Run the app's own command line

Runs one command with the app's own CLI, on the customer's server. Answers 202 with a run_id; poll GET /platform/deployments/{id}/cli/{run_id} until status leaves pending.

Arguments are a list, never a string. Each element becomes one argv entry and reaches the process through execve — no shell parses any of it, so quoting is not your problem and a semicolon in a value is a semicolon in a value. A plain string is accepted and split on whitespace as a convenience, but only when it contains no quote characters: splitting a quoted string correctly means implementing a shell, and a half-right shell is worse than none.

No docker socket is involved. The CLI runs in a separate container built from the app's own image, joined to the app's own network, with its data mounted — the shape the official CLI images are designed for. It carries cap_drop: ALL and no new privilege on the machine.

manage scope, and destructive. A command line can do anything the app itself can: drop its database, delete a user, empty a site. That is the same ceiling uninstall with purge_data already sits at.

Output is capped at 256 KB and a single command is stopped after 300 seconds.