@crvouga/dev-fleet 0.0.0-stage → 0.1.0

package/ansible/ubuntu/tasks/user.yml

@@ -0,0 +1,120 @@
+---
+- name: Inspect existing designated-user sudo policy ownership
+  ansible.builtin.stat:
+    path: '/etc/sudoers.d/personal-fleet-{{ development_user }}'
+  register: sudo_owned_file
+- name: Read existing designated-user sudo policy for ownership validation
+  ansible.builtin.slurp:
+    src: '/etc/sudoers.d/personal-fleet-{{ development_user }}'
+  when: sudo_owned_file.stat.exists
+  register: sudo_previous
+  no_log: true
+- name: Preserve conflicting sudo policy until a reviewed migration
+  ansible.builtin.assert:
+    that:
+      - not sudo_owned_file.stat.islnk | default(false)
+      - "not sudo_owned_file.stat.exists or (sudo_previous.content | b64decode).startswith('# Managed by personal Fleet: designated development user')"
+    fail_msg: SUDOERS_OWNERSHIP_CONFLICT; preserve and review the existing fragment before adoption.
+- name: Validate and install designated-user sudo policy
+  ansible.builtin.copy:
+    dest: '/etc/sudoers.d/personal-fleet-{{ development_user }}'
+    content: |
+      # Managed by personal Fleet: designated development user
+      {{ development_user }} ALL=(ALL:ALL) NOPASSWD: ALL
+    owner: root
+    group: root
+    mode: '0440'
+    validate: /usr/sbin/visudo -cf %s
+    backup: true
+- name: Enable lingering without requiring an open desktop session
+  ansible.builtin.command:
+    argv: [loginctl, enable-linger, '{{ development_user }}']
+    creates: '/var/lib/systemd/linger/{{ development_user }}'
+- name: Check whether GNOME settings schemas are installed
+  ansible.builtin.stat:
+    path: /usr/share/glib-2.0/schemas/org.gnome.desktop.screensaver.gschema.xml
+  register: gnome_schema
+- name: Check whether the GNOME power plugin schema is installed
+  ansible.builtin.stat:
+    path: /usr/share/glib-2.0/schemas/org.gnome.settings-daemon.plugins.power.gschema.xml
+  register: gnome_power_schema
+- name: Ensure user configuration directory exists
+  ansible.builtin.file:
+    path: '{{ development_home }}/.config'
+    state: directory
+    owner: '{{ development_user }}'
+    mode: '0700'
+  when: gnome_schema.stat.exists
+- name: Inspect designated-user GNOME lock and idle policy
+  become: true
+  become_user: '{{ development_user }}'
+  ansible.builtin.command:
+    argv:
+      [
+        dbus-run-session,
+        '--',
+        gsettings,
+        get,
+        '{{ item.schema }}',
+        '{{ item.key }}',
+      ]
+  environment:
+    HOME: '{{ development_home }}'
+    XDG_CONFIG_HOME: '{{ development_home }}/.config'
+  loop: '{{ gnome_session_settings + (gnome_power_settings if gnome_power_schema.stat.exists else []) }}'
+  vars:
+    gnome_session_settings:
+      - {
+          schema: org.gnome.desktop.screensaver,
+          key: lock-enabled,
+          value: 'false',
+          observed: 'false',
+        }
+      - {
+          schema: org.gnome.desktop.session,
+          key: idle-delay,
+          value: '0',
+          observed: 'uint32 0',
+        }
+    gnome_power_settings:
+      - {
+          schema: org.gnome.settings-daemon.plugins.power,
+          key: sleep-inactive-ac-type,
+          value: 'nothing',
+          observed: "'nothing'",
+        }
+      - {
+          schema: org.gnome.settings-daemon.plugins.power,
+          key: sleep-inactive-battery-type,
+          value: 'nothing',
+          observed: "'nothing'",
+        }
+      - {
+          schema: org.gnome.settings-daemon.plugins.power,
+          key: idle-dim,
+          value: 'false',
+          observed: 'false',
+        }
+  when: gnome_schema.stat.exists
+  changed_when: false
+  register: gnome_settings
+- name: Repair only changed designated-user settings
+  become: true
+  become_user: '{{ development_user }}'
+  ansible.builtin.command:
+    argv:
+      [
+        dbus-run-session,
+        '--',
+        gsettings,
+        set,
+        '{{ item.item.schema }}',
+        '{{ item.item.key }}',
+        '{{ item.item.value }}',
+      ]
+  environment:
+    HOME: '{{ development_home }}'
+    XDG_CONFIG_HOME: '{{ development_home }}/.config'
+  loop: '{{ gnome_settings.results }}'
+  when: gnome_schema.stat.exists and item.stdout | default('') != item.item.observed
+  changed_when: true

