@crvouga/dev-fleet 0.1.0 → 0.2.0

package/src/monitoring/hub-backup.ts

@@ -0,0 +1,121 @@
+import { record } from '../config';
+import type { Check } from '../types';
+import {
+  LOCAL_HUB,
+  api,
+  superuserToken,
+  type HubLogin,
+  type Session,
+} from './hub-viewer';
+
+/** A scheduled backup older than this means the schedule is not running. */
+export const BACKUP_MAX_AGE_MS = 48 * 60 * 60 * 1000;
+
+function backupCheck(
+  status: Check['status'],
+  summary: string,
+  action?: string
+): Check {
+  return {
+    id: 'beszel:backup',
+    status,
+    summary,
+    ...(action ? { remedy: { action } } : {}),
+  };
+}
+
+const SETTINGS =
+  'Open the hub as its superuser (/_/ on the manager), Settings > Backups.';
+
+/** Reads, never changes, the hub's own backup settings and its list of
+ * backups through the stock PocketBase API of the pinned release (superuser
+ * only: GET /api/settings and GET /api/backups). Backups are configured in
+ * the hub's UI; this says whether they are scheduled, kept off the manager
+ * and recent. Storage names, keys and endpoints are never reported.
+ */
+export async function verifyHubBackups(
+  login: HubLogin | null,
+  fetcher: typeof fetch = fetch,
+  base: string = LOCAL_HUB,
+  now: number = Date.now()
+): Promise<Check> {
+  if (!login)
+    return backupCheck(
+      'skip',
+      'BESZEL_BACKUP_UNVERIFIED',
+      "The fleet admin login is unavailable, so the hub's backups were not read. Log the manager's Vault session in and rerun fleet-sync."
+    );
+  let settings: unknown;
+  let backups: unknown;
+  try {
+    const anonymous: Session = { fetcher, base, token: '' };
+    const session = {
+      ...anonymous,
+      token: await superuserToken(anonymous, login),
+    };
+    settings = await api(session, 'GET', '/api/settings');
+    backups = await api(session, 'GET', '/api/backups');
+  } catch {
+    return backupCheck(
+      'warn',
+      'BESZEL_BACKUP_UNVERIFIED',
+      `The hub's backup settings could not be read with the fleet admin login. ${SETTINGS} Details are withheld.`
+    );
+  }
+  const policy = backupPolicy(settings);
+  if (!policy || !Array.isArray(backups))
+    return backupCheck(
+      'warn',
+      'BESZEL_BACKUP_UNVERIFIED',
+      `The hub answered in a form this release does not expect. ${SETTINGS}`
+    );
+  if (!policy.cron)
+    return backupCheck(
+      'warn',
+      'BESZEL_BACKUP_UNSCHEDULED',
+      `The hub takes no scheduled backups, so its history, settings and machine identities are lost with the manager. ${SETTINGS} Set a schedule and how many to keep.`
+    );
+  if (!policy.offHost)
+    return backupCheck(
+      'warn',
+      'BESZEL_BACKUP_OFFHOST_REQUIRED',
+      `Scheduled backups stay on the manager's disk, which is not disaster recovery. ${SETTINGS} Store them in existing encrypted S3-compatible storage you already approved; do not create new storage or reuse unrelated credentials.`
+    );
+  const newest = newestBackup(backups);
+  if (newest === null || now - newest > BACKUP_MAX_AGE_MS)
+    return backupCheck(
+      'warn',
+      'BESZEL_BACKUP_STALE',
+      `No backup newer than ${BACKUP_MAX_AGE_MS / 3_600_000} hours is listed although a schedule is set. ${SETTINGS} Check the schedule and the storage's credentials, then create a backup by hand.`
+    );
+  return backupCheck(
+    'pass',
+    `Scheduled backups go to off-host storage, keeping ${policy.keep}; the newest is from ${new Date(newest).toISOString()}.`
+  );
+}
+
+function backupPolicy(
+  settings: unknown
+): { cron: string; keep: number; offHost: boolean } | null {
+  if (!record(settings) || !record(settings['backups'])) return null;
+  const backups = settings['backups'];
+  const s3 = record(backups['s3']) ? backups['s3'] : {};
+  return {
+    cron: typeof backups['cron'] === 'string' ? backups['cron'].trim() : '',
+    keep:
+      typeof backups['cronMaxKeep'] === 'number' ? backups['cronMaxKeep'] : 0,
+    offHost: s3['enabled'] === true,
+  };
+}
+
+/** PocketBase lists `modified` as "2006-01-02 15:04:05.000Z". */
+function newestBackup(backups: unknown[]): number | null {
+  const times = backups
+    .map((entry) =>
+      record(entry) && typeof entry['modified'] === 'string'
+        ? Date.parse(entry['modified'].replace(' ', 'T'))
+        : NaN
+    )
+    .filter(Number.isFinite);
+  return times.length ? Math.max(...times) : null;
+}

