tutti-ops-cli

Internal CLI for Tutti admin operations: access, commerce, App Center, market, LLM, releases, computers, tasks, and diagnostics.

Design and development

See implementation status for delivered capabilities and remaining backend dependencies. See CLI design for target commands and compatibility, execution contract for agent-facing behavior, and admin capability inventory for verified API coverage and gaps. Repository contributors start with AGENTS.md.

Discover and run

pnpm install --frozen-lockfile
pnpm build
node dist/index.js capabilities --access read
node dist/index.js schema access.login-code-settings.update
node dist/index.js skills show tutti-admin

# Offline request preview
node dist/index.js access login-code-settings update \
  --scope-app-id example-app --enabled false --dry-run

# Explicitly execute an authorized write
node dist/index.js access login-code-settings update \
  --scope-app-id example-app --enabled false --yes

# Read all pages for an operation with verified pagination support
node dist/index.js --mode read brand list --page-all --page-limit 10

Canonical commands accept --params / --data as JSON objects, @file.json, or - for stdin. Use schema for required fields and scope. Output defaults to a v1 JSON envelope; --format table produces TSV and --format ndjson emits records and a summary. Failures use stderr JSON and nonzero exit codes. Exit 6 retains partial data or indicates an uncertain write outcome; inspect state before retrying.

Management keys support Read-only (access_mode=read) and Full access (access_mode=write) with the companion backend changes. New keys default to read-only; existing keys retain full access. Server enforcement requires the coordinated rollout. Verify the target environment before relying on typed key support. --mode read (or TUTTI_OPS_MODE=read) adds a local write restriction and does not change the key's actual permission. Existing administrator and business rules apply. Session access can use an explicitly supplied TUTTI_ADMIN_COOKIE.

Credential fields are redacted by default. If an authorized task needs a client config, pass --show-secrets on that successful request. Dry-run and error output always redact known credential fields.

Auth

Manage key lists, details, creation and revocation in the Web admin 管理密钥 page (/admin-tokens; Tutti). The CLI imports an existing key and checks its current status and permissions. Legacy admin-token commands exit 8 with a Web migration message and send no requests. auth logout clears only the local credential; revoke a key from the Web page.

Create a key there, then run:

tutti-ops auth login --admin-url https://admin.nextop.sh
tutti-ops auth whoami

The CLI stores the token in ~/.config/tutti-ops/config.json with 0600 permissions. CI can provide TUTTI_ADMIN_TOKEN instead. admin.nextop.sh is normalized to the API origin https://nextop.sh.

App Release (legacy commands)

tutti-ops app list --brand nextop --query design
tutti-ops app detail --brand nextop --app-id vibe-design --include latest,versions
tutti-ops app validate --zip ./output/vibe-design.zip
tutti-ops app release --brand nextop --app-id vibe-design --zip ./output/vibe-design.zip --publish --latest

app release validates the zip, creates an artifact upload session, uploads the zip, synchronizes its localized catalog metadata, creates the App Center version, and optionally publishes it and moves the latest pointer.

To backfill catalog metadata without creating a new version:

tutti-ops app sync-metadata --brand nextop --app-id vibe-design --zip ./output/vibe-design.zip

Maintenance

tutti-ops app create --brand nextop --app-id vibe-design --name "Vibe Design"
tutti-ops app edit --brand nextop --app-id vibe-design --name "Vibe Design" --icon ./assets/icon.png
tutti-ops app delete --brand nextop --app-id codex-smoke-20260625 --yes --reason "cleanup test app"
tutti-ops app publish --brand nextop --app-id vibe-design --version 0.1.47 --latest
tutti-ops app rollback --brand nextop --app-id vibe-design --version 0.1.46
tutti-ops app archive --brand nextop --app-id vibe-design --version 0.1.45

app create and app edit accept either --icon <file> to upload a PNG/JPEG/WebP icon through App Center asset upload, or --icon-url <url> when the asset is already hosted. app delete removes the app catalog entry and all version metadata. It does not delete previously uploaded CDN artifacts.

Canonical App workflow

tutti-ops app +validate --zip ./output/vibe-design.zip
tutti-ops app +release --app-id vibe-design --zip ./output/vibe-design.zip \
  --publish true --latest true --dry-run
tutti-ops app +release --app-id vibe-design --zip ./output/vibe-design.zip \
  --publish true --latest true --yes

Legacy App commands retain their original success output and flags. Legacy --brand does not enforce brand isolation. Use canonical entries for schema, dry-run, confirmation, structured output and workflow request history.