package/bin/devfleet.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+// The npm entry point: `npx @crvouga/dev-fleet <command>`. The CLI is TypeScript
+// run by Bun, and Node refuses to run TypeScript from node_modules, so this
+// plain-JavaScript launcher hands the arguments to Bun and nothing else.
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import process from 'node:process';
+import { fileURLToPath, URL } from 'node:url';
+
+const cli = fileURLToPath(new URL('../src/cli/cli.ts', import.meta.url));
+
+/** The Bun this release pins (a dependency), then any Bun on PATH. The
+ * dependency's binary is a stub when its install script was skipped.
+ */
+function bunCandidates() {
+  const candidates = ['bun'];
+  try {
+    candidates.unshift(
+      createRequire(import.meta.url).resolve('bun/bin/bun.exe')
+    );
+  } catch {
+    // Not installed beside this package.
+  }
+  return candidates;
+}
+
+for (const bun of bunCandidates()) {
+  const child = spawnSync(bun, [cli, ...process.argv.slice(2)], {
+    stdio: 'inherit',
+  });
+  if (!child.error) process.exit(child.status ?? 1);
+}
+process.stderr.write(
+  'dev-fleet needs Bun and could not start it. Install it from https://bun.sh and retry.\n'
+);
+process.exit(127);

package/bootstrap/bootstrap.ps1

@@ -0,0 +1,50 @@
+# Native Windows, PowerShell 5.1+. Download and run this file (not a bash script).
+param([string]$WorkspaceDir = "$HOME\workspace")
+$ErrorActionPreference = 'Stop'
+$MiseVersion = '2026.10.24'
+function Invoke-Checked([string]$Program, [string[]]$Arguments) {
+  & $Program @Arguments
+  if ($LASTEXITCODE -ne 0) { throw "$Program failed with exit code $LASTEXITCODE" }
+}
+if (-not (Get-Command git -ErrorAction SilentlyContinue)) {
+  if (-not (Get-Command winget -ErrorAction SilentlyContinue)) {
+    throw 'Install Git for Windows (https://git-scm.com/download/win), reopen PowerShell and rerun. WinGet is available through Microsoft App Installer.'
+  }
+  Invoke-Checked winget @('install', '--id', 'Git.Git', '--exact', '--source', 'winget', '--accept-source-agreements', '--accept-package-agreements')
+  $env:Path = [Environment]::GetEnvironmentVariable('Path', 'Machine') + ';' + [Environment]::GetEnvironmentVariable('Path', 'User')
+  if (-not (Get-Command git -ErrorAction SilentlyContinue)) { throw 'Reopen PowerShell and rerun to pick up Git on PATH.' }
+}
+$LocalRoot = Join-Path $PSScriptRoot '..'
+if (Test-Path (Join-Path $LocalRoot 'mise.toml')) {
+  $WorkspaceDir = (Resolve-Path $LocalRoot).Path
+} else {
+  if (-not (Test-Path (Join-Path $WorkspaceDir '.git'))) {
+    Invoke-Checked git @('clone', 'https://github.com/crvouga/dev-fleet.git', $WorkspaceDir)
+  }
+  $Origin = & git -C $WorkspaceDir remote get-url origin
+  if ($LASTEXITCODE -ne 0 -or $Origin -ne 'https://github.com/crvouga/dev-fleet.git') { throw "Unexpected checkout at $WorkspaceDir; choose an empty -WorkspaceDir." }
+}
+# The baseline uses Windows x64; ARM machines can use an x64 PowerShell/process.
+if ($env:PROCESSOR_ARCHITECTURE -ne 'AMD64') { throw 'Use Windows x64 PowerShell. Native Windows ARM64 tool coverage is not yet validated.' }
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+$Temp = Join-Path ([IO.Path]::GetTempPath()) ([Guid]::NewGuid().ToString())
+New-Item -ItemType Directory -Path $Temp | Out-Null
+try {
+  $Asset = "mise-v$MiseVersion-windows-x64.zip"
+  $Base = "https://github.com/jdx/mise/releases/download/v$MiseVersion"
+  Invoke-WebRequest "$Base/$Asset" -OutFile "$Temp\$Asset" -UseBasicParsing
+  Invoke-WebRequest "$Base/SHASUMS256.txt" -OutFile "$Temp\SHASUMS256.txt" -UseBasicParsing
+  $Line = Get-Content "$Temp\SHASUMS256.txt" | Where-Object { $_ -match ('\s+\./' + [regex]::Escape($Asset) + '$') }
+  if (-not $Line) { throw 'Missing mise checksum.' }
+  $Expected = ($Line -split '\s+')[0]
+  if ((Get-FileHash "$Temp\$Asset" -Algorithm SHA256).Hash -ne $Expected) { throw 'mise checksum mismatch.' }
+  Expand-Archive "$Temp\$Asset" -DestinationPath $Temp
+  $Bin = "$HOME\.local\bin"
+  New-Item -ItemType Directory -Force -Path $Bin | Out-Null
+  Copy-Item "$Temp\mise\bin\*.exe" $Bin -Force
+  $env:Path = "$Bin;$env:Path"
+  Set-Location $WorkspaceDir
+  Invoke-Checked mise @('trust', $WorkspaceDir)
+  Invoke-Checked mise @('install', '--locked', 'bun')
+  Invoke-Checked mise @('exec', '--locked', 'bun', '--', 'bun', 'bootstrap/setup.ts')
+} finally { Remove-Item $Temp -Recurse -Force }

