CLI reference

The CLI deploys the long-running Cengrid services. It is not the runtime. From a source checkout run it as node cli/bin/cengrid.ts <command>. From inside a deployment directory the commands act on that directory, and --config, --env-file and --sandbox-dir relocate a piece.

node cli/bin/cengrid.ts init deploy/layers/acme --org acme --target aws
node cli/bin/cengrid.ts check --config deploy/layers/acme/cengrid.config.jsonc
node cli/bin/cengrid.ts plan --config deploy/layers/acme/cengrid.config.jsonc
node cli/bin/cengrid.ts up --config deploy/layers/acme/cengrid.config.jsonc --build-from . --yes
node cli/bin/cengrid.ts check --config deploy/layers/acme/cengrid.config.jsonc --live

Commands

Command	Purpose
init [dir] [--org id] [--target docker|fly|aws]	Scaffold a deployment directory. The target defaults to docker. Also --model-provider and --email-transport.
setup [path]	Interactive wizard: scaffold if needed, then walk the missing secrets with per-provider instructions.
check [--json] [--live]	Validate config, computed secret names, tools, skills and plugins without building anything, and verify provider credentials whose values are present locally. --live verifies the running deployment.
doctor	Read-only checks of external prerequisites.
plan	Alias for up --dry-run: resolve the config and report the plan without changing anything.
up [--build-from[=repo]] [--dry-run]	Build images and bring the deployment up. AWS also takes --yes, which mutation requires.
status	Show deployment status.
logs [service] [-f] [--tail n]	Read service logs.
outputs [--json]	Print the operational URLs, including the Slack app creation link and admin onboarding URLs.
secrets push [--from file]	Upload operator-managed values to Fly secrets or AWS Secrets Manager without printing them.
secrets set <KEY> [<value>] [--from-file path]	Write one .env value in place. With no value it reads stdin or prompts, so the secret never reaches shell history.
slack render	Regenerate the Slack manifests after you change botName, orgId, publicUrl or the portal’s OIDC endpoints.
sandbox build	Local validation build of the sandbox image.
sandbox publish [--from image] [--app registry/repo] [--tag tag] [--no-pin] [--dry-run]	Push the image, resolve its digest and record the pin.
infra render|build-image|delete-image|delete-task-definitions	AWS infrastructure helpers.
rollback [--to revision-or-sha]	Restore a previous deployment.
down [--purge]	Tear down.
config get <dot.path>	Read a config value.
config migrate [dir] [--dry-run]	Rename and migrate an existing configuration.
proof scope-key <scope-id>	Derive the provider snapshot key for an exact scope.
conformance [dir] [--static]	Run the static gates and compare the live resolved layer.
help, version	Print usage or the CLI version.

Note

cengrid setup walks any missing secrets interactively, and prompts for the first administrator’s email followed by :org_admin.

The dev commands are the contributor loop for working in the product repository and are separate from deployment. The @shelf-b2b/cengrid package is private and is not published to npm. Build it with npm ci --prefix cli and npm run build --prefix cli, or install it into a deployment directory from a local path. It shells out to Docker with Buildx, flyctl, the AWS CLI and Git, and Terraform is operator-run against the module init generates.