@caribeth-ai/kitchen-admin-cli

The kitchen-admin CLI — the ergonomic client for the admin API (the backend-deploy plane).

Clean-arch CLI mirroring kitchen-cli (commander, tsyringe, zod DTOs, formatter layer).

Install

The package is published to the public npm registry:

npm install -g @caribeth-ai/kitchen-admin-cli

The tarball ships dist/ only; the kitchen-admin bin maps to dist/main.js.

Configuration

The CLI resolves the admin URL and Cloudflare Access service token from one of two sources:

1. Environment — when KITCHEN_ADMIN_URL, KITCHEN_ADMIN_CLIENT_ID, and KITCHEN_ADMIN_CLIENT_SECRET are all set, the config is synthesized from them and no file is read. This is how the runtime connector injects credentials without a config file. If any of the three is unset, the CLI falls back to the file.
2. Config file — ~/.config/kitchen/admin.json, written by kitchen-admin init (respecting XDG_CONFIG_HOME).

Commands

• kitchen-admin init — prompt for the admin URL and the Cloudflare Access service token (client id + secret), then write ~/.config/kitchen/admin.json (dir 0700, file 0600, respecting XDG_CONFIG_HOME).
• kitchen-admin status — GET /status; renders the live status of every stack service (service, state, health, tag, digest, updatedAt).
• kitchen-admin version — GET /version; prints the running admin service git sha.
• kitchen-admin logs <service> [--tail N] [--follow] — GET /logs/:service?tail=&follow=. Without --follow it prints the last N lines (default 100) and exits. With --follow it streams new lines to stdout until Ctrl-C (SIGINT closes the stream and exits 0).
• kitchen-admin update <backend|dashboard|admin> [--tag sha-…|latest] — POST /update { service, tag } (default tag latest). backend and dashboard are managed services: the CLI surfaces the server-side progress and exits non-zero if the update fails (the API returns 502). For admin the update is async (the API answers 202 and the service self-updates), so the CLI captures the current /version sha first, then polls GET /version until the sha flips or a ~120s timeout — exiting non-zero on timeout. There is no runtime target; the runtime image is rolled out via kitchen runtime set-image.
• kitchen-admin restart <service> — POST /restart { service }; exits non-zero on API error.

Re-login (email magic-link)

kitchen-admin logs backend is the re-login path when a magic-link login email cannot be sent:

1. kitchen login --api-url https://api.example.com — the product CLI's device flow prints its own URL directly.
2. kitchen-admin logs backend — read the magic-link URL printed in the backend logs, open it, and approve.

Requests carry CF-Access-Client-Id / CF-Access-Client-Secret; Cloudflare Access exchanges the service token for the Cf-Access-Jwt-Assertion the admin service verifies. A 401/403 surfaces as a clear auth error.