package/src/monitoring/hub-viewer.ts

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { record } from '../config';
 import type { Check } from '../types';
-import { BESZEL_PUBLIC_VIEWER_IDENTITY } from './hub-access';
+import { publicViewerIdentity } from './hub-access';
 
 /** Loopback address of the hub container on the manager. */
 export const LOCAL_HUB = 'http://127.0.0.1:8090';
@@ -25,13 +25,13 @@ function viewerCheck(
   };
 }
 
-interface Session {
+export interface Session {
   fetcher: Fetcher;
   base: string;
   token: string;
 }
 
-async function api(
+export async function api(
   session: Session,
   method: string,
   path: string,
@@ -52,7 +52,7 @@ async function api(
   return response.json() as Promise<unknown>;
 }
 
-async function superuserToken(
+export async function superuserToken(
   session: Session,
   login: HubLogin
 ): Promise<string> {
@@ -70,7 +70,7 @@ async function superuserToken(
 async function findViewer(
   session: Session
 ): Promise<{ id: string; role: unknown } | null> {
-  const filter = encodeURIComponent(`email="${BESZEL_PUBLIC_VIEWER_IDENTITY}"`);
+  const filter = encodeURIComponent(`email="${publicViewerIdentity()}"`);
   const list = await api(
     session,
     'GET',
@@ -86,7 +86,7 @@ async function findViewer(
 async function createViewer(session: Session): Promise<void> {
   const password = randomBytes(24).toString('base64url');
   await api(session, 'POST', '/api/collections/users/records', {
-    email: BESZEL_PUBLIC_VIEWER_IDENTITY,
+    email: publicViewerIdentity(),
     username: 'public-viewer',
     password,
     passwordConfirm: password,
@@ -130,13 +130,13 @@ export async function ensurePublicViewer(
     if (verified?.role !== 'readonly') throw new Error('BESZEL_VIEWER_ROLE');
     return viewerCheck(
       'pass',
-      `Visitors are signed in automatically as ${BESZEL_PUBLIC_VIEWER_IDENTITY} (read-only).`
+      `Visitors are signed in automatically as ${publicViewerIdentity()} (read-only).`
     );
   } catch {
     return viewerCheck(
       'warn',
       'BESZEL_VIEWER_UNVERIFIED',
-      `Could not create or verify the read-only ${BESZEL_PUBLIC_VIEWER_IDENTITY} user with the fleet admin login. Create it in the hub (Settings > Users, role Read-only); never make it an admin. Details are withheld.`
+      `Could not create or verify the read-only ${publicViewerIdentity()} user with the fleet admin login. Create it in the hub (Settings > Users, role Read-only); never make it an admin. Details are withheld.`
     );
   }
 }

package/src/monitoring/hub.ts

@@ -1,6 +1,6 @@
 import { record } from '../config';
 import type { Check, Runner } from '../types';
-import { PUBLIC_HUB_URL } from './beszel';
+import { publicHubUrl } from './beszel';
 import { secretVia } from '../fleet-config';
 
