) error {
 	return nil
 }
 
+func getDeployVersion(cliArgs []string, deployMeta stack.DeployMeta, app app.App) (string, error) {
+	// Chaos mode overrides everything
+	if internal.Chaos {
+		v, err := app.Recipe.ChaosVersion()
+		if err != nil {
+			return "", err
+		}
+		log.Debugf("version: taking chaos version: %s", v)
+		return v, nil
+	}
+
+	// Check if the deploy version is set with a cli argument
+	if len(cliArgs) == 2 && cliArgs[1] != "" {
+		log.Debugf("version: taking version from cli arg: %s", cliArgs[1])
+		return cliArgs[1], nil
+	}
+
+	// Check if the recipe has a version in the .env file
+	if app.Recipe.EnvVersion != "" && !internal.IgnoreEnvVersion {
+		if strings.HasSuffix(app.Recipe.EnvVersionRaw, "+U") {
+			return "", fmt.Errorf("version: can not redeploy chaos version %s", app.Recipe.EnvVersionRaw)
+		}
+		log.Debugf("version: taking version from .env file: %s", app.Recipe.EnvVersion)
+		return app.Recipe.EnvVersion, nil
+	}
+
+	// Take deployed version
+	if deployMeta.IsDeployed {
+		log.Debugf("version: taking deployed version: %s", deployMeta.Version)
+		return deployMeta.Version, nil
+	}
+
+	v, err := getLatestVersionOrCommit(app)
+	log.Debugf("version: taking new recipe version: %s", v)
+	if err != nil {
+		return "", err
+	}
+	return v, nil
+}
+
 func init() {
 	AppDeployCommand.Flags().BoolVarP(
 		&internal.Chaos,

cli/app/list.go

@@ -142,10 +142,14 @@ Use "--status/-S" flag to query all servers for the live deployment status.`,
 					appStats.AutoUpdate = autoUpdate
 
 					var newUpdates []string
-					if version != "unknown" {
+					if version != "unknown" && chaosVersion == "unknown" {
+						if err := app.Recipe.EnsureExists(); err != nil {
+							log.Fatalf("unable to clone %s: %s", app.Name, err)
+						}
+
 						updates, err := app.Recipe.Tags()
 						if err != nil {
-							log.Fatal(err)
+							log.Fatalf("unable to retrieve tags for %s: %s", app.Name, err)
 						}
 
 						parsedVersion, err := tagcmp.Parse(version)

cli/app/logs.go

@@ -3,23 +3,14 @@ package app
 import (
 	"context"
 	"fmt"
-	"io"
-	"os"
-	"slices"
-	"sync"
-	"time"
 
 	"coopcloud.tech/abra/cli/internal"
 	appPkg "coopcloud.tech/abra/pkg/app"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/logs"
 	"coopcloud.tech/abra/pkg/upstream/stack"
-	"github.com/docker/docker/api/types"
-	containerTypes "github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/docker/api/types/swarm"
-	dockerClient "github.com/docker/docker/client"
 	"github.com/spf13/cobra"
 )
 
@@ -73,80 +64,25 @@ var AppLogsCommand = &cobra.Command{
 			serviceNames = []string{args[1]}
 		}
 
-		if err = tailLogs(cl, app, serviceNames); err != nil {
+		f, err := app.Filters(true, false, serviceNames...)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		opts := logs.TailOpts{
+			AppName:  app.Name,
+			Services: serviceNames,
+			StdErr:   stdErr,
+			Since:    sinceLogs,
+			Filters:  f,
+		}
+
+		if err := logs.TailLogs(cl, opts); err != nil {
 			log.Fatal(err)
 		}
 	},
 }
 
-// tailLogs prints logs for the given app with optional service names to be
-// filtered on. It also checks if the latest task is not runnning and then
-// prints the past tasks.
-func tailLogs(cl *dockerClient.Client, app appPkg.App, serviceNames []string) error {
-	f, err := app.Filters(true, false, serviceNames...)
-	if err != nil {
-		return err
-	}
-
-	services, err := cl.ServiceList(context.Background(), types.ServiceListOptions{Filters: f})
-	if err != nil {
-		return err
-	}
-
-	var wg sync.WaitGroup
-	for _, service := range services {
-		filters := filters.NewArgs()
-		filters.Add("name", service.Spec.Name)
-		tasks, err := cl.TaskList(context.Background(), types.TaskListOptions{Filters: f})
-		if err != nil {
-			return err
-		}
-		if len(tasks) > 0 {
-			// Need to sort the tasks by the CreatedAt field in the inverse order.
-			// Otherwise they are in the reversed order and not sorted properly.
-			slices.SortFunc[[]swarm.Task](tasks, func(t1, t2 swarm.Task) int {
-				return int(t2.Meta.CreatedAt.Unix() - t1.Meta.CreatedAt.Unix())
-			})
-			lastTask := tasks[0].Status
-			if lastTask.State != swarm.TaskStateRunning {
-				for _, task := range tasks {
-					log.Errorf("[%s] %s State %s: %s", service.Spec.Name, task.Meta.CreatedAt.Format(time.RFC3339), task.Status.State, task.Status.Err)
-				}
-			}
-		}
-
-		// Collect the logs in a go routine, so the logs from all services are
-		// collected in parallel.
-		wg.Add(1)
-		go func(serviceID string) {
-			logs, err := cl.ServiceLogs(context.Background(), serviceID, containerTypes.LogsOptions{
-				ShowStderr: true,
-				ShowStdout: !stdErr,
-				Since:      sinceLogs,
-				Until:      "",
-				Timestamps: true,
-				Follow:     true,
-				Tail:       "20",
-				Details:    false,
-			})
-			if err != nil {
-				log.Fatal(err)
-			}
-			defer logs.Close()
-
-			_, err = io.Copy(os.Stdout, logs)
-			if err != nil && err != io.EOF {
-				log.Fatal(err)
-			}
-		}(service.ID)
-	}
-
-	// Wait for all log streams to be closed.
-	wg.Wait()
-
-	return nil
-}
-
 var (
 	stdErr    bool
 	sinceLogs string

cli/app/new.go

@@ -109,6 +109,15 @@ var AppNewCommand = &cobra.Command{
 				if err := recipe.EnsureLatest(); err != nil {
 					log.Fatal(err)
 				}
+
+				if recipeVersion == "" {
+					head, err := recipe.Head()
+					if err != nil {
+						log.Fatalf("failed to retrieve latest commit for %s: %s", recipe.Name, err)
+					}
+
+					recipeVersion = formatter.SmallSHA(head.String())
+				}
 			}
 		}
 
@@ -185,7 +194,7 @@ var AppNewCommand = &cobra.Command{
 			newAppServer = "local"
 		}
 
-		log.Infof("%s created successfully (version: %s, chaos: %s)", appDomain, recipeVersion, chaosVersion)
+		log.Infof("%s created (version: %s)", appDomain, recipeVersion)
 
 		if len(appSecrets) > 0 {
 			rows := [][]string{}
@@ -209,16 +218,7 @@ var AppNewCommand = &cobra.Command{
 			log.Fatal(err)
 		}
 
-		if err := app.Recipe.IsDirty(); err != nil {
-			log.Fatal(err)
-		}
-
-		toWriteVersion := recipeVersion
-		if internal.Chaos || app.Recipe.Dirty {
-			toWriteVersion = chaosVersion
-		}
-
-		if err := app.WriteRecipeVersion(toWriteVersion, false); err != nil {
+		if err := app.WriteRecipeVersion(recipeVersion, false); err != nil {
 			log.Fatalf("writing recipe version failed: %s", err)
 		}
 	},
@@ -302,6 +302,12 @@ func ensureServerFlag() error {
 		return err
 	}
 
+	if len(servers) == 1 {
+		newAppServer = servers[0]
+		log.Infof("single server detected, choosing %s automatically", newAppServer)
+		return nil
+	}
+
 	if newAppServer == "" && !internal.NoInput {
 		prompt := &survey.Select{
 			Message: "Select app server:",

cli/app/ps.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"sort"
 	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
@@ -91,9 +92,14 @@ func showPSOutput(app appPkg.App, cl *dockerClient.Client, deployedVersion, chao
 		return
 	}
 
+	services := compose.Services
+	sort.Slice(services, func(i, j int) bool {
+		return services[i].Name < services[j].Name
+	})
+
 	var rows [][]string
 	allContainerStats := make(map[string]map[string]string)
-	for _, service := range compose.Services {
+	for _, service := range services {
 		filters := filters.NewArgs()
 		filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(), service.Name))
 
@@ -143,10 +149,10 @@ func showPSOutput(app appPkg.App, cl *dockerClient.Client, deployedVersion, chao
 
 		row := []string{
 			containerStats["service"],
+			containerStats["status"],
 			containerStats["image"],
 			dVersion,
 			cVersion,
-			containerStats["status"],
 		}
 
 		rows = append(rows, row)
@@ -170,10 +176,10 @@ func showPSOutput(app appPkg.App, cl *dockerClient.Client, deployedVersion, chao
 
 	headers := []string{
 		"SERVICE",
+		"STATUS",
 		"IMAGE",
 		"VERSION",
 		"CHAOS",
-		"STATUS",
 	}
 
 	table.

cli/app/restart.go

@@ -9,8 +9,10 @@ import (
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/ui"
 	upstream "coopcloud.tech/abra/pkg/upstream/service"
 	stack "coopcloud.tech/abra/pkg/upstream/stack"
+	"github.com/docker/docker/api/types"
 	"github.com/spf13/cobra"
 )
 
@@ -93,13 +95,36 @@ Pass "--all-services/-a" to restart all services.`,
 		for _, serviceName := range serviceNames {
 			stackServiceName := fmt.Sprintf("%s_%s", app.StackName(), serviceName)
 
+			service, _, err := cl.ServiceInspectWithRaw(
+				context.Background(),
+				stackServiceName,
+				types.ServiceInspectOptions{},
+			)
+			if err != nil {
+				log.Fatal(err)
+			}
+
 			log.Debugf("attempting to scale %s to 0", stackServiceName)
 
 			if err := upstream.RunServiceScale(context.Background(), cl, stackServiceName, 0); err != nil {
 				log.Fatal(err)
 			}
 
-			if err := stack.WaitOnService(context.Background(), cl, stackServiceName, app.Name); err != nil {
+			f, err := app.Filters(true, false, serviceName)
+			if err != nil {
+				log.Fatal(err)
+			}
+
+			waitOpts := stack.WaitOpts{
+				Services:   []ui.ServiceMeta{{Name: stackServiceName, ID: service.ID}},
+				AppName:    app.Name,
+				ServerName: app.Server,
+				Filters:    f,
+				NoLog:      true,
+				Quiet:      true,
+			}
+
+			if err := stack.WaitOnServices(cmd.Context(), cl, waitOpts); err != nil {
 				log.Fatal(err)
 			}
 
@@ -110,7 +135,7 @@ Pass "--all-services/-a" to restart all services.`,
 				log.Fatal(err)
 			}
 
-			if err := stack.WaitOnService(context.Background(), cl, stackServiceName, app.Name); err != nil {
+			if err := stack.WaitOnServices(cmd.Context(), cl, waitOpts); err != nil {
 				log.Fatal(err)
 			}
 
@@ -123,6 +148,13 @@ Pass "--all-services/-a" to restart all services.`,
 var allServices bool
 
 func init() {
+	AppRestartCommand.Flags().BoolVarP(
+		&internal.Chaos,
+		"chaos",
+		"C",
+		false,
+		"ignore uncommitted recipes changes",
+	)
 	AppRestartCommand.Flags().BoolVarP(
 		&allServices,
 		"all-services",

cli/app/rollback.go

@@ -183,25 +183,43 @@ beforehand. See "abra app backup" for more.`,
 		}
 		appPkg.SetUpdateLabel(compose, stackName, app.Env)
 
-		chaosVersion := config.CHAOS_DEFAULT
-		if deployMeta.IsChaos {
-			chaosVersion = deployMeta.ChaosVersion
-		}
-
 		// NOTE(d1): no release notes implemeneted for rolling back
-		if err := internal.NewVersionOverview(
+		if err := internal.DeployOverview(
 			app,
-			downgradeWarnMessages,
-			"rollback",
 			deployMeta.Version,
-			chaosVersion,
 			chosenDowngrade,
 			"",
+			downgradeWarnMessages,
 		); err != nil {
 			log.Fatal(err)
 		}
 
-		if err := stack.RunDeploy(cl, deployOpts, compose, stackName, internal.DontWaitConverge); err != nil {
+		stack.WaitTimeout, err = appPkg.GetTimeoutFromLabel(compose, stackName)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		log.Debugf("set waiting timeout to %d second(s)", stack.WaitTimeout)
+
+		serviceNames, err := appPkg.GetAppServiceNames(app.Name)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		f, err := app.Filters(true, false, serviceNames...)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if err := stack.RunDeploy(
+			cl,
+			deployOpts,
+			compose,
+			stackName,
+			app.Server,
+			internal.DontWaitConverge,
+			f,
+		); err != nil {
 			log.Fatal(err)
 		}
 
@@ -249,7 +267,7 @@ func validateDowngradeVersionArg(
 ) error {
 	parsedDeployedVersion, err := tagcmp.Parse(deployMeta.Version)
 	if err != nil {
-		return fmt.Errorf("'%s' is not a known version for %s", deployMeta.Version, app.Recipe.Name)
+		return fmt.Errorf("current deployment '%s' is not a known version for %s", deployMeta.Version, app.Recipe.Name)
 	}
 
 	parsedSpecificVersion, err := tagcmp.Parse(specificVersion)

cli/app/run.go

@@ -11,7 +11,7 @@ import (
 	"coopcloud.tech/abra/pkg/log"
 	"coopcloud.tech/abra/pkg/upstream/container"
 	"github.com/docker/cli/cli/command"
-	"github.com/docker/docker/api/types"
+	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/spf13/cobra"
 )
@@ -64,7 +64,7 @@ var AppRunCommand = &cobra.Command{
 		}
 
 		userCmd := args[2:]
-		execCreateOpts := types.ExecConfig{
+		execCreateOpts := containertypes.ExecOptions{
 			AttachStderr: true,
 			AttachStdin:  true,
 			AttachStdout: true,

cli/app/secret.go

@@ -49,11 +49,11 @@ var AppSecretGenerateCommand = &cobra.Command{
 			log.Fatal(err)
 		}
 
-		if len(args) == 1 && !generateAllSecrets {
+		if len(args) <= 2 && !generateAllSecrets {
 			log.Fatal("missing arguments [secret]/[version] or '--all'")
 		}
 
-		if len(args) > 1 && generateAllSecrets {
+		if len(args) > 2 && generateAllSecrets {
 			log.Fatal("cannot use '[secret] [version]' and '--all' together")
 		}
 

cli/app/undeploy.go

@@ -54,25 +54,34 @@ Passing "--prune/-p" does not remove those volumes.`,
 			log.Fatalf("%s is not deployed?", app.Name)
 		}
 
-		chaosVersion := config.CHAOS_DEFAULT
-		if deployMeta.IsChaos {
-			chaosVersion = deployMeta.ChaosVersion
-		}
-
-		toWriteVersion := deployMeta.Version
-		if deployMeta.IsChaos {
-			toWriteVersion = chaosVersion
-		}
-
-		if err := internal.UndeployOverview(
+		if err := internal.DeployOverview(
 			app,
 			deployMeta.Version,
-			chaosVersion,
-			toWriteVersion,
+			config.NO_DOMAIN_DEFAULT,
+			"",
+			nil,
 		); err != nil {
 			log.Fatal(err)
 		}
 
+		composeFiles, err := app.Recipe.GetComposeFiles(app.Env)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		opts := stack.Deploy{Composefiles: composeFiles, Namespace: stackName}
+		compose, err := appPkg.GetAppComposeConfig(app.Name, opts, app.Env)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		stack.WaitTimeout, err = appPkg.GetTimeoutFromLabel(compose, stackName)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		log.Info("initialising undeploy")
+
 		rmOpts := stack.Remove{
 			Namespaces: []string{stackName},
 			Detach:     false,
@@ -87,7 +96,9 @@ Passing "--prune/-p" does not remove those volumes.`,
 			}
 		}
 
-		if err := app.WriteRecipeVersion(toWriteVersion, false); err != nil {
+		log.Info("undeploy succeeded 🟢")
+
+		if err := app.WriteRecipeVersion(deployMeta.Version, false); err != nil {
 			log.Fatalf("writing recipe version failed: %s", err)
 		}
 	},

cli/app/upgrade.go

@@ -3,6 +3,7 @@ package app
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/app"
@@ -14,6 +15,7 @@ import (
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/lint"
 	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/recipe"
 	stack "coopcloud.tech/abra/pkg/upstream/stack"
 	"coopcloud.tech/tagcmp"
 	"github.com/AlecAivazis/survey/v2"
@@ -43,7 +45,8 @@ beforehand. See "abra app backup" for more.`,
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
 		args []string,
-		toComplete string) ([]string, cobra.ShellCompDirective) {
+		toComplete string,
+	) ([]string, cobra.ShellCompDirective) {
 		switch l := len(args); l {
 		case 0:
 			return autocomplete.AppNameComplete()
@@ -68,7 +71,13 @@ beforehand. See "abra app backup" for more.`,
 
 		app := internal.ValidateApp(args)
 
-		if err := app.Recipe.Ensure(internal.GetEnsureContext()); err != nil {
+		if err := app.Recipe.Ensure(recipe.EnsureContext{
+			Chaos:   internal.Chaos,
+			Offline: internal.Offline,
+			// Ignore the env version for now, to make sure we are at the latest commit.
+			// This enables us to get release notes, that were added after a release.
+			IgnoreEnvVersion: true,
+		}); err != nil {
 			log.Fatal(err)
 		}
 
@@ -141,10 +150,9 @@ beforehand. See "abra app backup" for more.`,
 
 		log.Debugf("choosing %s as version to upgrade", chosenUpgrade)
 
-		// NOTE(d1): if release notes written after git tag published, read them
-		// before we check out the tag and then they'll appear to be missing. this
-		// covers when we obviously will forget to write release notes before
-		// publishing
+		// Get the release notes before checking out the new version in the
+		// recipe. This enables us to get release notes, that were added after
+		// a release.
 		if err := getReleaseNotes(app, versions, chosenUpgrade, deployMeta, &upgradeReleaseNotes); err != nil {
 			log.Fatal(err)
 		}
@@ -206,23 +214,19 @@ beforehand. See "abra app backup" for more.`,
 			return
 		}
 
-		chaosVersion := config.CHAOS_DEFAULT
-		if deployMeta.IsChaos {
-			chaosVersion = deployMeta.ChaosVersion
-
-			if deployMeta.ChaosVersion == "" {
-				chaosVersion = config.UNKNOWN_DEFAULT
-			}
+		if upgradeReleaseNotes == "" {
+			upgradeWarnMessages = append(
+				upgradeWarnMessages,
+				fmt.Sprintf("no release notes available for %s", chosenUpgrade),
+			)
 		}
 
-		if err := internal.NewVersionOverview(
+		if err := internal.DeployOverview(
 			app,
-			upgradeWarnMessages,
-			"upgrade",
 			deployMeta.Version,
-			chaosVersion,
 			chosenUpgrade,
 			upgradeReleaseNotes,
+			upgradeWarnMessages,
 		); err != nil {
 			log.Fatal(err)
 		}
@@ -234,7 +238,25 @@ beforehand. See "abra app backup" for more.`,
 
 		log.Debugf("set waiting timeout to %d second(s)", stack.WaitTimeout)
 
-		if err := stack.RunDeploy(cl, deployOpts, compose, stackName, internal.DontWaitConverge); err != nil {
+		serviceNames, err := appPkg.GetAppServiceNames(app.Name)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		f, err := app.Filters(true, false, serviceNames...)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if err := stack.RunDeploy(
+			cl,
+			deployOpts,
+			compose,
+			stackName,
+			app.Server,
+			internal.DontWaitConverge,
+			f,
+		); err != nil {
 			log.Fatal(err)
 		}
 
@@ -314,6 +336,11 @@ func getReleaseNotes(
 			}
 
 			if note != "" {
+				// NOTE(d1): trim any final newline on the end of the note itself before
+				//           we manually handle newlines (for multiple release notes and
+				//           ensuring space between the warning messages)
+				note = strings.TrimSuffix(note, "\n")
+
 				*upgradeReleaseNotes += fmt.Sprintf("%s\n", note)
 			}
 		}
@@ -365,7 +392,7 @@ func validateUpgradeVersionArg(
 
 	parsedDeployedVersion, err := tagcmp.Parse(deployMeta.Version)
 	if err != nil {
-		return err
+		return fmt.Errorf("'%s' is not a known version", deployMeta.Version)
 	}
 
 	if parsedSpecificVersion.IsLessThan(parsedDeployedVersion) &&
@@ -397,9 +424,7 @@ func ensureDeployed(cl *dockerClient.Client, app app.App) (stack.DeployMeta, err
 	return deployMeta, nil
 }
 
-var (
-	showReleaseNotes bool
-)
+var showReleaseNotes bool
 
 func init() {
 	AppUpgradeCommand.Flags().BoolVarP(

cli/internal/backup.go

@@ -12,6 +12,7 @@ import (
 	"coopcloud.tech/abra/pkg/upstream/container"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/docker/api/types"
+	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
 	dockerClient "github.com/docker/docker/client"
 )
@@ -47,7 +48,7 @@ func RunBackupCmdRemote(
 	backupCmd string,
 	containerID string,
 	execEnv []string) (io.Writer, error) {
-	execBackupListOpts := types.ExecConfig{
+	execBackupListOpts := containertypes.ExecOptions{
 		AttachStderr: true,
 		AttachStdin:  true,
 		AttachStdout: true,

cli/internal/command.go

@@ -14,7 +14,7 @@ import (
 	"coopcloud.tech/abra/pkg/log"
 	"coopcloud.tech/abra/pkg/upstream/container"
 	"github.com/docker/cli/cli/command"
-	"github.com/docker/docker/api/types"
+	containertypes "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
 	dockerClient "github.com/docker/docker/client"
 	"github.com/docker/docker/pkg/archive"
@@ -24,7 +24,7 @@ import (
 func RunCmdRemote(
 	cl *dockerClient.Client,
 	app appPkg.App,
-	requestTTY bool,
+	disableTTY bool,
 	abraSh, serviceName, cmdName, cmdArgs, remoteUser string) error {
 	filters := filters.NewArgs()
 	filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(), serviceName))
@@ -42,7 +42,7 @@ func RunCmdRemote(
 		return err
 	}
 
-	copyOpts := types.CopyToContainerOptions{AllowOverwriteDirWithFile: false, CopyUIDGID: false}
+	copyOpts := containertypes.CopyToContainerOptions{AllowOverwriteDirWithFile: false, CopyUIDGID: false}
 	if err := cl.CopyToContainer(context.Background(), targetContainer.ID, "/tmp", content, copyOpts); err != nil {
 		return err
 	}
@@ -55,7 +55,7 @@ func RunCmdRemote(
 
 	shell := "/bin/bash"
 	findShell := []string{"test", "-e", shell}
-	execCreateOpts := types.ExecConfig{
+	execCreateOpts := containertypes.ExecOptions{
 		AttachStderr: true,
 		AttachStdin:  true,
 		AttachStdout: true,
@@ -84,8 +84,10 @@ func RunCmdRemote(
 	}
 
 	execCreateOpts.Cmd = cmd
-	execCreateOpts.Tty = requestTTY
-	if !requestTTY {
+
+	execCreateOpts.Tty = true
+	if disableTTY {
+		execCreateOpts.Tty = false
 		log.Debugf("not requesting a remote TTY")
 	}
 

cli/internal/deploy.go

@@ -10,7 +10,6 @@ import (
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/log"
-	"coopcloud.tech/abra/pkg/recipe"
 	"coopcloud.tech/tagcmp"
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/charmbracelet/lipgloss"
@@ -38,109 +37,21 @@ func horizontal(left, mid, right string) string {
 	return lipgloss.JoinHorizontal(lipgloss.Left, left, mid, right)
 }
 
-// NewVersionOverview shows an upgrade or downgrade overview
-func NewVersionOverview(
-	app appPkg.App,
-	warnMessages []string,
-	kind,
-	deployedVersion,
-	deployedChaosVersion,
-	toDeployVersion,
-	releaseNotes string) error {
-	deployConfig := "compose.yml"
-	if composeFiles, ok := app.Env["COMPOSE_FILE"]; ok {
-		deployConfig = composeFiles
-	}
-
-	server := app.Server
-	if app.Server == "default" {
-		server = "local"
-	}
-
-	domain := app.Domain
-	if domain == "" {
-		domain = config.NO_DOMAIN_DEFAULT
-	}
-
-	upperKind := strings.ToUpper(kind)
-
-	envVersion, err := recipe.GetEnvVersionRaw(app.Recipe.Name)
-	if err != nil {
-		return err
-	}
-
-	if envVersion == "" {
-		envVersion = config.NO_VERSION_DEFAULT
-	}
-
-	rows := [][]string{
-		{"DOMAIN", domain},
-		{"RECIPE", app.Recipe.Name},
-		{"SERVER", server},
-		{"CONFIG", deployConfig},
-
-		{"CURRENT DEPLOYMENT", "---"},
-		{"VERSION", formatter.BoldDirtyDefault(deployedVersion)},
-		{"CHAOS ", formatter.BoldDirtyDefault(deployedChaosVersion)},
-
-		{upperKind, "---"},
-		{"VERSION", formatter.BoldDirtyDefault(toDeployVersion)},
-
-		{fmt.Sprintf("%s.ENV", strings.ToUpper(app.Domain)), "---"},
-		{"CURRENT VERSION", formatter.BoldDirtyDefault(envVersion)},
-		{"NEW VERSION", formatter.BoldDirtyDefault(toDeployVersion)},
-	}
-
-	overview := formatter.CreateOverview(
-		fmt.Sprintf("%s OVERVIEW", upperKind),
-		rows,
-	)
-
-	fmt.Println(overview)
-
-	if releaseNotes != "" && toDeployVersion != "" {
-		fmt.Print(releaseNotes)
-	} else {
-		warnMessages = append(
-			warnMessages,
-			fmt.Sprintf("no release notes available for %s", toDeployVersion),
-		)
-	}
-
-	for _, msg := range warnMessages {
-		log.Warn(msg)
-	}
-
-	if NoInput {
-		return nil
-	}
-
-	response := false
-	prompt := &survey.Confirm{Message: "proceed?"}
-	if err := survey.AskOne(prompt, &response); err != nil {
-		return err
-	}
-
-	if !response {
-		log.Fatal("deployment cancelled")
-	}
-
-	return nil
+func formatComposeFiles(composeFiles string) string {
+	return strings.ReplaceAll(composeFiles, ":", "\n")
 }
 
 // DeployOverview shows a deployment overview
 func DeployOverview(
 	app appPkg.App,
-	warnMessages []string,
 	deployedVersion string,
-	deployedChaosVersion string,
-	toDeployVersion,
-	toDeployChaosVersion string,
-	toWriteVersion string,
+	toDeployVersion string,
+	releaseNotes string,
+	warnMessages []string,
 ) error {
 	deployConfig := "compose.yml"
 	if composeFiles, ok := app.Env["COMPOSE_FILE"]; ok {
-		deployConfig = composeFiles
+		deployConfig = formatComposeFiles(composeFiles)
 	}
 
 	server := app.Server
@@ -153,21 +64,7 @@ func DeployOverview(
 		domain = config.NO_DOMAIN_DEFAULT
 	}
 
-	if app.Recipe.Dirty {
-		toWriteVersion = formatter.AddDirtyMarker(toWriteVersion)
-		toDeployChaosVersion = formatter.AddDirtyMarker(toDeployChaosVersion)
-	}
-
-	recipeName, exists := app.Env["RECIPE"]
-	if !exists {
-		recipeName = app.Env["TYPE"]
-	}
-
-	envVersion, err := recipe.GetEnvVersionRaw(recipeName)
-	if err != nil {
-		return err
-	}
-
+	envVersion := app.Recipe.EnvVersionRaw
 	if envVersion == "" {
 		envVersion = config.NO_VERSION_DEFAULT
 	}
@@ -177,24 +74,21 @@ func DeployOverview(
 		{"RECIPE", app.Recipe.Name},
 		{"SERVER", server},
 		{"CONFIG", deployConfig},
-
-		{"CURRENT DEPLOYMENT", "---"},
-		{"VERSION", formatter.BoldDirtyDefault(deployedVersion)},
-		{"CHAOS", formatter.BoldDirtyDefault(deployedChaosVersion)},
-
-		{"NEW DEPLOYMENT", "---"},
-		{"VERSION", formatter.BoldDirtyDefault(toDeployVersion)},
-		{"CHAOS", formatter.BoldDirtyDefault(toDeployChaosVersion)},
-
-		{fmt.Sprintf("%s.ENV", strings.ToUpper(app.Name)), "---"},
-		{"CURRENT VERSION", formatter.BoldDirtyDefault(envVersion)},
-		{"NEW VERSION", formatter.BoldDirtyDefault(toWriteVersion)},
+		{"", ""},
+		{"CURRENT DEPLOYMENT", formatter.BoldDirtyDefault(deployedVersion)},
+		{"ENV VERSION", formatter.BoldDirtyDefault(envVersion)},
+		{"NEW DEPLOYMENT", formatter.BoldDirtyDefault(toDeployVersion)},
 	}
 
-	overview := formatter.CreateOverview("DEPLOY OVERVIEW", rows)
+	deployType := getDeployType(deployedVersion, toDeployVersion)
+	overview := formatter.CreateOverview(fmt.Sprintf("%s OVERVIEW", deployType), rows)
 
 	fmt.Println(overview)
 
+	if releaseNotes != "" {
+		fmt.Print(releaseNotes)
+	}
+
 	for _, msg := range warnMessages {
 		log.Warn(msg)
 	}
@@ -216,76 +110,34 @@ func DeployOverview(
 	return nil
 }
 
-// UndeployOverview shows an undeployment overview
-func UndeployOverview(
-	app appPkg.App,
-	deployedVersion,
-	deployedChaosVersion,
-	toWriteVersion string,
-) error {
-	deployConfig := "compose.yml"
-	if composeFiles, ok := app.Env["COMPOSE_FILE"]; ok {
-		deployConfig = composeFiles
+func getDeployType(currentVersion, newVersion string) string {
+	if newVersion == config.NO_DOMAIN_DEFAULT {
+		return "UNDEPLOY"
 	}
-
-	server := app.Server
-	if app.Server == "default" {
-		server = "local"
+	if strings.Contains(newVersion, "+U") {
+		return "CHAOS DEPLOY"
 	}
-
-	domain := app.Domain
-	if domain == "" {
-		domain = config.NO_DOMAIN_DEFAULT
+	if strings.Contains(currentVersion, "+U") {
+		return "UNCHAOS DEPLOY"
 	}
-
-	recipeName, exists := app.Env["RECIPE"]
-	if !exists {
-		recipeName = app.Env["TYPE"]
+	if currentVersion == newVersion {
+		return "REDEPLOY"
 	}
-
-	envVersion, err := recipe.GetEnvVersionRaw(recipeName)
+	if currentVersion == config.NO_VERSION_DEFAULT {
+		return "NEW DEPLOY"
+	}
+	currentParsed, err := tagcmp.Parse(currentVersion)
 	if err != nil {
-		return err
+		return "DEPLOY"
 	}
-
-	if envVersion == "" {
-		envVersion = config.NO_VERSION_DEFAULT
+	newParsed, err := tagcmp.Parse(newVersion)
+	if err != nil {
+		return "DEPLOY"
 	}
-
-	rows := [][]string{
-		{"DOMAIN", domain},
-		{"RECIPE", app.Recipe.Name},
-		{"SERVER", server},
-		{"CONFIG", deployConfig},
-
-		{"CURRENT DEPLOYMENT", "---"},
-		{"VERSION", formatter.BoldDirtyDefault(deployedVersion)},
-		{"CHAOS", formatter.BoldDirtyDefault(deployedChaosVersion)},
-
-		{fmt.Sprintf("%s.ENV", strings.ToUpper(app.Name)), "---"},
-		{"CURRENT VERSION", formatter.BoldDirtyDefault(envVersion)},
-		{"NEW VERSION", formatter.BoldDirtyDefault(toWriteVersion)},
+	if currentParsed.IsLessThan(newParsed) {
+		return "UPGRADE"
 	}
-
-	overview := formatter.CreateOverview("UNDEPLOY OVERVIEW", rows)
-
-	fmt.Println(overview)
-
-	if NoInput {
-		return nil
-	}
-
-	response := false
-	prompt := &survey.Confirm{Message: "proceed?"}
-	if err := survey.AskOne(prompt, &response); err != nil {
-		return err
-	}
-
-	if !response {
-		log.Fatal("undeploy cancelled")
-	}
-
-	return nil
+	return "DOWNGRADE"
 }
 
 // PostCmds parses a string of commands and executes them inside of the respective services

cli/recipe/fetch.go

@@ -1,11 +1,15 @@
 package recipe
 
 import (
+	"os"
+
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/log"
 	"coopcloud.tech/abra/pkg/recipe"
+	"github.com/go-git/go-git/v5"
+	gitCfg "github.com/go-git/go-git/v5/config"
 	"github.com/spf13/cobra"
 )
 
@@ -13,7 +17,16 @@ var RecipeFetchCommand = &cobra.Command{
 	Use:     "fetch [recipe | --all] [flags]",
 	Aliases: []string{"f"},
 	Short:   "Clone recipe(s) locally",
+	Long:    `Using "--force/-f" Git syncs an existing recipe. It does not erase unstaged changes.`,
 	Args:    cobra.RangeArgs(0, 1),
+	Example: `  # fetch from recipe catalogue
+  abra recipe fetch gitea
+
+  # fetch from remote recipe
+  abra recipe fetch git.foo.org/recipes/myrecipe
+
+  # fetch with ssh remote for hacking
+  abra recipe fetch gitea --ssh`,
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
 		args []string,
@@ -36,10 +49,39 @@ var RecipeFetchCommand = &cobra.Command{
 
 		ensureCtx := internal.GetEnsureContext()
 		if recipeName != "" {
-			r := internal.ValidateRecipe(args, cmd.Name())
-			if err := r.Ensure(ensureCtx); err != nil {
-				log.Fatal(err)
+			r := recipe.Get(recipeName)
+			if _, err := os.Stat(r.Dir); !os.IsNotExist(err) {
+				if !force {
+					log.Warnf("%s is already fetched", r.Name)
+					return
+				}
 			}
+
+			r = internal.ValidateRecipe(args, cmd.Name())
+
+			if sshRemote {
+				if r.SSHURL == "" {
+					log.Warnf("unable to discover SSH remote for %s", r.Name)
+					return
+				}
+
+				repo, err := git.PlainOpen(r.Dir)
+				if err != nil {
+					log.Fatalf("unable to open %s: %s", r.Dir, err)
+				}
+
+				if err = repo.DeleteRemote("origin"); err != nil {
+					log.Fatalf("unable to remove default remote in %s: %s", r.Dir, err)
+				}
+
+				if _, err := repo.CreateRemote(&gitCfg.RemoteConfig{
+					Name: "origin",
+					URLs: []string{r.SSHURL},
+				}); err != nil {
+					log.Fatalf("unable to set SSH remote in %s: %s", r.Dir, err)
+				}
+			}
+
 			return
 		}
 
@@ -61,6 +103,8 @@ var RecipeFetchCommand = &cobra.Command{
 
 var (
 	fetchAllRecipes bool
+	sshRemote       bool
+	force           bool
 )
 
 func init() {
@@ -71,4 +115,20 @@ func init() {
 		false,
 		"fetch all recipes",
 	)
+
+	RecipeFetchCommand.Flags().BoolVarP(
+		&sshRemote,
+		"ssh",
+		"s",
+		false,
+		"automatically set ssh remote",
+	)
+
+	RecipeFetchCommand.Flags().BoolVarP(
+		&force,
+		"force",
+		"f",
+		false,
+		"force re-fetch",
+	)
 }

cli/run.go

@@ -35,6 +35,7 @@ func Run(version, commit string) {
 				config.ABRA_DIR,
 				config.SERVERS_DIR,
 				config.RECIPES_DIR,
+				config.LOGS_DIR,
 				config.VENDOR_DIR, // TODO(d1): remove > 0.9.x
 				config.BACKUP_DIR, // TODO(d1): remove > 0.9.x
 			}

cli/server/add.go

@@ -103,8 +103,7 @@ developer machine. The domain is then set to "default".`,
 
 		if _, err := client.New(name, timeout); err != nil {
 			cleanUp(name)
-			log.Debugf("ssh %s error: %s", name, sshPkg.Fatal(name, err))
-			log.Fatalf("can't ssh to %s, make sure \"ssh %s\" works", name, name)
+			log.Fatalf("ssh %s error: %s", name, sshPkg.Fatal(name, err))
 		}
 
 		if created {

cli/updater/updater.go

@@ -441,7 +441,25 @@ func upgrade(cl *dockerclient.Client, stackName, recipeName, upgradeVersion stri
 
 	log.Infof("upgrade %s (%s) to version %s", stackName, recipeName, upgradeVersion)
 