package/bootstrap/bootstrap.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# Download to a file and run with bash; also works directly from a checkout.
+set -euo pipefail
+MISE_VERSION=2026.10.24
+repo=https://github.com/crvouga/dev-fleet.git
+os=$(uname -s)
+case "$os" in
+  Darwin) platform=macos ;;
+  Linux) platform=linux ;;
+  *) echo 'Use bootstrap.ps1 for native Windows.' >&2; exit 1 ;;
+esac
+case "$(uname -m)" in
+  arm64|aarch64) arch=arm64 ;;
+  x86_64|amd64) arch=x64 ;;
+  *) echo 'Supported: x64 and arm64.' >&2; exit 1 ;;
+esac
+# Git, TLS roots and extraction are OS prerequisites, outside the mise lock.
+if ! git --version >/dev/null 2>&1; then
+  case "$os" in
+    Darwin)
+      xcode-select --install || true
+      echo 'Finish installing Apple Command Line Tools, then rerun this script.' >&2
+      exit 1 ;;
+    Linux)
+      if command -v apt-get >/dev/null; then
+        sudo apt-get update
+        sudo apt-get install -y git curl ca-certificates unzip xz-utils build-essential
+      elif command -v dnf >/dev/null; then
+        sudo dnf install -y git curl ca-certificates unzip xz gcc gcc-c++ make
+      else
+        echo 'Install git, curl, CA certificates, unzip, xz and a C/C++ toolchain, then rerun.' >&2
+        exit 1
+      fi ;;
+  esac
+fi
+for tool in curl tar unzip; do
+  command -v "$tool" >/dev/null || { echo "Install $tool, then rerun." >&2; exit 1; }
+done
+script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+if [[ -f "$script_dir/../mise.toml" ]]; then
+  checkout=$(cd "$script_dir/.." && pwd)
+else
+  checkout=${WORKSPACE_DIR:-"$HOME/workspace"}
+  if [[ ! -d "$checkout/.git" ]]; then git clone "$repo" "$checkout"; fi
+  [[ "$(git -C "$checkout" remote get-url origin)" == "$repo" ]] || {
+    echo "Unexpected checkout at $checkout; choose an empty WORKSPACE_DIR." >&2; exit 1;
+  }
+fi
+cd "$checkout"
+# Reuse an observed matching managed executable. Repeated reconciliation must
+# not download/reinstall mise solely because a previous run finished.
+installed_mise=$("$HOME/.local/bin/mise" --version 2>/dev/null | awk '{print $1}') || installed_mise=''
+if [[ "$installed_mise" != "$MISE_VERSION" ]]; then
+temp=$(mktemp -d)
+trap 'rm -rf "$temp"' EXIT
+asset="mise-v${MISE_VERSION}-${platform}-${arch}.tar.gz"
+# Alpine/musl is not part of the supported workstation baseline.
+base="https://github.com/jdx/mise/releases/download/v${MISE_VERSION}"
+curl -fsSL "$base/$asset" -o "$temp/$asset"
+curl -fsSL "$base/SHASUMS256.txt" -o "$temp/SHASUMS256.txt"
+(cd "$temp"; awk -v file="./$asset" '$2 == file { print }' SHASUMS256.txt > check.txt
+  test -s check.txt
+  if command -v sha256sum >/dev/null; then sha256sum -c check.txt; else shasum -a 256 -c check.txt; fi)
+tar -xzf "$temp/$asset" -C "$temp"
+mkdir -p "$HOME/.local/bin"
+install -m 0755 "$temp/mise/bin/mise" "$HOME/.local/bin/mise"
+fi
+export PATH="$HOME/.local/bin:$PATH"
+# Trust the checkout directory, not only its file, so `mise trust --show` there
+# reports trusted.
+mise trust "$checkout"
+mise install --locked bun
+mise exec --locked bun -- bun bootstrap/setup.ts "$@"