 /** Shared Beszel hub helpers. The hub runs only on the manager; see
@@ -11,14 +11,14 @@ export function publicEndpointCheck(connected: boolean): Check {
     ? {
         id: 'beszel:public-endpoint',
         status: 'pass',
-        summary: `Cloudflare connector for ${PUBLIC_HUB_URL} was started from the Vault credential.`,
+        summary: `Cloudflare connector for ${publicHubUrl()} was started from the Vault credential.`,
       }
     : {
         id: 'beszel:public-endpoint',
         status: 'warn',
         summary: 'BESZEL_TUNNEL_CREDENTIAL_UNAVAILABLE',
         remedy: {
-          action: `Create the Cloudflare tunnel and store its token in the fleet's secrets, then log the manager's Vault session in with read access to secret/beszel/tunnel and rerun fleet-sync. The private dashboard is unaffected; ${PUBLIC_HUB_URL} stays offline until then.`,
+          action: `Create the Cloudflare tunnel and store its token in the fleet's secrets, then log the manager's Vault session in with read access to secret/beszel/tunnel and rerun fleet-sync. The private dashboard is unaffected; ${publicHubUrl()} stays offline until then.`,
         },
       };
 }

package/src/monitoring/manager-hub.ts

@@ -1,19 +1,23 @@
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { delimiter, join, resolve } from 'node:path';
+import { runAnsible } from '../platform/ansible';
 import { runAnsibleWithReceipt } from '../platform/ansible-receipt';
 import { failure, inspectRoute, publicEndpointCheck, tunnelToken } from './hub';
-import { BESZEL_PUBLIC_VIEWER_IDENTITY, fleetAccount } from './hub-access';
+import { publicViewerIdentity, fleetAccount } from './hub-access';
 import { ensurePublicViewer, type HubLogin } from './hub-viewer';
+import { verifyHubBackups } from './hub-backup';
 import type { FleetDefinition } from '../definition';
 import { hostId, hubUrl } from '../topology';
-import { PUBLIC_HUB_URL, privateHub } from './beszel';
+import { publicHubUrl, privateHub } from './beszel';
 import type { Check, Runner } from '../types';
 
 /** Bundled CLI of the Tailscale macOS app when no `tailscale` is on PATH. */
 export const TAILSCALE_APP_CLI =
   '/Applications/Tailscale.app/Contents/MacOS/Tailscale';
 const LOCAL_HUB = 'http://127.0.0.1:8090';
+/** The one place the route is declared; `hub-route-darwin.yml` receives it. */
+export const HUB_ROUTE = { port: '8443', proxy: LOCAL_HUB };
 
 /** Per-user hub paths on the manager. Data stays in the human's home (and its
  * normal backups); it is never copied to a worker.
@@ -52,12 +56,15 @@ export interface ManagerHubOptions {
   receipts?: string;
   /** Ensures the read-only AUTO_LOGIN user; defaults to the loopback hub API. */
   viewer?: (login: HubLogin | null) => Promise<Check>;
+  /** Reads the hub's backup settings; defaults to the loopback hub API. */
+  backups?: (login: HubLogin | null) => Promise<Check>;
 }
 
 /** Converges the singleton Beszel hub locally on the manager: pinned Compose
  * under Docker Desktop, the connector token from the manager's own Vault
  * session (private variables file, never argv or output), a private Tailscale
- * Serve route, then independent health checks locally and over the tailnet.
+ * Serve route (its own playbook), then independent health checks locally and
+ * over the tailnet.
  */
 export async function convergeManagerHub(
   root: string,
@@ -105,7 +112,7 @@ export async function convergeManagerHub(
       'Inspect Docker Desktop, the Compose image, file sharing for ~/Library/Application Support and disk space. Existing data is never deleted.'
     );
   const route = await servePrivateRoute(
-    hub,
+    { hub, monitoring },
     run,
     options.tailscale === undefined ? tailscaleCommand() : options.tailscale
   );
@@ -120,6 +127,7 @@ export async function convergeManagerHub(
     },
     publicEndpointCheck(tunnel !== null),
     await ensureViewer(options, account),
+    await (options.backups ?? verifyHubBackups)(account),
   ];
 }
 
@@ -131,8 +139,8 @@ function hubVariables(
 ): Record<string, string> {
   return {
     beszel_hub_url: hub,
-    beszel_public_url: PUBLIC_HUB_URL,
-    beszel_auto_login: BESZEL_PUBLIC_VIEWER_IDENTITY,
+    beszel_public_url: publicHubUrl(),
+    beszel_auto_login: publicViewerIdentity(),
     beszel_data_dir: paths.data,
     beszel_tunnel_dir: paths.tunnel,
     ...(tunnel ? { beszel_tunnel_token: tunnel } : {}),
@@ -175,8 +183,11 @@ async function preconditions(
   return null;
 }
 