-	err = stack.RunDeploy(cl, deployOpts, compose, stackName, true)
+	serviceNames, err := appPkg.GetAppServiceNames(app.Name)
+	if err != nil {
+		return err
+	}
+
+	f, err := app.Filters(true, false, serviceNames...)
+	if err != nil {
+		return err
+	}
+
+	err = stack.RunDeploy(
+		cl,
+		deployOpts,
+		compose,
+		stackName,
+		app.Server,
+		true,
+		f,
+	)
 
 	return err
 }

go.mod

@@ -1,6 +1,6 @@
 module coopcloud.tech/abra
 
-go 1.22.7
+go 1.23.0
 
 toolchain go1.23.1
 
@@ -8,21 +8,22 @@ require (
 	coopcloud.tech/tagcmp v0.0.0-20230809071031-eb3e7758d4eb
 	git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c
 	github.com/AlecAivazis/survey/v2 v2.3.7
-	github.com/charmbracelet/lipgloss v1.0.0
-	github.com/charmbracelet/log v0.4.0
+	github.com/charmbracelet/bubbletea v1.3.4
+	github.com/charmbracelet/lipgloss v1.1.0
+	github.com/charmbracelet/log v0.4.1
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v27.4.1+incompatible
-	github.com/docker/docker v27.4.1+incompatible
+	github.com/docker/cli v28.0.1+incompatible
+	github.com/docker/docker v28.0.1+incompatible
 	github.com/docker/go-units v0.5.0
-	github.com/go-git/go-git/v5 v5.13.1
-	github.com/google/go-cmp v0.6.0
+	github.com/go-git/go-git/v5 v5.14.0
+	github.com/google/go-cmp v0.7.0
 	github.com/moby/sys/signal v0.7.1
 	github.com/moby/term v0.5.2
 	github.com/pkg/errors v0.9.1
-	github.com/schollz/progressbar/v3 v3.17.1
-	golang.org/x/term v0.28.0
+	github.com/schollz/progressbar/v3 v3.18.0
+	golang.org/x/term v0.30.0
 	gopkg.in/yaml.v3 v3.0.1
-	gotest.tools/v3 v3.5.1
+	gotest.tools/v3 v3.5.2
 )
 
 require (
@@ -31,16 +32,19 @@ require (
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/BurntSushi/toml v1.4.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/ProtonMail/go-crypto v1.1.3 // indirect
+	github.com/ProtonMail/go-crypto v1.1.6 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/x/ansi v0.6.0 // indirect
-	github.com/cloudflare/circl v1.5.0 // indirect
+	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
+	github.com/charmbracelet/x/ansi v0.8.0 // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
+	github.com/charmbracelet/x/term v0.2.1 // indirect
+	github.com/cloudflare/circl v1.6.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
-	github.com/cyphar/filepath-securejoin v0.3.6 // indirect
+	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
@@ -48,11 +52,12 @@ require (
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.6.1 // indirect
+	github.com/go-git/go-billy/v5 v5.6.2 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
@@ -60,70 +65,71 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/mmcloughlin/avo v0.6.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/sys/mountinfo v0.6.2 // indirect
 	github.com/moby/sys/user v0.3.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
-	github.com/muesli/termenv v0.15.2 // indirect
+	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
+	github.com/muesli/cancelreader v0.2.2 // indirect
+	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/runc v1.1.13 // indirect
 	github.com/opencontainers/runtime-spec v1.1.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
-	github.com/pjbgf/sha1cd v0.3.1 // indirect
+	github.com/pjbgf/sha1cd v0.3.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.61.0 // indirect
+	github.com/prometheus/common v0.63.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/skeema/knownhosts v1.3.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/skeema/knownhosts v1.3.1 // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
-	go.opentelemetry.io/otel v1.33.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.33.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.35.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 // indirect
-	go.opentelemetry.io/otel/metric v1.33.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.33.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.33.0 // indirect
-	go.opentelemetry.io/otel/trace v1.33.0 // indirect
+	go.opentelemetry.io/otel/metric v1.35.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.35.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.35.0 // indirect
+	go.opentelemetry.io/otel/trace v1.35.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
-	golang.org/x/crypto v0.32.0 // indirect
-	golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 // indirect
-	golang.org/x/mod v0.22.0 // indirect
-	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/sync v0.10.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/time v0.9.0 // indirect
-	golang.org/x/tools v0.29.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 // indirect
-	google.golang.org/grpc v1.69.2 // indirect
-	google.golang.org/protobuf v1.36.2 // indirect
+	golang.org/x/crypto v0.36.0 // indirect
+	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect
+	golang.org/x/net v0.37.0 // indirect
+	golang.org/x/sync v0.12.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/time v0.11.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
+	google.golang.org/grpc v1.71.0 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
@@ -132,19 +138,19 @@ require (
 	github.com/containers/image v3.0.2+incompatible
 	github.com/containers/storage v1.38.2 // indirect
 	github.com/decentral1se/passgen v1.0.1
-	github.com/docker/docker-credential-helpers v0.8.2 // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/fvbommel/sortorder v1.1.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.7
 	github.com/moby/patternmatcher v0.6.0 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0 // indirect
-	github.com/prometheus/client_golang v1.20.5 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/prometheus/client_golang v1.21.1 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
-	github.com/spf13/cobra v1.8.1
+	github.com/spf13/cobra v1.9.1
 	github.com/stretchr/testify v1.10.0
 	github.com/theupdateframework/notary v0.7.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	golang.org/x/sys v0.29.0
+	golang.org/x/sys v0.31.0
 )

go.sum

@@ -79,8 +79,8 @@ github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb0
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/ProtonMail/go-crypto v1.1.3 h1:nRBOetoydLeUb4nHajyO2bKqMLfWQ/ZPwkXqXxPxCFk=
-github.com/ProtonMail/go-crypto v1.1.3/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
+github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
+github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
@@ -131,19 +131,26 @@ github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInq
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/lipgloss v1.0.0 h1:O7VkGDvqEdGi93X+DeqsQ7PKHDgtQfF8j8/O2qFMQNg=
-github.com/charmbracelet/lipgloss v1.0.0/go.mod h1:U5fy9Z+C38obMs+T+tJqst9VGzlOYGj4ri9reL3qUlo=
-github.com/charmbracelet/log v0.4.0 h1:G9bQAcx8rWA2T3pWvx7YtPTPwgqpk7D68BX21IRW8ZM=
-github.com/charmbracelet/log v0.4.0/go.mod h1:63bXt/djrizTec0l11H20t8FDSvA4CRZJ1KH22MdptM=
-github.com/charmbracelet/x/ansi v0.6.0 h1:qOznutrb93gx9oMiGf7caF7bqqubh6YIM0SWKyA08pA=
-github.com/charmbracelet/x/ansi v0.6.0/go.mod h1:KBUFw1la39nl0dLl10l5ORDAqGXaeurTQmwyyVKse/Q=
+github.com/charmbracelet/bubbletea v1.3.4 h1:kCg7B+jSCFPLYRA52SDZjr51kG/fMUEoPoZrkaDHyoI=
+github.com/charmbracelet/bubbletea v1.3.4/go.mod h1:dtcUCyCGEX3g9tosuYiut3MXgY/Jsv9nKVdibKKRRXo=
+github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
+github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
+github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
+github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
+github.com/charmbracelet/log v0.4.1 h1:6AYnoHKADkghm/vt4neaNEXkxcXLSV2g1rdyFDOpTyk=
+github.com/charmbracelet/log v0.4.1/go.mod h1:pXgyTsqsVu4N9hGdHmQ0xEA4RsXof402LX9ZgiITn2I=
+github.com/charmbracelet/x/ansi v0.8.0 h1:9GTq3xq9caJW8ZrBTe0LIe2fvfLR/bYXKTx2llXn7xE=
+github.com/charmbracelet/x/ansi v0.8.0/go.mod h1:wdYl/ONOLHLIVmQaxbIYEC/cRKOQyjTkowiI4blgS9Q=
+github.com/charmbracelet/x/cellbuf v0.0.13 h1:/KBBKHuVRbq1lYx5BzEHBAFBP8VcQzJejZ/IA3iR28k=
+github.com/charmbracelet/x/cellbuf v0.0.13/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
 github.com/charmbracelet/x/exp/golden v0.0.0-20240806155701-69247e0abc2a h1:G99klV19u0QnhiizODirwVksQB91TJKV/UaTnACcG30=
 github.com/charmbracelet/x/exp/golden v0.0.0-20240806155701-69247e0abc2a/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
+github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
+github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
 github.com/checkpoint-restore/go-criu/v4 v4.1.0/go.mod h1:xUQBLp4RLc5zJtWY++yjOoMoB5lihDt7fai+75m+rGw=
 github.com/checkpoint-restore/go-criu/v5 v5.0.0/go.mod h1:cfwC0EG7HMUenopBsUf9d89JlCLQIfgVcNsNN0t6T2M=
 github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E=
@@ -161,8 +168,8 @@ github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2u
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004 h1:lkAMpLVBDaj17e85keuznYcH5rqI438v41pKcBl4ZxQ=
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
-github.com/cloudflare/circl v1.5.0 h1:hxIWksrX6XN5a1L2TI/h53AGPhNHoUBo+TD1ms9+pys=
-github.com/cloudflare/circl v1.5.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
+github.com/cloudflare/circl v1.6.0 h1:cr5JKic4HI+LkINy2lg3W2jF8sHCVTBncJr5gIIq7qk=
+github.com/cloudflare/circl v1.6.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
@@ -276,7 +283,6 @@ github.com/coreos/pkg v0.0.0-20160727233714-3ac0863d7acf/go.mod h1:E3G3o1h8I7cfc
 github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
@@ -286,8 +292,8 @@ github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
 github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
-github.com/cyphar/filepath-securejoin v0.3.6 h1:4d9N5ykBnSp5Xn2JkhocYDkOpURL/18CYMpo6xB9uWM=
-github.com/cyphar/filepath-securejoin v0.3.6/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
+github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
+github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
 github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ=
 github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW34z5W5s=
 github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
@@ -306,19 +312,19 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
 github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/cli v27.4.1+incompatible h1:VzPiUlRJ/xh+otB75gva3r05isHMo5wXDfPRi5/b4hI=
-github.com/docker/cli v27.4.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.0.1+incompatible h1:g0h5NQNda3/CxIsaZfH4Tyf6vpxFth7PYl3hgCPOKzs=
+github.com/docker/cli v28.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v27.4.1+incompatible h1:ZJvcY7gfwHn1JF48PfbyXg7Jyt9ZCWDW+GGXOIxEwp4=
-github.com/docker/docker v27.4.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.0.1+incompatible h1:FCHjSRdXhNRFjlHMTv4jUNlIBbTeRjrWfeFuJp7jpo0=
+github.com/docker/docker v28.0.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
-github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
-github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
+github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
+github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c/go.mod h1:CADgU4DSXK5QUlFslkQu2yW2TKzFZcXq/leZfM0UH5Q=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
@@ -341,8 +347,8 @@ github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:Htrtb
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dvsekhvalnov/jose2go v0.0.0-20170216131308-f21a8cedbbae/go.mod h1:7BvyPhdbLxMXIYTFPLsyJRFMsKmOZnQmzh6Gb+uquuM=
 github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
-github.com/elazarl/goproxy v1.2.3 h1:xwIyKHbaP5yfT6O9KIeYJR5549MXRQkoQMRXGztz8YQ=
-github.com/elazarl/goproxy v1.2.3/go.mod h1:YfEbZtqP4AetfO6d40vWchF3znWX7C7Vd6ZMfdL8z64=
+github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
+github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
 github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
@@ -353,6 +359,8 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
 github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5/go.mod h1:a2zkGnVExMxdzMo3M0Hi/3sEU+cWnZpSni0O6/Yb/P0=
 github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
@@ -377,12 +385,12 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.6.1 h1:u+dcrgaguSSkbjzHwelEjc0Yj300NUevrrPphk/SoRA=
-github.com/go-git/go-billy/v5 v5.6.1/go.mod h1:0AsLr1z2+Uksi4NlElmMblP5rPcDZNRCD8ujZCRR2BE=
+github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
+github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.13.1 h1:DAQ9APonnlvSWpvolXWIuV6Q6zXy2wHbN4cVlNR5Q+M=
-github.com/go-git/go-git/v5 v5.13.1/go.mod h1:qryJB4cSBoq3FRoBRf5A77joojuBcmPJ0qu3XXXVixc=
+github.com/go-git/go-git/v5 v5.14.0 h1:/MD3lCrGjCen5WfEAzKg00MJJffKhC8gzS80ycmCi60=
+github.com/go-git/go-git/v5 v5.14.0/go.mod h1:Z5Xhoia5PcWA3NF8vRLURn9E5FRhSl7dGj9ItW3Wk5k=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -479,8 +487,8 @@ github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-containerregistry v0.5.1/go.mod h1:Ct15B4yir3PLOP5jsy0GNeYVaIZs/MK/Jz5any1wFW0=
 github.com/google/go-intervals v0.0.2/go.mod h1:MkaR3LNRfeKLPmqgJYs4E66z5InYjmCjbbr4TQlcT6Y=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -520,10 +528,9 @@ github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 h1:VNqngBF40hVlDloBruUehVYC3ArSgIyScOAyMRqBxRg=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1/go.mod h1:RBRO7fro65R6tjKzYgLAFo0t1QEXY1Dp+i/bvpRiqiQ=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -585,8 +592,8 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/compress v1.11.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.11.13/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.14.2/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
-github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
-github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -618,13 +625,14 @@ github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7
 github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
+github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
@@ -651,8 +659,6 @@ github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
-github.com/mmcloughlin/avo v0.6.0 h1:QH6FU8SKoTLaVs80GA8TJuLNkUYl4VokHKlPhVDg4YY=
-github.com/mmcloughlin/avo v0.6.0/go.mod h1:8CoAGaCSYXtCPR+8y18Y9aB/kxb8JSS6FRI7mSkvD+8=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
@@ -673,8 +679,6 @@ github.com/moby/sys/user v0.3.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.0.0-20200312100748-672ec06f55cd/go.mod h1:DdlQx2hp0Ss5/fLikoLlEeIYiATotOjgB//nb973jeo=
-github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
-github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -685,8 +689,12 @@ github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjY
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
-github.com/muesli/termenv v0.15.2 h1:GohcuySI0QmI3wN8Ok9PtKGkgkFIk7y6Vpb5PvrY+Wo=
-github.com/muesli/termenv v0.15.2/go.mod h1:Epx+iuz8sNs7mNKhxzH4fWXGNpZwUaJKRS1noLXviQ8=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
+github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
+github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
+github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
+github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
@@ -723,8 +731,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.0.0/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v1.0.0-rc8.0.20190926000215-3e425f80a8c9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
@@ -754,8 +762,8 @@ github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrap
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
-github.com/pjbgf/sha1cd v0.3.1 h1:Dh2GYdpJnO84lIw0LJwTFXjcNbasP/bklicSznyAaPI=
-github.com/pjbgf/sha1cd v0.3.1/go.mod h1:Y8t7jSB/dEI/lQE04A1HVKteqjj9bX5O4+Cex0TCu8s=
+github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
+github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -771,8 +779,8 @@ github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDf
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
-github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
+github.com/prometheus/client_golang v1.21.1 h1:DOvXXTqVzvkIewV/CDPFdejpMCGeMcbGCQ8YOmu+Ibk=
+github.com/prometheus/client_golang v1.21.1/go.mod h1:U9NM32ykUErtVBxdvD3zfi+EuFkkaBvMb09mIfe0Zgg=
 github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -786,8 +794,8 @@ github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y8
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/common v0.61.0 h1:3gv/GThfX0cV2lpO7gkTUwZru38mxevy90Bj8YFSRQQ=
-github.com/prometheus/common v0.61.0/go.mod h1:zr29OCN/2BsJRaFwG8QOBr41D6kkchKbpeNH7pAjb/s=
+github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
+github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
 github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
@@ -808,16 +816,15 @@ github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUc
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
-github.com/russross/blackfriday v1.6.0 h1:KqfZb0pUVN2lYqZUYRddxF4OR8ZMURnJIG5Y3VRLtww=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/schollz/progressbar/v3 v3.17.1 h1:bI1MTaoQO+v5kzklBjYNRQLoVpe0zbyRZNK6DFkVC5U=
-github.com/schollz/progressbar/v3 v3.17.1/go.mod h1:RzqpnsPQNjUyIgdglUjRLgD7sVnxN1wpmBMV+UiEbL4=
+github.com/schollz/progressbar/v3 v3.18.0 h1:uXdoHABRFmNIjUfte/Ex7WtuyVslrw2wVPQmCN62HpA=
+github.com/schollz/progressbar/v3 v3.18.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
 github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
 github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
@@ -834,8 +841,8 @@ github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.3.0 h1:AM+y0rI04VksttfwjkSTNQorvGqmwATnvnAHpSgc0LY=
-github.com/skeema/knownhosts v1.3.0/go.mod h1:sPINvnADmT/qYH1kfv+ePMmOBTH6Tbl7b5LvTDjFK7M=
+github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
+github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
@@ -850,8 +857,8 @@ github.com/spf13/cobra v0.0.1/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3
 github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
-github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
-github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
+github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/jwalterweatherman v0.0.0-20141219030609-3d60171a6431/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/jwalterweatherman v1.0.0 h1:XHEdyB+EcvlqZamSM4ZOMGlc93t6AcsBEu9Gc1vn7yk=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
@@ -860,8 +867,9 @@ github.com/spf13/pflag v1.0.0/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnIn
 github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v0.0.0-20150530192845-be5ff3e4840c/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
 github.com/spf13/viper v1.4.0 h1:yXHLWeravcrgGyFSyCgdYpXQ9dR9c/WED3pg1RhxqEU=
 github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
@@ -916,6 +924,8 @@ github.com/xeipuuv/gojsonschema v0.0.0-20180618132009-1d523034197f/go.mod h1:5yf
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -936,29 +946,27 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
-go.opentelemetry.io/otel v1.33.0 h1:/FerN9bax5LoK51X/sI0SVYrjSE0/yUL7DpxW4K3FWw=
-go.opentelemetry.io/otel v1.33.0/go.mod h1:SUUkR6csvUQl+yjReHu5uM3EtVV7MBm5FHKRlNx4I8I=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.33.0 h1:7F29RDmnlqk6B5d+sUqemt8TBfDqxryYW5gX6L74RFA=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.33.0/go.mod h1:ZiGDq7xwDMKmWDrN1XsXAj0iC7hns+2DhxBFSncNHSE=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 h1:Vh5HayB/0HHfOQA7Ctx69E/Y/DcQSMPpKANYVMQ7fBA=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0/go.mod h1:cpgtDBaqD/6ok/UG0jT15/uKjAY8mRA53diogHBg3UI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 h1:5pojmb1U1AogINhN3SurB+zm/nIcusopeBNp42f45QM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0/go.mod h1:57gTHJSE5S1tqg+EKsLPlTWhpHMsWlVmer+LA926XiA=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0 h1:QcFwRrZLc82r8wODjvyCbP7Ifp3UANaBSmhDSFjnqSc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0/go.mod h1:CXIWhUomyWBG/oY2/r/kLp6K/cmx9e/7DLpBuuGdLCA=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 h1:1fTNlAIJZGWLP5FVu0fikVry1IsiUnXjf7QFvoNN3Xw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0/go.mod h1:zjPK58DtkqQFn+YUMbx0M2XV3QgKU0gS9LeGohREyK4=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 h1:m639+BofXTvcY1q8CGs4ItwQarYtJPOWmVobfM1HpVI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0/go.mod h1:LjReUci/F4BUyv+y4dwnq3h/26iNOeC3wAIqgvTIZVo=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 h1:IeMeyr1aBvBiPVYihXIaeIZba6b8E1bYp7lbdxK8CQg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0/go.mod h1:oVdCUtjq9MK9BlS7TtucsQwUcXcymNiEDjgDD2jMtZU=
-go.opentelemetry.io/otel/metric v1.33.0 h1:r+JOocAyeRVXD8lZpjdQjzMadVZp2M4WmQ+5WtEnklQ=
-go.opentelemetry.io/otel/metric v1.33.0/go.mod h1:L9+Fyctbp6HFTddIxClbQkjtubW6O9QS3Ann/M82u6M=
-go.opentelemetry.io/otel/sdk v1.33.0 h1:iax7M131HuAm9QkZotNHEfstof92xM+N8sr3uHXc2IM=
-go.opentelemetry.io/otel/sdk v1.33.0/go.mod h1:A1Q5oi7/9XaMlIWzPSxLRWOI8nG3FnzHJNbiENQuihM=
-go.opentelemetry.io/otel/sdk/metric v1.33.0 h1:Gs5VK9/WUJhNXZgn8MR6ITatvAmKeIuCtNbsP3JkNqU=
-go.opentelemetry.io/otel/sdk/metric v1.33.0/go.mod h1:dL5ykHZmm1B1nVRk9dDjChwDmt81MjVp3gLkQRwKf/Q=
-go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
-go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
+go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
+go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
+go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
+go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.4.0 h1:TA9WRvW6zMwP+Ssb6fLoUIuirti1gGbP28GcKG1jgeg=
-go.opentelemetry.io/proto/otlp v1.4.0/go.mod h1:PPBWZIP98o2ElSqI35IHfu7hIhSwvc5N38Jw8pXuGFY=
 go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
 go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
@@ -985,10 +993,8 @@ golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWP
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
-golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -999,10 +1005,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329 h1:9kj3STMvgqy3YA4VQXBrN7925ICMxD5wzMRcgA30588=
-golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329/go.mod h1:qj5a5QZpwLU2NLQudwIN5koi3beDhSAlJwa67PuM98c=
-golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 h1:yqrTHse8TCMW1M1ZCP+VAR/l0kKxwaAIqN/il7x4voA=
-golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8/go.mod h1:tujkw807nyEEAamNbDrEGzRav+ilXA7PCRAd6xsmwiU=
+golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
+golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1025,8 +1029,6 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
-golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1068,10 +1070,8 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
-golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
+golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
+golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1089,8 +1089,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1160,6 +1160,7 @@ golang.org/x/sys v0.0.0-20210426230700-d19ff857e887/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1167,20 +1168,15 @@ golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
-golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
-golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
+golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
+golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1190,18 +1186,16 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
-golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
-golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
+golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1247,10 +1241,6 @@ golang.org/x/tools v0.0.0-20200916195026-c9a70fc28ce3/go.mod h1:z6u4i615ZeAfBE4X
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8=
-golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
-golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE=
-golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1299,14 +1289,10 @@ google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfG
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20200527145253-8367513e4ece/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto/googleapis/api v0.0.0-20250102185135-69823020774d h1:H8tOf8XM88HvKqLTxe755haY6r1fqqzLbEnfrmLXlSA=
-google.golang.org/genproto/googleapis/api v0.0.0-20250102185135-69823020774d/go.mod h1:2v7Z7gP2ZUOGsaFyxATQSRoBnKygqVq2Cwnvom7QiqY=
-google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 h1:GVIKPyP/kLIyVOgOnTwFOrvQaQUzOzGMCxgFUOEmm24=
-google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422/go.mod h1:b6h1vNKhxaSoEI+5jc3PJUCustfli/mRab7295pY7rw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 h1:3UsHvIr4Wc2aW4brOaSCmcxh9ksica6fHEr8P1XhkYw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
+google.golang.org/genproto/googleapis/api v0.0.0-20250313205543-e70fdf4c4cb4 h1:IFnXJq3UPB3oBREOodn1v1aGQeZYQclEmvWRMN0PSsY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250313205543-e70fdf4c4cb4/go.mod h1:c8q6Z6OCqnfVIqUFJkCzKcrj8eCvUrz+K4KRzSTuANg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 h1:iK2jbkWL86DXjEx0qiHcRE9dE4/Ahua5k6V8OWFb//c=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -1326,8 +1312,8 @@ google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTp
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
-google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
+google.golang.org/grpc v1.71.0 h1:kF77BGdPTQ4/JZWMlb9VpJ5pa25aqvVqogsxNHHdeBg=
+google.golang.org/grpc v1.71.0/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1341,10 +1327,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
-google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
-google.golang.org/protobuf v1.36.2 h1:R8FeyR1/eLmkutZOM5CWghmo5itiG9z0ktFlTVLuTmU=
-google.golang.org/protobuf v1.36.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/cenkalti/backoff.v2 v2.2.1 h1:eJ9UAg01/HIHG987TwxvnzK2MgxXq97YY6rYDpY9aII=
@@ -1384,12 +1368,11 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
-gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
-gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
+gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=

pkg/app/app.go

@@ -655,19 +655,6 @@ func (a App) WriteRecipeVersion(version string, dryRun bool) error {
 
 		splitted := strings.Split(line, ":")
 
-		if a.Recipe.Dirty {
-			dirtyVersion = fmt.Sprintf("%s%s", version, config.DIRTY_DEFAULT)
-			if strings.Contains(line, dirtyVersion) {
-				skipped = true
-				lines = append(lines, line)
-				continue
-			}
-
-			line = fmt.Sprintf("%s:%s", splitted[0], dirtyVersion)
-			lines = append(lines, line)
-			continue
-		}
-
 		line = fmt.Sprintf("%s:%s", splitted[0], version)
 		lines = append(lines, line)
 	}

pkg/app/app_test.go

@@ -223,16 +223,4 @@ func TestWriteRecipeVersionOverwrite(t *testing.T) {
 	}
 
 	assert.Equal(t, "foo", app.Recipe.EnvVersion)
-
-	app.Recipe.Dirty = true
-	if err := app.WriteRecipeVersion("foo+U", false); err != nil {
-		t.Fatal(err)
-	}
-
-	app, err = appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	assert.Equal(t, "foo+U", app.Recipe.EnvVersion)
 }

pkg/app/compose.go

@@ -44,6 +44,16 @@ func SetChaosVersionLabel(compose *composetypes.Config, stackName string, chaosV
 	}
 }
 
+func SetVersionLabel(compose *composetypes.Config, stackName string, version string) {
+	for _, service := range compose.Services {
+		if service.Name == "app" {
+			log.Debugf("set label 'coop-cloud.%s.version' to %v for %s", stackName, version, stackName)
+			labelKey := fmt.Sprintf("coop-cloud.%s.version", stackName)
+			service.Deploy.Labels[labelKey] = version
+		}
+	}
+}
+
 // SetUpdateLabel adds env ENABLE_AUTO_UPDATE as label to enable/disable the
 // auto update process for this app. The default if this variable is not set is to disable
 // the auto update process.

pkg/config/abra.go

@@ -90,6 +90,7 @@ func (a Abra) GetAbraDir() string {
 
 func (a Abra) GetServersDir() string   { return path.Join(a.GetAbraDir(), "servers") }
 func (a Abra) GetRecipesDir() string   { return path.Join(a.GetAbraDir(), "recipes") }
+func (a Abra) GetLogsDir() string      { return path.Join(a.GetAbraDir(), "logs") }
 func (a Abra) GetVendorDir() string    { return path.Join(a.GetAbraDir(), "vendor") }
 func (a Abra) GetBackupDir() string    { return path.Join(a.GetAbraDir(), "backups") }
 func (a Abra) GetCatalogueDir() string { return path.Join(a.GetAbraDir(), "catalogue") }
@@ -100,6 +101,7 @@ var (
 	ABRA_DIR                  = config.GetAbraDir()
 	SERVERS_DIR               = config.GetServersDir()
 	RECIPES_DIR               = config.GetRecipesDir()
+	LOGS_DIR                  = config.GetLogsDir()
 	VENDOR_DIR                = config.GetVendorDir()
 	BACKUP_DIR                = config.GetBackupDir()
 	CATALOGUE_DIR             = config.GetCatalogueDir()

pkg/git/clone.go

@@ -1,7 +1,10 @@
 package git
 
 import (
+	"context"
+	"fmt"
 	"os"
+	"os/signal"
 	"strings"
 
 	"coopcloud.tech/abra/pkg/log"
@@ -22,46 +25,81 @@ func gitCloneIgnoreErr(err error) bool {
 	return false
 }
 
-// Clone runs a git clone which accounts for different default branches.
+// Clone runs a git clone which accounts for different default branches. This
+// function respects Ctrl+C (SIGINT) calls from the user, cancelling the
+// context and deleting the (typically) half-baked clone of the repository.
+// This avoids broken state for future clone / recipe ops.
 func Clone(dir, url string) error {
-	if _, err := os.Stat(dir); os.IsNotExist(err) {
-		log.Debugf("git clone: %s", dir, url)
+	ctx := context.Background()
+	ctx, cancelCtx := context.WithCancel(ctx)
 
-		_, err := git.PlainClone(dir, false, &git.CloneOptions{
-			URL:           url,
-			Tags:          git.AllTags,
-			ReferenceName: plumbing.ReferenceName("refs/heads/main"),
-			SingleBranch:  true,
-		})
+	sigIntCh := make(chan os.Signal, 1)
+	signal.Notify(sigIntCh, os.Interrupt)
+	defer func() {
+		signal.Stop(sigIntCh)
+		cancelCtx()
+	}()
 
-		if err != nil && gitCloneIgnoreErr(err) {
-			log.Debugf("git clone: %s cloned successfully", dir)
-			return nil
-		}
+	errCh := make(chan error)
 
-		if err != nil {
-			log.Debug("git clone: main branch failed, attempting master branch")
+	go func() {
+		if _, err := os.Stat(dir); os.IsNotExist(err) {
+			log.Debugf("git clone: %s", url)
 
-			_, err := git.PlainClone(dir, false, &git.CloneOptions{
+			_, err := git.PlainCloneContext(ctx, dir, false, &git.CloneOptions{
 				URL:           url,
 				Tags:          git.AllTags,
-				ReferenceName: plumbing.ReferenceName("refs/heads/master"),
+				ReferenceName: plumbing.ReferenceName("refs/heads/main"),
 				SingleBranch:  true,
 			})
 
 			if err != nil && gitCloneIgnoreErr(err) {
 				log.Debugf("git clone: %s cloned successfully", dir)
-				return nil
+				errCh <- nil
+			}
+
+			if err := ctx.Err(); err != nil {
+				errCh <- fmt.Errorf("git clone %s: cancelled due to interrupt", dir)
 			}
 
 			if err != nil {
-				return err
+				log.Debug("git clone: main branch failed, attempting master branch")
+
+				_, err := git.PlainCloneContext(ctx, dir, false, &git.CloneOptions{
+					URL:           url,
+					Tags:          git.AllTags,
+					ReferenceName: plumbing.ReferenceName("refs/heads/master"),
+					SingleBranch:  true,
+				})
+
+				if err != nil && gitCloneIgnoreErr(err) {
+					log.Debugf("git clone: %s cloned successfully", dir)
+					errCh <- nil
+				}
+
+				if err != nil {
+					errCh <- err
+				}
 			}
+
+			log.Debugf("git clone: %s cloned successfully", dir)
+		} else {
+			log.Debugf("git clone: %s already exists", dir)
 		}
 
-		log.Debugf("git clone: %s cloned successfully", dir)
-	} else {
-		log.Debugf("git clone: %s already exists", dir)
+		errCh <- nil
+	}()
+
+	select {
+	case <-sigIntCh:
+		cancelCtx()
+		fmt.Println() // NOTE(d1): newline after ^C
+		if err := os.RemoveAll(dir); err != nil {
+			return fmt.Errorf("unable to clean up git clone of %s: %s", dir, err)
+		}
+		return fmt.Errorf("git clone %s: cancelled due to interrupt", dir)
+	case err := <-errCh:
+		return err
 	}
 
 	return nil

pkg/git/clone_test.go

@@ -0,0 +1,48 @@
+package git
+
+import (
+	"fmt"
+	"os"
+	"path"
+	"syscall"
+	"testing"
+
+	"coopcloud.tech/abra/pkg/config"
+)
+
+func TestClone(t *testing.T) {
+	dir := path.Join(config.RECIPES_DIR, "gitea")
+	os.RemoveAll(dir)
+
+	gitURL := fmt.Sprintf("%s/%s.git", config.REPOS_BASE_URL, "gitea")
+	if err := Clone(dir, gitURL); err != nil {
+		t.Fatalf("unable to git clone gitea: %s", err)
+	}
+
+	if _, err := os.Stat(dir); err != nil && os.IsNotExist(err) {
+		t.Fatal("gitea repo was not cloned successfully")
+	}
+}
+
+func TestCancelGitClone(t *testing.T) {
+	dir := path.Join(config.RECIPES_DIR, "gitea")
+	os.RemoveAll(dir)
+
+	go func() {
+		p, err := os.FindProcess(os.Getpid())
+		if err != nil {
+			t.Fatalf("unable to find current process: %s", err)
+		}
+
+		p.Signal(syscall.SIGINT)
+	}()
+
+	gitURL := fmt.Sprintf("%s/%s.git", config.REPOS_BASE_URL, "gitea")
+	if err := Clone(dir, gitURL); err == nil {
+		t.Fatal("cloning should have been interrupted")
+	}
+
+	if _, err := os.Stat(dir); err != nil && !os.IsNotExist(err) {
+		t.Fatal("recipe repo was not deleted")
+	}
+}

pkg/lint/recipe.go

@@ -15,8 +15,10 @@ import (
 	"github.com/go-git/go-git/v5/plumbing"
 )
 
-var Warn = "warn"
-var Critical = "critical"
+var (
+	Warn     = "warn"
+	Critical = "critical"
+)
 
 type LintFunction func(recipe.Recipe) (bool, error)
 
@@ -194,7 +196,7 @@ func LintForErrors(recipe recipe.Recipe) error {
 
 			ok, err := rule.Function(recipe)
 			if err != nil {
-				return err
+				return fmt.Errorf("lint %s: %s", rule.Ref, err)
 			}
 			if !ok {
 				return fmt.Errorf("lint error in %s configs: \"%s\" failed lint checks (%s)", recipe.Name, rule.Description, rule.Ref)

pkg/log/log.go

@@ -2,8 +2,10 @@
 package log
 
 import (
+	"math"
 	"os"
 
+	tea "github.com/charmbracelet/bubbletea"
 	charmLog "github.com/charmbracelet/log"
 )
 
@@ -32,3 +34,13 @@ var SetLevel = Logger.SetLevel
 var DebugLevel = charmLog.DebugLevel
 var SetOutput = charmLog.SetOutput
 var SetReportCaller = charmLog.SetReportCaller
+
+type f func() (tea.Model, error)
+
+func Without(fn f) (tea.Model, error) {
+	l := Logger.GetLevel()
+	Logger.SetLevel(math.MaxInt)
+	m, err := fn()
+	Logger.SetLevel(l)
+	return m, err
+}

pkg/logs/logs.go

@@ -0,0 +1,104 @@
+package logs
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+	"sync"
+
+	"github.com/docker/docker/api/types"
+	containerTypes "github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+	dockerClient "github.com/docker/docker/client"
+)
+
+type TailOpts struct {
+	AppName  string
+	Services []string
+	StdErr   bool
+	Since    string
+	Buffer   *[]string
+	ToBuffer bool
+	Filters  filters.Args
+}
+
+// TailLogs gathers logs for the given app with optional service names to be
+// filtered on. These logs can be printed to os.Stdout or gathered to a buffer.
+func TailLogs(
+	cl *dockerClient.Client,
+	opts TailOpts,
+) error {
+	sigIntCh := make(chan os.Signal, 1)
+	signal.Notify(sigIntCh, os.Interrupt)
+	defer signal.Stop(sigIntCh)
+
+	services, err := cl.ServiceList(
+		context.Background(),
+		types.ServiceListOptions{Filters: opts.Filters},
+	)
+	if err != nil {
+		return err
+	}
+
+	errCh := make(chan error)
+	waitCh := make(chan struct{})
+
+	go func() {
+		var wg sync.WaitGroup
+		for _, service := range services {
+			wg.Add(1)
+			go func(serviceID string) {
+				tail := "50"
+				if opts.ToBuffer {
+					// NOTE(d1): more logs from before deployment when analysing via file
+					tail = "150"
+				}
+
+				logs, err := cl.ServiceLogs(context.Background(), serviceID, containerTypes.LogsOptions{
+					ShowStderr: true,
+					ShowStdout: !opts.StdErr,
+					Since:      opts.Since,
+					Until:      "",
+					Timestamps: true,
+					Follow:     true,
+					Tail:       tail,
+					Details:    false,
+				})
+
+				if err == nil {
+					defer logs.Close()
+					if opts.ToBuffer {
+						buf := bufio.NewScanner(logs)
+						for buf.Scan() {
+							line := fmt.Sprintf("%s: %s", service.Spec.Name, buf.Text())
+							*opts.Buffer = append(*opts.Buffer, line)
+						}
+						logs.Close()
+						return
+					}
+
+					if _, err = io.Copy(os.Stdout, logs); err != nil && err != io.EOF {
+						errCh <- fmt.Errorf("tailLogs: unable to copy buffer: %s", err)
+					}
+				}
+			}(service.ID)
+		}
+
+		wg.Wait()
+		close(waitCh)
+	}()
+
+	select {
+	case <-waitCh:
+		return nil
+	case <-sigIntCh:
+		return nil
+	case err := <-errCh:
+		return err
+	}
+
+	return nil
+}

pkg/recipe/git.go

@@ -4,11 +4,14 @@ import (
 	"fmt"
 	"os"
 	"slices"
+	"sort"
 	"strings"
 
