nexoctl command reference

Command	Support status
login	Unavailable: interactive token fields do not match the API; API-key mode exposes argv.
status	Unavailable end to end: no supported CLI authentication path and detailed fields differ.
upgrade	Unavailable against the current Control Plane contract.
diagnostics, diag	Supported with Kubernetes access.
support-bundle and aliases	Collection supported; redaction is best-effort.
scaffold, validate, test	Available for plugin development.
publish	Dry-run only recommended; API key and archive handling are not hardened.
version, help	Supported.

Supported examples

nexoctl diagnostics --namespace nexo-system --output ./nexo-diagnostics.json
nexoctl support-bundle generate \
  --namespace nexo-system \
  --redact-secrets=true \
  --output ./nexo-support.tar.gz

login and status remain implemented commands but are omitted from supported examples because their current contracts are incompatible with the Control Plane.

Diagnostics flags

--namespace, --output, --log-lines, --include-logs, --include-metrics, --wide.

Support-bundle flags

Generate accepts --namespace, --timerange, --include-logs, --include-metrics, --include-config, --include-health, --include-decisions, --include-events, --redact-secrets, --output, --api-endpoint, and --offline.

nexoctl support-bundle inspect ./nexo-support.tar.gz
nexoctl support-bundle redact \
  --output ./nexo-support-redacted.tar.gz \
  ./nexo-support.tar.gz

Inspection lists metadata and filenames only. Redaction can miss unlabelled or application-specific secrets, so extracted content requires a separate security/DLP review before transfer.

Plugin commands

scaffold accepts --name, --type, and --lang. validate accepts --dir. test accepts --plugin-path, --config, and --verbose. publish accepts --api-key, --endpoint, --dir, and --dry-run.

Publishing recursively packages all files under --dir, including hidden files. Use a clean staging directory and --dry-run; inspect the resulting archive before any separately approved upload.