+/** `hub-route-darwin.yml` publishes the route when its port has no owner; this
+ * refuses a conflicting owner beforehand and measures the result.
+ */
 async function servePrivateRoute(
-  hub: string,
+  { hub, monitoring }: { hub: string; monitoring: string },
   run: Runner,
   cli: string | null
 ): Promise<Check[] | null> {
@@ -191,21 +202,26 @@ async function servePrivateRoute(
       'BESZEL_PRIVATE_ROUTE_UNVERIFIED',
       'Inspect Tailscale Serve permission and existing private routes before retry.'
     );
-  const route = inspectRoute(status.stdout, hub);
+  const route = inspectRoute(status.stdout, hub, HUB_ROUTE);
   if (Array.isArray(route)) return route;
   if (!route) {
-    const serve = [cli, 'serve', '--bg', '--https=8443', LOCAL_HUB] as const;
-    const applied =
-      (await run([...serve], { timeoutMs: 20_000 })).ok ||
-      (await run(['sudo', '-n', ...serve], { timeoutMs: 20_000 })).ok;
-    if (!applied)
+    const published = await runAnsible(run, 'hub-route-darwin.yml', {
+      cwd: monitoring,
+      input: JSON.stringify({
+        beszel_tailscale_cli: cli,
+        beszel_route_port: HUB_ROUTE.port,
+        beszel_route_target: HUB_ROUTE.proxy,
+      }),
+      timeoutMs: 120_000,
+    });
+    if (!published.ok)
       return failure(
         'BESZEL_PRIVATE_ROUTE_REQUIRED',
         'Allow Tailscale Serve (HTTPS certificates) for this tailnet and approve it in the Tailscale app if asked; no tailnet policy or public ingress is changed.'
       );
   }
   const verified = await run([cli, 'serve', 'status', '--json']);
-  if (!verified.ok || inspectRoute(verified.stdout, hub) !== true)
+  if (!verified.ok || inspectRoute(verified.stdout, hub, HUB_ROUTE) !== true)
     return failure(
       'BESZEL_PRIVATE_ROUTE_UNVERIFIED',
       'The requested route was not independently observed after application. Inspect Serve permissions and configuration; installer success is insufficient.'

package/src/node-converge-linux.ts

@@ -78,6 +78,8 @@ export async function convergeLinux(
     ...(await attempt('agent:verification', () =>
       verifyNativeAgents(node, root, run, {
         outOfQuota: quotaLimited(providers),
+        // Where T3 starts them: the environment of its user service.
+        t3Service: true,
       })
     ))
   );

package/src/package-info.ts

@@ -0,0 +1,45 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/** Where this code's own files live: the published package, or a checkout. */
+export const PACKAGE_ROOT = fileURLToPath(new URL('..', import.meta.url));
+
+export interface PackageInfo {
+  name: string;
+  version: string;
+  /** The commit this package was published from; null in a checkout. */
+  revision: string | null;
+  /** Where a defect or a feature request is raised (`bugs` in the manifest). */
+  issues: string | null;
+}
+
+function issueTracker(bugs: unknown): string | null {
+  const url =
+    typeof bugs === 'object' && bugs !== null
+      ? (bugs as { url?: unknown }).url
+      : bugs;
+  return typeof url === 'string' && /^https:\/\/\S+$/.test(url) ? url : null;
+}
+
+/** What the running package says about itself. The release workflow stamps
+ * the version and the commit (`gitHead`) into the package it publishes, so an
+ * installed dev-fleet knows which revision every machine has to run. A
+ * checkout carries neither: its revision is its own HEAD. The issue tracker
+ * comes from the manifest too, so a fork sends its users to its own.
+ */
+export function packageInfo(root = PACKAGE_ROOT): PackageInfo {
+  const manifest = JSON.parse(
+    readFileSync(join(root, 'package.json'), 'utf8')
+  ) as { name?: unknown; version?: unknown; gitHead?: unknown; bugs?: unknown };
+  const { gitHead } = manifest;
+  return {
+    name: String(manifest.name),
+    version: String(manifest.version),
+    revision:
+      typeof gitHead === 'string' && /^[a-f0-9]{40}$/.test(gitHead)
+        ? gitHead
+        : null,
+    issues: issueTracker(manifest.bugs),
+  };
+}