+	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/formatter"
 	gitPkg "coopcloud.tech/abra/pkg/git"
 	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/tagcmp"
 	"github.com/distribution/reference"
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/plumbing"
@@ -43,6 +46,9 @@ func (r Recipe) Ensure(ctx EnsureContext) error {
 
 	if r.EnvVersion != "" && !ctx.IgnoreEnvVersion {
 		log.Debugf("ensuring env version %s", r.EnvVersion)
+		if strings.Contains(r.EnvVersion, "+U") {
+			log.Fatalf("can not redeploy chaos version (%s) without --chaos", r.EnvVersion)
+		}
 
 		if _, err := r.EnsureVersion(r.EnvVersion); err != nil {
 			return err
@@ -272,19 +278,14 @@ func (r Recipe) EnsureUpToDate() error {
 	return nil
 }
 
-// IsDirty checks whether a recipe is dirty or not. N.B., if you call IsDirty
-// from another Recipe method, you should propagate the pointer reference (*).
-func (r *Recipe) IsDirty() error {
+// IsDirty checks whether a recipe is dirty or not.
+func (r *Recipe) IsDirty() (bool, error) {
 	isClean, err := gitPkg.IsClean(r.Dir)
 	if err != nil {
-		return err
+		return false, err
 	}
 
-	if !isClean {
-		r.Dirty = true
-	}
-
-	return nil
+	return !isClean, nil
 }
 
 // ChaosVersion constructs a chaos mode recipe version.
@@ -298,8 +299,12 @@ func (r *Recipe) ChaosVersion() (string, error) {
 
 	version = formatter.SmallSHA(head.String())
 
-	if err := r.IsDirty(); err != nil {
-		return version, err
+	dirty, err := r.IsDirty()
+	if err != nil {
+		return "", err
+	}
+	if dirty {
+		return fmt.Sprintf("%s%s", version, config.DIRTY_DEFAULT), nil
 	}
 
 	return version, nil
@@ -345,6 +350,18 @@ func (r Recipe) Tags() ([]string, error) {
 		return tags, err
 	}
 
+	sort.Slice(tags, func(i, j int) bool {
+		version1, err := tagcmp.Parse(tags[i])
+		if err != nil {
+			return false
+		}
+		version2, err := tagcmp.Parse(tags[j])
+		if err != nil {
+			return false
+		}
+		return version1.IsLessThan(version2)
+	})
+
 	log.Debugf("detected %s as tags for recipe %s", strings.Join(tags, ", "), r.Name)
 
 	return tags, nil

pkg/recipe/git_test.go

@@ -15,10 +15,6 @@ func TestIsDirty(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := r.IsDirty(); err != nil {
-		t.Fatal(err)
-	}
-
 	assert.False(t, r.Dirty)
 
 	fpath := filepath.Join(r.Dir, "foo.txt")
@@ -31,9 +27,10 @@ func TestIsDirty(t *testing.T) {
 		os.Remove(fpath)
 	})
 
-	if err := r.IsDirty(); err != nil {
+	dirty, err := r.IsDirty()
+	if err != nil {
 		t.Fatal(err)
 	}
 
-	assert.True(t, r.Dirty)
+	assert.True(t, dirty)
 }

pkg/recipe/recipe.go

@@ -12,6 +12,8 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/go-git/go-git/v5"
+
 	"coopcloud.tech/abra/pkg/catalogue"
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/formatter"
@@ -20,7 +22,6 @@ import (
 	"coopcloud.tech/abra/pkg/log"
 	"coopcloud.tech/abra/pkg/web"
 	"coopcloud.tech/tagcmp"
-	"github.com/go-git/go-git/v5"
 )
 
 // RecipeCatalogueURL is the only current recipe catalogue available.
@@ -119,22 +120,9 @@ type Features struct {
 	SSO         string `json:"sso"`
 }
 
-func GetEnvVersionRaw(name string) (string, error) {
-	var version string
-
-	if strings.Contains(name, ":") {
-		split := strings.Split(name, ":")
-		if len(split) > 2 {
-			return version, fmt.Errorf("version seems invalid: %s", name)
-		}
-		version = split[1]
-	}
-
-	return version, nil
-}
-
 func Get(name string) Recipe {
 	version := ""
+	versionRaw := ""
 	if strings.Contains(name, ":") {
 		split := strings.Split(name, ":")
 		if len(split) > 2 {
@@ -143,6 +131,7 @@ func Get(name string) Recipe {
 		name = split[0]
 
 		version = split[1]
+		versionRaw = version
 		if strings.HasSuffix(version, config.DIRTY_DEFAULT) {
 			version = strings.Replace(split[1], config.DIRTY_DEFAULT, "", 1)
 			log.Debugf("removed dirty suffix from .env version: %s -> %s", split[1], version)
@@ -167,11 +156,12 @@ func Get(name string) Recipe {
 	dir := path.Join(config.RECIPES_DIR, escapeRecipeName(name))
 
 	r := Recipe{
-		Name:       name,
-		EnvVersion: version,
-		Dir:        dir,
-		GitURL:     gitURL,
-		SSHURL:     sshURL,
+		Name:          name,
+		EnvVersion:    version,
+		EnvVersionRaw: versionRaw,
+		Dir:           dir,
+		GitURL:        gitURL,
+		SSHURL:        sshURL,
 
 		ComposePath:   path.Join(dir, "compose.yml"),
 		ReadmePath:    path.Join(dir, "README.md"),
@@ -179,20 +169,23 @@ func Get(name string) Recipe {
 		AbraShPath:    path.Join(dir, "abra.sh"),
 	}
 
-	if err := r.IsDirty(); err != nil && !errors.Is(err, git.ErrRepositoryNotExists) {
+	dirty, err := r.IsDirty()
+	if err != nil && !errors.Is(err, git.ErrRepositoryNotExists) {
 		log.Fatalf("failed to check git status of %s: %s", r.Name, err)
 	}
+	r.Dirty = dirty
 
 	return r
 }
 
 type Recipe struct {
-	Name       string
-	EnvVersion string
-	Dirty      bool // NOTE(d1): git terminology for unstaged changes
-	Dir        string
-	GitURL     string
-	SSHURL     string
+	Name          string
+	EnvVersion    string
+	EnvVersionRaw string
+	Dirty         bool // NOTE(d1): git terminology for unstaged changes
+	Dir           string
+	GitURL        string
+	SSHURL        string
 
 	ComposePath   string
 	ReadmePath    string

pkg/recipe/recipe_test.go

@@ -34,6 +34,7 @@ func TestGet(t *testing.T) {
 			recipe: Recipe{
 				Name:          "foo",
 				EnvVersion:    "1.2.3",
+				EnvVersionRaw: "1.2.3",
 				Dir:           path.Join(cfg.GetAbraDir(), "/recipes/foo"),
 				GitURL:        "https://git.coopcloud.tech/coop-cloud/foo.git",
 				SSHURL:        "ssh://git@git.coopcloud.tech:2222/coop-cloud/foo.git",
@@ -61,6 +62,22 @@ func TestGet(t *testing.T) {
 			recipe: Recipe{
 				Name:          "mygit.org/myorg/cool-recipe",
 				EnvVersion:    "1.2.4",
+				EnvVersionRaw: "1.2.4",
+				Dir:           path.Join(cfg.GetAbraDir(), "/recipes/mygit_org_myorg_cool-recipe"),
+				GitURL:        "https://mygit.org/myorg/cool-recipe.git",
+				SSHURL:        "ssh://git@mygit.org/myorg/cool-recipe.git",
+				ComposePath:   path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/compose.yml"),
+				ReadmePath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/README.md"),
+				SampleEnvPath: path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/.env.sample"),
+				AbraShPath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/abra.sh"),
+			},
+		},
+		{
+			name: "mygit.org/myorg/cool-recipe:1e83340e+U",
+			recipe: Recipe{
+				Name:          "mygit.org/myorg/cool-recipe",
+				EnvVersion:    "1e83340e",
+				EnvVersionRaw: "1e83340e+U",
 				Dir:           path.Join(cfg.GetAbraDir(), "/recipes/mygit_org_myorg_cool-recipe"),
 				GitURL:        "https://mygit.org/myorg/cool-recipe.git",
 				SSHURL:        "ssh://git@mygit.org/myorg/cool-recipe.git",
@@ -105,16 +122,3 @@ func TestGetVersionLabelLocalDoesNotUseTimeoutLabel(t *testing.T) {
 		assert.NotEqual(t, label, defaultTimeoutLabel)
 	}
 }
-
-func TestDirtyMarkerRemoved(t *testing.T) {
-	r := Get("abra-test-recipe:1e83340e+U")
-	assert.Equal(t, "1e83340e", r.EnvVersion)
-}
-
-func TestGetEnvVersionRaw(t *testing.T) {
-	v, err := GetEnvVersionRaw("abra-test-recipe:1e83340e+U")
-	if err != nil {
-		t.Fatal(err)
-	}
-	assert.Equal(t, "1e83340e+U", v)
-}

pkg/secret/secret.go

@@ -33,6 +33,10 @@ type Secret struct {
 	// variable. For Example:
 	//   SECRET_FOO=v1 # length=12
 	Length int
+	// Charset comes from the charset modifier at the secret version environment
+	// variable. For Example:
+	//   SECRET_FOO=v1 # charset=default,special
+	Charset string
 	// RemoteName is the name of the secret on the server. For example:
 	//   name: ${STACK_NAME}_test_pass_two_${SECRET_TEST_PASS_TWO_VERSION}
 	// With the following:
@@ -43,38 +47,38 @@ type Secret struct {
 	RemoteName string
 }
 
-// GeneratePasswords generates passwords.
-func GeneratePasswords(count, length uint) ([]string, error) {
+// GeneratePassword generates passwords.
+func GeneratePassword(length uint, charset string) (string, error) {
 	passwords, err := passgen.GeneratePasswords(
-		count,
+		1,
 		length,
-		passgen.AlphabetDefault,
+		charset,
 	)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	log.Debugf("generated %s", strings.Join(passwords, ", "))
 
-	return passwords, nil
+	return passwords[0], nil
 }
 
-// GeneratePassphrases generates human readable and rememberable passphrases.
-func GeneratePassphrases(count uint) ([]string, error) {
+// GeneratePassphrase generates human readable and rememberable passphrases.
+func GeneratePassphrase() (string, error) {
 	passphrases, err := passgen.GeneratePassphrases(
-		count,
+		1,
 		passgen.PassphraseWordCountDefault,
 		rune('-'),
 		passgen.PassphraseCasingDefault,
 		passgen.WordListDefault,
 	)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	log.Debugf("generated %s", strings.Join(passphrases, ", "))
 
-	return passphrases, nil
+	return passphrases[0], nil
 }
 
 // ReadSecretsConfig reads secret names/versions from the recipe config. The
@@ -150,6 +154,8 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 				}
 				value.Length = length
 			}
+
+			value.Charset = resolveCharset(modifierValues["charset"])
 			break
 		}
 		secretValues[secretId] = value
@@ -158,6 +164,22 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 	return secretValues, nil
 }
 
+// resolveCharset sets the passgen Alphabet required for a secret
+func resolveCharset(input string) string {
+	switch strings.ToLower(input) {
+	case "special":
+		return passgen.AlphabetSpecial
+	case "safespecial":
+		return "!@#%^&*_-+="
+	case "default,special", "special,default":
+		return passgen.AlphabetDefault + passgen.AlphabetSpecial
+	case "default,safespecial", "safespecial,default":
+		return passgen.AlphabetDefault + "!@#%^&*_-+="
+	default:
+		return passgen.AlphabetDefault // Fallback to default
+	}
+}
+
 // GenerateSecrets generates secrets locally and sends them to a remote server for storage.
 func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server string) (map[string]string, error) {
 	secretsGenerated := map[string]string{}
@@ -173,13 +195,13 @@ func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server
 			log.Debugf("attempting to generate and store %s on %s", secret.RemoteName, server)
 
 			if secret.Length > 0 {
-				passwords, err := GeneratePasswords(1, uint(secret.Length))
+				password, err := GeneratePassword(uint(secret.Length), secret.Charset)
 				if err != nil {
 					ch <- err
 					return
 				}
 
-				if err := client.StoreSecret(cl, secret.RemoteName, passwords[0], server); err != nil {
+				if err := client.StoreSecret(cl, secret.RemoteName, password, server); err != nil {
 					if strings.Contains(err.Error(), "AlreadyExists") {
 						log.Warnf("%s already exists", secret.RemoteName)
 						ch <- nil
@@ -191,15 +213,15 @@ func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server
 
 				mutex.Lock()
 				defer mutex.Unlock()
-				secretsGenerated[secretName] = passwords[0]
+				secretsGenerated[secretName] = password
 			} else {
-				passphrases, err := GeneratePassphrases(1)
+				passphrase, err := GeneratePassphrase()
 				if err != nil {
 					ch <- err
 					return
 				}
 
-				if err := client.StoreSecret(cl, secret.RemoteName, passphrases[0], server); err != nil {
+				if err := client.StoreSecret(cl, secret.RemoteName, passphrase, server); err != nil {
 					if strings.Contains(err.Error(), "AlreadyExists") {
 						log.Warnf("%s already exists", secret.RemoteName)
 						ch <- nil
@@ -211,7 +233,7 @@ func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server
 
 				mutex.Lock()
 				defer mutex.Unlock()
-				secretsGenerated[secretName] = passphrases[0]
+				secretsGenerated[secretName] = passphrase
 			}
 			ch <- nil
 		}(n, v)

pkg/secret/secret_test.go

@@ -17,16 +17,37 @@ func TestReadSecretsConfig(t *testing.T) {
 	assert.Equal(t, "test_example_com_test_pass_one_v2", secretsFromConfig["test_pass_one"].RemoteName)
 	assert.Equal(t, "v2", secretsFromConfig["test_pass_one"].Version)
 	assert.Equal(t, 0, secretsFromConfig["test_pass_one"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_one"].Charset)
 
 	// Has a length modifier
 	assert.Equal(t, "test_example_com_test_pass_two_v1", secretsFromConfig["test_pass_two"].RemoteName)
 	assert.Equal(t, "v1", secretsFromConfig["test_pass_two"].Version)
 	assert.Equal(t, 10, secretsFromConfig["test_pass_two"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_two"].Charset)
 
 	// Secret name does not include the secret id
 	assert.Equal(t, "test_example_com_pass_three_v2", secretsFromConfig["test_pass_three"].RemoteName)
 	assert.Equal(t, "v2", secretsFromConfig["test_pass_three"].Version)
 	assert.Equal(t, 0, secretsFromConfig["test_pass_three"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_three"].Charset)
+
+	// Has a length modifier and a charset=default,safespecial modifier
+	assert.Equal(t, "test_example_com_test_pass_four_v1", secretsFromConfig["test_pass_four"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_four"].Version)
+	assert.Equal(t, 12, secretsFromConfig["test_pass_four"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#%^&*_-+=", secretsFromConfig["test_pass_four"].Charset)
+
+	// Has a length modifier and a charset=default,special modifier
+	assert.Equal(t, "test_example_com_test_pass_five_v1", secretsFromConfig["test_pass_five"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_five"].Version)
+	assert.Equal(t, 12, secretsFromConfig["test_pass_five"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%^&*_-+=", secretsFromConfig["test_pass_five"].Charset)
+
+	// Has only a charset=default,special modifier, which gets setted but ignored in the generation
+	assert.Equal(t, "test_example_com_test_pass_six_v1", secretsFromConfig["test_pass_six"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_six"].Version)
+	assert.Equal(t, 0, secretsFromConfig["test_pass_six"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%^&*_-+=", secretsFromConfig["test_pass_six"].Charset)
 }
 
 func TestReadSecretsConfigWithLongDomain(t *testing.T) {

pkg/secret/testdir/.env.sample

@@ -1,3 +1,6 @@
 SECRET_TEST_PASS_ONE_VERSION=v2
 SECRET_TEST_PASS_TWO_VERSION=v1 # length=10
 SECRET_TEST_PASS_THREE_VERSION=v2
+SECRET_TEST_PASS_FOUR_VERSION=v1 # length=12 charset=default,safespecial
+SECRET_TEST_PASS_FIVE_VERSION=v1 # length=12 charset=default,special
+SECRET_TEST_PASS_SIX_VERSION=v1 # charset=default,special

pkg/secret/testdir/compose.yaml

@@ -8,6 +8,9 @@ services:
       - test_pass_one
       - test_pass_two
       - test_pass_three
+      - test_pass_four
+      - test_pass_five
+      - test_pass_six
 
 secrets:
   test_pass_one:
@@ -19,3 +22,12 @@ secrets:
   test_pass_three:
     external: true
     name: ${STACK_NAME}_pass_three_${SECRET_TEST_PASS_THREE_VERSION} # secretId and name don't match
+  test_pass_four:
+    external: true
+    name: ${STACK_NAME}_test_pass_four_${SECRET_TEST_PASS_FOUR_VERSION}
+  test_pass_five:
+    external: true
+    name: ${STACK_NAME}_test_pass_five_${SECRET_TEST_PASS_FIVE_VERSION}
+  test_pass_six:
+    external: true
+    name: ${STACK_NAME}_test_pass_six_${SECRET_TEST_PASS_SIX_VERSION}

pkg/ssh/ssh.go

@@ -20,6 +20,8 @@ func Fatal(hostname string, err error) error {
 		return fmt.Errorf("ssh auth: permission denied for %s", hostname)
 	} else if strings.Contains(out, "Network is unreachable") {
 		return fmt.Errorf("unable to connect to %s, please check your SSH config", hostname)
+	} else if strings.Contains(out, "Is the docker daemon running") {
+		return fmt.Errorf("docker: is the daemon running / your user has docker permissions?")
 	}
 
 	return err

pkg/ui/deploy.go

@@ -0,0 +1,353 @@
+package ui
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"sort"
+	"strings"
+	"time"
+
+	"coopcloud.tech/abra/pkg/formatter"
+	"coopcloud.tech/abra/pkg/logs"
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/docker/cli/cli/command/service/progress"
+	containerTypes "github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+	dockerClient "github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/jsonmessage"
+)
+
+var IsRunning bool
+
+type statusMsg struct {
+	stream  stream
+	jsonMsg jsonmessage.JSONMessage
+}
+
+type progressCompleteMsg struct {
+	stream stream
+	failed bool
+}
+
+type healthcheckMsg struct {
+	stream stream
+	health string
+}
+
+type ServiceMeta struct {
+	Name string
+	ID   string
+}
+
+type Model struct {
+	appName string
+	cl      *dockerClient.Client
+	count   int
+	ctx     context.Context
+	timeout time.Duration
+	width   int
+	filters filters.Args
+
+	Streams  *[]stream
+	Logs     *[]string
+	Failed   bool
+	TimedOut bool
+	Quit     bool
+}
+
+func (m Model) complete() bool {
+	if m.count == len(*m.Streams) {
+		return true
+	}
+	return false
+}
+
+type stream struct {
+	Name string
+	Err  error
+
+	decoder  *json.Decoder
+	id       string
+	reader   *io.PipeReader
+	writer   *io.PipeWriter
+	status   string
+	retries  int
+	health   string
+	rollback bool
+}
+
+func (s stream) String() string {
+	out := fmt.Sprintf("{decoder: %v, ", s.decoder)
+	out += fmt.Sprintf("err: %v, ", s.Err)
+	out += fmt.Sprintf("id: %s, ", s.id)
+	out += fmt.Sprintf("name: %s, ", s.Name)
+	out += fmt.Sprintf("reader: %v, ", s.reader)
+	out += fmt.Sprintf("writer: %v, ", s.writer)
+	out += fmt.Sprintf("status: %s, ", s.status)
+	return out
+}
+
+func (s stream) progress(m Model) tea.Msg {
+	if err := progress.ServiceProgress(m.ctx, m.cl, s.id, s.writer); err != nil {
+		return progressCompleteMsg{
+			stream: s,
+			failed: true,
+		}
+	}
+
+	return progressCompleteMsg{stream: s}
+}
+
+func (s stream) process() tea.Msg {
+	var jsonMsg jsonmessage.JSONMessage
+
+	if err := s.decoder.Decode(&jsonMsg); err != nil {
+		if err == io.EOF {
+			// NOTE(d1): end processing messages
+			return nil
+		}
+	}
+
+	return statusMsg{
+		stream:  s,
+		jsonMsg: jsonMsg,
+	}
+}
+
+func (s stream) healthcheck(m Model) tea.Msg {
+	filters := filters.NewArgs()
+	filters.Add("name", fmt.Sprintf("^%s", s.Name))
+
+	containers, err := m.cl.ContainerList(m.ctx, containerTypes.ListOptions{Filters: filters})
+	if err != nil {
+		s.Err = err
+		return healthcheckMsg{stream: s}
+	}
+
+	if len(containers) == 0 {
+		return healthcheckMsg{stream: s}
+	}
+
+	container := containers[0]
+	containerState, err := m.cl.ContainerInspect(m.ctx, container.ID)
+	if err != nil {
+		s.Err = err
+		return healthcheckMsg{stream: s}
+	}
+
+	var health string
+	if containerState.State.Health != nil {
+		health = containerState.State.Health.Status
+	}
+
+	return healthcheckMsg{stream: s, health: health}
+}
+
+func DeployInitialModel(
+	ctx context.Context,
+	cl *dockerClient.Client,
+	services []ServiceMeta,
+	appName string,
+	timeout time.Duration,
+	filters filters.Args,
+) Model {
+	var streams []stream
+	for _, service := range services {
+		r, w := io.Pipe()
+		d := json.NewDecoder(r)
+		streams = append(streams, stream{
+			Name:    service.Name,
+			id:      service.ID,
+			reader:  r,
+			writer:  w,
+			decoder: d,
+			retries: -1, // NOTE(d1): skip first attempt
+			health:  "?",
+		})
+	}
+
+	sort.Slice(streams, func(i, j int) bool {
+		return streams[i].Name < streams[j].Name
+	})
+
+	return Model{
+		ctx:     ctx,
+		cl:      cl,
+		appName: appName,
+		timeout: timeout,
+		filters: filters,
+		Streams: &streams,
+		Logs:    &[]string{},
+	}
+}
+
+func (m Model) Init() tea.Cmd {
+	var cmds []tea.Cmd
+
+	for _, stream := range *m.Streams {
+		cmds = append(
+			cmds,
+			[]tea.Cmd{
+				func() tea.Msg { return stream.progress(m) },
+				func() tea.Msg { return stream.process() },
+				func() tea.Msg { return stream.healthcheck(m) },
+			}...,
+		)
+	}
+
+	cmds = append(cmds, func() tea.Msg { return deployTimeout(m) })
+	cmds = append(cmds, func() tea.Msg { return m.gatherLogs() })
+
+	return tea.Batch(cmds...)
+}
+
+func (m Model) gatherLogs() tea.Msg {
+	var services []string
+	for _, s := range *m.Streams {
+		services = append(services, s.Name)
+	}
+
+	opts := logs.TailOpts{
+		AppName:  m.appName,
+		Services: services,
+		StdErr:   true,
+		Buffer:   m.Logs,
+		ToBuffer: true,
+		Filters:  m.filters,
+	}
+
+	// NOTE(d1): not interested in log polling errors. if we don't see logs it
+	// will hopefully be self-evident based on what happened in the deployment
+	logs.TailLogs(m.cl, opts)
+
+	return nil
+}
+
+type timeoutMsg struct{}
+
+func deployTimeout(m Model) tea.Msg {
+	<-time.After(m.timeout)
+	return timeoutMsg{}
+}
+
+func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	var cmds []tea.Cmd
+
+	switch msg := msg.(type) {
+	case tea.KeyMsg:
+		switch msg.String() {
+		case "ctrl+c", "q":
+			m.Quit = true
+			return m, tea.Quit
+		}
+
+	case tea.WindowSizeMsg:
+		m.width = msg.Width
+
+	case progressCompleteMsg:
+		if msg.failed {
+			m.Failed = true
+		}
+
+		m.count += 1
+
+		if m.complete() {
+			return m, tea.Quit
+		}
+
+	case timeoutMsg:
+		m.TimedOut = true
+		return m, tea.Quit
+
+	case healthcheckMsg:
+		for idx, s := range *m.Streams {
+			if s.id == msg.stream.id {
+				h := "?"
+				if s.health != "" {
+					h = s.health
+				}
+				if msg.health != "" {
+					h = msg.health
+				}
+				(*m.Streams)[idx].health = h
+			}
+		}
+
+		cmds = append(
+			cmds,
+			func() tea.Msg { return msg.stream.healthcheck(m) },
+		)
+
+	case statusMsg:
+		for idx, s := range *m.Streams {
+			if s.id == msg.stream.id {
+
+				if msg.jsonMsg.ID == "rollback" {
+					m.Failed = true
+					(*m.Streams)[idx].rollback = true
+				}
+
+				if msg.jsonMsg.ID != "overall progress" {
+					newStatus := strings.ToLower(msg.jsonMsg.Status)
+					currentStatus := (*m.Streams)[idx].status
+
+					if !strings.Contains(currentStatus, "starting") &&
+						strings.Contains(newStatus, "starting") {
+						(*m.Streams)[idx].retries += 1
+					}
+
+					if (*m.Streams)[idx].rollback {
+						if msg.jsonMsg.ID == "rollback" {
+							(*m.Streams)[idx].status = newStatus
+						}
+					} else {
+						(*m.Streams)[idx].status = newStatus
+					}
+				}
+			}
+		}
+
+		cmds = append(
+			cmds,
+			func() tea.Msg { return msg.stream.process() },
+		)
+	}
+
+	return m, tea.Batch(cmds...)
+}
+
+func (m Model) View() string {
+	body := strings.Builder{}
+
+	for _, stream := range *m.Streams {
+		split := strings.Split(stream.Name, "_")
+		short := split[len(split)-1]
+
+		status := stream.status
+		if strings.Contains(stream.status, "converged") && !stream.rollback {
+			status = "succeeded"
+		}
+		if strings.Contains(stream.status, "rolled back") {
+			status = "rolled back"
+		}
+
+		retries := 0
+		if stream.retries > 0 {
+			retries = stream.retries
+		}
+
+		output := fmt.Sprintf("%s: %s (retries: %v, healthcheck: %s)",
+			formatter.BoldStyle.Render(short),
+			status,
+			retries,
+			stream.health,
+		)
+
+		body.WriteString(output)
+		body.WriteString("\n")
+	}
+
+	return body.String()
+}

pkg/upstream/container/exec.go

@@ -9,14 +9,14 @@ import (
 	"coopcloud.tech/abra/pkg/log"
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
-	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
 	apiclient "github.com/docker/docker/client"
 )
 
 // RunExec runs a command on a remote container. io.Writer corresponds to the
 // command output.
 func RunExec(dockerCli command.Cli, client *apiclient.Client, containerID string,
-	execConfig *types.ExecConfig) (io.Writer, error) {
+	execOptions *container.ExecOptions) (io.Writer, error) {
 	ctx := context.Background()
 
 	// We need to check the tty _before_ we do the ContainerExecCreate, because
@@ -26,13 +26,13 @@ func RunExec(dockerCli command.Cli, client *apiclient.Client, containerID string
 	if _, err := client.ContainerInspect(ctx, containerID); err != nil {
 		return nil, err
 	}
-	if !execConfig.Detach {
-		if err := dockerCli.In().CheckTty(execConfig.AttachStdin, execConfig.Tty); err != nil {
+	if !execOptions.Detach {
+		if err := dockerCli.In().CheckTty(execOptions.AttachStdin, execOptions.Tty); err != nil {
 			return nil, err
 		}
 	}
 
-	response, err := client.ContainerExecCreate(ctx, containerID, *execConfig)
+	response, err := client.ContainerExecCreate(ctx, containerID, *execOptions)
 	if err != nil {
 		return nil, err
 	}
@@ -42,40 +42,40 @@ func RunExec(dockerCli command.Cli, client *apiclient.Client, containerID string
 		return nil, errors.New("exec ID empty")
 	}
 
-	if execConfig.Detach {
-		execStartCheck := types.ExecStartCheck{
-			Detach: execConfig.Detach,
-			Tty:    execConfig.Tty,
+	if execOptions.Detach {
+		execStartCheck := container.ExecStartOptions{
+			Detach: execOptions.Detach,
+			Tty:    execOptions.Tty,
 		}
 		return nil, client.ContainerExecStart(ctx, execID, execStartCheck)
 	}
-	return interactiveExec(ctx, dockerCli, client, execConfig, execID)
+	return interactiveExec(ctx, dockerCli, client, execOptions, execID)
 }
 
 func interactiveExec(ctx context.Context, dockerCli command.Cli, client *apiclient.Client,
-	execConfig *types.ExecConfig, execID string) (io.Writer, error) {
+	execOpts *container.ExecOptions, execID string) (io.Writer, error) {
 	// Interactive exec requested.
 	var (
 		out, stderr io.Writer
 		in          io.ReadCloser
 	)
 
-	if execConfig.AttachStdin {
+	if execOpts.AttachStdin {
 		in = dockerCli.In()
 	}
-	if execConfig.AttachStdout {
+	if execOpts.AttachStdout {
 		out = dockerCli.Out()
 	}
-	if execConfig.AttachStderr {
-		if execConfig.Tty {
+	if execOpts.AttachStderr {
+		if execOpts.Tty {
 			stderr = dockerCli.Out()
 		} else {
 			stderr = dockerCli.Err()
 		}
 	}
 
-	execStartCheck := types.ExecStartCheck{
-		Tty: execConfig.Tty,
+	execStartCheck := container.ExecStartOptions{
+		Tty: execOpts.Tty,
 	}
 	resp, err := client.ContainerExecAttach(ctx, execID, execStartCheck)
 	if err != nil {
@@ -94,15 +94,15 @@ func interactiveExec(ctx context.Context, dockerCli command.Cli, client *apiclie
 				outputStream: out,
 				errorStream:  stderr,
 				resp:         resp,
-				tty:          execConfig.Tty,
-				detachKeys:   execConfig.DetachKeys,
+				tty:          execOpts.Tty,
+				detachKeys:   execOpts.DetachKeys,
 			}
 
 			return streamer.stream(ctx)
 		}()
 	}()
 
-	if execConfig.Tty && dockerCli.In().IsTerminal() {
+	if execOpts.Tty && dockerCli.In().IsTerminal() {
 		if err := MonitorTtySize(ctx, client, dockerCli, execID, true); err != nil {
 			fmt.Fprintln(dockerCli.Err(), "Error monitoring TTY size:", err)
 		}

pkg/upstream/convert/compose.go

@@ -5,7 +5,6 @@ import (
 	"strings"
 
 	composetypes "github.com/docker/cli/cli/compose/types"
-	"github.com/docker/docker/api/types"
 	networktypes "github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/swarm"
 )
@@ -52,13 +51,13 @@ func AddStackLabel(namespace Namespace, labels map[string]string) map[string]str
 type networkMap map[string]composetypes.NetworkConfig
 
 // Networks from the compose-file type to the engine API type
-func Networks(namespace Namespace, networks networkMap, servicesNetworks map[string]struct{}) (map[string]types.NetworkCreate, []string) {
+func Networks(namespace Namespace, networks networkMap, servicesNetworks map[string]struct{}) (map[string]networktypes.CreateOptions, []string) {
 	if networks == nil {
 		networks = make(map[string]composetypes.NetworkConfig)
 	}
 
 	externalNetworks := []string{}
-	result := make(map[string]types.NetworkCreate)
+	result := make(map[string]networktypes.CreateOptions)
 	for internalName := range servicesNetworks {
 		network := networks[internalName]
 		if network.External.External {
@@ -66,7 +65,7 @@ func Networks(namespace Namespace, networks networkMap, servicesNetworks map[str
 			continue
 		}
 
-		createOpts := types.NetworkCreate{
+		createOpts := networktypes.CreateOptions{
 			Labels:     AddStackLabel(namespace, network.Labels),
 			Driver:     network.Driver,
 			Options:    network.DriverOpts,

pkg/upstream/convert/compose_test.go

@@ -4,7 +4,6 @@ import (
 	"testing"
 
 	composetypes "github.com/docker/cli/cli/compose/types"
-	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/network"
 	"gotest.tools/v3/assert"
 	is "gotest.tools/v3/assert/cmp"
@@ -67,7 +66,7 @@ func TestNetworks(t *testing.T) {
 			Name: "othername",
 		},
 	}
-	expected := map[string]types.NetworkCreate{
+	expected := map[string]network.CreateOptions{
 		"foo_default": {
 			Labels: map[string]string{
 				LabelNamespace: "foo",

pkg/upstream/stack/remove.go

@@ -3,11 +3,15 @@ package stack // https://github.com/docker/cli/blob/master/cli/command/stack/rem
 import (
 	"context"
 	"fmt"
+	"os"
+	"os/signal"
 	"sort"
 	"strings"
+	"time"
 
 	"coopcloud.tech/abra/pkg/log"
 	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/swarm"
 	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/client"
@@ -17,57 +21,87 @@ import (
 
 // RunRemove is the swarm implementation of docker stack remove
 func RunRemove(ctx context.Context, client *apiclient.Client, opts Remove) error {
-	var errs []string
-	for _, namespace := range opts.Namespaces {
-		services, err := GetStackServices(ctx, client, namespace)
-		if err != nil {
-			return err
-		}
+	sigIntCh := make(chan os.Signal, 1)
+	signal.Notify(sigIntCh, os.Interrupt)
+	defer signal.Stop(sigIntCh)
 
-		networks, err := getStackNetworks(ctx, client, namespace)
-		if err != nil {
-			return err
-		}
+	waitCh := make(chan struct{})
+	errCh := make(chan error)
 
-		var secrets []swarm.Secret
-		if versions.GreaterThanOrEqualTo(client.ClientVersion(), "1.25") {
-			secrets, err = getStackSecrets(ctx, client, namespace)
+	go func() {
+		var errs []string
+		for _, namespace := range opts.Namespaces {
+			services, err := GetStackServices(ctx, client, namespace)
 			if err != nil {
-				return err
+				errCh <- err
+				return
+			}
+
+			networks, err := getStackNetworks(ctx, client, namespace)
+			if err != nil {
+				errCh <- err
+				return
+			}
+
+			var secrets []swarm.Secret
+			if versions.GreaterThanOrEqualTo(client.ClientVersion(), "1.25") {
+				secrets, err = getStackSecrets(ctx, client, namespace)
+				if err != nil {
+					errCh <- err
+					return
+				}
+			}
+
+			var configs []swarm.Config
+			if versions.GreaterThanOrEqualTo(client.ClientVersion(), "1.30") {
+				configs, err = getStackConfigs(ctx, client, namespace)
+				if err != nil {
+					errCh <- err
+					return
+				}
+			}
+
+			if len(services)+len(networks)+len(secrets)+len(configs) == 0 {
+				log.Warnf("nothing found in stack: %s", namespace)
+				continue
+			}
+
+			hasError := removeServices(ctx, client, services)
+			hasError = removeSecrets(ctx, client, secrets) || hasError
+			hasError = removeConfigs(ctx, client, configs) || hasError
+			hasError = removeNetworks(ctx, client, networks) || hasError
+
+			if hasError {
+				errs = append(errs, fmt.Sprintf("failed to remove some resources from stack: %s", namespace))
+				continue
+			}
+
+			log.Info("polling undeploy status")
+			timeout, err := waitOnTasks(ctx, client, namespace)
+			if timeout {
+				errs = append(errs, err.Error())
+			} else {
+				if err != nil {
+					errs = append(errs, fmt.Sprintf("failed to wait on tasks of stack: %s: %s", namespace, err))
+				}
 			}
 		}
 
