feat(services): clone/move ops + owner-scoped registry credentials (C4)

Service lifecycle: POST /services/:id/clone duplicates config, volumes,
domains, access gates, builder settings, and variables (secret ciphertext
copied verbatim); POST /services/:id/move re-parents to another owned
project. Both enforce ownership, reject name conflicts, and audit.

Registries: CRUD at /registries — host-matched pull credentials for
prebuilt-image deploys, encrypted at rest via secrets pkg, never returned
(has_password flag). Empty password on update keeps the stored credential;
host normalized (scheme/case/trailing slash). Credentials thread through
BuildConfig → BuildRequest → pull auth config, used only for the pull.

Surfaces: CLI services clone|move + registries group, 7 MCP tools,
OpenAPI paths/schemas, frontend Lifecycle card (clone/move/delete) and
Settings registries section, llms.txt + CLI.md.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/cli/commands/registries.go

@@ -0,0 +1,160 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+// RegistriesCmd manages private-image registry credentials.
+var RegistriesCmd = &cobra.Command{
+	Use:     "registries",
+	Aliases: []string{"registry"},
+	Short:   "Manage registry credentials",
+}
+
+var registriesListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List registry credentials",
+	Args:  cobra.NoArgs,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/registries", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "registries")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, r := range items {
+			hasPw := ""
+			if b, ok := r["has_password"].(bool); ok && b {
+				hasPw = "yes"
+			}
+			rows = append(rows, []string{str(r, "id"), str(r, "name"), str(r, "host"), str(r, "username"), hasPw})
+		}
+		printRows(data, []string{"ID", "NAME", "HOST", "USERNAME", "PASSWORD"}, rows)
+		return nil
+	},
+}
+
+var registriesAddCmd = &cobra.Command{
+	Use:   "add <name> <host>",
+	Short: "Add a registry credential (e.g. ghcr.io, registry.example.com, docker.io)",
+	Args:  cobra.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		body := map[string]interface{}{"name": args[0], "host": args[1]}
+		if v, _ := cmd.Flags().GetString("username"); v != "" {
+			body["username"] = v
+		}
+		if v, _ := cmd.Flags().GetString("password"); v != "" {
+			body["password"] = v
+		}
+		data, err := c.Do("POST", "/registries", body)
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		r, _ := unwrapObject(data, "registry")
+		fmt.Printf("Added registry %s (%s)\n", str(r, "name"), str(r, "host"))
+		return nil
+	},
+}
+
+var registriesUpdateCmd = &cobra.Command{
+	Use:   "update <id>",
+	Short: "Update a registry credential (empty --password keeps the stored one)",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		body := map[string]interface{}{}
+		for _, f := range []string{"name", "host", "username", "password"} {
+			if cmd.Flags().Changed(f) {
+				v, _ := cmd.Flags().GetString(f)
+				body[f] = v
+			}
+		}
+		if len(body) == 0 {
+			return &APIError{Message: "nothing to update — pass a flag", ExitCode: ExitError}
+		}
+		// The API requires name+host — backfill them from the stored row
+		// when the caller didn't supply both.
+		_, hasName := body["name"]
+		_, hasHost := body["host"]
+		if !hasName || !hasHost {
+			data, err := c.Do("GET", "/registries", nil)
+			if err != nil {
+				return err
+			}
+			items, _ := unwrapList(data, "registries")
+			for _, r := range items {
+				if str(r, "id") == args[0] {
+					if !hasName {
+						body["name"] = str(r, "name")
+					}
+					if !hasHost {
+						body["host"] = str(r, "host")
+					}
+				}
+			}
+		}
+		data, err := c.Do("PUT", "/registries/"+args[0], body)
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		fmt.Printf("Updated registry %s\n", args[0])
+		return nil
+	},
+}
+
+var registriesRemoveCmd = &cobra.Command{
+	Use:   "remove <id>",
+	Short: "Remove a registry credential",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		if !Confirm(fmt.Sprintf("Remove registry %s?", args[0])) {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		if _, err := c.Do("DELETE", "/registries/"+args[0], nil); err != nil {
+			return err
+		}
+		if JSONMode() {
+			return PrintJSON(map[string]string{"status": "deleted", "id": args[0]})
+		}
+		fmt.Printf("Removed registry %s\n", args[0])
+		return nil
+	},
+}
+
+func init() {
+	registriesAddCmd.Flags().String("username", "", "registry username")
+	registriesAddCmd.Flags().String("password", "", "registry password/token (stored encrypted)")
+	registriesUpdateCmd.Flags().String("name", "", "display name")
+	registriesUpdateCmd.Flags().String("host", "", "registry host")
+	registriesUpdateCmd.Flags().String("username", "", "registry username")
+	registriesUpdateCmd.Flags().String("password", "", "registry password/token")
+	RegistriesCmd.AddCommand(registriesListCmd, registriesAddCmd, registriesUpdateCmd, registriesRemoveCmd)
+}