package/bootstrap/devfleet

@@ -0,0 +1,7 @@
+#!/bin/sh
+# The devfleet command. ~/.local/bin/devfleet links here; nothing is copied.
+set -eu
+self=$(readlink -f "$0")
+root=$(cd "$(dirname "$self")/.." && pwd)
+export PATH="$HOME/.local/bin:$HOME/.local/share/mise/shims:$PATH"
+exec bun "$root/src/cli/cli.ts" "$@"

package/bootstrap/docker-desktop.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Private macOS workstation installer; invoke with dev-fleet tools docker-setup.
+set -euo pipefail
+cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.."
+case "$(uname -s)/$(uname -m)" in
+Darwin/arm64) docker_arch=arm64 ;;
+Darwin/x86_64) docker_arch=amd64 ;;
+*)
+  echo 'Docker Desktop setup is supported here only on macOS.' >&2
+  exit 2
+  ;;
+esac
+if [[ ! -d /Applications/Docker.app ]]; then
+  read -r docker_build docker_hash < <(mise exec -- bun -e '
+    const {vars}=Bun.TOML.parse(await Bun.file("mise.toml").text());
+    console.log(vars.docker_desktop_build,vars["docker_desktop_"+process.argv[1]+"_sha256"]);
+  ' "$docker_arch")
+  [[ "$docker_build" =~ ^[0-9]+$ && "$docker_hash" =~ ^[a-f0-9]{64}$ ]]
+  docker_cache="${XDG_CACHE_HOME:-$HOME/.cache}/personal/docker-desktop/$docker_build/$docker_arch"
+  mkdir -p "$docker_cache"
+  docker_image="$docker_cache/Docker.dmg"
+  if ! echo "$docker_hash  $docker_image" | shasum -a 256 -c - >/dev/null 2>&1; then
+    curl --fail --location --retry 3 "https://desktop.docker.com/mac/main/$docker_arch/$docker_build/Docker.dmg" -o "$docker_image"
+  fi
+  echo "$docker_hash  $docker_image" | shasum -a 256 -c -
+  docker_mount=$(mktemp -d)
+  trap 'hdiutil detach "$docker_mount" >/dev/null 2>&1 || true; rmdir "$docker_mount" 2>/dev/null || true' EXIT
+  hdiutil attach "$docker_image" -nobrowse -mountpoint "$docker_mount"
+  codesign --verify --deep --strict "$docker_mount/Docker.app"
+  ditto "$docker_mount/Docker.app" /Applications/Docker.app
+fi
+open -a /Applications/Docker.app
+printf '%s\n' 'Docker Desktop opened. Complete any first-run agreement/setup in the app, then rerun dev-fleet tools check --docker.'