-		var configs []swarm.Config
-		if versions.GreaterThanOrEqualTo(client.ClientVersion(), "1.30") {
-			configs, err = getStackConfigs(ctx, client, namespace)
-			if err != nil {
-				return err
-			}
+		if len(errs) > 0 {
+			errCh <- errors.Errorf(strings.Join(errs, "\n"))
+			return
 		}
 
-		if len(services)+len(networks)+len(secrets)+len(configs) == 0 {
-			log.Warnf("nothing found in stack: %s", namespace)
-			continue
-		}
+		close(waitCh)
+	}()
 
-		hasError := removeServices(ctx, client, services)
-		hasError = removeSecrets(ctx, client, secrets) || hasError
-		hasError = removeConfigs(ctx, client, configs) || hasError
-		hasError = removeNetworks(ctx, client, networks) || hasError
-
-		if hasError {
-			errs = append(errs, fmt.Sprintf("failed to remove some resources from stack: %s", namespace))
-			continue
-		}
-
-		err = waitOnTasks(ctx, client, namespace)
-		if err != nil {
-			errs = append(errs, fmt.Sprintf("failed to wait on tasks of stack: %s: %s", namespace, err))
-		}
-	}
-
-	if len(errs) > 0 {
-		return errors.Errorf(strings.Join(errs, "\n"))
+	select {
+	case <-waitCh:
+		return nil
+	case <-sigIntCh:
+		return fmt.Errorf("skipping as requested, undeploy still in progress 🟠")
+	case err := <-errCh:
+		return err
 	}
 
 	return nil
@@ -87,7 +121,7 @@ func removeServices(
 	var hasError bool
 	sort.Slice(services, sortServiceByName(services))
 	for _, service := range services {
-		log.Infof("removing service %s", service.Spec.Name)
+		log.Debugf("removing service %s", service.Spec.Name)
 		if err := client.ServiceRemove(ctx, service.ID); err != nil {
 			hasError = true
 			log.Fatalf("failed to remove service %s: %s", service.ID, err)
@@ -99,11 +133,11 @@ func removeServices(
 func removeNetworks(
 	ctx context.Context,
 	client *apiclient.Client,
-	networks []types.NetworkResource,
+	networks []network.Inspect,
 ) bool {
 	var hasError bool
 	for _, network := range networks {
-		log.Infof("removing network %s", network.Name)
+		log.Debugf("removing network %s", network.Name)
 		if err := client.NetworkRemove(ctx, network.ID); err != nil {
 			hasError = true
 			log.Fatalf("failed to remove network %s: %s", network.ID, err)
@@ -119,7 +153,7 @@ func removeSecrets(
 ) bool {
 	var hasError bool
 	for _, secret := range secrets {
-		log.Infof("removing secret %s", secret.Spec.Name)
+		log.Debugf("removing secret %s", secret.Spec.Name)
 		if err := client.SecretRemove(ctx, secret.ID); err != nil {
 			hasError = true
 			log.Fatalf("Failed to remove secret %s: %s", secret.ID, err)
@@ -135,7 +169,7 @@ func removeConfigs(
 ) bool {
 	var hasError bool
 	for _, config := range configs {
-		log.Infof("removing config %s", config.Spec.Name)
+		log.Debugf("removing config %s", config.Spec.Name)
 		if err := client.ConfigRemove(ctx, config.ID); err != nil {
 			hasError = true
 			log.Fatalf("failed to remove config %s: %s", config.ID, err)
@@ -169,12 +203,23 @@ func terminalState(state swarm.TaskState) bool {
 	return numberedStates[state] > numberedStates[swarm.TaskStateRunning]
 }
 
-func waitOnTasks(ctx context.Context, client apiclient.APIClient, namespace string) error {
+func waitOnTasks(ctx context.Context, client apiclient.APIClient, namespace string) (bool, error) {
+	var timedOut bool
+
+	log.Debugf("waiting on undeploy tasks (timeout=%v secs)", WaitTimeout)
+
+	go func() {
+		t := time.Duration(WaitTimeout) * time.Second
+		<-time.After(t)
+		log.Debug("timed out on undeploy")
+		timedOut = true
+	}()
+
 	terminalStatesReached := 0
 	for {
 		tasks, err := getStackTasks(ctx, client, namespace)
 		if err != nil {
-			return fmt.Errorf("failed to get tasks: %w", err)
+			return false, fmt.Errorf("failed to get tasks: %w", err)
 		}
 
 		for _, task := range tasks {
@@ -187,6 +232,11 @@ func waitOnTasks(ctx context.Context, client apiclient.APIClient, namespace stri
 		if terminalStatesReached == len(tasks) {
 			break
 		}
+
+		if timedOut {
+			return true, fmt.Errorf("deployment timed out 🟠")
+		}
 	}
-	return nil
+
+	return false, nil
 }

pkg/upstream/stack/stack.go

@@ -3,25 +3,27 @@ package stack // https://github.com/docker/cli/blob/master/cli/command/stack/swa
 import (
 	"context"
 	"fmt"
-	"io"
-	"io/ioutil"
 	"os"
-	"os/signal"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
 
 	stdlibErr "errors"
 
+	tea "github.com/charmbracelet/bubbletea"
+
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/ui"
 	"coopcloud.tech/abra/pkg/upstream/convert"
-	"github.com/docker/cli/cli/command/service/progress"
+	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/stack/formatter"
 	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
+	networktypes "github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/swarm"
 	"github.com/docker/docker/api/types/versions"
 	"github.com/docker/docker/client"
@@ -176,7 +178,7 @@ func IsDeployed(ctx context.Context, cl *dockerClient.Client, stackName string)
 func pruneServices(ctx context.Context, cl *dockerClient.Client, namespace convert.Namespace, services map[string]struct{}) {
 	oldServices, err := GetStackServices(ctx, cl, namespace.Name())
 	if err != nil {
-		log.Infof("failed to list services: %s", err)
+		log.Warnf("failed to list services: %s", err)
 	}
 
 	pruneServices := []swarm.Service{}
@@ -190,7 +192,17 @@ func pruneServices(ctx context.Context, cl *dockerClient.Client, namespace conve
 }
 
 // RunDeploy is the swarm implementation of docker stack deploy
-func RunDeploy(cl *dockerClient.Client, opts Deploy, cfg *composetypes.Config, appName string, dontWait bool) error {
+func RunDeploy(
+	cl *dockerClient.Client,
+	opts Deploy,
+	cfg *composetypes.Config,
+	appName string,
+	serverName string,
+	dontWait bool,
+	filters filters.Args,
+) error {
+	log.Info("initialising deployment")
+
 	if err := validateResolveImageFlag(&opts); err != nil {
 		return err
 	}
@@ -200,7 +212,16 @@ func RunDeploy(cl *dockerClient.Client, opts Deploy, cfg *composetypes.Config, a
 		opts.ResolveImage = ResolveImageNever
 	}
 
-	return deployCompose(context.Background(), cl, opts, cfg, appName, dontWait)
+	return deployCompose(
+		context.Background(),
+		cl,
+		opts,
+		cfg,
+		appName,
+		serverName,
+		dontWait,
+		filters,
+	)
 }
 
 // validateResolveImageFlag validates the opts.resolveImage command line option
@@ -213,7 +234,16 @@ func validateResolveImageFlag(opts *Deploy) error {
 	}
 }
 
-func deployCompose(ctx context.Context, cl *dockerClient.Client, opts Deploy, config *composetypes.Config, appName string, dontWait bool) error {
+func deployCompose(
+	ctx context.Context,
+	cl *dockerClient.Client,
+	opts Deploy,
+	config *composetypes.Config,
+	appName string,
+	serverName string,
+	dontWait bool,
+	filters filters.Args,
+) error {
 	namespace := convert.NewNamespace(opts.Namespace)
 
 	if opts.Prune {
@@ -254,7 +284,14 @@ func deployCompose(ctx context.Context, cl *dockerClient.Client, opts Deploy, co
 		return err
 	}
 
-	serviceIDs, err := deployServices(ctx, cl, services, namespace, opts.SendRegistryAuth, opts.ResolveImage)
+	serviceIDs, err := deployServices(
+		ctx,
+		cl,
+		services,
+		namespace,
+		opts.SendRegistryAuth,
+		opts.ResolveImage,
+	)
 	if err != nil {
 		return err
 	}
@@ -264,13 +301,16 @@ func deployCompose(ctx context.Context, cl *dockerClient.Client, opts Deploy, co
 		return nil
 	}
 
-	log.Infof("waiting for %s to deploy... please hold 🤚", appName)
-
-	if err := waitOnServices(ctx, cl, serviceIDs, appName); err != nil {
-		return err
+	waitOpts := WaitOpts{
+		Services:   serviceIDs,
+		AppName:    appName,
+		ServerName: serverName,
+		Filters:    filters,
 	}
 
-	log.Infof("successfully deployed %s", appName)
+	if err := WaitOnServices(ctx, cl, waitOpts); err != nil {
+		return err
+	}
 
 	return nil
 }
@@ -296,7 +336,7 @@ func validateExternalNetworks(ctx context.Context, client dockerClient.NetworkAP
 			// local-scoped networks, so there's no need to inspect them.
 			continue
 		}
-		network, err := client.NetworkInspect(ctx, networkName, types.NetworkInspectOptions{})
+		network, err := client.NetworkInspect(ctx, networkName, networktypes.InspectOptions{})
 		switch {
 		case dockerClient.IsErrNotFound(err):
 			return errors.Errorf("network %q is declared as external, but could not be found. You need to create a swarm-scoped network before the stack is deployed, which you can do by running this on the server: docker network create -d overlay proxy", networkName)
@@ -342,7 +382,7 @@ func createConfigs(ctx context.Context, cl *dockerClient.Client, configs []swarm
 			}
 		case dockerClient.IsErrNotFound(err):
 			// config does not exist, then we create a new one.
-			log.Infof("creating config %s", configSpec.Name)
+			log.Debugf("creating config %s", configSpec.Name)
 			if _, err := cl.ConfigCreate(ctx, configSpec); err != nil {
 				return errors.Wrapf(err, "failed to create config %s", configSpec.Name)
 			}
@@ -353,13 +393,13 @@ func createConfigs(ctx context.Context, cl *dockerClient.Client, configs []swarm
 	return nil
 }
 
-func createNetworks(ctx context.Context, cl *dockerClient.Client, namespace convert.Namespace, networks map[string]types.NetworkCreate) error {
+func createNetworks(ctx context.Context, cl *dockerClient.Client, namespace convert.Namespace, networks map[string]networktypes.CreateOptions) error {
 	existingNetworks, err := getStackNetworks(ctx, cl, namespace.Name())
 	if err != nil {
 		return err
 	}
 
-	existingNetworkMap := make(map[string]types.NetworkResource)
+	existingNetworkMap := make(map[string]networktypes.Inspect)
 	for _, network := range existingNetworks {
 		existingNetworkMap[network.Name] = network
 	}
@@ -373,7 +413,7 @@ func createNetworks(ctx context.Context, cl *dockerClient.Client, namespace conv
 			createOpts.Driver = defaultNetworkDriver
 		}
 
-		log.Infof("creating network %s", name)
+		log.Debugf("creating network %s", name)
 		if _, err := cl.NetworkCreate(ctx, name, createOpts); err != nil {
 			return errors.Wrapf(err, "failed to create network %s", name)
 		}
@@ -387,10 +427,13 @@ func deployServices(
 	services map[string]swarm.ServiceSpec,
 	namespace convert.Namespace,
 	sendAuth bool,
-	resolveImage string) ([]string, error) {
+	resolveImage string,
+) ([]ui.ServiceMeta, error) {
+	var servicesMeta []ui.ServiceMeta
+
 	existingServices, err := GetStackServices(ctx, cl, namespace.Name())
 	if err != nil {
-		return nil, err
+		return servicesMeta, err
 	}
 
 	existingServiceMap := make(map[string]swarm.Service)
@@ -398,8 +441,6 @@ func deployServices(
 		existingServiceMap[service.Spec.Name] = service
 	}
 
-	var serviceIDs []string
-
 	for internalName, serviceSpec := range services {
 		var (
 			name        = namespace.Scope(internalName)
@@ -407,8 +448,23 @@ func deployServices(
 			encodedAuth string
 		)
 
+		// When sendAuth is set, use the docker cli to retrieve the auth token
+		// for the image we are deploying.
+		// This enables using a private registry by running docker login on the
+		// machine, that abra is executed.
+		if sendAuth {
+			dockerCLI, err := command.NewDockerCli()
+			if err != nil {
+				log.Errorf("retrieving docker auth token: failed create docker cli: %s", err)
+			}
+			encodedAuth, err = command.RetrieveAuthTokenFromImage(dockerCLI.ConfigFile(), image)
+			if err != nil {
+				log.Errorf("failed to retrieve registry auth for image %s: %s", image, err)
+			}
+		}
+
 		if service, exists := existingServiceMap[name]; exists {
-			log.Infof("updating %s", name)
+			log.Debugf("updating %s", name)
 
 			updateOpts := types.ServiceUpdateOptions{EncodedRegistryAuth: encodedAuth}
 
@@ -450,9 +506,12 @@ func deployServices(
 				log.Warn(warning)
 			}
 
-			serviceIDs = append(serviceIDs, service.ID)
+			servicesMeta = append(servicesMeta, ui.ServiceMeta{
+				Name: name,
+				ID:   service.ID,
+			})
 		} else {
-			log.Infof("creating %s", name)
+			log.Debugf("creating %s", name)
 
 			createOpts := types.ServiceCreateOptions{EncodedRegistryAuth: encodedAuth}
 
@@ -466,15 +525,18 @@ func deployServices(
 				return nil, errors.Wrapf(err, "failed to create %s", name)
 			}
 
-			serviceIDs = append(serviceIDs, serviceCreateResponse.ID)
+			servicesMeta = append(servicesMeta, ui.ServiceMeta{
+				Name: name,
+				ID:   serviceCreateResponse.ID,
+			})
 		}
 	}
 
-	return serviceIDs, nil
+	return servicesMeta, nil
 }
 
-func getStackNetworks(ctx context.Context, dockerclient client.APIClient, namespace string) ([]types.NetworkResource, error) {
-	return dockerclient.NetworkList(ctx, types.NetworkListOptions{Filters: getStackFilter(namespace)})
+func getStackNetworks(ctx context.Context, dockerclient client.APIClient, namespace string) ([]networktypes.Inspect, error) {
+	return dockerclient.NetworkList(ctx, networktypes.ListOptions{Filters: getStackFilter(namespace)})
 }
 
 func getStackSecrets(ctx context.Context, dockerclient client.APIClient, namespace string) ([]swarm.Secret, error) {
@@ -485,67 +547,89 @@ func getStackConfigs(ctx context.Context, dockerclient client.APIClient, namespa
 	return dockerclient.ConfigList(ctx, types.ConfigListOptions{Filters: getStackFilter(namespace)})
 }
 
-func waitOnServices(ctx context.Context, cl *dockerClient.Client, serviceIDs []string, appName string) error {
-	var errs []error
+func timestamp() string {
+	ts := time.Now().UTC().Format(time.RFC3339)
+	return strings.Replace(ts, ":", "", -1) // get rid of offensive colons
+}
 
-	for _, serviceID := range serviceIDs {
-		if err := WaitOnService(ctx, cl, serviceID, appName); err != nil {
-			errs = append(errs, fmt.Errorf("%s: %w", serviceID, err))
-		}
+type WaitOpts struct {
+	AppName    string
+	Filters    filters.Args
+	NoLog      bool
+	Quiet      bool
+	ServerName string
+	Services   []ui.ServiceMeta
+}
+
+func WaitOnServices(ctx context.Context, cl *dockerClient.Client, opts WaitOpts) error {
+	timeout := time.Duration(WaitTimeout) * time.Second
+	model := ui.DeployInitialModel(ctx, cl, opts.Services, opts.AppName, timeout, opts.Filters)
+	tui := tea.NewProgram(model)
+
+	if !opts.Quiet {
+		log.Info("polling deployment status")
 	}
 
-	if len(errs) > 0 {
+	m, err := log.Without(
+		func() (tea.Model, error) {
+			return tui.Run()
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("waitOnServices: error running TUI: %s", err)
+	}
+
+	deployModel := m.(ui.Model)
+	if deployModel.TimedOut || deployModel.Failed || deployModel.Quit {
+		var errs []error
+
+		if deployModel.Failed {
+			errs = append(errs, fmt.Errorf("deploy failed 🛑"))
+		} else if deployModel.TimedOut {
+			errs = append(errs, fmt.Errorf("deploy timed out 🟠"))
+		} else {
+			errs = append(errs, fmt.Errorf("deploy in progress 🟠"))
+		}
+
+		for _, s := range *deployModel.Streams {
+			if s.Err != nil {
+				errs = append(errs, fmt.Errorf("%s: %s", s.Name, s.Err))
+			}
+		}
+
+		if len(*deployModel.Logs) > 0 && !opts.NoLog {
+			logsPath := filepath.Join(
+				config.LOGS_DIR,
+				opts.ServerName,
+				fmt.Sprintf("%s_%s", opts.AppName, timestamp()),
+			)
+
+			if err := os.MkdirAll(filepath.Join(config.LOGS_DIR, opts.ServerName), 0o764); err != nil {
+				return fmt.Errorf("waitOnServices: error creating log dir: %s", err)
+			}
+
+			file, err := os.Create(logsPath)
+			if err != nil {
+				return fmt.Errorf("waitOnServices: error opening file: %s", err)
+			}
+			defer file.Close()
+
+			s := strings.Join(*deployModel.Logs, "\n")
+			if _, err := file.WriteString(s); err != nil {
+				return fmt.Errorf("waitOnServices: writeFile: %s", err)
+			}
+
+			errs = append(errs, fmt.Errorf("logs: %s", logsPath))
+		}
+
 		return stdlibErr.Join(errs...)
 	}
 
-	return nil
-}
-
-// https://github.com/docker/cli/blob/master/cli/command/service/helpers.go
-// https://github.com/docker/cli/blob/master/cli/command/service/progress/progress.go
-func WaitOnService(ctx context.Context, cl *dockerClient.Client, serviceID, appName string) error {
-	errChan := make(chan error, 1)
-	pipeReader, pipeWriter := io.Pipe()
-
-	sigintChannel := make(chan os.Signal, 1)
-	signal.Notify(sigintChannel, os.Interrupt)
-	defer signal.Stop(sigintChannel)
-
-	go func() {
-		errChan <- progress.ServiceProgress(ctx, cl, serviceID, pipeWriter)
-	}()
-
-	go io.Copy(ioutil.Discard, pipeReader)
-
-	timeout := time.Duration(WaitTimeout) * time.Second
-
-	select {
-	case err := <-errChan:
-		return err
-	case <-sigintChannel:
-		return fmt.Errorf(`
-Not waiting for %s to deploy. The deployment is ongoing...
-
-If you want to stop the deployment, try:
-
-    abra app undeploy %s`, appName, appName)
-	case <-time.After(timeout):
-		return fmt.Errorf(`
-%s has not converged (%s second timeout reached).
-
-This does not necessarily mean your deployment has failed, it may just be that
-the app is taking longer to deploy based on your server resources or network
-latency.
-
-You can track latest deployment status with:
-
-    abra app ps %s
-
-And inspect the logs with:
-
-    abra app logs %s
-`, appName, timeout, appName, appName)
+	if !opts.Quiet {
+		log.Info("deploy succeeded 🟢")
 	}
+
+	return nil
 }
 
 // Copypasta from https://github.com/docker/cli/blob/master/cli/command/stack/swarm/list.go

scripts/installer/installer

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 
-ABRA_VERSION="0.9.0-beta"
+ABRA_VERSION="0.10.0-beta"
 ABRA_RELEASE_URL="https://git.coopcloud.tech/api/v1/repos/toolshed/abra/releases/tags/$ABRA_VERSION"
-RC_VERSION="0.10.0-rc1-beta"
+RC_VERSION="0.10.0-beta"
 RC_VERSION_URL="https://git.coopcloud.tech/api/v1/repos/toolshed/abra/releases/tags/$RC_VERSION"
 
 for arg in "$@"; do

scripts/installer/makefile

@@ -3,5 +3,5 @@ STACK := abra_installer_script
 default: deploy
 
 deploy:
-	@DOCKER_CONTEXT=swarm.autonomic.zone docker stack rm $(STACK) && \
-		DOCKER_CONTEXT=swarm.autonomic.zone docker stack deploy -c compose.yml $(STACK)
+	@DOCKER_CONTEXT=swarm-0.coopcloud.tech docker stack rm $(STACK) && \
+		DOCKER_CONTEXT=swarm-0.coopcloud.tech docker stack deploy -c compose.yml $(STACK)

tests/integration/app_deploy.bats

@@ -22,6 +22,8 @@ setup(){
 teardown(){
   _reset_recipe
   _undeploy_app
+  _undeploy_app2 "gitea.$TEST_SERVER"
+
   _reset_app
   _reset_tags
 
@@ -106,8 +108,6 @@ teardown(){
 
 # bats test_tags=slow
 @test "deploy latest commit if no published versions and no --chaos" {
-  latestCommit="$(git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rev-parse --short HEAD)"
-
   _remove_tags
   _wipe_env_version
 
@@ -115,7 +115,7 @@ teardown(){
   run $ABRA app deploy "$TEST_APP_DOMAIN" \
     --no-input --no-converge-checks --offline
   assert_success
-  assert_output --partial "$latestCommit"
+  assert_output --partial "${_get_head_hash:0:8}"
 }
 
 # bats test_tags=slow
@@ -222,19 +222,6 @@ teardown(){
   run $ABRA app deploy "gitea.$TEST_SERVER" --no-input --no-converge-checks
   assert_success
   assert_output --partial "$latestVersion"
-
-  run $ABRA app undeploy "gitea.$TEST_SERVER" --no-input
-  assert_success
-
-  run $ABRA app secret remove "gitea.$TEST_SERVER" --all --no-input
-  assert_success
-
-  run $ABRA app volume remove "gitea.$TEST_SERVER" --no-input
-  assert_success
-
-  run $ABRA app remove "gitea.$TEST_SERVER" --no-input
-  assert_success
-  assert_not_exists "$ABRA_DIR/servers/$TEST_SERVER/gitea.$TEST_SERVER.env"
 }
 
 # bats test_tags=slow
@@ -414,8 +401,6 @@ teardown(){
 
 # bats test_tags=slow
 @test "ignore env version on new deploy" {
-  tagHash=$(_get_tag_hash "0.1.0+1.20.0")
-
   run $ABRA app deploy "$TEST_APP_DOMAIN" "0.1.0+1.20.0" \
     --no-input --no-converge-checks
   assert_success

tests/integration/app_deploy_env_version.bats

@@ -54,13 +54,21 @@ teardown(){
 }
 
 # bats test_tags=slow
-@test "chaos commit written to env" {
+@test "deploy commit written to env and redeploy keeps that version" {
   run $ABRA app deploy "$TEST_APP_DOMAIN" "1e83340e" --no-input --no-converge-checks
   assert_success
 
   run grep -q "TYPE=$TEST_RECIPE:1e83340e" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" \
+    --force --no-input --no-converge-checks
+  assert_success
+
+  run grep -q "TYPE=$TEST_RECIPE:1e83340e" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
 }
 
 # bats test_tags=slow
@@ -98,12 +106,15 @@ teardown(){
 }
 
 # bats test_tags=slow
-@test "deploy overwrites chaos deploy" {
-  run $ABRA app deploy "$TEST_APP_DOMAIN" "1e83340e" \
-    --no-input --no-converge-checks
+@test "takes deployed version when no .env version is present " {
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.1.0+1.20.0" --no-input --no-converge-checks --ignore-env-version
   assert_success
 
-  run grep -q "TYPE=$TEST_RECIPE:1e83340e" \
+  run grep -q "TYPE=$TEST_RECIPE:0.1.0+1.20.0" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=abra-test-recipe/g' \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 
@@ -111,7 +122,7 @@ teardown(){
     --force --no-input --no-converge-checks
   assert_success
 
-  run grep -q "TYPE=$TEST_RECIPE:1e83340e" \
+  run grep -q "TYPE=$TEST_RECIPE:0.1.0+1.20.0" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
-  assert_failure
+  assert_success
 }

tests/integration/app_deploy_overview.bats

@@ -37,17 +37,10 @@ teardown(){
     --no-input --no-converge-checks
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*N/A'
-  assert_output --regexp 'CHAOS.*false'
-
-  # new deployment
-  assert_output --regexp 'VERSION.* ' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*false'
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*N/A'
-  assert_output --regexp 'NEW VERSION.*' + "${latestRelease}"
+  assert_output --partial 'NEW DEPLOY OVERVIEW'
+  assert_output --partial 'CURRENT DEPLOYMENT    N/A'
+  assert_output --partial 'ENV VERSION           N/A'
+  assert_output --partial "NEW DEPLOYMENT        ${latestRelease}"
 
   run grep -q "TYPE=$TEST_RECIPE:${latestRelease}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
@@ -61,17 +54,10 @@ teardown(){
     --no-input --no-converge-checks
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*N/A'
-  assert_output --regexp 'CHAOS.*false'
-
-  # new deployment
-  assert_output --regexp 'VERSION.* ' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*false'
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'NEW VERSION.*' + "${latestRelease}"
+  assert_output --partial 'NEW DEPLOY OVERVIEW'
+  assert_output --partial "CURRENT DEPLOYMENT    N/A"
+  assert_output --partial "ENV VERSION           ${latestRelease}"
+  assert_output --partial "NEW DEPLOYMENT        ${latestRelease}"
 
   run grep -q "TYPE=$TEST_RECIPE:${latestRelease}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
@@ -90,17 +76,10 @@ teardown(){
     --no-input --no-converge-checks
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*N/A'
-  assert_output --regexp 'CHAOS.*false'
-
-  # new deployment
-  assert_output --regexp 'VERSION.*' + "0.1.1+1.20.2"
-  assert_output --regexp 'CHAOS.*false'
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "0.1.1+1.20.2"
-  assert_output --regexp 'NEW VERSION.*' + "0.1.1+1.20.2"
+  assert_output --partial 'NEW DEPLOY OVERVIEW'
+  assert_output --partial "CURRENT DEPLOYMENT    N/A"
+  assert_output --partial "ENV VERSION           0.1.1+1.20.2"
+  assert_output --partial "NEW DEPLOYMENT        0.1.1+1.20.2"
 
   run grep -q "TYPE=$TEST_RECIPE:0.1.1+1.20.2" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
@@ -120,17 +99,10 @@ teardown(){
     --no-input --no-converge-checks --ignore-env-version
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*N/A'
-  assert_output --regexp 'CHAOS.*false'
-
-  # new deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*false'
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "0.1.1+1.20.2"
-  assert_output --regexp 'NEW VERSION.*' + "${latestRelease}"
+  assert_output --partial 'NEW DEPLOY OVERVIEW'
+  assert_output --partial "CURRENT DEPLOYMENT    N/A"
+  assert_output --partial "ENV VERSION           0.1.1+1.20.2"
+  assert_output --partial "NEW DEPLOYMENT        ${latestRelease}"
 
   run grep -q "TYPE=$TEST_RECIPE:${latestRelease}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
@@ -153,17 +125,10 @@ teardown(){
     --no-input --no-converge-checks --chaos
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*false'
-
-  # new deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*' + "${headHash:0:8}+U"
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'NEW VERSION.*' + "${headHash:0:8}+U"
+  assert_output --partial 'CHAOS DEPLOY OVERVIEW'
+  assert_output --partial "CURRENT DEPLOYMENT    ${latestRelease}"
+  assert_output --partial "ENV VERSION           ${latestRelease}"
+  assert_output --partial "NEW DEPLOYMENT        ${headHash:0:8}+U"
 
   run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
   assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
@@ -173,7 +138,7 @@ teardown(){
   assert_success
 }
 
-@test "chaos deploy then force deploy" {
+@test "can not redeploy chaos version without --chaos" {
   headHash=$(_get_head_hash)
   latestRelease=$(_latest_release)
 
@@ -189,27 +154,12 @@ teardown(){
   assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
 
   run $ABRA app deploy "$TEST_APP_DOMAIN" \
-    --no-input --no-converge-checks --force
-  assert_success
-
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*' + "${headHash:0:8}+U"
-
-  # new deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*false'
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "${headHash:0:8}+U"
-  assert_output --regexp 'NEW VERSION.*' + "${latestRelease}"
-
-  run grep -q "TYPE=$TEST_RECIPE:${latestRelease}" \
-    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
-  assert_success
+    --no-input --no-converge-checks --force --debug
+  assert_failure
+  assert_output --regexp 'can not redeploy chaos version .*' + "${headHash:0:8}+U"
 }
 
-@test "deploy then force chaos commit deploy" {
+@test "deploy then force commit deploy" {
   headHash=$(_get_head_hash)
   latestRelease=$(_latest_release)
 
@@ -225,17 +175,10 @@ teardown(){
     --no-input --no-converge-checks --force
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*false'
-
-  # new deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*' + "${headHash:0:8}"
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'NEW VERSION.*' + "${headHash:0:8}"
+  assert_output --partial 'DEPLOY OVERVIEW'
+  assert_output --partial "CURRENT DEPLOYMENT    ${latestRelease}"
+  assert_output --partial "ENV VERSION           ${latestRelease}"
+  assert_output --partial "NEW DEPLOYMENT        ${headHash:0:8}"
 
   run grep -q "TYPE=$TEST_RECIPE:${headHash:0:8}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
@@ -250,17 +193,10 @@ teardown(){
     --no-input --no-converge-checks --chaos
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*N/A'
-  assert_output --regexp 'CHAOS.*false'
-
-  # new deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*' + "${headHash:0:8}"
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'NEW VERSION.*' + "${headHash:0:8}"
+  assert_output --partial 'NEW DEPLOY OVERVIEW'
+  assert_output --partial "CURRENT DEPLOYMENT    N/A"
+  assert_output --partial "ENV VERSION           ${latestRelease}"
+  assert_output --partial "NEW DEPLOYMENT        ${headHash:0:8}"
 
   run bash -c 'echo "unstaged changes" >> "$ABRA_DIR/recipes/$TEST_RECIPE/foo"'
   assert_success
@@ -270,17 +206,28 @@ teardown(){
     --no-input --no-converge-checks --chaos
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*' + "${headHash:0:8}"
+  assert_output --partial 'CHAOS DEPLOY OVERVIEW'
+  assert_output --partial "CURRENT DEPLOYMENT    ${headHash:0:8}"
+  assert_output --partial "ENV VERSION           ${headHash:0:8}"
+  assert_output --partial "NEW DEPLOYMENT        ${headHash:0:8}+U"
 
-  # new deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*' + "${headHash:0:8}+U"
+  run $ABRA app deploy "$TEST_APP_DOMAIN" \
+    --no-input --no-converge-checks --chaos
+  assert_success
 
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'NEW VERSION.*' + "${headHash:0:8}+U"
+  assert_output --partial 'CHAOS DEPLOY OVERVIEW'
+  assert_output --partial "CURRENT DEPLOYMENT    ${headHash:0:8}+U"
+  assert_output --partial "ENV VERSION           ${headHash:0:8}+U"
+  assert_output --partial "NEW DEPLOYMENT        ${headHash:0:8}+U"
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" \
+    --no-input --no-converge-checks --chaos
+  assert_success
+
+  assert_output --partial 'CHAOS DEPLOY OVERVIEW'
+  assert_output --partial "CURRENT DEPLOYMENT    ${headHash:0:8}+U"
+  assert_output --partial "ENV VERSION           ${headHash:0:8}+U"
+  assert_output --partial "NEW DEPLOYMENT        ${headHash:0:8}+U"
 
   run grep -q "TYPE=$TEST_RECIPE:${headHash:0:8}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
@@ -302,19 +249,8 @@ teardown(){
     --no-input --no-converge-checks --force
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*' + "${headHash:0:8}"
-
-  # new deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*false'
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "${headHash:0:8}"
-  assert_output --regexp 'NEW VERSION.*' + "${latestRelease}"
-
-  run grep -q "TYPE=$TEST_RECIPE:${latestRelease}" \
-    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
-  assert_success
+  assert_output --partial 'REDEPLOY OVERVIEW'
+  assert_output --partial "CURRENT DEPLOYMENT    ${headHash:0:8}"
+  assert_output --partial "ENV VERSION           ${headHash:0:8}"
+  assert_output --partial "NEW DEPLOYMENT        ${headHash:0:8}"
 }

tests/integration/app_list.bats

@@ -8,6 +8,7 @@ setup_file(){
 }
 
 teardown_file(){
+  _undeploy_app
   _rm_app
   _rm_server
 }
@@ -18,6 +19,7 @@ setup(){
 }
 
 teardown(){
+  _reset_recipe
   _undeploy_app
 }
 
@@ -87,6 +89,10 @@ teardown(){
   assert_success
   refute_output --partial "$TEST_RECIPE"
   assert_output --partial "foo-recipe"
+
+  run rm -rf "$ABRA_DIR/servers/foo.com"
+  assert_success
+  assert_not_exists "$ABRA_DIR/servers/foo.com"
 }
 
 @test "output is machine readable" {
@@ -98,3 +104,36 @@ teardown(){
 
   assert_output --partial "$expectedOutput"
 }
+
+# bats test_tags=slow
+@test "list with status fetches recipe" {
+  _deploy_app
+
+  run $ABRA app ls --status
+  assert_success
+
+  run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE"
+  assert_success
+
+  run $ABRA app ls --status
+  assert_success
+}
+
+# bats test_tags=slow
+@test "list with chaos version" {
+  run bash -c "echo foo >> $ABRA_DIR/recipes/$TEST_RECIPE/foo"
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" \
+    --no-input --no-converge-checks --chaos
+  assert_success
+
+  run $ABRA app ls --status
+  assert_success
+  assert_output --partial "+U"
+
+  run rm -rf "$ABRA_DIR/servers/foo.com"
+  assert_success
+  assert_not_exists "$ABRA_DIR/servers/foo.com"
+}

tests/integration/app_new.bats

@@ -214,8 +214,7 @@ teardown(){
     --chaos
   assert_success
   assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
-  assert_output --partial "version: ${currentHash:0:8}"
-  assert_output --partial "chaos: ${currentHash:0:8}"
+  assert_output --partial "version: ${currentHash:0:8}+U"
 
   assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
   assert_equal "$(_git_status)" "?? foo"
@@ -242,8 +241,7 @@ teardown(){
     --chaos
   assert_success
   assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
-  assert_output --partial "version: ${currentHash:0:8}"
-  assert_output --partial "chaos: ${currentHash:0:8}"
+  assert_output --partial "version: ${currentHash:0:8}+U"
 
   assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
   assert_equal "$(_git_status)" "?? foo"
@@ -252,3 +250,10 @@ teardown(){
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 }
+
+@test "automatically select single server" {
+  # NOTE(d1): no --no-input required, single server available
+  run $ABRA app new "$TEST_RECIPE" --domain "$TEST_APP_DOMAIN"
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+}

tests/integration/app_rollback.bats

@@ -19,8 +19,8 @@ setup(){
 }
 
 teardown(){
-  _reset_app
   _undeploy_app
+  _reset_app
   _reset_recipe
 }
 
@@ -153,7 +153,7 @@ teardown(){
 }
 
 # bats test_tags=slow
-@test "rollback chaos deployment" {
+@test "rollback chaos deployment is not possible" {
   tagHash=$(_get_tag_hash "0.2.0+1.21.0")
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout "$tagHash"
   assert_success
@@ -163,17 +163,8 @@ teardown(){
   assert_output --partial "${tagHash:0:8}"
 
   run $ABRA app rollback "$TEST_APP_DOMAIN" "0.1.1+1.20.2" --no-input --no-converge-checks
-  assert_success
-  assert_output --partial "0.1.1+1.20.2"
-  assert_output --partial "${tagHash:0:8}"
-
-  run $ABRA app rollback "$TEST_APP_DOMAIN" "0.1.0+1.20.0" --no-input --no-converge-checks
-  assert_success
-  assert_output --partial "0.1.0+1.20.0"
-
-  tagHash=$(_get_tag_hash "0.1.1+1.20.2")
-  refute_output --partial "${tagHash:0:8}"
-  assert_output --partial "false"
+  assert_failure
+  assert_output --partial 'current deployment' + "${tagHash:0:8}" + 'is not a known version'
 }
 