app/backend/internal/cli/commands/services.go

@@ -226,6 +226,61 @@ var servicesUpdateCmd = &cobra.Command{
 	},
 }
 
+var servicesCloneCmd = &cobra.Command{
+	Use:   "clone <id>",
+	Short: "Clone a service (config, volumes, domains, variables)",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		body := map[string]interface{}{}
+		for _, f := range []string{"name", "project", "environment"} {
+			if v, _ := cmd.Flags().GetString(f); v != "" {
+				key := f
+				if f == "project" {
+					key = "project_id"
+				}
+				body[key] = v
+			}
+		}
+		data, err := c.Do("POST", "/services/"+args[0]+"/clone", body)
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		m, _ := unwrapObject(data)
+		fmt.Printf("Cloned to service %s (%s)\n", str(m, "service_id"), str(m, "name"))
+		return nil
+	},
+}
+
+var servicesMoveCmd = &cobra.Command{
+	Use:   "move <id> <project-id>",
+	Short: "Move a service to another project",
+	Args:  cobra.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/services/"+args[0]+"/move", map[string]interface{}{"project_id": args[1]})
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		fmt.Printf("Moved service %s to project %s\n", args[0], args[1])
+		return nil
+	},
+}
+
 // volumeFlagValues parses repeated "src:target[:ro]" flags into API mount
 // objects. Bind mounts are type=bind, named volumes type=volume.
 func volumeFlagValues(cmd *cobra.Command, flags ...string) []map[string]interface{} {
@@ -459,7 +514,11 @@ func init() {
 			RunE:  serviceAction(verb),
 		})
 	}
+	servicesCloneCmd.Flags().String("name", "", "name for the clone (default <name>-copy)")
+	servicesCloneCmd.Flags().String("project", "", "target project id (default: same project)")
+	servicesCloneCmd.Flags().String("environment", "", "target environment (default: source's)")
+
 	domainsAddCmd.Flags().Bool("default", false, "set as the default domain")
 	servicesDomainsCmd.AddCommand(domainsListCmd, domainsAddCmd, domainsRemoveCmd, domainsDefaultCmd, domainsCheckCmd)
-	ServicesCmd.AddCommand(servicesListCmd, servicesGetCmd, servicesCreateCmd, servicesUpdateCmd, servicesDeleteCmd, servicesDomainsCmd)
+	ServicesCmd.AddCommand(servicesListCmd, servicesGetCmd, servicesCreateCmd, servicesUpdateCmd, servicesDeleteCmd, servicesDomainsCmd, servicesCloneCmd, servicesMoveCmd)
 }

app/backend/internal/cli/root.go

@@ -74,6 +74,7 @@ func init() {
 	rootCmd.AddCommand(commands.ExecCmd)
 	rootCmd.AddCommand(commands.VariablesCmd)
 	rootCmd.AddCommand(commands.VolumesCmd)
+	rootCmd.AddCommand(commands.RegistriesCmd)
 	rootCmd.AddCommand(commands.DatabasesCmd)
 	rootCmd.AddCommand(commands.CronCmd)
 	rootCmd.AddCommand(commands.TemplatesCmd)