package/src/platform/ansible.ts

@@ -1,27 +1,31 @@
 import { mkdir, mkdtemp, writeFile, rm } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
-import { delimiter, join } from 'node:path';
+import { join } from 'node:path';
 import { homedir } from 'node:os';
-import macos from '../../ansible/macos/policy.json';
+import { PACKAGE_ROOT } from '../package-info';
 import type { Runner, CommandOptions, CommandResult } from '../types';
 
-/** Ubuntu provides ansible-core through APT; macOS runs the pinned release through
- * uv's isolated tool runner so no global Python environment is modified.
+/** The Ansible each machine runs playbooks with, pinned either way. A worker
+ * has the exact `ansible-core` package the Ubuntu policy names. The manager
+ * runs the project in `ansible/` (`pyproject.toml`, `uv.lock`): one release on
+ * one Python, every dependency checked against its locked hash, in a
+ * throwaway environment. No global Python environment is modified, nothing is
+ * written into the checkout, and an `ansible-playbook` that happens to be on
+ * PATH is never used.
  */
 export function ansibleCommand(
-  path = process.env['PATH'] ?? '',
-  exists: (candidate: string) => boolean = existsSync
+  platform: NodeJS.Platform = process.platform,
+  root = PACKAGE_ROOT
 ): string[] {
-  const found = path
-    .split(delimiter)
-    .filter(Boolean)
-    .some((directory) => exists(join(directory, 'ansible-playbook')));
-  return found
+  return platform === 'linux'
     ? ['ansible-playbook']
     : [
-        'uvx',
-        '--from',
-        `ansible-core==${macos.ansibleCore}`,
+        'uv',
+        'run',
+        '--project',
+        join(root, 'ansible'),
+        '--locked',
+        '--isolated',
+        '--quiet',
         'ansible-playbook',
       ];
 }

package/src/platform/resource-verify.ts

@@ -3,7 +3,11 @@ import type { Check, Runner } from '../types';
 
 const AGENT_DROP_IN =
   '/etc/systemd/user/t3code-.scope.d/60-personal-fleet.conf';
-const GUARDS = ['systemd-oomd.service', 'personal-fleet-disk-guard.service'];
+const GUARDS = [
+  'systemd-oomd.service',
+  'personal-fleet-disk-guard.service',
+  'personal-fleet-disk-gc.timer',
+];
 const MIB = 1024 * 1024;
 const FLOOR_MIB = policy.resourceSafety.diskGuardFloorMiB;
 
@@ -67,7 +71,7 @@ const diskAboveFloor =
     if (free >= FLOOR_MIB * MIB) return undefined;
     return [
       'DISK_FREE_BELOW_FLOOR',
-      `${path} has ${Math.floor(free / MIB)} MiB free, under the ${FLOOR_MIB} MiB floor. The guard stops runaway writers but never deletes files; remove stale worktrees or data.`,
+      `${path} has ${Math.floor(free / MIB)} MiB free, under the ${FLOOR_MIB} MiB floor. The disk GC already removed idle build output and caches; remove stale worktrees or data, or run "sudo systemctl start personal-fleet-disk-gc.service" and read its journal.`,
     ];
   };
 