 # bats test_tags=slow

tests/integration/app_rollback_overview.bats

@@ -24,7 +24,7 @@ teardown(){
   _reset_recipe
 }
 
-@test "deploy then rollback" { 
+@test "deploy then rollback" {
   run $ABRA app deploy "$TEST_APP_DOMAIN" "0.2.0+1.21.0" \
     --no-input --no-converge-checks
   assert_success
@@ -33,23 +33,17 @@ teardown(){
     --no-input --no-converge-checks
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "0.2.0+1.21.0" 
-  assert_output --regexp 'CHAOS.*false'
-
-  # rollback
-  assert_output --regexp 'VERSION.*' + "0.1.0+1.20.0" 
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "0.2.0+1.21.0"
-  assert_output --regexp 'NEW VERSION.*' + "0.1.0+1.20.0"
+  assert_output --partial 'DOWNGRADE OVERVIEW'
+  assert_output --partial 'CURRENT DEPLOYMENT    0.2.0+1.21.0'
+  assert_output --partial 'ENV VERSION           0.2.0+1.21.0'
+  assert_output --partial 'NEW DEPLOYMENT        0.1.0+1.20.0'
 
   run grep -q "TYPE=$TEST_RECIPE:0.1.0+1.20.0" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 }
 
-@test "force rollback" { 
+@test "force rollback" {
   run $ABRA app deploy "$TEST_APP_DOMAIN" "0.2.0+1.21.0" \
     --no-input --no-converge-checks
   assert_success
@@ -58,16 +52,10 @@ teardown(){
     --no-input --no-converge-checks --force
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "0.2.0+1.21.0" 
-  assert_output --regexp 'CHAOS.*false'
-
-  # rollback
-  assert_output --regexp 'VERSION.*' + "0.2.0+1.21.0"
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "0.2.0+1.21.0"
-  assert_output --regexp 'NEW VERSION.*' + "0.2.0+1.21.0"
+  assert_output --partial 'REDEPLOY OVERVIEW'
+  assert_output --partial 'CURRENT DEPLOYMENT    0.2.0+1.21.0'
+  assert_output --partial 'ENV VERSION           0.2.0+1.21.0'
+  assert_output --partial 'NEW DEPLOYMENT        0.2.0+1.21.0'
 
   run grep -q "TYPE=$TEST_RECIPE:0.2.0+1.21.0" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
@@ -85,16 +73,10 @@ teardown(){
     --no-input --no-converge-checks
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "0.2.0+1.21.0"
-  assert_output --regexp 'CHAOS.*false'
-
-  # rollback
-  assert_output --regexp 'VERSION.*' + "0.1.0+1.20.0"
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*N/A'
-  assert_output --regexp 'NEW VERSION.*' + "0.2.0+1.21.0"
+  assert_output --partial 'DOWNGRADE OVERVIEW'
+  assert_output --partial 'CURRENT DEPLOYMENT    0.2.0+1.21.0'
+  assert_output --partial 'ENV VERSION           N/A'
+  assert_output --partial 'NEW DEPLOYMENT        0.1.0+1.20.0'
 
   run grep -q "TYPE=$TEST_RECIPE:${latestRelease}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"

tests/integration/app_secret.bats

@@ -41,6 +41,11 @@ teardown(){
 
   run $ABRA app secret generate "$TEST_APP_DOMAIN"
   assert_failure
+  assert_output --partial 'missing arguments'
+
+  run $ABRA app secret generate "$TEST_APP_DOMAIN" test_pass_one
+  assert_failure
+  assert_output --partial 'missing arguments'
 
   run $ABRA app secret generate "$TEST_APP_DOMAIN" testSecret testVersion --all
   assert_failure

tests/integration/app_undeploy.bats

@@ -92,9 +92,6 @@ teardown(){
 
   run $ABRA app undeploy "$TEST_APP_DOMAIN" --no-input
   assert_success
-
-  # NOTE(d1): ensure not chaos undeploy
-  assert_output --partial 'false'
 }
 
 # bats test_tags=slow

tests/integration/app_undeploy_overview.bats

@@ -33,13 +33,10 @@ teardown(){
   run $ABRA app undeploy "$TEST_APP_DOMAIN" --no-input
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "0.1.0+1.20.0" 
-  assert_output --regexp 'CHAOS.*false'
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "0.1.0+1.20.0"
-  assert_output --regexp 'NEW VERSION.*' + "0.1.0+1.20.0"
+  assert_output --partial 'UNDEPLOY OVERVIEW'
+  assert_output --partial 'CURRENT DEPLOYMENT    0.1.0+1.20.0'
+  assert_output --partial 'ENV VERSION           0.1.0+1.20.0'
+  assert_output --partial 'NEW DEPLOYMENT        N/A'
 
   run grep -q "TYPE=$TEST_RECIPE:0.1.0+1.20.0" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
@@ -57,13 +54,10 @@ teardown(){
   run $ABRA app undeploy "$TEST_APP_DOMAIN" --no-input
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*' + "${headHash:0:8}"
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'NEW VERSION.*' + "${headHash:0:8}"
+  assert_output --partial 'UNDEPLOY OVERVIEW'
+  assert_output --partial "CURRENT DEPLOYMENT    ${headHash:0:8}"
+  assert_output --partial "ENV VERSION           ${headHash:0:8}"
+  assert_output --partial 'NEW DEPLOYMENT        N/A'
 
   run grep -q "TYPE=$TEST_RECIPE:${headHash:0:8}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
@@ -72,7 +66,6 @@ teardown(){
 
 @test "chaos deploy with unstaged commits and undeploy" {
   headHash=$(_get_head_hash)
-  latestRelease=$(_latest_release)
 
   run bash -c 'echo "unstaged changes" >> "$ABRA_DIR/recipes/$TEST_RECIPE/foo"'
   assert_success
@@ -85,13 +78,10 @@ teardown(){
   run $ABRA app undeploy "$TEST_APP_DOMAIN" --no-input
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'CHAOS.*' + "${headHash:0:8}+U"
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "${latestRelease}"
-  assert_output --regexp 'NEW VERSION.*' + "${headHash:0:8}+U"
+  assert_output --partial 'UNDEPLOY OVERVIEW'
+  assert_output --partial "CURRENT DEPLOYMENT    ${headHash:0:8}+U"
+  assert_output --partial "ENV VERSION           ${headHash:0:8}+U"
+  assert_output --partial 'NEW DEPLOYMENT        N/A'
 
   run grep -q "TYPE=$TEST_RECIPE:${headHash:0:8}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"

tests/integration/app_upgrade.bats

@@ -205,7 +205,19 @@ teardown(){
 }
 
 # bats test_tags=slow
-@test "upgrade chaos deployment" {
+@test "show release note added after release" {
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.2.0+1.21.0" --no-input --no-converge-checks
+  assert_success
+  assert_output --partial '0.2.0+1.21.0'
+
+  run $ABRA app upgrade "$TEST_APP_DOMAIN" "0.3.0+1.21.0" --no-input --no-converge-checks
+  assert_success
+  assert_output --partial '0.3.0+1.21.0'
+  assert_output --partial 'A release note added after the release'
+}
+
+# bats test_tags=slow
+@test "upgrade commit deployment not possible" {
   tagHash=$(_get_tag_hash "0.1.0+1.20.0")
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout "$tagHash"
   assert_success
@@ -215,17 +227,8 @@ teardown(){
   assert_output --partial "${tagHash:0:8}"
 
   run $ABRA app upgrade "$TEST_APP_DOMAIN" "0.1.1+1.20.2" --no-input --no-converge-checks
-  assert_success
-  assert_output --partial "0.1.1+1.20.2"
-  assert_output --partial "${tagHash:0:8}"
-
-  run $ABRA app upgrade "$TEST_APP_DOMAIN" "0.2.0+1.21.0" --no-input --no-converge-checks
-  assert_success
-  assert_output --partial "0.2.0+1.21.0"
-
-  tagHash=$(_get_tag_hash "0.1.1+1.20.2")
-  refute_output --partial "${tagHash:0:8}"
-  assert_output --partial "false"
+  assert_failure
+  assert_output --partial "not a known version"
 }
 
 @test "chaos commit upgrade not possible" {

tests/integration/app_upgrade_overview.bats

@@ -31,24 +31,17 @@ teardown(){
     --no-input --no-converge-checks
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "0.1.0+1.20.0"
-  assert_output --regexp 'CHAOS.*false'
-
-  # upgrade
-  assert_output --regexp 'VERSION.*' + "0.2.0+1.21.0" 
-  assert_output --regexp 'CHAOS.*false'
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "0.1.0+1.20.0"
-  assert_output --regexp 'NEW VERSION.*' + "0.2.0+1.21.0"
+  assert_output --partial 'UPGRADE OVERVIEW'
+  assert_output --partial 'CURRENT DEPLOYMENT    0.1.0+1.20.0'
+  assert_output --partial 'ENV VERSION           0.1.0+1.20.0'
+  assert_output --partial 'NEW DEPLOYMENT        0.2.0+1.21.0'
 
   run grep -q "TYPE=$TEST_RECIPE:0.2.0+1.21.0" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 }
 
-@test "force upgrade" { 
+@test "force upgrade" {
   run $ABRA app deploy "$TEST_APP_DOMAIN" "0.2.0+1.21.0" \
     --no-input --no-converge-checks
   assert_success
@@ -57,17 +50,10 @@ teardown(){
     --no-input --no-converge-checks --force
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "0.2.0+1.21.0" 
-  assert_output --regexp 'CHAOS.*false'
-
-  # upgrade
-  assert_output --regexp 'VERSION.*' + "0.2.0+1.21.0"
-  assert_output --regexp 'CHAOS.*false'
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*' + "0.2.0+1.21.0"
-  assert_output --regexp 'NEW VERSION.*' + "0.2.0+1.21.0"
+  assert_output --partial 'REDEPLOY OVERVIEW'
+  assert_output --partial 'CURRENT DEPLOYMENT    0.2.0+1.21.0'
+  assert_output --partial 'ENV VERSION           0.2.0+1.21.0'
+  assert_output --partial 'NEW DEPLOYMENT        0.2.0+1.21.0'
 
   run grep -q "TYPE=$TEST_RECIPE:0.2.0+1.21.0" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
@@ -87,17 +73,10 @@ teardown(){
     --no-input --no-converge-checks --force
   assert_success
 
-  # current deployment
-  assert_output --regexp 'VERSION.*' + "0.2.0+1.21.0"
-  assert_output --regexp 'CHAOS.*false'
-
-  # upgrade
-  assert_output --regexp 'VERSION.*' + "0.2.0+1.21.0"
-  assert_output --regexp 'CHAOS.*false'
-
-  # env version
-  assert_output --regexp 'CURRENT VERSION.*N/A'
-  assert_output --regexp 'NEW VERSION.*' + "0.2.0+1.21.0"
+  assert_output --partial 'UPGRADE OVERVIEW'
+  assert_output --partial 'CURRENT DEPLOYMENT    0.2.0+1.21.0'
+  assert_output --partial 'ENV VERSION           N/A'
+  assert_output --partial 'NEW DEPLOYMENT        0.3.1+1.21.0'
 
   run grep -q "TYPE=$TEST_RECIPE:${latestRelease}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"

tests/integration/helpers/app.bash

@@ -30,6 +30,15 @@ _undeploy_app() {
   assert_output --partial 'unknown'
 }
 
+_undeploy_app2() {
+  run $ABRA app undeploy "$1" --no-input
+
+  run $ABRA app ls --server "$TEST_SERVER" --status
+  assert_success
+  assert_output --partial "$1"
+  assert_output --partial 'unknown'
+}
+
 _rm_app() {
   # NOTE(d1): not asserting outcomes on teardown here since some might fail
   # depending on what the test created. all commands run through anyway

tests/integration/helpers/git.bash

@@ -38,6 +38,8 @@ _set_git_author() {
 }
 
 _git_commit() {
+  _set_git_author
+
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" add .
   assert_success
 

tests/integration/install.bats

@@ -25,13 +25,3 @@ teardown(){
   run "$HOME/.local/bin/abra" -v
   assert_output --partial 'beta'
 }
-
-# bats test_tags=slow
-@test "install release candidate from script" {
-  run bash -c 'curl https://install.abra.coopcloud.tech | bash -s -- --rc'
-  assert_success
-
-  assert_exists "$HOME/.local/bin/abra"
-  run "$HOME/.local/bin/abra" -v
-  assert_output --partial '-rc'
-}

tests/integration/recipe_fetch.bats

@@ -5,6 +5,16 @@ setup() {
   _common_setup
 }
 
+teardown(){
+  run rm -rf "$ABRA_DIR/recipes/matrix-synapse"
+  assert_success
+  assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE"
+
+  run rm -rf "$ABRA_DIR/recipes/git_coopcloud_tech_coop-cloud_matrix-synapse"
+  assert_success
+  assert_not_exists "$ABRA_DIR/recipes/git_coopcloud_tech_coop-cloud_matrix-synapse"
+}
+
 # bats test_tags=slow
 @test "recipe fetch all" {
   run rm -rf "$ABRA_DIR/recipes/matrix-synapse"
@@ -35,3 +45,81 @@ setup() {
   run $ABRA recipe fetch matrix-synapse --all
   assert_failure
 }
+
+@test "do not refetch without --force" {
+  run $ABRA recipe fetch matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run $ABRA recipe fetch matrix-synapse
+  assert_output --partial "already fetched"
+}
+
+@test "refetch with --force" {
+  run $ABRA recipe fetch matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run $ABRA recipe fetch matrix-synapse --force
+  assert_success
+  refute_output --partial "already fetched"
+}
+
+@test "refetch with --force does not erase unstaged changes" {
+  run $ABRA recipe fetch matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run bash -c "echo foo >> $ABRA_DIR/recipes/matrix-synapse/foo"
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse/foo"
+
+  run $ABRA recipe fetch matrix-synapse --force
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse/foo"
+}
+
+@test "fetch with --ssh" {
+  run $ABRA recipe fetch matrix-synapse --ssh
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run git -C "$ABRA_DIR/recipes/matrix-synapse" remote -v
+  assert_success
+  assert_output --partial "ssh://"
+}
+
+@test "re-fetch with --ssh/--force" {
+  run $ABRA recipe fetch matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run git -C "$ABRA_DIR/recipes/matrix-synapse" remote -v
+  assert_success
+  assert_output --partial "https://"
+
+  run $ABRA recipe fetch matrix-synapse --ssh --force
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run git -C "$ABRA_DIR/recipes/matrix-synapse" remote -v
+  assert_success
+  assert_output --partial "ssh://"
+}
+
+@test "fetch remote recipe" {
+  run $ABRA recipe fetch git.coopcloud.tech/coop-cloud/matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/git_coopcloud_tech_coop-cloud_matrix-synapse"
+}
+
+@test "remote recipe do not refetch without --force" {
+  run $ABRA recipe fetch git.coopcloud.tech/coop-cloud/matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/git_coopcloud_tech_coop-cloud_matrix-synapse"
+
+  run $ABRA recipe fetch git.coopcloud.tech/coop-cloud/matrix-synapse
+  assert_success
+  assert_output --partial "already fetched"
+}

tests/integration/recipe_new.bats

@@ -68,3 +68,27 @@ teardown(){
   assert_output --partial 'fooUser'
   assert_output --partial 'foo@example.com'
 }
+
+# bats test_tags=slow
+@test "recipe new, app new, no releases, latest commit" {
+  recipeName="foobar"
+
+  run $ABRA recipe new "$recipeName"
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/$recipeName"
+
+  currentHash=$(git -C "$ABRA_DIR/recipes/$recipeName" show -s --format="%H")
+  domain="$recipeName.$TEST_APP_SERVER" 
+
+  run $ABRA app new "$recipeName" \
+    --no-input \
+    --server "$TEST_SERVER" \
+    --domain "$domain"
+  assert_success
+  assert_output --partial "version: ${currentHash:0:8}"
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$domain.env"
+
+  run grep -q "TYPE=$recipeName:${currentHash:0:8}" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$domain.env"
+  assert_success
+}

tests/integration/upgrade.bats

@@ -26,14 +26,3 @@ teardown(){
   run "$HOME/.local/bin/abra" -v
   assert_output --partial 'beta'
 }
-
-# bats test_tags=slow
-@test "abra upgrade release candidate" {
-  run $ABRA upgrade --rc
-  assert_success
-  assert_output --partial 'Public interest infrastructure'
-
-  assert_exists "$HOME/.local/bin/abra"
-  run "$HOME/.local/bin/abra" -v
-  assert_output --partial '-rc'
-}

vendor/github.com/ProtonMail/go-crypto/internal/byteutil/byteutil.go

@@ -49,16 +49,16 @@ func ShiftNBytesLeft(dst, x []byte, n int) {
 	dst = append(dst, make([]byte, n/8)...)
 }
 
-// XorBytesMut assumes equal input length, replaces X with X XOR Y
+// XorBytesMut replaces X with X XOR Y. len(X) must be >= len(Y).
 func XorBytesMut(X, Y []byte) {
-	for i := 0; i < len(X); i++ {
+	for i := 0; i < len(Y); i++ {
 		X[i] ^= Y[i]
 	}
 }
 
-// XorBytes assumes equal input length, puts X XOR Y into Z
+// XorBytes puts X XOR Y into Z. len(Z) and len(X) must be >= len(Y).
 func XorBytes(Z, X, Y []byte) {
-	for i := 0; i < len(X); i++ {
+	for i := 0; i < len(Y); i++ {
 		Z[i] = X[i] ^ Y[i]
 	}
 }

vendor/github.com/ProtonMail/go-crypto/ocb/ocb.go

@@ -109,8 +109,10 @@ func (o *ocb) Seal(dst, nonce, plaintext, adata []byte) []byte {
 	if len(nonce) > o.nonceSize {
 		panic("crypto/ocb: Incorrect nonce length given to OCB")
 	}
-	ret, out := byteutil.SliceForAppend(dst, len(plaintext)+o.tagSize)
-	o.crypt(enc, out, nonce, adata, plaintext)
+	sep := len(plaintext)
+	ret, out := byteutil.SliceForAppend(dst, sep+o.tagSize)
+	tag := o.crypt(enc, out[:sep], nonce, adata, plaintext)
+	copy(out[sep:], tag)
 	return ret
 }
 
@@ -122,12 +124,10 @@ func (o *ocb) Open(dst, nonce, ciphertext, adata []byte) ([]byte, error) {
 		return nil, ocbError("Ciphertext shorter than tag length")
 	}
 	sep := len(ciphertext) - o.tagSize
-	ret, out := byteutil.SliceForAppend(dst, len(ciphertext))
+	ret, out := byteutil.SliceForAppend(dst, sep)
 	ciphertextData := ciphertext[:sep]
-	tag := ciphertext[sep:]
-	o.crypt(dec, out, nonce, adata, ciphertextData)
-	if subtle.ConstantTimeCompare(ret[sep:], tag) == 1 {
-		ret = ret[:sep]
+	tag := o.crypt(dec, out, nonce, adata, ciphertextData)
+	if subtle.ConstantTimeCompare(tag, ciphertext[sep:]) == 1 {
 		return ret, nil
 	}
 	for i := range out {
@@ -137,7 +137,8 @@ func (o *ocb) Open(dst, nonce, ciphertext, adata []byte) ([]byte, error) {
 }
 
 // On instruction enc (resp. dec), crypt is the encrypt (resp. decrypt)
-// function. It returns the resulting plain/ciphertext with the tag appended.
+// function. It writes the resulting plain/ciphertext into Y and returns
+// the tag.
 func (o *ocb) crypt(instruction int, Y, nonce, adata, X []byte) []byte {
 	//
 	// Consider X as a sequence of 128-bit blocks
@@ -194,13 +195,14 @@ func (o *ocb) crypt(instruction int, Y, nonce, adata, X []byte) []byte {
 		byteutil.XorBytesMut(offset, o.mask.L[bits.TrailingZeros(uint(i+1))])
 		blockX := X[i*blockSize : (i+1)*blockSize]
 		blockY := Y[i*blockSize : (i+1)*blockSize]
-		byteutil.XorBytes(blockY, blockX, offset)
 		switch instruction {
 		case enc:
+			byteutil.XorBytesMut(checksum, blockX)
+			byteutil.XorBytes(blockY, blockX, offset)
 			o.block.Encrypt(blockY, blockY)
 			byteutil.XorBytesMut(blockY, offset)
-			byteutil.XorBytesMut(checksum, blockX)
 		case dec:
+			byteutil.XorBytes(blockY, blockX, offset)
 			o.block.Decrypt(blockY, blockY)
 			byteutil.XorBytesMut(blockY, offset)
 			byteutil.XorBytesMut(checksum, blockY)
@@ -216,31 +218,24 @@ func (o *ocb) crypt(instruction int, Y, nonce, adata, X []byte) []byte {
 		o.block.Encrypt(pad, offset)
 		chunkX := X[blockSize*m:]
 		chunkY := Y[blockSize*m : len(X)]
-		byteutil.XorBytes(chunkY, chunkX, pad[:len(chunkX)])
-		// P_* || bit(1) || zeroes(127) - len(P_*)
 		switch instruction {
 		case enc:
-			paddedY := append(chunkX, byte(128))
-			paddedY = append(paddedY, make([]byte, blockSize-len(chunkX)-1)...)
-			byteutil.XorBytesMut(checksum, paddedY)
+			byteutil.XorBytesMut(checksum, chunkX)
+			checksum[len(chunkX)] ^= 128
+			byteutil.XorBytes(chunkY, chunkX, pad[:len(chunkX)])
+			// P_* || bit(1) || zeroes(127) - len(P_*)
 		case dec:
-			paddedX := append(chunkY, byte(128))
-			paddedX = append(paddedX, make([]byte, blockSize-len(chunkY)-1)...)
-			byteutil.XorBytesMut(checksum, paddedX)
+			byteutil.XorBytes(chunkY, chunkX, pad[:len(chunkX)])
+			// P_* || bit(1) || zeroes(127) - len(P_*)
+			byteutil.XorBytesMut(checksum, chunkY)
+			checksum[len(chunkY)] ^= 128
 		}
-		byteutil.XorBytes(tag, checksum, offset)
-		byteutil.XorBytesMut(tag, o.mask.lDol)
-		o.block.Encrypt(tag, tag)
-		byteutil.XorBytesMut(tag, o.hash(adata))
-		copy(Y[blockSize*m+len(chunkY):], tag[:o.tagSize])
-	} else {
-		byteutil.XorBytes(tag, checksum, offset)
-		byteutil.XorBytesMut(tag, o.mask.lDol)
-		o.block.Encrypt(tag, tag)
-		byteutil.XorBytesMut(tag, o.hash(adata))
-		copy(Y[blockSize*m:], tag[:o.tagSize])
 	}
-	return Y
+	byteutil.XorBytes(tag, checksum, offset)
+	byteutil.XorBytesMut(tag, o.mask.lDol)
+	o.block.Encrypt(tag, tag)
+	byteutil.XorBytesMut(tag, o.hash(adata))
+	return tag[:o.tagSize]
 }
 
 // This hash function is used to compute the tag. Per design, on empty input it

vendor/github.com/ProtonMail/go-crypto/openpgp/armor/encode.go

@@ -7,6 +7,7 @@ package armor
 import (
 	"encoding/base64"
 	"io"
+	"sort"
 )
 
 var armorHeaderSep = []byte(": ")
@@ -159,8 +160,15 @@ func encode(out io.Writer, blockType string, headers map[string]string, checksum
 		return
 	}
 
-	for k, v := range headers {
-		err = writeSlices(out, []byte(k), armorHeaderSep, []byte(v), newline)
+	keys := make([]string, len(headers))
+	i := 0
+	for k := range headers {
+		keys[i] = k
+		i++
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		err = writeSlices(out, []byte(k), armorHeaderSep, []byte(headers[k]), newline)
 		if err != nil {
 			return
 		}

vendor/github.com/ProtonMail/go-crypto/openpgp/errors/errors.go

@@ -6,6 +6,7 @@
 package errors // import "github.com/ProtonMail/go-crypto/openpgp/errors"
 
 import (
+	"fmt"
 	"strconv"
 )
 
@@ -178,3 +179,22 @@ type ErrMalformedMessage string
 func (dke ErrMalformedMessage) Error() string {
 	return "openpgp: malformed message " + string(dke)
 }
+
+// ErrEncryptionKeySelection is returned if encryption key selection fails (v2 API).
+type ErrEncryptionKeySelection struct {
+	PrimaryKeyId      string
+	PrimaryKeyErr     error
+	EncSelectionKeyId *string
+	EncSelectionErr   error
+}
+
+func (eks ErrEncryptionKeySelection) Error() string {
+	prefix := fmt.Sprintf("openpgp: key selection for primary key %s:", eks.PrimaryKeyId)
+	if eks.PrimaryKeyErr != nil {
+		return fmt.Sprintf("%s invalid primary key: %s", prefix, eks.PrimaryKeyErr)
+	}
+	if eks.EncSelectionKeyId != nil {
+		return fmt.Sprintf("%s invalid encryption key %s: %s", prefix, *eks.EncSelectionKeyId, eks.EncSelectionErr)
+	}
+	return fmt.Sprintf("%s no encryption key: %s", prefix, eks.EncSelectionErr)
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_crypter.go

@@ -3,7 +3,6 @@
 package packet
 
 import (
-	"bytes"
 	"crypto/cipher"
 	"encoding/binary"
 	"io"
@@ -15,12 +14,11 @@ import (
 type aeadCrypter struct {
 	aead           cipher.AEAD
 	chunkSize      int
-	initialNonce   []byte
+	nonce          []byte
 	associatedData []byte       // Chunk-independent associated data
 	chunkIndex     []byte       // Chunk counter
 	packetTag      packetType   // SEIP packet (v2) or AEAD Encrypted Data packet
 	bytesProcessed int          // Amount of plaintext bytes encrypted/decrypted
-	buffer         bytes.Buffer // Buffered bytes across chunks
 }
 
 // computeNonce takes the incremental index and computes an eXclusive OR with
@@ -28,12 +26,12 @@ type aeadCrypter struct {
 // 5.16.1 and 5.16.2). It returns the resulting nonce.
 func (wo *aeadCrypter) computeNextNonce() (nonce []byte) {
 	if wo.packetTag == packetTypeSymmetricallyEncryptedIntegrityProtected {
-		return append(wo.initialNonce, wo.chunkIndex...)
+		return wo.nonce
 	}
 
-	nonce = make([]byte, len(wo.initialNonce))
-	copy(nonce, wo.initialNonce)
-	offset := len(wo.initialNonce) - 8
+	nonce = make([]byte, len(wo.nonce))
+	copy(nonce, wo.nonce)
+	offset := len(wo.nonce) - 8
 	for i := 0; i < 8; i++ {
 		nonce[i+offset] ^= wo.chunkIndex[i]
 	}
@@ -62,8 +60,9 @@ func (wo *aeadCrypter) incrementIndex() error {
 type aeadDecrypter struct {
 	aeadCrypter           // Embedded ciphertext opener
 	reader      io.Reader // 'reader' is a partialLengthReader
+	chunkBytes  []byte
 	peekedBytes []byte    // Used to detect last chunk
-	eof         bool
+	buffer      []byte    // Buffered decrypted bytes
 }
 
 // Read decrypts bytes and reads them into dst. It decrypts when necessary and
@@ -71,59 +70,44 @@ type aeadDecrypter struct {
 // and an error.
 func (ar *aeadDecrypter) Read(dst []byte) (n int, err error) {
 	// Return buffered plaintext bytes from previous calls
-	if ar.buffer.Len() > 0 {
-		return ar.buffer.Read(dst)
-	}
-
-	// Return EOF if we've previously validated the final tag
-	if ar.eof {
-		return 0, io.EOF
+	if len(ar.buffer) > 0 {
+		n = copy(dst, ar.buffer)
+		ar.buffer = ar.buffer[n:]
+		return
 	}
 
 	// Read a chunk
 	tagLen := ar.aead.Overhead()
-	cipherChunkBuf := new(bytes.Buffer)
-	_, errRead := io.CopyN(cipherChunkBuf, ar.reader, int64(ar.chunkSize+tagLen))
-	cipherChunk := cipherChunkBuf.Bytes()
-	if errRead != nil && errRead != io.EOF {
+	copy(ar.chunkBytes, ar.peekedBytes) // Copy bytes peeked in previous chunk or in initialization
+	bytesRead, errRead := io.ReadFull(ar.reader, ar.chunkBytes[tagLen:])
+	if errRead != nil && errRead != io.EOF && errRead != io.ErrUnexpectedEOF {
 		return 0, errRead
 	}
 
-	if len(cipherChunk) > 0 {
-		decrypted, errChunk := ar.openChunk(cipherChunk)
+	if bytesRead > 0 {
+		ar.peekedBytes = ar.chunkBytes[bytesRead:bytesRead+tagLen]
+
+		decrypted, errChunk := ar.openChunk(ar.chunkBytes[:bytesRead])
 		if errChunk != nil {
 			return 0, errChunk
 		}
 
 		// Return decrypted bytes, buffering if necessary
-		if len(dst) < len(decrypted) {
-			n = copy(dst, decrypted[:len(dst)])
-			ar.buffer.Write(decrypted[len(dst):])
-		} else {
-			n = copy(dst, decrypted)
-		}
+		n = copy(dst, decrypted)
+		ar.buffer = decrypted[n:]
+		return
 	}
 
-	// Check final authentication tag
-	if errRead == io.EOF {
-		errChunk := ar.validateFinalTag(ar.peekedBytes)
-		if errChunk != nil {
-			return n, errChunk
-		}
-		ar.eof = true // Mark EOF for when we've returned all buffered data
-	}
-	return
+	return 0, io.EOF
 }
 
-// Close is noOp. The final authentication tag of the stream was already
-// checked in the last Read call. In the future, this function could be used to
-// wipe the reader and peeked, decrypted bytes, if necessary.
+// Close checks the final authentication tag of the stream.
+// In the future, this function could also be used to wipe the reader
+// and peeked & decrypted bytes, if necessary.
 func (ar *aeadDecrypter) Close() (err error) {
-	if !ar.eof {
-		errChunk := ar.validateFinalTag(ar.peekedBytes)
-		if errChunk != nil {
-			return errChunk
-		}
+	errChunk := ar.validateFinalTag(ar.peekedBytes)
+	if errChunk != nil {
+		return errChunk
 	}
 	return nil
 }
@@ -132,20 +116,13 @@ func (ar *aeadDecrypter) Close() (err error) {
 // the underlying plaintext and an error. It accesses peeked bytes from next
 // chunk, to identify the last chunk and decrypt/validate accordingly.
 func (ar *aeadDecrypter) openChunk(data []byte) ([]byte, error) {
-	tagLen := ar.aead.Overhead()
-	// Restore carried bytes from last call
-	chunkExtra := append(ar.peekedBytes, data...)
-	// 'chunk' contains encrypted bytes, followed by an authentication tag.
-	chunk := chunkExtra[:len(chunkExtra)-tagLen]
-	ar.peekedBytes = chunkExtra[len(chunkExtra)-tagLen:]
-
 	adata := ar.associatedData
 	if ar.aeadCrypter.packetTag == packetTypeAEADEncrypted {
 		adata = append(ar.associatedData, ar.chunkIndex...)
 	}
 
 	nonce := ar.computeNextNonce()
-	plainChunk, err := ar.aead.Open(nil, nonce, chunk, adata)
+	plainChunk, err := ar.aead.Open(data[:0:len(data)], nonce, data, adata)
 	if err != nil {
 		return nil, errors.ErrAEADTagVerification
 	}
@@ -183,27 +160,29 @@ func (ar *aeadDecrypter) validateFinalTag(tag []byte) error {
 type aeadEncrypter struct {
 	aeadCrypter                // Embedded plaintext sealer
 	writer      io.WriteCloser // 'writer' is a partialLengthWriter
+	chunkBytes  []byte
+	offset      int
 }
 
 // Write encrypts and writes bytes. It encrypts when necessary and buffers extra
 // plaintext bytes for next call. When the stream is finished, Close() MUST be
 // called to append the final tag.
 func (aw *aeadEncrypter) Write(plaintextBytes []byte) (n int, err error) {
-	// Append plaintextBytes to existing buffered bytes
-	n, err = aw.buffer.Write(plaintextBytes)
-	if err != nil {
-		return n, err
-	}
-	// Encrypt and write chunks
-	for aw.buffer.Len() >= aw.chunkSize {
-		plainChunk := aw.buffer.Next(aw.chunkSize)
-		encryptedChunk, err := aw.sealChunk(plainChunk)
-		if err != nil {
-			return n, err
-		}
-		_, err = aw.writer.Write(encryptedChunk)
-		if err != nil {
-			return n, err
+	for n != len(plaintextBytes) {
+		copied := copy(aw.chunkBytes[aw.offset:aw.chunkSize], plaintextBytes[n:])
+		n += copied
+		aw.offset += copied
+
+		if aw.offset == aw.chunkSize {
+			encryptedChunk, err := aw.sealChunk(aw.chunkBytes[:aw.offset])
+			if err != nil {
+				return n, err
+			}
+			_, err = aw.writer.Write(encryptedChunk)
+			if err != nil {
+				return n, err
+			}
+			aw.offset = 0
 		}
 	}
 	return
@@ -215,9 +194,8 @@ func (aw *aeadEncrypter) Write(plaintextBytes []byte) (n int, err error) {
 func (aw *aeadEncrypter) Close() (err error) {
 	// Encrypt and write a chunk if there's buffered data left, or if we haven't
 	// written any chunks yet.
-	if aw.buffer.Len() > 0 || aw.bytesProcessed == 0 {
-		plainChunk := aw.buffer.Bytes()
-		lastEncryptedChunk, err := aw.sealChunk(plainChunk)
+	if aw.offset > 0 || aw.bytesProcessed == 0 {
+		lastEncryptedChunk, err := aw.sealChunk(aw.chunkBytes[:aw.offset])
 		if err != nil {
 			return err
 		}
@@ -263,7 +241,7 @@ func (aw *aeadEncrypter) sealChunk(data []byte) ([]byte, error) {
 	}
 
 	nonce := aw.computeNextNonce()
-	encrypted := aw.aead.Seal(nil, nonce, data, adata)
+	encrypted := aw.aead.Seal(data[:0], nonce, data, adata)
 	aw.bytesProcessed += len(data)
 	if err := aw.aeadCrypter.incrementIndex(); err != nil {
 		return nil, err

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_encrypted.go

@@ -65,24 +65,28 @@ func (ae *AEADEncrypted) decrypt(key []byte) (io.ReadCloser, error) {
 	blockCipher := ae.cipher.new(key)
 	aead := ae.mode.new(blockCipher)
 	// Carry the first tagLen bytes
+	chunkSize := decodeAEADChunkSize(ae.chunkSizeByte)
 	tagLen := ae.mode.TagLength()
-	peekedBytes := make([]byte, tagLen)
+	chunkBytes := make([]byte, chunkSize+tagLen*2)
+	peekedBytes := chunkBytes[chunkSize+tagLen:]
 	n, err := io.ReadFull(ae.Contents, peekedBytes)
 	if n < tagLen || (err != nil && err != io.EOF) {
 		return nil, errors.AEADError("Not enough data to decrypt:" + err.Error())
 	}
-	chunkSize := decodeAEADChunkSize(ae.chunkSizeByte)
+
 	return &aeadDecrypter{
 		aeadCrypter: aeadCrypter{
 			aead:           aead,
 			chunkSize:      chunkSize,
-			initialNonce:   ae.initialNonce,
+			nonce:          ae.initialNonce,
 			associatedData: ae.associatedData(),
 			chunkIndex:     make([]byte, 8),
 			packetTag:      packetTypeAEADEncrypted,
 		},
 		reader:      ae.Contents,
-		peekedBytes: peekedBytes}, nil
+		chunkBytes:  chunkBytes,
+		peekedBytes: peekedBytes,
+	}, nil
 }
 
 // associatedData for chunks: tag, version, cipher, mode, chunk size byte

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/config.go

@@ -173,6 +173,11 @@ type Config struct {
 	// weaknesses in the hash algo, potentially hindering e.g. some chosen-prefix attacks.
 	// The default behavior, when the config or flag is nil, is to enable the feature.
 	NonDeterministicSignaturesViaNotation *bool
+
+	// InsecureAllowAllKeyFlagsWhenMissing determines how a key without valid key flags is handled.
+	// When set to true, a key without flags is treated as if all flags are enabled.
+	// This behavior is consistent with GPG.
+	InsecureAllowAllKeyFlagsWhenMissing bool
 }
 
 func (c *Config) Random() io.Reader {
@@ -403,6 +408,13 @@ func (c *Config) RandomizeSignaturesViaNotation() bool {
 	return *c.NonDeterministicSignaturesViaNotation
 }
 
+func (c *Config) AllowAllKeyFlagsWhenMissing() bool {
+	if c == nil {
+		return false
+	}
+	return c.InsecureAllowAllKeyFlagsWhenMissing
+}
+
 // BoolPointer is a helper function to set a boolean pointer in the Config.
 // e.g., config.CheckPacketSequence = BoolPointer(true)
 func BoolPointer(value bool) *bool {