package/bootstrap/doctor.ts

@@ -0,0 +1,189 @@
+import { workerTools } from './worker-tools';
+/** Read-only toolchain checks; no logins, installations or changes to Docker. */
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir, tmpdir } from 'node:os';
+import { AGENT_WORKTREE_ROOTS, workspaceRoot } from './global-config';
+
+type Tool = string | { version: string; lazy?: boolean; os?: string[] };
+type Config = {
+  tools: Record<string, Tool>;
+  vars?: { worker_tools?: unknown };
+};
+export type Check = {
+  id: string;
+  status: 'pass' | 'warn' | 'fail';
+  detail: string;
+};
+export type Runner = (command: string[]) => { ok: boolean; output: string };
+const COMMANDS: Record<string, string> = {
+  'npm:@yarnpkg/cli-dist': 'yarn',
+  'npm:vercel': 'vercel',
+  'npm:wrangler': 'wrangler',
+  'aqua:anomalyco/opencode': 'opencode',
+  'docker-cli': 'docker',
+  opentofu: 'tofu',
+  ripgrep: 'rg',
+  rust: 'rustc',
+  'npm:@devcontainers/cli': 'devcontainer',
+  'http:grok': 'grok',
+  'http:antigravity': 'antigravity',
+};
+const VERSION_ARGS: Record<string, string[]> = {
+  go: ['version'],
+  gitleaks: ['version'],
+  kubectl: ['version', '--client=true', '--output=json'],
+  helm: ['version', '--short'],
+};
+const run: Runner = (command) => {
+  const result = spawnSync(command[0]!, command.slice(1), {
+    encoding: 'utf8',
+    timeout: 30_000,
+    windowsHide: true,
+    cwd: tmpdir(),
+  });
+  return {
+    ok: result.status === 0,
+    output: `${result.stdout ?? ''}${result.stderr ?? ''}`.trim(),
+  };
+};
+
+/** mise's `os` names for the platforms it installs a tool on. */
+const MISE_OS: Record<string, string> = {
+  darwin: 'macos',
+  linux: 'linux',
+  win32: 'windows',
+};
+/** Installed on Windows by a native installer (native-aws.ts), not by mise. */
+const NATIVE_WINDOWS = new Set(['aws']);
+
+function unavailable(id: string, tool: Tool, platform: string): boolean {
+  if (typeof tool === 'string' || !tool.os) return false;
+  if (platform === 'win32' && NATIVE_WINDOWS.has(id)) return false;
+  return !tool.os.includes(MISE_OS[platform] ?? platform);
+}
+
+export function toolChecks(
+  tools: Record<string, Tool>,
+  execute: Runner = run,
+  platform: string = process.platform
+): Check[] {
+  const checks: Check[] = [];
+  for (const [id, tool] of Object.entries(tools)) {
+    if (typeof tool !== 'string' && tool.lazy) continue;
+    // A tool pinned only for other platforms has no artifact to verify here.
+    if (unavailable(id, tool, platform)) continue;
+    const version = typeof tool === 'string' ? tool : tool.version;
+    const command = COMMANDS[id] ?? id;
+    const result = execute([command, ...(VERSION_ARGS[id] ?? ['--version'])]);
+    const exact = new RegExp(
+      `(?:^|[^0-9])${version.replaceAll('.', '\\.')}($|(?![0-9]|\\.[0-9]))`
+    );
+    const matches = result.ok && exact.test(result.output);
+    checks.push({
+      id,
+      status: matches ? 'pass' : 'fail',
+      detail: matches
+        ? version
+        : `Expected ${command} ${version}; run dev-fleet tools sync and reopen the shell. Check for competing PATH entries.`,
+    });
+  }
