fix: make server operations executable

tools/thothctl/cmd/thothctl/main.go

@@ -18,6 +18,7 @@ import (
 	"github.com/aritmolab/thothii/tools/thothctl/internal/config"
 	"github.com/aritmolab/thothii/tools/thothctl/internal/output"
 	"github.com/aritmolab/thothii/tools/thothctl/internal/pi"
+	"github.com/aritmolab/thothii/tools/thothctl/internal/serverops"
 )
 
 const usage = `Usage: thothctl --installation <absolute-path>/thothii-installation.yaml <command>
@@ -29,6 +30,10 @@ Commands:
   start               Start the installation in the background.
   stop                Stop the installation.
   update --check-only Validate the current installation without changing containers.
+  sessions migrate --yes
+                      Run only the server session migrator and verify pending=[] and drifted=[].
+  remove              Display exact stopped app container IDs without mutation.
+  remove --yes ID...  Remove only the stopped IDs copied from the preceding display.
   pi status           Show the Pi version embedded in core.
   pi doctor           Check Pi preconditions without changing the installation.
   pi test             Run the temporary Pi/core smoke checks.
@@ -113,12 +118,67 @@ func run(ctx context.Context, args []string, stdout, stderr io.Writer) int {
 		return doctor(ctx, installation, runner, secretValues, stdout, stderr)
 	case "pi":
 		return piCommand(ctx, installation, runner, commandArgs, secretValues, stdout, stderr)
+	case "sessions":
+		if len(commandArgs) != 2 || commandArgs[0] != "migrate" || commandArgs[1] != "--yes" {
+			return commandUsageError(stderr, "sessions migrate requires --yes")
+		}
+		status, operationErr := serverops.MigrateSessions(ctx, installation, runner, true)
+		if operationErr != nil {
+			return serverOperationFailure(stderr, operationErr, secretValues)
+		}
+		if encodeErr := json.NewEncoder(stdout).Encode(status); encodeErr != nil {
+			fmt.Fprintln(stderr, "thothctl: migration status could not be written")
+			return 1
+		}
+		return 0
+	case "remove":
+		var confirmedIDs []string
+		if len(commandArgs) > 0 {
+			if commandArgs[0] != "--yes" || len(commandArgs) < 2 {
+				return commandUsageError(stderr, "remove requires either no arguments or --yes followed by every displayed container ID")
+			}
+			confirmedIDs = commandArgs[1:]
+		}
+		removal, operationErr := serverops.Remove(ctx, installation, runner, confirmedIDs)
+		writeRemovalTargets(stdout, installation.ProjectName(), removal.Targets)
+		if errors.Is(operationErr, serverops.ErrConfirmationRequired) {
+			fmt.Fprint(stderr, "thothctl: inspect the exact targets above, then re-run with remove --yes")
+			for _, target := range removal.Targets {
+				fmt.Fprintf(stderr, " %s", target.ID)
+			}
+			fmt.Fprintln(stderr)
+			return 2
+		}
+		if operationErr != nil {
+			return serverOperationFailure(stderr, operationErr, secretValues)
+		}
+		fmt.Fprintf(stdout, "Removed %d stopped app containers; verified %d preserved paths.\n", len(removal.Targets), removal.Preserved)
+		return 0
 	default:
 		return commandUsageError(stderr, fmt.Sprintf("unknown command %q", command))
 	}
 	return writeResult(result, err, secretValues, stdout, stderr)
 }
 
+func writeRemovalTargets(outputWriter io.Writer, project string, targets []serverops.Container) {
+	fmt.Fprintf(outputWriter, "Removal targets for installation project %s:\n", project)
+	if len(targets) == 0 {
+		fmt.Fprintln(outputWriter, "  (none)")
+		return
+	}
+	for _, target := range targets {
+		fmt.Fprintf(outputWriter, "  service=%s name=%s id=%s state=%s\n", target.Service, target.Name, target.ID, target.State)
+	}
+}
+
+func serverOperationFailure(stderr io.Writer, err error, secretValues []string) int {
+	fmt.Fprintf(stderr, "thothctl: %s\n", output.Sanitize(err.Error(), secretValues))
+	if errors.Is(err, serverops.ErrConfirmationRequired) || errors.Is(err, serverops.ErrUnsafeState) {
+		return 2
+	}
+	return 1
+}
+
 // installationRunner transforms only Compose invocations into the installation's validated,
 // profile-specific argument list. Direct Docker image commands remain host-side and use arguments.
 type installationRunner struct {