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/public_key.go

@@ -1048,12 +1048,17 @@ func (pk *PublicKey) VerifyDirectKeySignature(sig *Signature) (err error) {
 // KeyIdString returns the public key's fingerprint in capital hex
 // (e.g. "6C7EE1B8621CC013").
 func (pk *PublicKey) KeyIdString() string {
-	return fmt.Sprintf("%X", pk.Fingerprint[12:20])
+	return fmt.Sprintf("%016X", pk.KeyId)
 }
 
 // KeyIdShortString returns the short form of public key's fingerprint
 // in capital hex, as shown by gpg --list-keys (e.g. "621CC013").
+// This function will return the full key id for v5 and v6 keys
+// since the short key id is undefined for them.
 func (pk *PublicKey) KeyIdShortString() string {
+	if pk.Version >= 5 {
+		return pk.KeyIdString()
+	}
 	return fmt.Sprintf("%X", pk.Fingerprint[16:20])
 }
 

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/signature.go

@@ -1288,7 +1288,9 @@ func (sig *Signature) buildSubpackets(issuer PublicKey) (subpackets []outputSubp
 	if sig.IssuerKeyId != nil && sig.Version == 4 {
 		keyId := make([]byte, 8)
 		binary.BigEndian.PutUint64(keyId, *sig.IssuerKeyId)
-		subpackets = append(subpackets, outputSubpacket{true, issuerSubpacket, true, keyId})
+		// Note: making this critical breaks RPM <=4.16.
+		// See: https://github.com/ProtonMail/go-crypto/issues/263
+		subpackets = append(subpackets, outputSubpacket{true, issuerSubpacket, false, keyId})
 	}
 	// Notation Data
 	for _, notation := range sig.Notations {

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/symmetrically_encrypted_aead.go

@@ -70,8 +70,10 @@ func (se *SymmetricallyEncrypted) decryptAead(inputKey []byte) (io.ReadCloser, e
 
 	aead, nonce := getSymmetricallyEncryptedAeadInstance(se.Cipher, se.Mode, inputKey, se.Salt[:], se.associatedData())
 	// Carry the first tagLen bytes
+	chunkSize := decodeAEADChunkSize(se.ChunkSizeByte)
 	tagLen := se.Mode.TagLength()
-	peekedBytes := make([]byte, tagLen)
+	chunkBytes := make([]byte, chunkSize+tagLen*2)
+	peekedBytes := chunkBytes[chunkSize+tagLen:]
 	n, err := io.ReadFull(se.Contents, peekedBytes)
 	if n < tagLen || (err != nil && err != io.EOF) {
 		return nil, errors.StructuralError("not enough data to decrypt:" + err.Error())
@@ -81,12 +83,13 @@ func (se *SymmetricallyEncrypted) decryptAead(inputKey []byte) (io.ReadCloser, e
 		aeadCrypter: aeadCrypter{
 			aead:           aead,
 			chunkSize:      decodeAEADChunkSize(se.ChunkSizeByte),
-			initialNonce:   nonce,
+			nonce:          nonce,
 			associatedData: se.associatedData(),
-			chunkIndex:     make([]byte, 8),
+			chunkIndex:     nonce[len(nonce)-8:],
 			packetTag:      packetTypeSymmetricallyEncryptedIntegrityProtected,
 		},
 		reader:      se.Contents,
+		chunkBytes:  chunkBytes,
 		peekedBytes: peekedBytes,
 	}, nil
 }
@@ -130,16 +133,20 @@ func serializeSymmetricallyEncryptedAead(ciphertext io.WriteCloser, cipherSuite
 
 	aead, nonce := getSymmetricallyEncryptedAeadInstance(cipherSuite.Cipher, cipherSuite.Mode, inputKey, salt, prefix)
 
+	chunkSize := decodeAEADChunkSize(chunkSizeByte)
+	tagLen := aead.Overhead()
+	chunkBytes := make([]byte, chunkSize+tagLen)
 	return &aeadEncrypter{
 		aeadCrypter: aeadCrypter{
 			aead:           aead,
-			chunkSize:      decodeAEADChunkSize(chunkSizeByte),
+			chunkSize:      chunkSize,
 			associatedData: prefix,
-			chunkIndex:     make([]byte, 8),
-			initialNonce:   nonce,
+			nonce:          nonce,
+			chunkIndex:     nonce[len(nonce)-8:],
 			packetTag:      packetTypeSymmetricallyEncryptedIntegrityProtected,
 		},
-		writer: ciphertext,
+		writer:     ciphertext,
+		chunkBytes: chunkBytes,
 	}, nil
 }
 
@@ -149,10 +156,10 @@ func getSymmetricallyEncryptedAeadInstance(c CipherFunction, mode AEADMode, inpu
 	encryptionKey := make([]byte, c.KeySize())
 	_, _ = readFull(hkdfReader, encryptionKey)
 
-	// Last 64 bits of nonce are the counter
-	nonce = make([]byte, mode.IvLength()-8)
+	nonce = make([]byte, mode.IvLength())
 
-	_, _ = readFull(hkdfReader, nonce)
+	// Last 64 bits of nonce are the counter
+	_, _ = readFull(hkdfReader, nonce[:len(nonce)-8])
 
 	blockCipher := c.new(encryptionKey)
 	aead = mode.new(blockCipher)

vendor/github.com/charmbracelet/bubbletea/.gitattributes

@@ -0,0 +1 @@
+*.golden -text

vendor/github.com/charmbracelet/bubbletea/.gitignore

@@ -0,0 +1,23 @@
+.DS_Store
+.envrc
+
+examples/fullscreen/fullscreen
+examples/help/help
+examples/http/http
+examples/list-default/list-default
+examples/list-fancy/list-fancy
+examples/list-simple/list-simple
+examples/mouse/mouse
+examples/pager/pager
+examples/progress-download/color_vortex.blend
+examples/progress-download/progress-download
+examples/simple/simple
+examples/spinner/spinner
+examples/textinput/textinput
+examples/textinputs/textinputs
+examples/views/views
+tutorials/basics/basics
+tutorials/commands/commands
+.idea
+coverage.txt
+dist/

vendor/github.com/charmbracelet/bubbletea/.golangci-soft.yml

@@ -1,5 +1,6 @@
 run:
   tests: false
+  issues-exit-code: 0
 
 issues:
   include:
@@ -36,5 +37,4 @@ linters:
     - govet
     - ineffassign
     - staticcheck
-    - typecheck
     - unused

vendor/github.com/charmbracelet/bubbletea/.golangci.yml

@@ -0,0 +1,28 @@
+run:
+  tests: false
+
+issues:
+  include:
+    - EXC0001
+    - EXC0005
+    - EXC0011
+    - EXC0012
+    - EXC0013
+
+  max-issues-per-linter: 0
+  max-same-issues: 0
+
+linters:
+  enable:
+    - bodyclose
+    - gofumpt
+    - goimports
+    - gosec
+    - nilerr
+    - revive
+    - rowserrcheck
+    - sqlclosecheck
+    - tparallel
+    - unconvert
+    - unparam
+    - whitespace

vendor/github.com/charmbracelet/bubbletea/.goreleaser.yml

@@ -0,0 +1,5 @@
+# yaml-language-server: $schema=https://goreleaser.com/static/schema-pro.json
+version: 2
+includes:
+  - from_url:
+      url: charmbracelet/meta/main/goreleaser-lib.yaml

vendor/github.com/charmbracelet/bubbletea/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020-2023 Charmbracelet, Inc
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vendor/github.com/charmbracelet/bubbletea/README.md

@@ -0,0 +1,396 @@
+# Bubble Tea
+
+<p>
+    <a href="https://stuff.charm.sh/bubbletea/bubbletea-4k.png"><img src="https://github.com/charmbracelet/bubbletea/assets/25087/108d4fdb-d554-4910-abed-2a5f5586a60e" width="313" alt="Bubble Tea Title Treatment"></a><br>
+    <a href="https://github.com/charmbracelet/bubbletea/releases"><img src="https://img.shields.io/github/release/charmbracelet/bubbletea.svg" alt="Latest Release"></a>
+    <a href="https://pkg.go.dev/github.com/charmbracelet/bubbletea?tab=doc"><img src="https://godoc.org/github.com/charmbracelet/bubbletea?status.svg" alt="GoDoc"></a>
+    <a href="https://github.com/charmbracelet/bubbletea/actions"><img src="https://github.com/charmbracelet/bubbletea/actions/workflows/build.yml/badge.svg" alt="Build Status"></a>
+    <a href="https://www.phorm.ai/query?projectId=a0e324b6-b706-4546-b951-6671ea60c13f"><img src="https://stuff.charm.sh/misc/phorm-badge.svg" alt="phorm.ai"></a>
+</p>
+
+The fun, functional and stateful way to build terminal apps. A Go framework
+based on [The Elm Architecture][elm]. Bubble Tea is well-suited for simple and
+complex terminal applications, either inline, full-window, or a mix of both.
+
+<p>
+    <img src="https://stuff.charm.sh/bubbletea/bubbletea-example.gif" width="100%" alt="Bubble Tea Example">
+</p>
+
+Bubble Tea is in use in production and includes a number of features and
+performance optimizations we’ve added along the way. Among those is
+a framerate-based renderer, mouse support, focus reporting and more.
+
+To get started, see the tutorial below, the [examples][examples], the
+[docs][docs], the [video tutorials][youtube] and some common [resources](#libraries-we-use-with-bubble-tea).
+
+[youtube]: https://charm.sh/yt
+
+## By the way
+
+Be sure to check out [Bubbles][bubbles], a library of common UI components for Bubble Tea.
+
+<p>
+    <a href="https://github.com/charmbracelet/bubbles"><img src="https://stuff.charm.sh/bubbles/bubbles-badge.png" width="174" alt="Bubbles Badge"></a>&nbsp;&nbsp;
+    <a href="https://github.com/charmbracelet/bubbles"><img src="https://stuff.charm.sh/bubbles-examples/textinput.gif" width="400" alt="Text Input Example from Bubbles"></a>
+</p>
+
+---
+
+## Tutorial
+
+Bubble Tea is based on the functional design paradigms of [The Elm
+Architecture][elm], which happens to work nicely with Go. It's a delightful way
+to build applications.
+
+This tutorial assumes you have a working knowledge of Go.
+
+By the way, the non-annotated source code for this program is available
+[on GitHub][tut-source].
+
+[elm]: https://guide.elm-lang.org/architecture/
+[tut-source]: https://github.com/charmbracelet/bubbletea/tree/main/tutorials/basics
+
+### Enough! Let's get to it.
+
+For this tutorial, we're making a shopping list.
+
+To start we'll define our package and import some libraries. Our only external
+import will be the Bubble Tea library, which we'll call `tea` for short.
+
+```go
+package main
+
+// These imports will be used later on the tutorial. If you save the file
+// now, Go might complain they are unused, but that's fine.
+// You may also need to run `go mod tidy` to download bubbletea and its
+// dependencies.
+import (
+    "fmt"
+    "os"
+
+    tea "github.com/charmbracelet/bubbletea"
+)
+```
+
+Bubble Tea programs are comprised of a **model** that describes the application
+state and three simple methods on that model:
+
+- **Init**, a function that returns an initial command for the application to run.
+- **Update**, a function that handles incoming events and updates the model accordingly.
+- **View**, a function that renders the UI based on the data in the model.
+
+### The Model
+
+So let's start by defining our model which will store our application's state.
+It can be any type, but a `struct` usually makes the most sense.
+
+```go
+type model struct {
+    choices  []string           // items on the to-do list
+    cursor   int                // which to-do list item our cursor is pointing at
+    selected map[int]struct{}   // which to-do items are selected
+}
+```
+
+### Initialization
+
+Next, we’ll define our application’s initial state. In this case, we’re defining
+a function to return our initial model, however, we could just as easily define
+the initial model as a variable elsewhere, too.
+
+```go
+func initialModel() model {
+	return model{
+		// Our to-do list is a grocery list
+		choices:  []string{"Buy carrots", "Buy celery", "Buy kohlrabi"},
+
+		// A map which indicates which choices are selected. We're using
+		// the  map like a mathematical set. The keys refer to the indexes
+		// of the `choices` slice, above.
+		selected: make(map[int]struct{}),
+	}
+}
+```
+
+Next, we define the `Init` method. `Init` can return a `Cmd` that could perform
+some initial I/O. For now, we don't need to do any I/O, so for the command,
+we'll just return `nil`, which translates to "no command."
+
+```go
+func (m model) Init() tea.Cmd {
+    // Just return `nil`, which means "no I/O right now, please."
+    return nil
+}
+```
+
+### The Update Method
+
+Next up is the update method. The update function is called when ”things
+happen.” Its job is to look at what has happened and return an updated model in
+response. It can also return a `Cmd` to make more things happen, but for now
+don't worry about that part.
+
+In our case, when a user presses the down arrow, `Update`’s job is to notice
+that the down arrow was pressed and move the cursor accordingly (or not).
+
+The “something happened” comes in the form of a `Msg`, which can be any type.
+Messages are the result of some I/O that took place, such as a keypress, timer
+tick, or a response from a server.
+
+We usually figure out which type of `Msg` we received with a type switch, but
+you could also use a type assertion.
+
+For now, we'll just deal with `tea.KeyMsg` messages, which are automatically
+sent to the update function when keys are pressed.
+
+```go
+func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+    switch msg := msg.(type) {
+
+    // Is it a key press?
+    case tea.KeyMsg:
+
+        // Cool, what was the actual key pressed?
+        switch msg.String() {
+
+        // These keys should exit the program.
+        case "ctrl+c", "q":
+            return m, tea.Quit
+
+        // The "up" and "k" keys move the cursor up
+        case "up", "k":
+            if m.cursor > 0 {
+                m.cursor--
+            }
+
+        // The "down" and "j" keys move the cursor down
+        case "down", "j":
+            if m.cursor < len(m.choices)-1 {
+                m.cursor++
+            }
+
+        // The "enter" key and the spacebar (a literal space) toggle
+        // the selected state for the item that the cursor is pointing at.
+        case "enter", " ":
+            _, ok := m.selected[m.cursor]
+            if ok {
+                delete(m.selected, m.cursor)
+            } else {
+                m.selected[m.cursor] = struct{}{}
+            }
+        }
+    }
+
+    // Return the updated model to the Bubble Tea runtime for processing.
+    // Note that we're not returning a command.
+    return m, nil
+}
+```
+
+You may have noticed that <kbd>ctrl+c</kbd> and <kbd>q</kbd> above return
+a `tea.Quit` command with the model. That’s a special command which instructs
+the Bubble Tea runtime to quit, exiting the program.
+
+### The View Method
+
+At last, it’s time to render our UI. Of all the methods, the view is the
+simplest. We look at the model in its current state and use it to return
+a `string`. That string is our UI!
+
+Because the view describes the entire UI of your application, you don’t have to
+worry about redrawing logic and stuff like that. Bubble Tea takes care of it
+for you.
+
+```go
+func (m model) View() string {
+    // The header
+    s := "What should we buy at the market?\n\n"
+
+    // Iterate over our choices
+    for i, choice := range m.choices {
+
+        // Is the cursor pointing at this choice?
+        cursor := " " // no cursor
+        if m.cursor == i {
+            cursor = ">" // cursor!
+        }
+
+        // Is this choice selected?
+        checked := " " // not selected
+        if _, ok := m.selected[i]; ok {
+            checked = "x" // selected!
+        }
+
+        // Render the row
+        s += fmt.Sprintf("%s [%s] %s\n", cursor, checked, choice)
+    }
+
+    // The footer
+    s += "\nPress q to quit.\n"
+
+    // Send the UI for rendering
+    return s
+}
+```
+
+### All Together Now
+
+The last step is to simply run our program. We pass our initial model to
+`tea.NewProgram` and let it rip:
+
+```go
+func main() {
+    p := tea.NewProgram(initialModel())
+    if _, err := p.Run(); err != nil {
+        fmt.Printf("Alas, there's been an error: %v", err)
+        os.Exit(1)
+    }
+}
+```
+
+## What’s Next?
+
+This tutorial covers the basics of building an interactive terminal UI, but
+in the real world you'll also need to perform I/O. To learn about that have a
+look at the [Command Tutorial][cmd]. It's pretty simple.
+
+There are also several [Bubble Tea examples][examples] available and, of course,
+there are [Go Docs][docs].
+
+[cmd]: https://github.com/charmbracelet/bubbletea/tree/main/tutorials/commands/
+[examples]: https://github.com/charmbracelet/bubbletea/tree/main/examples
+[docs]: https://pkg.go.dev/github.com/charmbracelet/bubbletea?tab=doc
+
+## Debugging
+
+### Debugging with Delve
+
+Since Bubble Tea apps assume control of stdin and stdout, you’ll need to run
+delve in headless mode and then connect to it:
+
+```bash
+# Start the debugger
+$ dlv debug --headless --api-version=2 --listen=127.0.0.1:43000 .
+API server listening at: 127.0.0.1:43000
+
+# Connect to it from another terminal
+$ dlv connect 127.0.0.1:43000
+```
+
+If you do not explicitly supply the `--listen` flag, the port used will vary
+per run, so passing this in makes the debugger easier to use from a script
+or your IDE of choice.
+
+Additionally, we pass in `--api-version=2` because delve defaults to version 1
+for backwards compatibility reasons. However, delve recommends using version 2
+for all new development and some clients may no longer work with version 1.
+For more information, see the [Delve documentation](https://github.com/go-delve/delve/tree/master/Documentation/api).
+
+### Logging Stuff
+
+You can’t really log to stdout with Bubble Tea because your TUI is busy
+occupying that! You can, however, log to a file by including something like
+the following prior to starting your Bubble Tea program:
+
+```go
+if len(os.Getenv("DEBUG")) > 0 {
+	f, err := tea.LogToFile("debug.log", "debug")
+	if err != nil {
+		fmt.Println("fatal:", err)
+		os.Exit(1)
+	}
+	defer f.Close()
+}
+```
+
+To see what’s being logged in real time, run `tail -f debug.log` while you run
+your program in another window.
+
+## Libraries we use with Bubble Tea
+
+- [Bubbles][bubbles]: Common Bubble Tea components such as text inputs, viewports, spinners and so on
+- [Lip Gloss][lipgloss]: Style, format and layout tools for terminal applications
+- [Harmonica][harmonica]: A spring animation library for smooth, natural motion
+- [BubbleZone][bubblezone]: Easy mouse event tracking for Bubble Tea components
+- [ntcharts][ntcharts]: A terminal charting library built for Bubble Tea and [Lip Gloss][lipgloss]
+
+[bubbles]: https://github.com/charmbracelet/bubbles
+[lipgloss]: https://github.com/charmbracelet/lipgloss
+[harmonica]: https://github.com/charmbracelet/harmonica
+[bubblezone]: https://github.com/lrstanley/bubblezone
+[ntcharts]: https://github.com/NimbleMarkets/ntcharts
+
+## Bubble Tea in the Wild
+
+There are over [10,000 applications](https://github.com/charmbracelet/bubbletea/network/dependents) built with Bubble Tea! Here are a handful of ’em.
+
+### Staff favourites
+
+- [chezmoi](https://github.com/twpayne/chezmoi): securely manage your dotfiles across multiple machines
+- [circumflex](https://github.com/bensadeh/circumflex): read Hacker News in the terminal
+- [gh-dash](https://www.github.com/dlvhdr/gh-dash): a GitHub CLI extension for PRs and issues
+- [Tetrigo](https://github.com/Broderick-Westrope/tetrigo): Tetris in the terminal
+- [Signls](https://github.com/emprcl/signls): a generative midi sequencer designed for composition and live performance
+- [Superfile](https://github.com/yorukot/superfile): a super file manager
+
+### In Industry
+
+- Microsoft Azure – [Aztify](https://github.com/Azure/aztfy): bring Microsoft Azure resources under Terraform
+- Daytona – [Daytona](https://github.com/daytonaio/daytona): open source dev environment manager
+- Cockroach Labs – [CockroachDB](https://github.com/cockroachdb/cockroach): a cloud-native, high-availability distributed SQL database
+- Truffle Security Co. – [Trufflehog](https://github.com/trufflesecurity/trufflehog): find leaked credentials
+- NVIDIA – [container-canary](https://github.com/NVIDIA/container-canary): a container validator
+- AWS – [eks-node-viewer](https://github.com/awslabs/eks-node-viewer): a tool for visualizing dynamic node usage within an EKS cluster
+- MinIO – [mc](https://github.com/minio/mc): the official [MinIO](https://min.io) client
+- Ubuntu – [Authd](https://github.com/ubuntu/authd): an authentication daemon for cloud-based identity providers
+
+### Charm stuff
+
+- [Glow](https://github.com/charmbracelet/glow): a markdown reader, browser, and online markdown stash
+- [Huh?](https://github.com/charmbracelet/huh): an interactive prompt and form toolkit
+- [Mods](https://github.com/charmbracelet/mods): AI on the CLI, built for pipelines
+- [Wishlist](https://github.com/charmbracelet/wishlist): an SSH directory (and bastion!)
+
+### There’s so much more where that came from
+
+For more applications built with Bubble Tea see [Charm & Friends][community].
+Is there something cool you made with Bubble Tea you want to share? [PRs][community] are
+welcome!
+
+## Contributing
+
+See [contributing][contribute].
+
+[contribute]: https://github.com/charmbracelet/bubbletea/contribute
+
+## Feedback
+
+We’d love to hear your thoughts on this project. Feel free to drop us a note!
+
+- [Twitter](https://twitter.com/charmcli)
+- [The Fediverse](https://mastodon.social/@charmcli)
+- [Discord](https://charm.sh/chat)
+
+## Acknowledgments
+
+Bubble Tea is based on the paradigms of [The Elm Architecture][elm] by Evan
+Czaplicki et alia and the excellent [go-tea][gotea] by TJ Holowaychuk. It’s
+inspired by the many great [_Zeichenorientierte Benutzerschnittstellen_][zb]
+of days past.
+
+[elm]: https://guide.elm-lang.org/architecture/
+[gotea]: https://github.com/tj/go-tea
+[zb]: https://de.wikipedia.org/wiki/Zeichenorientierte_Benutzerschnittstelle
+[community]: https://github.com/charm-and-friends/charm-in-the-wild
+
+## License
+
+[MIT](https://github.com/charmbracelet/bubbletea/raw/main/LICENSE)
+
+---
+
+Part of [Charm](https://charm.sh).
+
+<a href="https://charm.sh/"><img alt="The Charm logo" src="https://stuff.charm.sh/charm-badge.jpg" width="400"></a>
+
+Charm热爱开源 • Charm loves open source • نحنُ نحب المصادر المفتوحة

vendor/github.com/charmbracelet/bubbletea/commands.go

@@ -0,0 +1,216 @@
+package tea
+
+import (
+	"time"
+)
+
+// Batch performs a bunch of commands concurrently with no ordering guarantees
+// about the results. Use a Batch to return several commands.
+//
+// Example:
+//
+//	    func (m model) Init() Cmd {
+//		       return tea.Batch(someCommand, someOtherCommand)
+//	    }
+func Batch(cmds ...Cmd) Cmd {
+	var validCmds []Cmd //nolint:prealloc
+	for _, c := range cmds {
+		if c == nil {
+			continue
+		}
+		validCmds = append(validCmds, c)
+	}
+	switch len(validCmds) {
+	case 0:
+		return nil
+	case 1:
+		return validCmds[0]
+	default:
+		return func() Msg {
+			return BatchMsg(validCmds)
+		}
+	}
+}
+
+// BatchMsg is a message used to perform a bunch of commands concurrently with
+// no ordering guarantees. You can send a BatchMsg with Batch.
+type BatchMsg []Cmd
+
+// Sequence runs the given commands one at a time, in order. Contrast this with
+// Batch, which runs commands concurrently.
+func Sequence(cmds ...Cmd) Cmd {
+	return func() Msg {
+		return sequenceMsg(cmds)
+	}
+}
+
+// sequenceMsg is used internally to run the given commands in order.
+type sequenceMsg []Cmd
+
+// Every is a command that ticks in sync with the system clock. So, if you
+// wanted to tick with the system clock every second, minute or hour you
+// could use this. It's also handy for having different things tick in sync.
+//
+// Because we're ticking with the system clock the tick will likely not run for
+// the entire specified duration. For example, if we're ticking for one minute
+// and the clock is at 12:34:20 then the next tick will happen at 12:35:00, 40
+// seconds later.
+//
+// To produce the command, pass a duration and a function which returns
+// a message containing the time at which the tick occurred.
+//
+//	type TickMsg time.Time
+//
+//	cmd := Every(time.Second, func(t time.Time) Msg {
+//	   return TickMsg(t)
+//	})
+//
+// Beginners' note: Every sends a single message and won't automatically
+// dispatch messages at an interval. To do that, you'll want to return another
+// Every command after receiving your tick message. For example:
+//
+//	type TickMsg time.Time
+//
+//	// Send a message every second.
+//	func tickEvery() Cmd {
+//	    return Every(time.Second, func(t time.Time) Msg {
+//	        return TickMsg(t)
+//	    })
+//	}
+//
+//	func (m model) Init() Cmd {
+//	    // Start ticking.
+//	    return tickEvery()
+//	}
+//
+//	func (m model) Update(msg Msg) (Model, Cmd) {
+//	    switch msg.(type) {
+//	    case TickMsg:
+//	        // Return your Every command again to loop.
+//	        return m, tickEvery()
+//	    }
+//	    return m, nil
+//	}
+//
+// Every is analogous to Tick in the Elm Architecture.
+func Every(duration time.Duration, fn func(time.Time) Msg) Cmd {
+	n := time.Now()
+	d := n.Truncate(duration).Add(duration).Sub(n)
+	t := time.NewTimer(d)
+	return func() Msg {
+		ts := <-t.C
+		t.Stop()
+		for len(t.C) > 0 {
+			<-t.C
+		}
+		return fn(ts)
+	}
+}
+
+// Tick produces a command at an interval independent of the system clock at
+// the given duration. That is, the timer begins precisely when invoked,
+// and runs for its entire duration.
+//
+// To produce the command, pass a duration and a function which returns
+// a message containing the time at which the tick occurred.
+//
+//	type TickMsg time.Time
+//
+//	cmd := Tick(time.Second, func(t time.Time) Msg {
+//	   return TickMsg(t)
+//	})
+//
+// Beginners' note: Tick sends a single message and won't automatically
+// dispatch messages at an interval. To do that, you'll want to return another
+// Tick command after receiving your tick message. For example:
+//
+//	type TickMsg time.Time
+//
+//	func doTick() Cmd {
+//	    return Tick(time.Second, func(t time.Time) Msg {
+//	        return TickMsg(t)
+//	    })
+//	}
+//
+//	func (m model) Init() Cmd {
+//	    // Start ticking.
+//	    return doTick()
+//	}
+//
+//	func (m model) Update(msg Msg) (Model, Cmd) {
+//	    switch msg.(type) {
+//	    case TickMsg:
+//	        // Return your Tick command again to loop.
+//	        return m, doTick()
+//	    }
+//	    return m, nil
+//	}
+func Tick(d time.Duration, fn func(time.Time) Msg) Cmd {
+	t := time.NewTimer(d)
+	return func() Msg {
+		ts := <-t.C
+		t.Stop()
+		for len(t.C) > 0 {
+			<-t.C
+		}
+		return fn(ts)
+	}
+}
+
+// Sequentially produces a command that sequentially executes the given
+// commands.
+// The Msg returned is the first non-nil message returned by a Cmd.
+//
+//	func saveStateCmd() Msg {
+//	   if err := save(); err != nil {
+//	       return errMsg{err}
+//	   }
+//	   return nil
+//	}
+//
+//	cmd := Sequentially(saveStateCmd, Quit)
+//
+// Deprecated: use Sequence instead.
+func Sequentially(cmds ...Cmd) Cmd {
+	return func() Msg {
+		for _, cmd := range cmds {
+			if cmd == nil {
+				continue
+			}
+			if msg := cmd(); msg != nil {
+				return msg
+			}
+		}
+		return nil
+	}
+}
+
+// setWindowTitleMsg is an internal message used to set the window title.
+type setWindowTitleMsg string
+
+// SetWindowTitle produces a command that sets the terminal title.
+//
+// For example:
+//
+//	func (m model) Init() Cmd {
+//	    // Set title.
+//	    return tea.SetWindowTitle("My App")
+//	}
+func SetWindowTitle(title string) Cmd {
+	return func() Msg {
+		return setWindowTitleMsg(title)
+	}
+}
+
+type windowSizeMsg struct{}
+
+// WindowSize is a command that queries the terminal for its current size. It
+// delivers the results to Update via a [WindowSizeMsg]. Keep in mind that
+// WindowSizeMsgs will automatically be delivered to Update when the [Program]
+// starts and when the window dimensions change so in many cases you will not
+// need to explicitly invoke this command.
+func WindowSize() Cmd {
+	return func() Msg {
+		return windowSizeMsg{}
+	}
+}

vendor/github.com/charmbracelet/bubbletea/exec.go

@@ -0,0 +1,129 @@
+package tea
+
+import (
+	"io"
+	"os"
+	"os/exec"
+)
+
+// execMsg is used internally to run an ExecCommand sent with Exec.
+type execMsg struct {
+	cmd ExecCommand
+	fn  ExecCallback
+}
+
+// Exec is used to perform arbitrary I/O in a blocking fashion, effectively
+// pausing the Program while execution is running and resuming it when
+// execution has completed.
+//
+// Most of the time you'll want to use ExecProcess, which runs an exec.Cmd.
+//
+// For non-interactive i/o you should use a Cmd (that is, a tea.Cmd).
+func Exec(c ExecCommand, fn ExecCallback) Cmd {
+	return func() Msg {
+		return execMsg{cmd: c, fn: fn}
+	}
+}
+
+// ExecProcess runs the given *exec.Cmd in a blocking fashion, effectively
+// pausing the Program while the command is running. After the *exec.Cmd exists
+// the Program resumes. It's useful for spawning other interactive applications
+// such as editors and shells from within a Program.
+//
+// To produce the command, pass an *exec.Cmd and a function which returns
+// a message containing the error which may have occurred when running the
+// ExecCommand.
+//
+//	type VimFinishedMsg struct { err error }
+//
+//	c := exec.Command("vim", "file.txt")
+//
+//	cmd := ExecProcess(c, func(err error) Msg {
+//	    return VimFinishedMsg{err: err}
+//	})
+//
+// Or, if you don't care about errors, you could simply:
+//
+//	cmd := ExecProcess(exec.Command("vim", "file.txt"), nil)
+//
+// For non-interactive i/o you should use a Cmd (that is, a tea.Cmd).
+func ExecProcess(c *exec.Cmd, fn ExecCallback) Cmd {
+	return Exec(wrapExecCommand(c), fn)
+}
+
+// ExecCallback is used when executing an *exec.Command to return a message
+// with an error, which may or may not be nil.
+type ExecCallback func(error) Msg
+
+// ExecCommand can be implemented to execute things in a blocking fashion in
+// the current terminal.
+type ExecCommand interface {
+	Run() error
+	SetStdin(io.Reader)
+	SetStdout(io.Writer)
+	SetStderr(io.Writer)
+}
+
+// wrapExecCommand wraps an exec.Cmd so that it satisfies the ExecCommand
+// interface so it can be used with Exec.
+func wrapExecCommand(c *exec.Cmd) ExecCommand {
+	return &osExecCommand{Cmd: c}
+}
+
+// osExecCommand is a layer over an exec.Cmd that satisfies the ExecCommand
+// interface.
+type osExecCommand struct{ *exec.Cmd }
+
+// SetStdin sets stdin on underlying exec.Cmd to the given io.Reader.
+func (c *osExecCommand) SetStdin(r io.Reader) {
+	// If unset, have the command use the same input as the terminal.
+	if c.Stdin == nil {
+		c.Stdin = r
+	}
+}
+
+// SetStdout sets stdout on underlying exec.Cmd to the given io.Writer.
+func (c *osExecCommand) SetStdout(w io.Writer) {
+	// If unset, have the command use the same output as the terminal.
+	if c.Stdout == nil {
+		c.Stdout = w
+	}
+}
+
+// SetStderr sets stderr on the underlying exec.Cmd to the given io.Writer.
+func (c *osExecCommand) SetStderr(w io.Writer) {
+	// If unset, use stderr for the command's stderr
+	if c.Stderr == nil {
+		c.Stderr = w
+	}
+}
+
+// exec runs an ExecCommand and delivers the results to the program as a Msg.
+func (p *Program) exec(c ExecCommand, fn ExecCallback) {
+	if err := p.ReleaseTerminal(); err != nil {
+		// If we can't release input, abort.
+		if fn != nil {
+			go p.Send(fn(err))
+		}
+		return
+	}
+
+	c.SetStdin(p.input)
+	c.SetStdout(p.output)
+	c.SetStderr(os.Stderr)
+
+	// Execute system command.
+	if err := c.Run(); err != nil {
+		_ = p.RestoreTerminal() // also try to restore the terminal.
+		if fn != nil {
+			go p.Send(fn(err))
+		}
+		return
+	}
+
+	// Have the program re-capture input.
+	err := p.RestoreTerminal()
+	if fn != nil {
+		go p.Send(fn(err))
+	}
+}

vendor/github.com/charmbracelet/bubbletea/focus.go

@@ -0,0 +1,9 @@
+package tea
+
+// FocusMsg represents a terminal focus message.
+// This occurs when the terminal gains focus.
+type FocusMsg struct{}
+
+// BlurMsg represents a terminal blur message.
+// This occurs when the terminal loses focus.
+type BlurMsg struct{}

vendor/github.com/charmbracelet/bubbletea/inputreader_other.go

@@ -0,0 +1,14 @@
+//go:build !windows
+// +build !windows
+
+package tea
+
+import (
+	"io"
+
+	"github.com/muesli/cancelreader"
+)
+
+func newInputReader(r io.Reader, _ bool) (cancelreader.CancelReader, error) {
+	return cancelreader.NewReader(r)
+}

vendor/github.com/charmbracelet/bubbletea/inputreader_windows.go

@@ -0,0 +1,127 @@
+//go:build windows
+// +build windows
+
+package tea
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"sync"
+
+	"github.com/charmbracelet/x/term"
+	"github.com/erikgeiser/coninput"
+	"github.com/muesli/cancelreader"
+	"golang.org/x/sys/windows"
+)
+
+type conInputReader struct {
+	cancelMixin
+
+	conin windows.Handle
+
+	originalMode uint32
+}
+
+var _ cancelreader.CancelReader = &conInputReader{}
+
+func newInputReader(r io.Reader, enableMouse bool) (cancelreader.CancelReader, error) {
+	fallback := func(io.Reader) (cancelreader.CancelReader, error) {
+		return cancelreader.NewReader(r)
+	}
+	if f, ok := r.(term.File); !ok || f.Fd() != os.Stdin.Fd() {
+		return fallback(r)
+	}
+
+	conin, err := coninput.NewStdinHandle()
+	if err != nil {
+		return fallback(r)
+	}
+
+	modes := []uint32{
+		windows.ENABLE_WINDOW_INPUT,
+		windows.ENABLE_EXTENDED_FLAGS,
+	}
+
+	// Since we have options to enable mouse events, [WithMouseCellMotion],
+	// [WithMouseAllMotion], and [EnableMouseCellMotion],
+	// [EnableMouseAllMotion], and [DisableMouse], we need to check if the user
+	// has enabled mouse events and add the appropriate mode accordingly.
+	// Otherwise, mouse events will be enabled all the time.
+	if enableMouse {
+		modes = append(modes, windows.ENABLE_MOUSE_INPUT)
+	}
+
+	originalMode, err := prepareConsole(conin, modes...)
+	if err != nil {
+		return nil, fmt.Errorf("failed to prepare console input: %w", err)
+	}
+
+	return &conInputReader{
+		conin:        conin,
+		originalMode: originalMode,
+	}, nil
+}
+
+// Cancel implements cancelreader.CancelReader.
+func (r *conInputReader) Cancel() bool {
+	r.setCanceled()
+
+	return windows.CancelIoEx(r.conin, nil) == nil || windows.CancelIo(r.conin) == nil
+}
+
+// Close implements cancelreader.CancelReader.
+func (r *conInputReader) Close() error {
+	if r.originalMode != 0 {
+		err := windows.SetConsoleMode(r.conin, r.originalMode)
+		if err != nil {
+			return fmt.Errorf("reset console mode: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// Read implements cancelreader.CancelReader.
+func (r *conInputReader) Read(_ []byte) (n int, err error) {
+	if r.isCanceled() {
+		err = cancelreader.ErrCanceled
+	}
+	return
+}
+
+func prepareConsole(input windows.Handle, modes ...uint32) (originalMode uint32, err error) {
+	err = windows.GetConsoleMode(input, &originalMode)
+	if err != nil {
+		return 0, fmt.Errorf("get console mode: %w", err)
+	}
+
+	newMode := coninput.AddInputModes(0, modes...)
+
+	err = windows.SetConsoleMode(input, newMode)
+	if err != nil {
+		return 0, fmt.Errorf("set console mode: %w", err)
+	}
+
+	return originalMode, nil
+}
+
+// cancelMixin represents a goroutine-safe cancelation status.
+type cancelMixin struct {
+	unsafeCanceled bool
+	lock           sync.Mutex
+}
+
+func (c *cancelMixin) setCanceled() {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	c.unsafeCanceled = true
+}
+
+func (c *cancelMixin) isCanceled() bool {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	return c.unsafeCanceled
+}