+  for (const command of ['git', 'npm']) {
+    const result = execute([command, '--version']);
+    checks.push({
+      id: command,
+      status: result.ok ? 'pass' : 'fail',
+      detail: result.ok
+        ? result.output
+        : `Missing ${command}; rerun the OS bootstrap.`,
+    });
+  }
+  return checks;
+}
+
+export function dockerChecks(
+  required: boolean,
+  execute: Runner = run
+): Check[] {
+  return [
+    ['docker-engine', ['docker', 'info', '--format', '{{.ServerVersion}}']],
+    ['docker-compose', ['docker', 'compose', 'version']],
+    ['docker-buildx', ['docker', 'buildx', 'version']],
+  ].map(([id, command]) => {
+    const result = execute(command as string[]);
+    return {
+      id: id as string,
+      status: result.ok ? 'pass' : required ? 'fail' : 'warn',
+      detail: result.ok
+        ? result.output
+        : 'Install/start Docker Desktop or Docker Engine with Compose + Buildx. See docs/machine-setup.md.',
+    };
+  });
+}
+
+/** Agent worktree roots must be trusted, or every mise shim fails there. */
+export function worktreeTrustCheck(
+  execute: Runner = run,
+  home: string = homedir()
+): Check {
+  const expand = (path: string) =>
+    path === '~' || path.startsWith('~/') ? home + path.slice(1) : path;
+  const result = execute(['mise', 'settings', 'get', 'trusted_config_paths']);
+  let trusted: string[] = [];
+  try {
+    const parsed: unknown = result.ok ? JSON.parse(result.output) : [];
+    if (Array.isArray(parsed))
+      trusted = parsed.filter((p): p is string => typeof p === 'string');
+  } catch {
+    trusted = [];
+  }
+  const have = new Set(trusted.map(expand));
+  const missing = AGENT_WORKTREE_ROOTS.filter(
+    (root) => !have.has(expand(root))
+  );
+  return {
+    id: 'agent-worktree-trust',
+    status: missing.length ? 'fail' : 'pass',
+    detail: missing.length
+      ? `mise does not trust ${missing.join(', ')}; agent CLIs fail in new worktrees there. Run dev-fleet tools sync.`
+      : AGENT_WORKTREE_ROOTS.join(', '),
+  };
+}
+
+export function checkMachine(requireDocker = false, worker = false): Check[] {
+  const config = Bun.TOML.parse(
+    readFileSync(join(workspaceRoot, 'mise.toml'), 'utf8')
+  ) as Config;
+  const auth = run(['gh', 'auth', 'status']);
+  return [
+    ...toolChecks(
+      worker
+        ? workerTools(config.tools, config.vars?.worker_tools)
+        : config.tools
+    ),
+    ...dockerChecks(requireDocker),
+    worktreeTrustCheck(),
+    {
+      id: 'github-auth',
+      status: auth.ok ? 'pass' : 'warn',
+      detail: auth.ok
+        ? 'Authenticated'
+        : 'Run gh auth login, then gh auth setup-git.',
+    },
+  ];
+}
+
+if (import.meta.main) {
+  const checks = checkMachine(
+    process.argv.includes('--docker'),
+    process.argv.includes('--worker')
+  );
+  const ok = checks.every((check) => check.status !== 'fail');
+  if (process.argv.includes('--json'))
+    console.log(JSON.stringify({ ok, checks }, null, 2));
+  else
+    for (const check of checks)
+      console.log(`${check.status.toUpperCase()} ${check.id}: ${check.detail}`);
+  process.exitCode = ok ? 0 : 1;
+}