vendor/github.com/charmbracelet/bubbletea/key.go

@@ -0,0 +1,715 @@
+package tea
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"regexp"
+	"strings"
+	"unicode/utf8"
+)
+
+// KeyMsg contains information about a keypress. KeyMsgs are always sent to
+// the program's update function. There are a couple general patterns you could
+// use to check for keypresses:
+//
+//	// Switch on the string representation of the key (shorter)
+//	switch msg := msg.(type) {
+//	case KeyMsg:
+//	    switch msg.String() {
+//	    case "enter":
+//	        fmt.Println("you pressed enter!")
+//	    case "a":
+//	        fmt.Println("you pressed a!")
+//	    }
+//	}
+//
+//	// Switch on the key type (more foolproof)
+//	switch msg := msg.(type) {
+//	case KeyMsg:
+//	    switch msg.Type {
+//	    case KeyEnter:
+//	        fmt.Println("you pressed enter!")
+//	    case KeyRunes:
+//	        switch string(msg.Runes) {
+//	        case "a":
+//	            fmt.Println("you pressed a!")
+//	        }
+//	    }
+//	}
+//
+// Note that Key.Runes will always contain at least one character, so you can
+// always safely call Key.Runes[0]. In most cases Key.Runes will only contain
+// one character, though certain input method editors (most notably Chinese
+// IMEs) can input multiple runes at once.
+type KeyMsg Key
+
+// String returns a string representation for a key message. It's safe (and
+// encouraged) for use in key comparison.
+func (k KeyMsg) String() (str string) {
+	return Key(k).String()
+}
+
+// Key contains information about a keypress.
+type Key struct {
+	Type  KeyType
+	Runes []rune
+	Alt   bool
+	Paste bool
+}
+
+// String returns a friendly string representation for a key. It's safe (and
+// encouraged) for use in key comparison.
+//
+//	k := Key{Type: KeyEnter}
+//	fmt.Println(k)
+//	// Output: enter
+func (k Key) String() (str string) {
+	var buf strings.Builder
+	if k.Alt {
+		buf.WriteString("alt+")
+	}
+	if k.Type == KeyRunes {
+		if k.Paste {
+			// Note: bubbles/keys bindings currently do string compares to
+			// recognize shortcuts. Since pasted text should never activate
+			// shortcuts, we need to ensure that the binding code doesn't
+			// match Key events that result from pastes. We achieve this
+			// here by enclosing pastes in '[...]' so that the string
+			// comparison in Matches() fails in that case.
+			buf.WriteByte('[')
+		}
+		buf.WriteString(string(k.Runes))
+		if k.Paste {
+			buf.WriteByte(']')
+		}
+		return buf.String()
+	} else if s, ok := keyNames[k.Type]; ok {
+		buf.WriteString(s)
+		return buf.String()
+	}
+	return ""
+}
+
+// KeyType indicates the key pressed, such as KeyEnter or KeyBreak or KeyCtrlC.
+// All other keys will be type KeyRunes. To get the rune value, check the Rune
+// method on a Key struct, or use the Key.String() method:
+//
+//	k := Key{Type: KeyRunes, Runes: []rune{'a'}, Alt: true}
+//	if k.Type == KeyRunes {
+//
+//	    fmt.Println(k.Runes)
+//	    // Output: a
+//
+//	    fmt.Println(k.String())
+//	    // Output: alt+a
+//
+//	}
+type KeyType int
+
+func (k KeyType) String() (str string) {
+	if s, ok := keyNames[k]; ok {
+		return s
+	}
+	return ""
+}
+
+// Control keys. We could do this with an iota, but the values are very
+// specific, so we set the values explicitly to avoid any confusion.
+//
+// See also:
+// https://en.wikipedia.org/wiki/C0_and_C1_control_codes
+const (
+	keyNUL KeyType = 0   // null, \0
+	keySOH KeyType = 1   // start of heading
+	keySTX KeyType = 2   // start of text
+	keyETX KeyType = 3   // break, ctrl+c
+	keyEOT KeyType = 4   // end of transmission
+	keyENQ KeyType = 5   // enquiry
+	keyACK KeyType = 6   // acknowledge
+	keyBEL KeyType = 7   // bell, \a
+	keyBS  KeyType = 8   // backspace
+	keyHT  KeyType = 9   // horizontal tabulation, \t
+	keyLF  KeyType = 10  // line feed, \n
+	keyVT  KeyType = 11  // vertical tabulation \v
+	keyFF  KeyType = 12  // form feed \f
+	keyCR  KeyType = 13  // carriage return, \r
+	keySO  KeyType = 14  // shift out
+	keySI  KeyType = 15  // shift in
+	keyDLE KeyType = 16  // data link escape
+	keyDC1 KeyType = 17  // device control one
+	keyDC2 KeyType = 18  // device control two
+	keyDC3 KeyType = 19  // device control three
+	keyDC4 KeyType = 20  // device control four
+	keyNAK KeyType = 21  // negative acknowledge
+	keySYN KeyType = 22  // synchronous idle
+	keyETB KeyType = 23  // end of transmission block
+	keyCAN KeyType = 24  // cancel
+	keyEM  KeyType = 25  // end of medium
+	keySUB KeyType = 26  // substitution
+	keyESC KeyType = 27  // escape, \e
+	keyFS  KeyType = 28  // file separator
+	keyGS  KeyType = 29  // group separator
+	keyRS  KeyType = 30  // record separator
+	keyUS  KeyType = 31  // unit separator
+	keyDEL KeyType = 127 // delete. on most systems this is mapped to backspace, I hear
+)
+
+// Control key aliases.
+const (
+	KeyNull      KeyType = keyNUL
+	KeyBreak     KeyType = keyETX
+	KeyEnter     KeyType = keyCR
+	KeyBackspace KeyType = keyDEL
+	KeyTab       KeyType = keyHT
+	KeyEsc       KeyType = keyESC
+	KeyEscape    KeyType = keyESC
+
+	KeyCtrlAt           KeyType = keyNUL // ctrl+@
+	KeyCtrlA            KeyType = keySOH
+	KeyCtrlB            KeyType = keySTX
+	KeyCtrlC            KeyType = keyETX
+	KeyCtrlD            KeyType = keyEOT
+	KeyCtrlE            KeyType = keyENQ
+	KeyCtrlF            KeyType = keyACK
+	KeyCtrlG            KeyType = keyBEL
+	KeyCtrlH            KeyType = keyBS
+	KeyCtrlI            KeyType = keyHT
+	KeyCtrlJ            KeyType = keyLF
+	KeyCtrlK            KeyType = keyVT
+	KeyCtrlL            KeyType = keyFF
+	KeyCtrlM            KeyType = keyCR
+	KeyCtrlN            KeyType = keySO
+	KeyCtrlO            KeyType = keySI
+	KeyCtrlP            KeyType = keyDLE
+	KeyCtrlQ            KeyType = keyDC1
+	KeyCtrlR            KeyType = keyDC2
+	KeyCtrlS            KeyType = keyDC3
+	KeyCtrlT            KeyType = keyDC4
+	KeyCtrlU            KeyType = keyNAK
+	KeyCtrlV            KeyType = keySYN
+	KeyCtrlW            KeyType = keyETB
+	KeyCtrlX            KeyType = keyCAN
+	KeyCtrlY            KeyType = keyEM
+	KeyCtrlZ            KeyType = keySUB
+	KeyCtrlOpenBracket  KeyType = keyESC // ctrl+[
+	KeyCtrlBackslash    KeyType = keyFS  // ctrl+\
+	KeyCtrlCloseBracket KeyType = keyGS  // ctrl+]
+	KeyCtrlCaret        KeyType = keyRS  // ctrl+^
+	KeyCtrlUnderscore   KeyType = keyUS  // ctrl+_
+	KeyCtrlQuestionMark KeyType = keyDEL // ctrl+?
+)
+
+// Other keys.
+const (
+	KeyRunes KeyType = -(iota + 1)
+	KeyUp
+	KeyDown
+	KeyRight
+	KeyLeft
+	KeyShiftTab
+	KeyHome
+	KeyEnd
+	KeyPgUp
+	KeyPgDown
+	KeyCtrlPgUp
+	KeyCtrlPgDown
+	KeyDelete
+	KeyInsert
+	KeySpace
+	KeyCtrlUp
+	KeyCtrlDown
+	KeyCtrlRight
+	KeyCtrlLeft
+	KeyCtrlHome
+	KeyCtrlEnd
+	KeyShiftUp
+	KeyShiftDown
+	KeyShiftRight
+	KeyShiftLeft
+	KeyShiftHome
+	KeyShiftEnd
+	KeyCtrlShiftUp
+	KeyCtrlShiftDown
+	KeyCtrlShiftLeft
+	KeyCtrlShiftRight
+	KeyCtrlShiftHome
+	KeyCtrlShiftEnd
+	KeyF1
+	KeyF2
+	KeyF3
+	KeyF4
+	KeyF5
+	KeyF6
+	KeyF7
+	KeyF8
+	KeyF9
+	KeyF10
+	KeyF11
+	KeyF12
+	KeyF13
+	KeyF14
+	KeyF15
+	KeyF16
+	KeyF17
+	KeyF18
+	KeyF19
+	KeyF20
+)
+
+// Mappings for control keys and other special keys to friendly consts.
+var keyNames = map[KeyType]string{
+	// Control keys.
+	keyNUL: "ctrl+@", // also ctrl+` (that's ctrl+backtick)
+	keySOH: "ctrl+a",
+	keySTX: "ctrl+b",
+	keyETX: "ctrl+c",
+	keyEOT: "ctrl+d",
+	keyENQ: "ctrl+e",
+	keyACK: "ctrl+f",
+	keyBEL: "ctrl+g",
+	keyBS:  "ctrl+h",
+	keyHT:  "tab", // also ctrl+i
+	keyLF:  "ctrl+j",
+	keyVT:  "ctrl+k",
+	keyFF:  "ctrl+l",
+	keyCR:  "enter",
+	keySO:  "ctrl+n",
+	keySI:  "ctrl+o",
+	keyDLE: "ctrl+p",
+	keyDC1: "ctrl+q",
+	keyDC2: "ctrl+r",
+	keyDC3: "ctrl+s",
+	keyDC4: "ctrl+t",
+	keyNAK: "ctrl+u",
+	keySYN: "ctrl+v",
+	keyETB: "ctrl+w",
+	keyCAN: "ctrl+x",
+	keyEM:  "ctrl+y",
+	keySUB: "ctrl+z",
+	keyESC: "esc",
+	keyFS:  "ctrl+\\",
+	keyGS:  "ctrl+]",
+	keyRS:  "ctrl+^",
+	keyUS:  "ctrl+_",
+	keyDEL: "backspace",
+
+	// Other keys.
+	KeyRunes:          "runes",
+	KeyUp:             "up",
+	KeyDown:           "down",
+	KeyRight:          "right",
+	KeySpace:          " ", // for backwards compatibility
+	KeyLeft:           "left",
+	KeyShiftTab:       "shift+tab",
+	KeyHome:           "home",
+	KeyEnd:            "end",
+	KeyCtrlHome:       "ctrl+home",
+	KeyCtrlEnd:        "ctrl+end",
+	KeyShiftHome:      "shift+home",
+	KeyShiftEnd:       "shift+end",
+	KeyCtrlShiftHome:  "ctrl+shift+home",
+	KeyCtrlShiftEnd:   "ctrl+shift+end",
+	KeyPgUp:           "pgup",
+	KeyPgDown:         "pgdown",
+	KeyCtrlPgUp:       "ctrl+pgup",
+	KeyCtrlPgDown:     "ctrl+pgdown",
+	KeyDelete:         "delete",
+	KeyInsert:         "insert",
+	KeyCtrlUp:         "ctrl+up",
+	KeyCtrlDown:       "ctrl+down",
+	KeyCtrlRight:      "ctrl+right",
+	KeyCtrlLeft:       "ctrl+left",
+	KeyShiftUp:        "shift+up",
+	KeyShiftDown:      "shift+down",
+	KeyShiftRight:     "shift+right",
+	KeyShiftLeft:      "shift+left",
+	KeyCtrlShiftUp:    "ctrl+shift+up",
+	KeyCtrlShiftDown:  "ctrl+shift+down",
+	KeyCtrlShiftLeft:  "ctrl+shift+left",
+	KeyCtrlShiftRight: "ctrl+shift+right",
+	KeyF1:             "f1",
+	KeyF2:             "f2",
+	KeyF3:             "f3",
+	KeyF4:             "f4",
+	KeyF5:             "f5",
+	KeyF6:             "f6",
+	KeyF7:             "f7",
+	KeyF8:             "f8",
+	KeyF9:             "f9",
+	KeyF10:            "f10",
+	KeyF11:            "f11",
+	KeyF12:            "f12",
+	KeyF13:            "f13",
+	KeyF14:            "f14",
+	KeyF15:            "f15",
+	KeyF16:            "f16",
+	KeyF17:            "f17",
+	KeyF18:            "f18",
+	KeyF19:            "f19",
+	KeyF20:            "f20",
+}
+
+// Sequence mappings.
+var sequences = map[string]Key{
+	// Arrow keys
+	"\x1b[A":    {Type: KeyUp},
+	"\x1b[B":    {Type: KeyDown},
+	"\x1b[C":    {Type: KeyRight},
+	"\x1b[D":    {Type: KeyLeft},
+	"\x1b[1;2A": {Type: KeyShiftUp},
+	"\x1b[1;2B": {Type: KeyShiftDown},
+	"\x1b[1;2C": {Type: KeyShiftRight},
+	"\x1b[1;2D": {Type: KeyShiftLeft},
+	"\x1b[OA":   {Type: KeyShiftUp},    // DECCKM
+	"\x1b[OB":   {Type: KeyShiftDown},  // DECCKM
+	"\x1b[OC":   {Type: KeyShiftRight}, // DECCKM
+	"\x1b[OD":   {Type: KeyShiftLeft},  // DECCKM
+	"\x1b[a":    {Type: KeyShiftUp},    // urxvt
+	"\x1b[b":    {Type: KeyShiftDown},  // urxvt
+	"\x1b[c":    {Type: KeyShiftRight}, // urxvt
+	"\x1b[d":    {Type: KeyShiftLeft},  // urxvt
+	"\x1b[1;3A": {Type: KeyUp, Alt: true},
+	"\x1b[1;3B": {Type: KeyDown, Alt: true},
+	"\x1b[1;3C": {Type: KeyRight, Alt: true},
+	"\x1b[1;3D": {Type: KeyLeft, Alt: true},
+
+	"\x1b[1;4A": {Type: KeyShiftUp, Alt: true},
+	"\x1b[1;4B": {Type: KeyShiftDown, Alt: true},
+	"\x1b[1;4C": {Type: KeyShiftRight, Alt: true},
+	"\x1b[1;4D": {Type: KeyShiftLeft, Alt: true},
+
+	"\x1b[1;5A": {Type: KeyCtrlUp},
+	"\x1b[1;5B": {Type: KeyCtrlDown},
+	"\x1b[1;5C": {Type: KeyCtrlRight},
+	"\x1b[1;5D": {Type: KeyCtrlLeft},
+	"\x1b[Oa":   {Type: KeyCtrlUp, Alt: true},    // urxvt
+	"\x1b[Ob":   {Type: KeyCtrlDown, Alt: true},  // urxvt
+	"\x1b[Oc":   {Type: KeyCtrlRight, Alt: true}, // urxvt
+	"\x1b[Od":   {Type: KeyCtrlLeft, Alt: true},  // urxvt
+	"\x1b[1;6A": {Type: KeyCtrlShiftUp},
+	"\x1b[1;6B": {Type: KeyCtrlShiftDown},
+	"\x1b[1;6C": {Type: KeyCtrlShiftRight},
+	"\x1b[1;6D": {Type: KeyCtrlShiftLeft},
+	"\x1b[1;7A": {Type: KeyCtrlUp, Alt: true},
+	"\x1b[1;7B": {Type: KeyCtrlDown, Alt: true},
+	"\x1b[1;7C": {Type: KeyCtrlRight, Alt: true},
+	"\x1b[1;7D": {Type: KeyCtrlLeft, Alt: true},
+	"\x1b[1;8A": {Type: KeyCtrlShiftUp, Alt: true},
+	"\x1b[1;8B": {Type: KeyCtrlShiftDown, Alt: true},
+	"\x1b[1;8C": {Type: KeyCtrlShiftRight, Alt: true},
+	"\x1b[1;8D": {Type: KeyCtrlShiftLeft, Alt: true},
+
+	// Miscellaneous keys
+	"\x1b[Z": {Type: KeyShiftTab},
+
+	"\x1b[2~":   {Type: KeyInsert},
+	"\x1b[3;2~": {Type: KeyInsert, Alt: true},
+
+	"\x1b[3~":   {Type: KeyDelete},
+	"\x1b[3;3~": {Type: KeyDelete, Alt: true},
+
+	"\x1b[5~":   {Type: KeyPgUp},
+	"\x1b[5;3~": {Type: KeyPgUp, Alt: true},
+	"\x1b[5;5~": {Type: KeyCtrlPgUp},
+	"\x1b[5^":   {Type: KeyCtrlPgUp}, // urxvt
+	"\x1b[5;7~": {Type: KeyCtrlPgUp, Alt: true},
+
+	"\x1b[6~":   {Type: KeyPgDown},
+	"\x1b[6;3~": {Type: KeyPgDown, Alt: true},
+	"\x1b[6;5~": {Type: KeyCtrlPgDown},
+	"\x1b[6^":   {Type: KeyCtrlPgDown}, // urxvt
+	"\x1b[6;7~": {Type: KeyCtrlPgDown, Alt: true},
+
+	"\x1b[1~":   {Type: KeyHome},
+	"\x1b[H":    {Type: KeyHome},                     // xterm, lxterm
+	"\x1b[1;3H": {Type: KeyHome, Alt: true},          // xterm, lxterm
+	"\x1b[1;5H": {Type: KeyCtrlHome},                 // xterm, lxterm
+	"\x1b[1;7H": {Type: KeyCtrlHome, Alt: true},      // xterm, lxterm
+	"\x1b[1;2H": {Type: KeyShiftHome},                // xterm, lxterm
+	"\x1b[1;4H": {Type: KeyShiftHome, Alt: true},     // xterm, lxterm
+	"\x1b[1;6H": {Type: KeyCtrlShiftHome},            // xterm, lxterm
+	"\x1b[1;8H": {Type: KeyCtrlShiftHome, Alt: true}, // xterm, lxterm
+
+	"\x1b[4~":   {Type: KeyEnd},
+	"\x1b[F":    {Type: KeyEnd},                     // xterm, lxterm
+	"\x1b[1;3F": {Type: KeyEnd, Alt: true},          // xterm, lxterm
+	"\x1b[1;5F": {Type: KeyCtrlEnd},                 // xterm, lxterm
+	"\x1b[1;7F": {Type: KeyCtrlEnd, Alt: true},      // xterm, lxterm
+	"\x1b[1;2F": {Type: KeyShiftEnd},                // xterm, lxterm
+	"\x1b[1;4F": {Type: KeyShiftEnd, Alt: true},     // xterm, lxterm
+	"\x1b[1;6F": {Type: KeyCtrlShiftEnd},            // xterm, lxterm
+	"\x1b[1;8F": {Type: KeyCtrlShiftEnd, Alt: true}, // xterm, lxterm
+
+	"\x1b[7~": {Type: KeyHome},          // urxvt
+	"\x1b[7^": {Type: KeyCtrlHome},      // urxvt
+	"\x1b[7$": {Type: KeyShiftHome},     // urxvt
+	"\x1b[7@": {Type: KeyCtrlShiftHome}, // urxvt
+
+	"\x1b[8~": {Type: KeyEnd},          // urxvt
+	"\x1b[8^": {Type: KeyCtrlEnd},      // urxvt
+	"\x1b[8$": {Type: KeyShiftEnd},     // urxvt
+	"\x1b[8@": {Type: KeyCtrlShiftEnd}, // urxvt
+
+	// Function keys, Linux console
+	"\x1b[[A": {Type: KeyF1}, // linux console
+	"\x1b[[B": {Type: KeyF2}, // linux console
+	"\x1b[[C": {Type: KeyF3}, // linux console
+	"\x1b[[D": {Type: KeyF4}, // linux console
+	"\x1b[[E": {Type: KeyF5}, // linux console
+
+	// Function keys, X11
+	"\x1bOP": {Type: KeyF1}, // vt100, xterm
+	"\x1bOQ": {Type: KeyF2}, // vt100, xterm
+	"\x1bOR": {Type: KeyF3}, // vt100, xterm
+	"\x1bOS": {Type: KeyF4}, // vt100, xterm
+
+	"\x1b[1;3P": {Type: KeyF1, Alt: true}, // vt100, xterm
+	"\x1b[1;3Q": {Type: KeyF2, Alt: true}, // vt100, xterm
+	"\x1b[1;3R": {Type: KeyF3, Alt: true}, // vt100, xterm
+	"\x1b[1;3S": {Type: KeyF4, Alt: true}, // vt100, xterm
+
+	"\x1b[11~": {Type: KeyF1}, // urxvt
+	"\x1b[12~": {Type: KeyF2}, // urxvt
+	"\x1b[13~": {Type: KeyF3}, // urxvt
+	"\x1b[14~": {Type: KeyF4}, // urxvt
+
+	"\x1b[15~": {Type: KeyF5}, // vt100, xterm, also urxvt
+
+	"\x1b[15;3~": {Type: KeyF5, Alt: true}, // vt100, xterm, also urxvt
+
+	"\x1b[17~": {Type: KeyF6},  // vt100, xterm, also urxvt
+	"\x1b[18~": {Type: KeyF7},  // vt100, xterm, also urxvt
+	"\x1b[19~": {Type: KeyF8},  // vt100, xterm, also urxvt
+	"\x1b[20~": {Type: KeyF9},  // vt100, xterm, also urxvt
+	"\x1b[21~": {Type: KeyF10}, // vt100, xterm, also urxvt
+
+	"\x1b[17;3~": {Type: KeyF6, Alt: true},  // vt100, xterm
+	"\x1b[18;3~": {Type: KeyF7, Alt: true},  // vt100, xterm
+	"\x1b[19;3~": {Type: KeyF8, Alt: true},  // vt100, xterm
+	"\x1b[20;3~": {Type: KeyF9, Alt: true},  // vt100, xterm
+	"\x1b[21;3~": {Type: KeyF10, Alt: true}, // vt100, xterm
+
+	"\x1b[23~": {Type: KeyF11}, // vt100, xterm, also urxvt
+	"\x1b[24~": {Type: KeyF12}, // vt100, xterm, also urxvt
+
+	"\x1b[23;3~": {Type: KeyF11, Alt: true}, // vt100, xterm
+	"\x1b[24;3~": {Type: KeyF12, Alt: true}, // vt100, xterm
+
+	"\x1b[1;2P": {Type: KeyF13},
+	"\x1b[1;2Q": {Type: KeyF14},
+
+	"\x1b[25~": {Type: KeyF13}, // vt100, xterm, also urxvt
+	"\x1b[26~": {Type: KeyF14}, // vt100, xterm, also urxvt
+
+	"\x1b[25;3~": {Type: KeyF13, Alt: true}, // vt100, xterm
+	"\x1b[26;3~": {Type: KeyF14, Alt: true}, // vt100, xterm
+
+	"\x1b[1;2R": {Type: KeyF15},
+	"\x1b[1;2S": {Type: KeyF16},
+
+	"\x1b[28~": {Type: KeyF15}, // vt100, xterm, also urxvt
+	"\x1b[29~": {Type: KeyF16}, // vt100, xterm, also urxvt
+
+	"\x1b[28;3~": {Type: KeyF15, Alt: true}, // vt100, xterm
+	"\x1b[29;3~": {Type: KeyF16, Alt: true}, // vt100, xterm
+
+	"\x1b[15;2~": {Type: KeyF17},
+	"\x1b[17;2~": {Type: KeyF18},
+	"\x1b[18;2~": {Type: KeyF19},
+	"\x1b[19;2~": {Type: KeyF20},
+
+	"\x1b[31~": {Type: KeyF17},
+	"\x1b[32~": {Type: KeyF18},
+	"\x1b[33~": {Type: KeyF19},
+	"\x1b[34~": {Type: KeyF20},
+
+	// Powershell sequences.
+	"\x1bOA": {Type: KeyUp, Alt: false},
+	"\x1bOB": {Type: KeyDown, Alt: false},
+	"\x1bOC": {Type: KeyRight, Alt: false},
+	"\x1bOD": {Type: KeyLeft, Alt: false},
+}
+
+// unknownInputByteMsg is reported by the input reader when an invalid
+// utf-8 byte is detected on the input. Currently, it is not handled
+// further by bubbletea. However, having this event makes it possible
+// to troubleshoot invalid inputs.
+type unknownInputByteMsg byte
+
+func (u unknownInputByteMsg) String() string {
+	return fmt.Sprintf("?%#02x?", int(u))
+}
+
+// unknownCSISequenceMsg is reported by the input reader when an
+// unrecognized CSI sequence is detected on the input. Currently, it
+// is not handled further by bubbletea. However, having this event
+// makes it possible to troubleshoot invalid inputs.
+type unknownCSISequenceMsg []byte
+
+func (u unknownCSISequenceMsg) String() string {
+	return fmt.Sprintf("?CSI%+v?", []byte(u)[2:])
+}
+
+var spaceRunes = []rune{' '}
+
+// readAnsiInputs reads keypress and mouse inputs from a TTY and produces messages
+// containing information about the key or mouse events accordingly.
+func readAnsiInputs(ctx context.Context, msgs chan<- Msg, input io.Reader) error {
+	var buf [256]byte
+
+	var leftOverFromPrevIteration []byte
+loop:
+	for {
+		// Read and block.
+		numBytes, err := input.Read(buf[:])
+		if err != nil {
+			return fmt.Errorf("error reading input: %w", err)
+		}
+		b := buf[:numBytes]
+		if leftOverFromPrevIteration != nil {
+			b = append(leftOverFromPrevIteration, b...)
+		}
+
+		// If we had a short read (numBytes < len(buf)), we're sure that
+		// the end of this read is an event boundary, so there is no doubt
+		// if we are encountering the end of the buffer while parsing a message.
+		// However, if we've succeeded in filling up the buffer, there may
+		// be more data in the OS buffer ready to be read in, to complete
+		// the last message in the input. In that case, we will retry with
+		// the left over data in the next iteration.
+		canHaveMoreData := numBytes == len(buf)
+
+		var i, w int
+		for i, w = 0, 0; i < len(b); i += w {
+			var msg Msg
+			w, msg = detectOneMsg(b[i:], canHaveMoreData)
+			if w == 0 {
+				// Expecting more bytes beyond the current buffer. Try waiting
+				// for more input.
+				leftOverFromPrevIteration = make([]byte, 0, len(b[i:])+len(buf))
+				leftOverFromPrevIteration = append(leftOverFromPrevIteration, b[i:]...)
+				continue loop
+			}
+
+			select {
+			case msgs <- msg:
+			case <-ctx.Done():
+				err := ctx.Err()
+				if err != nil {
+					err = fmt.Errorf("found context error while reading input: %w", err)
+				}
+				return err
+			}
+		}
+		leftOverFromPrevIteration = nil
+	}
+}
+
+var (
+	unknownCSIRe  = regexp.MustCompile(`^\x1b\[[\x30-\x3f]*[\x20-\x2f]*[\x40-\x7e]`)
+	mouseSGRRegex = regexp.MustCompile(`(\d+);(\d+);(\d+)([Mm])`)
+)
+
+func detectOneMsg(b []byte, canHaveMoreData bool) (w int, msg Msg) {
+	// Detect mouse events.
+	// X10 mouse events have a length of 6 bytes
+	const mouseEventX10Len = 6
+	if len(b) >= mouseEventX10Len && b[0] == '\x1b' && b[1] == '[' {
+		switch b[2] {
+		case 'M':
+			return mouseEventX10Len, MouseMsg(parseX10MouseEvent(b))
+		case '<':
+			if matchIndices := mouseSGRRegex.FindSubmatchIndex(b[3:]); matchIndices != nil {
+				// SGR mouse events length is the length of the match plus the length of the escape sequence
+				mouseEventSGRLen := matchIndices[1] + 3 //nolint:gomnd
+				return mouseEventSGRLen, MouseMsg(parseSGRMouseEvent(b))
+			}
+		}
+	}
+
+	// Detect focus events.
+	var foundRF bool
+	foundRF, w, msg = detectReportFocus(b)
+	if foundRF {
+		return w, msg
+	}
+
+	// Detect bracketed paste.
+	var foundbp bool
+	foundbp, w, msg = detectBracketedPaste(b)
+	if foundbp {
+		return w, msg
+	}
+
+	// Detect escape sequence and control characters other than NUL,
+	// possibly with an escape character in front to mark the Alt
+	// modifier.
+	var foundSeq bool
+	foundSeq, w, msg = detectSequence(b)
+	if foundSeq {
+		return w, msg
+	}
+
+	// No non-NUL control character or escape sequence.
+	// If we are seeing at least an escape character, remember it for later below.
+	alt := false
+	i := 0
+	if b[0] == '\x1b' {
+		alt = true
+		i++
+	}
+
+	// Are we seeing a standalone NUL? This is not handled by detectSequence().
+	if i < len(b) && b[i] == 0 {
+		return i + 1, KeyMsg{Type: keyNUL, Alt: alt}
+	}
+
+	// Find the longest sequence of runes that are not control
+	// characters from this point.
+	var runes []rune
+	for rw := 0; i < len(b); i += rw {
+		var r rune
+		r, rw = utf8.DecodeRune(b[i:])
+		if r == utf8.RuneError || r <= rune(keyUS) || r == rune(keyDEL) || r == ' ' {
+			// Rune errors are handled below; control characters and spaces will
+			// be handled by detectSequence in the next call to detectOneMsg.
+			break
+		}
+		runes = append(runes, r)
+		if alt {
+			// We only support a single rune after an escape alt modifier.
+			i += rw
+			break
+		}
+	}
+	if i >= len(b) && canHaveMoreData {
+		// We have encountered the end of the input buffer. Alas, we can't
+		// be sure whether the data in the remainder of the buffer is
+		// complete (maybe there was a short read). Instead of sending anything
+		// dumb to the message channel, do a short read. The outer loop will
+		// handle this case by extending the buffer as necessary.
+		return 0, nil
+	}
+
+	// If we found at least one rune, we report the bunch of them as
+	// a single KeyRunes or KeySpace event.
+	if len(runes) > 0 {
+		k := Key{Type: KeyRunes, Runes: runes, Alt: alt}
+		if len(runes) == 1 && runes[0] == ' ' {
+			k.Type = KeySpace
+		}
+		return i, KeyMsg(k)
+	}
+
+	// We didn't find an escape sequence, nor a valid rune. Was this a
+	// lone escape character at the end of the input?
+	if alt && len(b) == 1 {
+		return 1, KeyMsg(Key{Type: KeyEscape})
+	}
+
+	// The character at the current position is neither an escape
+	// sequence, a valid rune start or a sole escape character. Report
+	// it as an invalid byte.
+	return 1, unknownInputByteMsg(b[0])
+}

vendor/github.com/charmbracelet/bubbletea/key_other.go

@@ -0,0 +1,13 @@
+//go:build !windows
+// +build !windows
+
+package tea
+
+import (
+	"context"
+	"io"
+)
+
+func readInputs(ctx context.Context, msgs chan<- Msg, input io.Reader) error {
+	return readAnsiInputs(ctx, msgs, input)
+}

vendor/github.com/charmbracelet/bubbletea/key_sequences.go

@@ -0,0 +1,131 @@
+package tea
+
+import (
+	"bytes"
+	"sort"
+	"unicode/utf8"
+)
+
+// extSequences is used by the map-based algorithm below. It contains
+// the sequences plus their alternatives with an escape character
+// prefixed, plus the control chars, plus the space.
+// It does not contain the NUL character, which is handled specially
+// by detectOneMsg.
+var extSequences = func() map[string]Key {
+	s := map[string]Key{}
+	for seq, key := range sequences {
+		key := key
+		s[seq] = key
+		if !key.Alt {
+			key.Alt = true
+			s["\x1b"+seq] = key
+		}
+	}
+	for i := keyNUL + 1; i <= keyDEL; i++ {
+		if i == keyESC {
+			continue
+		}
+		s[string([]byte{byte(i)})] = Key{Type: i}
+		s[string([]byte{'\x1b', byte(i)})] = Key{Type: i, Alt: true}
+		if i == keyUS {
+			i = keyDEL - 1
+		}
+	}
+	s[" "] = Key{Type: KeySpace, Runes: spaceRunes}
+	s["\x1b "] = Key{Type: KeySpace, Alt: true, Runes: spaceRunes}
+	s["\x1b\x1b"] = Key{Type: KeyEscape, Alt: true}
+	return s
+}()
+
+// seqLengths is the sizes of valid sequences, starting with the
+// largest size.
+var seqLengths = func() []int {
+	sizes := map[int]struct{}{}
+	for seq := range extSequences {
+		sizes[len(seq)] = struct{}{}
+	}
+	lsizes := make([]int, 0, len(sizes))
+	for sz := range sizes {
+		lsizes = append(lsizes, sz)
+	}
+	sort.Slice(lsizes, func(i, j int) bool { return lsizes[i] > lsizes[j] })
+	return lsizes
+}()
+
+// detectSequence uses a longest prefix match over the input
+// sequence and a hash map.
+func detectSequence(input []byte) (hasSeq bool, width int, msg Msg) {
+	seqs := extSequences
+	for _, sz := range seqLengths {
+		if sz > len(input) {
+			continue
+		}
+		prefix := input[:sz]
+		key, ok := seqs[string(prefix)]
+		if ok {
+			return true, sz, KeyMsg(key)
+		}
+	}
+	// Is this an unknown CSI sequence?
+	if loc := unknownCSIRe.FindIndex(input); loc != nil {
+		return true, loc[1], unknownCSISequenceMsg(input[:loc[1]])
+	}
+
+	return false, 0, nil
+}
+
+// detectBracketedPaste detects an input pasted while bracketed
+// paste mode was enabled.
+//
+// Note: this function is a no-op if bracketed paste was not enabled
+// on the terminal, since in that case we'd never see this
+// particular escape sequence.
+func detectBracketedPaste(input []byte) (hasBp bool, width int, msg Msg) {
+	// Detect the start sequence.
+	const bpStart = "\x1b[200~"
+	if len(input) < len(bpStart) || string(input[:len(bpStart)]) != bpStart {
+		return false, 0, nil
+	}
+
+	// Skip over the start sequence.
+	input = input[len(bpStart):]
+
+	// If we saw the start sequence, then we must have an end sequence
+	// as well. Find it.
+	const bpEnd = "\x1b[201~"
+	idx := bytes.Index(input, []byte(bpEnd))
+	inputLen := len(bpStart) + idx + len(bpEnd)
+	if idx == -1 {
+		// We have encountered the end of the input buffer without seeing
+		// the marker for the end of the bracketed paste.
+		// Tell the outer loop we have done a short read and we want more.
+		return true, 0, nil
+	}
+
+	// The paste is everything in-between.
+	paste := input[:idx]
+
+	// All there is in-between is runes, not to be interpreted further.
+	k := Key{Type: KeyRunes, Paste: true}
+	for len(paste) > 0 {
+		r, w := utf8.DecodeRune(paste)
+		if r != utf8.RuneError {
+			k.Runes = append(k.Runes, r)
+		}
+		paste = paste[w:]
+	}
+
+	return true, inputLen, KeyMsg(k)
+}
+
+// detectReportFocus detects a focus report sequence.
+// nolint: gomnd
+func detectReportFocus(input []byte) (hasRF bool, width int, msg Msg) {
+	switch {
+	case bytes.Equal(input, []byte("\x1b[I")):
+		return true, 3, FocusMsg{}
+	case bytes.Equal(input, []byte("\x1b[O")):
+		return true, 3, BlurMsg{}
+	}
+	return false, 0, nil
+}

vendor/github.com/charmbracelet/bubbletea/key_windows.go

@@ -0,0 +1,360 @@
+//go:build windows
+// +build windows
+
+package tea
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/erikgeiser/coninput"
+	localereader "github.com/mattn/go-localereader"
+	"github.com/muesli/cancelreader"
+)
+
+func readInputs(ctx context.Context, msgs chan<- Msg, input io.Reader) error {
+	if coninReader, ok := input.(*conInputReader); ok {
+		return readConInputs(ctx, msgs, coninReader)
+	}
+
+	return readAnsiInputs(ctx, msgs, localereader.NewReader(input))
+}
+
+func readConInputs(ctx context.Context, msgsch chan<- Msg, con *conInputReader) error {
+	var ps coninput.ButtonState                 // keep track of previous mouse state
+	var ws coninput.WindowBufferSizeEventRecord // keep track of the last window size event
+	for {
+		events, err := coninput.ReadNConsoleInputs(con.conin, 16)
+		if err != nil {
+			if con.isCanceled() {
+				return cancelreader.ErrCanceled
+			}
+			return fmt.Errorf("read coninput events: %w", err)
+		}
+
+		for _, event := range events {
+			var msgs []Msg
+			switch e := event.Unwrap().(type) {
+			case coninput.KeyEventRecord:
+				if !e.KeyDown || e.VirtualKeyCode == coninput.VK_SHIFT {
+					continue
+				}
+
+				for i := 0; i < int(e.RepeatCount); i++ {
+					eventKeyType := keyType(e)
+					var runes []rune
+
+					// Add the character only if the key type is an actual character and not a control sequence.
+					// This mimics the behavior in readAnsiInputs where the character is also removed.
+					// We don't need to handle KeySpace here. See the comment in keyType().
+					if eventKeyType == KeyRunes {
+						runes = []rune{e.Char}
+					}
+
+					msgs = append(msgs, KeyMsg{
+						Type:  eventKeyType,
+						Runes: runes,
+						Alt:   e.ControlKeyState.Contains(coninput.LEFT_ALT_PRESSED | coninput.RIGHT_ALT_PRESSED),
+					})
+				}
+			case coninput.WindowBufferSizeEventRecord:
+				if e != ws {
+					ws = e
+					msgs = append(msgs, WindowSizeMsg{
+						Width:  int(e.Size.X),
+						Height: int(e.Size.Y),
+					})
+				}
+			case coninput.MouseEventRecord:
+				event := mouseEvent(ps, e)
+				if event.Type != MouseUnknown {
+					msgs = append(msgs, event)
+				}
+				ps = e.ButtonState
+			case coninput.FocusEventRecord, coninput.MenuEventRecord:
+				// ignore
+			default: // unknown event
+				continue
+			}
+
+			// Send all messages to the channel
+			for _, msg := range msgs {
+				select {
+				case msgsch <- msg:
+				case <-ctx.Done():
+					err := ctx.Err()
+					if err != nil {
+						return fmt.Errorf("coninput context error: %w", err)
+					}
+					return err
+				}
+			}
+		}
+	}
+}
+
+func mouseEventButton(p, s coninput.ButtonState) (button MouseButton, action MouseAction) {
+	btn := p ^ s
+	action = MouseActionPress
+	if btn&s == 0 {
+		action = MouseActionRelease
+	}
+
+	if btn == 0 {
+		switch {
+		case s&coninput.FROM_LEFT_1ST_BUTTON_PRESSED > 0:
+			button = MouseButtonLeft
+		case s&coninput.FROM_LEFT_2ND_BUTTON_PRESSED > 0:
+			button = MouseButtonMiddle
+		case s&coninput.RIGHTMOST_BUTTON_PRESSED > 0:
+			button = MouseButtonRight
+		case s&coninput.FROM_LEFT_3RD_BUTTON_PRESSED > 0:
+			button = MouseButtonBackward
+		case s&coninput.FROM_LEFT_4TH_BUTTON_PRESSED > 0:
+			button = MouseButtonForward
+		}
+		return
+	}
+
+	switch {
+	case btn == coninput.FROM_LEFT_1ST_BUTTON_PRESSED: // left button
+		button = MouseButtonLeft
+	case btn == coninput.RIGHTMOST_BUTTON_PRESSED: // right button
+		button = MouseButtonRight
+	case btn == coninput.FROM_LEFT_2ND_BUTTON_PRESSED: // middle button
+		button = MouseButtonMiddle
+	case btn == coninput.FROM_LEFT_3RD_BUTTON_PRESSED: // unknown (possibly mouse backward)
+		button = MouseButtonBackward
+	case btn == coninput.FROM_LEFT_4TH_BUTTON_PRESSED: // unknown (possibly mouse forward)
+		button = MouseButtonForward
+	}
+
+	return button, action
+}
+
+func mouseEvent(p coninput.ButtonState, e coninput.MouseEventRecord) MouseMsg {
+	ev := MouseMsg{
+		X:     int(e.MousePositon.X),
+		Y:     int(e.MousePositon.Y),
+		Alt:   e.ControlKeyState.Contains(coninput.LEFT_ALT_PRESSED | coninput.RIGHT_ALT_PRESSED),
+		Ctrl:  e.ControlKeyState.Contains(coninput.LEFT_CTRL_PRESSED | coninput.RIGHT_CTRL_PRESSED),
+		Shift: e.ControlKeyState.Contains(coninput.SHIFT_PRESSED),
+	}
+	switch e.EventFlags {
+	case coninput.CLICK, coninput.DOUBLE_CLICK:
+		ev.Button, ev.Action = mouseEventButton(p, e.ButtonState)
+		if ev.Action == MouseActionRelease {
+			ev.Type = MouseRelease
+		}
+		switch ev.Button {
+		case MouseButtonLeft:
+			ev.Type = MouseLeft
+		case MouseButtonMiddle:
+			ev.Type = MouseMiddle
+		case MouseButtonRight:
+			ev.Type = MouseRight
+		case MouseButtonBackward:
+			ev.Type = MouseBackward
+		case MouseButtonForward:
+			ev.Type = MouseForward
+		}
+	case coninput.MOUSE_WHEELED:
+		if e.WheelDirection > 0 {
+			ev.Button = MouseButtonWheelUp
+			ev.Type = MouseWheelUp
+		} else {
+			ev.Button = MouseButtonWheelDown
+			ev.Type = MouseWheelDown
+		}
+	case coninput.MOUSE_HWHEELED:
+		if e.WheelDirection > 0 {
+			ev.Button = MouseButtonWheelRight
+			ev.Type = MouseWheelRight
+		} else {
+			ev.Button = MouseButtonWheelLeft
+			ev.Type = MouseWheelLeft
+		}
+	case coninput.MOUSE_MOVED:
+		ev.Button, _ = mouseEventButton(p, e.ButtonState)
+		ev.Action = MouseActionMotion
+		ev.Type = MouseMotion
+	}
+
+	return ev
+}
+
+func keyType(e coninput.KeyEventRecord) KeyType {
+	code := e.VirtualKeyCode
+
+	shiftPressed := e.ControlKeyState.Contains(coninput.SHIFT_PRESSED)
+	ctrlPressed := e.ControlKeyState.Contains(coninput.LEFT_CTRL_PRESSED | coninput.RIGHT_CTRL_PRESSED)
+
+	switch code {
+	case coninput.VK_RETURN:
+		return KeyEnter
+	case coninput.VK_BACK:
+		return KeyBackspace
+	case coninput.VK_TAB:
+		if shiftPressed {
+			return KeyShiftTab
+		}
+		return KeyTab
+	case coninput.VK_SPACE:
+		return KeyRunes // this could be KeySpace but on unix space also produces KeyRunes
+	case coninput.VK_ESCAPE:
+		return KeyEscape
+	case coninput.VK_UP:
+		switch {
+		case shiftPressed && ctrlPressed:
+			return KeyCtrlShiftUp
+		case shiftPressed:
+			return KeyShiftUp
+		case ctrlPressed:
+			return KeyCtrlUp
+		default:
+			return KeyUp
+		}
+	case coninput.VK_DOWN:
+		switch {
+		case shiftPressed && ctrlPressed:
+			return KeyCtrlShiftDown
+		case shiftPressed:
+			return KeyShiftDown
+		case ctrlPressed:
+			return KeyCtrlDown
+		default:
+			return KeyDown
+		}
+	case coninput.VK_RIGHT:
+		switch {
+		case shiftPressed && ctrlPressed:
+			return KeyCtrlShiftRight
+		case shiftPressed:
+			return KeyShiftRight
+		case ctrlPressed:
+			return KeyCtrlRight
+		default:
+			return KeyRight
+		}
+	case coninput.VK_LEFT:
+		switch {
+		case shiftPressed && ctrlPressed:
+			return KeyCtrlShiftLeft
+		case shiftPressed:
+			return KeyShiftLeft
+		case ctrlPressed:
+			return KeyCtrlLeft
+		default:
+			return KeyLeft
+		}
+	case coninput.VK_HOME:
+		switch {
+		case shiftPressed && ctrlPressed:
+			return KeyCtrlShiftHome
+		case shiftPressed:
+			return KeyShiftHome
+		case ctrlPressed:
+			return KeyCtrlHome
+		default:
+			return KeyHome
+		}
+	case coninput.VK_END:
+		switch {
+		case shiftPressed && ctrlPressed:
+			return KeyCtrlShiftEnd
+		case shiftPressed:
+			return KeyShiftEnd
+		case ctrlPressed:
+			return KeyCtrlEnd
+		default:
+			return KeyEnd
+		}
+	case coninput.VK_PRIOR:
+		return KeyPgUp
+	case coninput.VK_NEXT:
+		return KeyPgDown
+	case coninput.VK_DELETE:
+		return KeyDelete
+	default:
+		switch {
+		case e.ControlKeyState.Contains(coninput.LEFT_CTRL_PRESSED) && e.ControlKeyState.Contains(coninput.RIGHT_ALT_PRESSED):
+			// AltGr is pressed, then it's a rune.
+			fallthrough
+		case !e.ControlKeyState.Contains(coninput.LEFT_CTRL_PRESSED) && !e.ControlKeyState.Contains(coninput.RIGHT_CTRL_PRESSED):
+			return KeyRunes
+		}
+
+		switch e.Char {
+		case '@':
+			return KeyCtrlAt
+		case '\x01':
+			return KeyCtrlA
+		case '\x02':
+			return KeyCtrlB
+		case '\x03':
+			return KeyCtrlC
+		case '\x04':
+			return KeyCtrlD
+		case '\x05':
+			return KeyCtrlE
+		case '\x06':
+			return KeyCtrlF
+		case '\a':
+			return KeyCtrlG
+		case '\b':
+			return KeyCtrlH
+		case '\t':
+			return KeyCtrlI
+		case '\n':
+			return KeyCtrlJ
+		case '\v':
+			return KeyCtrlK
+		case '\f':
+			return KeyCtrlL
+		case '\r':
+			return KeyCtrlM
+		case '\x0e':
+			return KeyCtrlN
+		case '\x0f':
+			return KeyCtrlO
+		case '\x10':
+			return KeyCtrlP
+		case '\x11':
+			return KeyCtrlQ
+		case '\x12':
+			return KeyCtrlR
+		case '\x13':
+			return KeyCtrlS
+		case '\x14':
+			return KeyCtrlT
+		case '\x15':
+			return KeyCtrlU
+		case '\x16':
+			return KeyCtrlV
+		case '\x17':
+			return KeyCtrlW
+		case '\x18':
+			return KeyCtrlX
+		case '\x19':
+			return KeyCtrlY
+		case '\x1a':
+			return KeyCtrlZ
+		case '\x1b':
+			return KeyCtrlOpenBracket // KeyEscape
+		case '\x1c':
+			return KeyCtrlBackslash
+		case '\x1f':
+			return KeyCtrlUnderscore
+		}
+
+		switch code {
+		case coninput.VK_OEM_4:
+			return KeyCtrlOpenBracket
+		case coninput.VK_OEM_6:
+			return KeyCtrlCloseBracket
+		}
+
+		return KeyRunes
+	}
+}

vendor/github.com/charmbracelet/bubbletea/logging.go

@@ -0,0 +1,53 @@
+package tea
+
+import (
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"unicode"
+)
+
+// LogToFile sets up default logging to log to a file. This is helpful as we
+// can't print to the terminal since our TUI is occupying it. If the file
+// doesn't exist it will be created.
+//
+// Don't forget to close the file when you're done with it.
+//
+//	  f, err := LogToFile("debug.log", "debug")
+//	  if err != nil {
+//			fmt.Println("fatal:", err)
+//			os.Exit(1)
+//	  }
+//	  defer f.Close()
+func LogToFile(path string, prefix string) (*os.File, error) {
+	return LogToFileWith(path, prefix, log.Default())
+}
+
+// LogOptionsSetter is an interface implemented by stdlib's log and charm's log
+// libraries.
+type LogOptionsSetter interface {
+	SetOutput(io.Writer)
+	SetPrefix(string)
+}
+
+// LogToFileWith does allows to call LogToFile with a custom LogOptionsSetter.
+func LogToFileWith(path string, prefix string, log LogOptionsSetter) (*os.File, error) {
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0o600) //nolint:gomnd
+	if err != nil {
+		return nil, fmt.Errorf("error opening file for logging: %w", err)
+	}
+	log.SetOutput(f)
+
+	// Add a space after the prefix if a prefix is being specified and it
+	// doesn't already have a trailing space.
+	if len(prefix) > 0 {
+		finalChar := prefix[len(prefix)-1]
+		if !unicode.IsSpace(rune(finalChar)) {
+			prefix += " "
+		}
+	}
+	log.SetPrefix(prefix)
+
+	return f, nil
+}

vendor/github.com/charmbracelet/bubbletea/mouse.go

@@ -0,0 +1,308 @@
+package tea
+
+import "strconv"
+
+// MouseMsg contains information about a mouse event and are sent to a programs
+// update function when mouse activity occurs. Note that the mouse must first
+// be enabled in order for the mouse events to be received.
+type MouseMsg MouseEvent
+
+// String returns a string representation of a mouse event.
+func (m MouseMsg) String() string {
+	return MouseEvent(m).String()
+}
+
+// MouseEvent represents a mouse event, which could be a click, a scroll wheel
+// movement, a cursor movement, or a combination.
+type MouseEvent struct {
+	X      int
+	Y      int
+	Shift  bool
+	Alt    bool
+	Ctrl   bool
+	Action MouseAction
+	Button MouseButton
+
+	// Deprecated: Use MouseAction & MouseButton instead.
+	Type MouseEventType
+}
+
+// IsWheel returns true if the mouse event is a wheel event.
+func (m MouseEvent) IsWheel() bool {
+	return m.Button == MouseButtonWheelUp || m.Button == MouseButtonWheelDown ||
+		m.Button == MouseButtonWheelLeft || m.Button == MouseButtonWheelRight
+}
+
+// String returns a string representation of a mouse event.
+func (m MouseEvent) String() (s string) {
+	if m.Ctrl {
+		s += "ctrl+"
+	}
+	if m.Alt {
+		s += "alt+"
+	}
+	if m.Shift {
+		s += "shift+"
+	}
+
+	if m.Button == MouseButtonNone { //nolint:nestif
+		if m.Action == MouseActionMotion || m.Action == MouseActionRelease {
+			s += mouseActions[m.Action]
+		} else {
+			s += "unknown"
+		}
+	} else if m.IsWheel() {
+		s += mouseButtons[m.Button]
+	} else {
+		btn := mouseButtons[m.Button]
+		if btn != "" {
+			s += btn
+		}
+		act := mouseActions[m.Action]
+		if act != "" {
+			s += " " + act
+		}
+	}
+
+	return s
+}
+
+// MouseAction represents the action that occurred during a mouse event.
+type MouseAction int
+
+// Mouse event actions.
+const (
+	MouseActionPress MouseAction = iota
+	MouseActionRelease
+	MouseActionMotion
+)
+
+var mouseActions = map[MouseAction]string{
+	MouseActionPress:   "press",
+	MouseActionRelease: "release",
+	MouseActionMotion:  "motion",
+}
+
+// MouseButton represents the button that was pressed during a mouse event.
+type MouseButton int
+
+// Mouse event buttons
+//
+// This is based on X11 mouse button codes.
+//
+//	1 = left button
+//	2 = middle button (pressing the scroll wheel)
+//	3 = right button
+//	4 = turn scroll wheel up
+//	5 = turn scroll wheel down
+//	6 = push scroll wheel left
+//	7 = push scroll wheel right
+//	8 = 4th button (aka browser backward button)
+//	9 = 5th button (aka browser forward button)
+//	10
+//	11
+//
+// Other buttons are not supported.
+const (
+	MouseButtonNone MouseButton = iota
+	MouseButtonLeft
+	MouseButtonMiddle
+	MouseButtonRight
+	MouseButtonWheelUp
+	MouseButtonWheelDown
+	MouseButtonWheelLeft
+	MouseButtonWheelRight
+	MouseButtonBackward
+	MouseButtonForward
+	MouseButton10
+	MouseButton11
+)
+
+var mouseButtons = map[MouseButton]string{
+	MouseButtonNone:       "none",
+	MouseButtonLeft:       "left",
+	MouseButtonMiddle:     "middle",
+	MouseButtonRight:      "right",
+	MouseButtonWheelUp:    "wheel up",
+	MouseButtonWheelDown:  "wheel down",
+	MouseButtonWheelLeft:  "wheel left",
+	MouseButtonWheelRight: "wheel right",
+	MouseButtonBackward:   "backward",
+	MouseButtonForward:    "forward",
+	MouseButton10:         "button 10",
+	MouseButton11:         "button 11",
+}
+
+// MouseEventType indicates the type of mouse event occurring.
+//
+// Deprecated: Use MouseAction & MouseButton instead.
+type MouseEventType int
+
+// Mouse event types.
+//
+// Deprecated: Use MouseAction & MouseButton instead.
+const (
+	MouseUnknown MouseEventType = iota
+	MouseLeft
+	MouseRight
+	MouseMiddle
+	MouseRelease // mouse button release (X10 only)
+	MouseWheelUp
+	MouseWheelDown
+	MouseWheelLeft
+	MouseWheelRight
+	MouseBackward
+	MouseForward
+	MouseMotion
+)
+
+// Parse SGR-encoded mouse events; SGR extended mouse events. SGR mouse events
+// look like:
+//
+//	ESC [ < Cb ; Cx ; Cy (M or m)
+//
+// where:
+//
+//	Cb is the encoded button code
+//	Cx is the x-coordinate of the mouse
+//	Cy is the y-coordinate of the mouse
+//	M is for button press, m is for button release
+//
+// https://invisible-island.net/xterm/ctlseqs/ctlseqs.html#h3-Extended-coordinates
+func parseSGRMouseEvent(buf []byte) MouseEvent {
+	str := string(buf[3:])
+	matches := mouseSGRRegex.FindStringSubmatch(str)
+	if len(matches) != 5 { //nolint:gomnd
+		// Unreachable, we already checked the regex in `detectOneMsg`.
+		panic("invalid mouse event")
+	}
+
+	b, _ := strconv.Atoi(matches[1])
+	px := matches[2]
+	py := matches[3]
+	release := matches[4] == "m"
+	m := parseMouseButton(b, true)
+
+	// Wheel buttons don't have release events
+	// Motion can be reported as a release event in some terminals (Windows Terminal)
+	if m.Action != MouseActionMotion && !m.IsWheel() && release {
+		m.Action = MouseActionRelease
+		m.Type = MouseRelease
+	}
+
+	x, _ := strconv.Atoi(px)
+	y, _ := strconv.Atoi(py)
+
+	// (1,1) is the upper left. We subtract 1 to normalize it to (0,0).
+	m.X = x - 1
+	m.Y = y - 1
+
+	return m
+}
+
+const x10MouseByteOffset = 32
+
+// Parse X10-encoded mouse events; the simplest kind. The last release of X10
+// was December 1986, by the way. The original X10 mouse protocol limits the Cx
+// and Cy coordinates to 223 (=255-032).
+//
+// X10 mouse events look like:
+//
+//	ESC [M Cb Cx Cy
+//
+// See: http://www.xfree86.org/current/ctlseqs.html#Mouse%20Tracking
+func parseX10MouseEvent(buf []byte) MouseEvent {
+	v := buf[3:6]
+	m := parseMouseButton(int(v[0]), false)
+
+	// (1,1) is the upper left. We subtract 1 to normalize it to (0,0).
+	m.X = int(v[1]) - x10MouseByteOffset - 1
+	m.Y = int(v[2]) - x10MouseByteOffset - 1
+
+	return m
+}
+
+// See: https://invisible-island.net/xterm/ctlseqs/ctlseqs.html#h3-Extended-coordinates
+func parseMouseButton(b int, isSGR bool) MouseEvent {
+	var m MouseEvent
+	e := b
+	if !isSGR {
+		e -= x10MouseByteOffset
+	}
+
+	const (
+		bitShift  = 0b0000_0100
+		bitAlt    = 0b0000_1000
+		bitCtrl   = 0b0001_0000
+		bitMotion = 0b0010_0000
+		bitWheel  = 0b0100_0000
+		bitAdd    = 0b1000_0000 // additional buttons 8-11
+
+		bitsMask = 0b0000_0011
+	)
+
+	if e&bitAdd != 0 {
+		m.Button = MouseButtonBackward + MouseButton(e&bitsMask)
+	} else if e&bitWheel != 0 {
+		m.Button = MouseButtonWheelUp + MouseButton(e&bitsMask)
+	} else {
+		m.Button = MouseButtonLeft + MouseButton(e&bitsMask)
+		// X10 reports a button release as 0b0000_0011 (3)
+		if e&bitsMask == bitsMask {
+			m.Action = MouseActionRelease
+			m.Button = MouseButtonNone
+		}
+	}
+
+	// Motion bit doesn't get reported for wheel events.
+	if e&bitMotion != 0 && !m.IsWheel() {
+		m.Action = MouseActionMotion
+	}
+
+	// Modifiers
+	m.Alt = e&bitAlt != 0
+	m.Ctrl = e&bitCtrl != 0
+	m.Shift = e&bitShift != 0
+
+	// backward compatibility
+	switch {
+	case m.Button == MouseButtonLeft && m.Action == MouseActionPress:
+		m.Type = MouseLeft
+	case m.Button == MouseButtonMiddle && m.Action == MouseActionPress:
+		m.Type = MouseMiddle
+	case m.Button == MouseButtonRight && m.Action == MouseActionPress:
+		m.Type = MouseRight
+	case m.Button == MouseButtonNone && m.Action == MouseActionRelease:
+		m.Type = MouseRelease
+	case m.Button == MouseButtonWheelUp && m.Action == MouseActionPress:
+		m.Type = MouseWheelUp
+	case m.Button == MouseButtonWheelDown && m.Action == MouseActionPress:
+		m.Type = MouseWheelDown
+	case m.Button == MouseButtonWheelLeft && m.Action == MouseActionPress:
+		m.Type = MouseWheelLeft
+	case m.Button == MouseButtonWheelRight && m.Action == MouseActionPress:
+		m.Type = MouseWheelRight
+	case m.Button == MouseButtonBackward && m.Action == MouseActionPress:
+		m.Type = MouseBackward
+	case m.Button == MouseButtonForward && m.Action == MouseActionPress:
+		m.Type = MouseForward
+	case m.Action == MouseActionMotion:
+		m.Type = MouseMotion
+		switch m.Button { //nolint:exhaustive
+		case MouseButtonLeft:
+			m.Type = MouseLeft
+		case MouseButtonMiddle:
+			m.Type = MouseMiddle
+		case MouseButtonRight:
+			m.Type = MouseRight
+		case MouseButtonBackward:
+			m.Type = MouseBackward
+		case MouseButtonForward:
+			m.Type = MouseForward
+		}
+	default:
+		m.Type = MouseUnknown
+	}
+
+	return m
+}

vendor/github.com/charmbracelet/bubbletea/nil_renderer.go

@@ -0,0 +1,28 @@
+package tea
+
+type nilRenderer struct{}
+
+func (n nilRenderer) start()                     {}
+func (n nilRenderer) stop()                      {}
+func (n nilRenderer) kill()                      {}
+func (n nilRenderer) write(_ string)             {}
+func (n nilRenderer) repaint()                   {}
+func (n nilRenderer) clearScreen()               {}
+func (n nilRenderer) altScreen() bool            { return false }
+func (n nilRenderer) enterAltScreen()            {}
+func (n nilRenderer) exitAltScreen()             {}
+func (n nilRenderer) showCursor()                {}
+func (n nilRenderer) hideCursor()                {}
+func (n nilRenderer) enableMouseCellMotion()     {}
+func (n nilRenderer) disableMouseCellMotion()    {}
+func (n nilRenderer) enableMouseAllMotion()      {}
+func (n nilRenderer) disableMouseAllMotion()     {}
+func (n nilRenderer) enableBracketedPaste()      {}
+func (n nilRenderer) disableBracketedPaste()     {}
+func (n nilRenderer) enableMouseSGRMode()        {}
+func (n nilRenderer) disableMouseSGRMode()       {}
+func (n nilRenderer) bracketedPasteActive() bool { return false }
+func (n nilRenderer) setWindowTitle(_ string)    {}
+func (n nilRenderer) reportFocus() bool          { return false }
+func (n nilRenderer) enableReportFocus()         {}
+func (n nilRenderer) disableReportFocus()        {}

vendor/github.com/charmbracelet/bubbletea/options.go

@@ -0,0 +1,252 @@
+package tea
+
+import (
+	"context"
+	"io"
+	"sync/atomic"
+)
+
+// ProgramOption is used to set options when initializing a Program. Program can
+// accept a variable number of options.
+//
+// Example usage:
+//
+//	p := NewProgram(model, WithInput(someInput), WithOutput(someOutput))
+type ProgramOption func(*Program)
+
+// WithContext lets you specify a context in which to run the Program. This is
+// useful if you want to cancel the execution from outside. When a Program gets
+// cancelled it will exit with an error ErrProgramKilled.
+func WithContext(ctx context.Context) ProgramOption {
+	return func(p *Program) {
+		p.ctx = ctx
+	}
+}
+
+// WithOutput sets the output which, by default, is stdout. In most cases you
+// won't need to use this.
+func WithOutput(output io.Writer) ProgramOption {
+	return func(p *Program) {
+		p.output = output
+	}
+}
+
+// WithInput sets the input which, by default, is stdin. In most cases you
+// won't need to use this. To disable input entirely pass nil.
+//
+//	p := NewProgram(model, WithInput(nil))
+func WithInput(input io.Reader) ProgramOption {
+	return func(p *Program) {
+		p.input = input
+		p.inputType = customInput
+	}
+}
+
+// WithInputTTY opens a new TTY for input (or console input device on Windows).
+func WithInputTTY() ProgramOption {
+	return func(p *Program) {
+		p.inputType = ttyInput
+	}
+}
+
+// WithEnvironment sets the environment variables that the program will use.
+// This useful when the program is running in a remote session (e.g. SSH) and
+// you want to pass the environment variables from the remote session to the
+// program.
+//
+// Example:
+//
+//	var sess ssh.Session // ssh.Session is a type from the github.com/charmbracelet/ssh package
+//	pty, _, _ := sess.Pty()
+//	environ := append(sess.Environ(), "TERM="+pty.Term)
+//	p := tea.NewProgram(model, tea.WithEnvironment(environ)
+func WithEnvironment(env []string) ProgramOption {
+	return func(p *Program) {
+		p.environ = env
+	}
+}
+
+// WithoutSignalHandler disables the signal handler that Bubble Tea sets up for
+// Programs. This is useful if you want to handle signals yourself.
+func WithoutSignalHandler() ProgramOption {
+	return func(p *Program) {
+		p.startupOptions |= withoutSignalHandler
+	}
+}
+
+// WithoutCatchPanics disables the panic catching that Bubble Tea does by
+// default. If panic catching is disabled the terminal will be in a fairly
+// unusable state after a panic because Bubble Tea will not perform its usual
+// cleanup on exit.
+func WithoutCatchPanics() ProgramOption {
+	return func(p *Program) {
+		p.startupOptions |= withoutCatchPanics
+	}
+}
+
+// WithoutSignals will ignore OS signals.
+// This is mainly useful for testing.
+func WithoutSignals() ProgramOption {
+	return func(p *Program) {
+		atomic.StoreUint32(&p.ignoreSignals, 1)
+	}
+}
+
+// WithAltScreen starts the program with the alternate screen buffer enabled
+// (i.e. the program starts in full window mode). Note that the altscreen will
+// be automatically exited when the program quits.
+//
+// Example:
+//
+//	p := tea.NewProgram(Model{}, tea.WithAltScreen())
+//	if _, err := p.Run(); err != nil {
+//	    fmt.Println("Error running program:", err)
+//	    os.Exit(1)
+//	}
+//
+// To enter the altscreen once the program has already started running use the
+// EnterAltScreen command.
+func WithAltScreen() ProgramOption {
+	return func(p *Program) {
+		p.startupOptions |= withAltScreen
+	}
+}
+
+// WithoutBracketedPaste starts the program with bracketed paste disabled.
+func WithoutBracketedPaste() ProgramOption {
+	return func(p *Program) {
+		p.startupOptions |= withoutBracketedPaste
+	}
+}
+
+// WithMouseCellMotion starts the program with the mouse enabled in "cell
+// motion" mode.
+//
+// Cell motion mode enables mouse click, release, and wheel events. Mouse
+// movement events are also captured if a mouse button is pressed (i.e., drag
+// events). Cell motion mode is better supported than all motion mode.
+//
+// This will try to enable the mouse in extended mode (SGR), if that is not
+// supported by the terminal it will fall back to normal mode (X10).
+//
+// To enable mouse cell motion once the program has already started running use
+// the EnableMouseCellMotion command. To disable the mouse when the program is
+// running use the DisableMouse command.
+//
+// The mouse will be automatically disabled when the program exits.
+func WithMouseCellMotion() ProgramOption {
+	return func(p *Program) {
+		p.startupOptions |= withMouseCellMotion // set
+		p.startupOptions &^= withMouseAllMotion // clear
+	}
+}
+
+// WithMouseAllMotion starts the program with the mouse enabled in "all motion"
+// mode.
+//
+// EnableMouseAllMotion is a special command that enables mouse click, release,
+// wheel, and motion events, which are delivered regardless of whether a mouse
+// button is pressed, effectively enabling support for hover interactions.
+//
+// This will try to enable the mouse in extended mode (SGR), if that is not
+// supported by the terminal it will fall back to normal mode (X10).
+//
+// Many modern terminals support this, but not all. If in doubt, use
+// EnableMouseCellMotion instead.
+//
+// To enable the mouse once the program has already started running use the
+// EnableMouseAllMotion command. To disable the mouse when the program is
+// running use the DisableMouse command.
+//
+// The mouse will be automatically disabled when the program exits.
+func WithMouseAllMotion() ProgramOption {
+	return func(p *Program) {
+		p.startupOptions |= withMouseAllMotion   // set
+		p.startupOptions &^= withMouseCellMotion // clear
+	}
+}
+
+// WithoutRenderer disables the renderer. When this is set output and log
+// statements will be plainly sent to stdout (or another output if one is set)
+// without any rendering and redrawing logic. In other words, printing and
+// logging will behave the same way it would in a non-TUI commandline tool.
+// This can be useful if you want to use the Bubble Tea framework for a non-TUI
+// application, or to provide an additional non-TUI mode to your Bubble Tea
+// programs. For example, your program could behave like a daemon if output is
+// not a TTY.
+func WithoutRenderer() ProgramOption {
+	return func(p *Program) {
+		p.renderer = &nilRenderer{}
+	}
+}
+
+// WithANSICompressor removes redundant ANSI sequences to produce potentially
+// smaller output, at the cost of some processing overhead.
+//
+// This feature is provisional, and may be changed or removed in a future version
+// of this package.
+//
+// Deprecated: this incurs a noticeable performance hit. A future release will
+// optimize ANSI automatically without the performance penalty.
+func WithANSICompressor() ProgramOption {
+	return func(p *Program) {
+		p.startupOptions |= withANSICompressor
+	}
+}
+
+// WithFilter supplies an event filter that will be invoked before Bubble Tea
+// processes a tea.Msg. The event filter can return any tea.Msg which will then
+// get handled by Bubble Tea instead of the original event. If the event filter
+// returns nil, the event will be ignored and Bubble Tea will not process it.
+//
+// As an example, this could be used to prevent a program from shutting down if
+// there are unsaved changes.
+//
+// Example:
+//
+//	func filter(m tea.Model, msg tea.Msg) tea.Msg {
+//		if _, ok := msg.(tea.QuitMsg); !ok {
+//			return msg
+//		}
+//
+//		model := m.(myModel)
+//		if model.hasChanges {
+//			return nil
+//		}
+//
+//		return msg
+//	}
+//
+//	p := tea.NewProgram(Model{}, tea.WithFilter(filter));
+//
+//	if _,err := p.Run(); err != nil {
+//		fmt.Println("Error running program:", err)
+//		os.Exit(1)
+//	}
+func WithFilter(filter func(Model, Msg) Msg) ProgramOption {
+	return func(p *Program) {
+		p.filter = filter
+	}
+}
+
+// WithFPS sets a custom maximum FPS at which the renderer should run. If
+// less than 1, the default value of 60 will be used. If over 120, the FPS
+// will be capped at 120.
+func WithFPS(fps int) ProgramOption {
+	return func(p *Program) {
+		p.fps = fps
+	}
+}
+
+// WithReportFocus enables reporting when the terminal gains and loses
+// focus. When this is enabled [FocusMsg] and [BlurMsg] messages will be sent
+// to your Update method.
+//
+// Note that while most terminals and multiplexers support focus reporting,
+// some do not. Also note that tmux needs to be configured to report focus
+// events.
+func WithReportFocus() ProgramOption {
+	return func(p *Program) {
+		p.startupOptions |= withReportFocus
+	}
+}

vendor/github.com/charmbracelet/bubbletea/renderer.go

@@ -0,0 +1,85 @@
+package tea
+
+// renderer is the interface for Bubble Tea renderers.
+type renderer interface {
+	// Start the renderer.
+	start()
+
+	// Stop the renderer, but render the final frame in the buffer, if any.
+	stop()
+
+	// Stop the renderer without doing any final rendering.
+	kill()
+
+	// Write a frame to the renderer. The renderer can write this data to
+	// output at its discretion.
+	write(string)
+
+	// Request a full re-render. Note that this will not trigger a render
+	// immediately. Rather, this method causes the next render to be a full
+	// repaint. Because of this, it's safe to call this method multiple times
+	// in succession.
+	repaint()
+
+	// Clears the terminal.
+	clearScreen()
+
+	// Whether or not the alternate screen buffer is enabled.
+	altScreen() bool
+	// Enable the alternate screen buffer.
+	enterAltScreen()
+	// Disable the alternate screen buffer.
+	exitAltScreen()
+
+	// Show the cursor.
+	showCursor()
+	// Hide the cursor.
+	hideCursor()
+
+	// enableMouseCellMotion enables mouse click, release, wheel and motion
+	// events if a mouse button is pressed (i.e., drag events).
+	enableMouseCellMotion()
+
+	// disableMouseCellMotion disables Mouse Cell Motion tracking.
+	disableMouseCellMotion()
+
+	// enableMouseAllMotion enables mouse click, release, wheel and motion
+	// events, regardless of whether a mouse button is pressed. Many modern
+	// terminals support this, but not all.
+	enableMouseAllMotion()
+
+	// disableMouseAllMotion disables All Motion mouse tracking.
+	disableMouseAllMotion()
+
+	// enableMouseSGRMode enables mouse extended mode (SGR).
+	enableMouseSGRMode()
+
+	// disableMouseSGRMode disables mouse extended mode (SGR).
+	disableMouseSGRMode()
+
+	// enableBracketedPaste enables bracketed paste, where characters
+	// inside the input are not interpreted when pasted as a whole.
+	enableBracketedPaste()
+
+	// disableBracketedPaste disables bracketed paste.
+	disableBracketedPaste()
+
+	// bracketedPasteActive reports whether bracketed paste mode is
+	// currently enabled.
+	bracketedPasteActive() bool
+
+	// setWindowTitle sets the terminal window title.
+	setWindowTitle(string)
+
+	// reportFocus returns whether reporting focus events is enabled.
+	reportFocus() bool
+
+	// enableReportFocus reports focus events to the program.
+	enableReportFocus()
+
+	// disableReportFocus stops reporting focus events to the program.
+	disableReportFocus()
+}
+
+// repaintMsg forces a full repaint.
+type repaintMsg struct{}