package/bootstrap/fleet-manager-run.sh

@@ -0,0 +1,76 @@
+#!/bin/sh
+# Every fleet-sync on the manager runs through this, whether started there or
+# handed off from a worker over strict SSH. Runs fleet-sync from a clean,
+# fleet-owned checkout of the exact approved revision, so the result never
+# depends on the working tree it was started in (uncommitted edits, another
+# branch, a removed worktree). Checkouts are reused when warm and pruned to the
+# three most recent plus the one T3's providers launch from. Never touches the
+# human's working tree.
+set -eu
+revision=$1
+shift
+case "$revision" in *[!a-f0-9]*|'') exit 2;; esac
+[ "${#revision}" = 40 ] || exit 2
+say() { printf 'fleet-sync (manager): %s\n' "$1" >&2; }
+# The dev-fleet clone to take the revision from: named by the caller, or the
+# one the devfleet launcher is linked into.
+repo=${DEVFLEET_REPO:-}
+if [ -z "$repo" ]; then
+  launcher=$(command -v devfleet) || { say 'set DEVFLEET_REPO to a dev-fleet clone, or install the launcher with sh bootstrap/install-launcher.sh.'; exit 3; }
+  repo=$(dirname "$(readlink -f "$launcher")")
+fi
+repo=$(git -C "$repo" rev-parse --show-toplevel) || { say 'cannot locate the dev-fleet clone on the manager.'; exit 3; }
+runs="$HOME/.local/share/personal/fleet/manager-runs"
+dir="$runs/$revision"
+ready() {
+  [ "$(git -C "$dir" rev-parse HEAD 2>/dev/null)" = "$revision" ] &&
+    [ -z "$(git -C "$dir" status --porcelain 2>/dev/null)" ]
+}
+if ! ready; then
+  git -C "$repo" cat-file -e "$revision^{commit}" 2>/dev/null || git -C "$repo" fetch --quiet origin || true
+  git -C "$repo" cat-file -e "$revision^{commit}" 2>/dev/null || { say "revision $revision is neither on the manager nor on origin; push it first."; exit 4; }
+  mkdir -p "$runs"
+  chmod 700 "$runs"
+  # A fleet-owned, disposable run checkout: recreate it when stale or dirty.
+  if [ -e "$dir" ]; then git -C "$repo" worktree remove --force "$dir" 2>/dev/null || rm -rf -- "$dir"; fi
+  git -C "$repo" worktree prune
+  git -C "$repo" worktree add --quiet --detach "$dir" "$revision"
+fi
+touch "$dir"
+cd "$dir"
+mise trust --quiet "$dir" >/dev/null 2>&1 || true
+# The manager runs the same locked toolchain (and so the same agent versions)
+# as every worker: publish this revision's global config, install it and the
+# frozen dependencies. Warm: the toolchain is skipped when the same inputs
+# (tool pins, locks, setup code) were installed within a day, so a revision
+# that changes none of them only installs its own dependencies.
+# Stamp and log sit beside the checkout: inside it they would make it dirty.
+stamp="$runs/toolchain-ready"
+log="$runs/$revision.setup.log"
+key=$(git rev-parse HEAD:mise.toml HEAD:mise.lock HEAD:.mise HEAD:bun.lock HEAD:package.json HEAD:bootstrap 2>/dev/null | tr '\n' ' ')
+[ -n "$key" ] || key=$revision
+failed() {
+  tail -n 20 "$log" >&2
+  say "toolchain or dependency install failed in the run checkout; full log: $log"
+  exit 5
+}
+if [ "$(cat "$stamp" 2>/dev/null)" != "$key" ] || [ -z "$(find "$stamp" -mmin -1440 2>/dev/null)" ]; then
+  rm -f -- "$stamp"
+  mise exec --locked bun -- bun bootstrap/setup.ts --tools-only >"$log" 2>&1 || failed
+  printf '%s' "$key" >"$stamp"
+fi
+if [ ! -d node_modules ]; then
+  mise exec --locked bun -- bun install --frozen-lockfile --silent >>"$log" 2>&1 || failed
+fi
+# Keep the three most recent run checkouts (names are commit SHAs) and the
+# applied one: fleet/current points at it and T3's providers launch from there.
+applied=$(basename "$(readlink "$(dirname "$runs")/current" 2>/dev/null || true)")
+# shellcheck disable=SC2012
+for old in $(ls -1td "$runs"/*/ | tail -n +4); do
+  [ "$(basename "$old")" != "$applied" ] || continue
+  git -C "$repo" worktree remove --force "$old" 2>/dev/null || true
+  rm -f -- "${old%/}.setup.log"
+done
+git -C "$repo" worktree prune
+export PERSONAL_WORKSPACE="$dir" PERSONAL_FLEET_RUN_CHECKOUT="$revision"
+exec mise exec --locked bun -- bun src/cli/cli.ts fleet-sync --revision "$revision" "$@"