@@ -90,7 +94,7 @@ const tmpWritable: Probe = async (run) =>
 
 /** Measured memory and disk safety on an Ubuntu worker: the running managers,
  * not the files Ansible wrote. Free space below the guard floor fails because
- * the guard only stops runaway writers; a person must recover space.
+ * what is left after the disk GC is work a person must decide about.
  */
 export async function verifyResourceSafety(
   home: string,
@@ -122,7 +126,7 @@ export async function verifyResourceSafety(
       id: 'ubuntu:resource-safety',
       status: 'pass',
       summary:
-        'systemd-oomd and the disk guard are running, user workloads are capped below physical memory, T3 agents have per-agent limits, swap is active, free disk is above the guard floor and /tmp is writable.',
+        'systemd-oomd, the disk guard and the disk GC timer are running, user workloads are capped below physical memory, T3 agents have per-agent limits, swap is active, free disk is above the guard floor and /tmp is writable.',
     },
   ];
 }

package/src/platform/ubuntu-audit.ts

@@ -31,12 +31,15 @@ export async function auditUbuntu(run: Runner): Promise<UbuntuAudit> {
   }
   const version =
     /^VERSION_ID="?([0-9]+\.[0-9]+)"?$/m.exec(release.stdout)?.[1] ?? null;
-  const architecture = /^(amd64|arm64)\s*$/.exec(arch.stdout)?.[1] ?? null;
+  const reported = arch.stdout.trim();
+  const architecture = policy.architectures.includes(reported)
+    ? reported
+    : null;
   return {
     supported:
       release.ok &&
       /^ID=ubuntu$/m.test(release.stdout) &&
-      version === '26.04' &&
+      version === policy.release &&
       architecture !== null,
     release: version,
     architecture,

package/src/remote-bootstrap.ts

@@ -6,7 +6,7 @@ import { isRevision } from './machine/state';
 import { sshArgs, shellQuote, sshFailure } from './ssh';
 import type { FleetNode, NodeReport, Runner, Check } from './types';
 import { record } from './config';
-import type { FleetDefinition } from './definition';
+import { installedDefinition, type FleetDefinition } from './definition';
 import { cleanCheck, validCheck } from './protocol';
 
 export interface BootstrapPayload {
@@ -48,16 +48,10 @@ export async function prepareBootstrap(
   );
   // The fleet configuration is data, not source: it travels beside the code.
   return payload && options.definition
-    ? { ...payload, config: JSON.stringify(options.definition, null, 2) + '\n' }
+    ? { ...payload, config: installedDefinition(options.definition) }
     : payload;
 }
 
-/** Installs the approved fleet configuration where every launcher and job on
- * the node reads it. It holds no secret.
- */
-const INSTALL_CONFIG =
-  'umask 077; d="$HOME/.config/dev-fleet"; mkdir -p "$d" && cat >"$d/fleet.json.new" && mv "$d/fleet.json.new" "$d/fleet.json"';
-
 /** Workers run one revision and never need history: the bundle holds only the
  * approved commit and its files (about a quarter of the full history), and the
  * receiving checkout is marked shallow at that commit. `git bundle create`
@@ -104,17 +98,9 @@ export async function bootstrapRemote(
 ): Promise<NodeReport> {
   const cached = await cachedRevision(node, payload.revision, run);
   if (typeof cached !== 'boolean') return { node: node.id, checks: [cached] };
-  if (payload.config) {
-    const installed = await run([...sshArgs(node), INSTALL_CONFIG], {
-      input: payload.config,
-      timeoutMs: 20_000,
-    });
-    if (!installed.ok)
-      return { node: node.id, checks: [sshFailure(installed)] };
-  }
   const transfer = cached
-    ? { mode: 'cached', input: '' }
-    : { mode: 'transfer', input: payload.bundle };
+    ? { mode: 'cached', bundle: '' }
+    : { mode: 'transfer', bundle: payload.bundle };
   const command = [
     'sh',
     '-c',
@@ -128,7 +114,7 @@ export async function bootstrapRemote(
     .map(shellQuote)
     .join(' ');
   const result = await run([...sshArgs(node), command], {
-    input: transfer.input,
+    input: bootstrapInput(payload.config, transfer.bundle),
     timeoutMs: 5_400_000,
   });
   const evidence = parseEvidence(result);
@@ -150,6 +136,18 @@ export async function bootstrapRemote(
   };
 }
 
+/** What the bootstrap reads on stdin: one line with the fleet configuration
+ * (installed under the remote lock, so overlapping runs never both write it),
+ * then the bundle when the worker lacks the revision.
+ */
+export function bootstrapInput(
+  config: string | undefined,
+  bundle: string
+): string {
+  const line = config ? Buffer.from(config).toString('base64') : '';
+  return `${line}\n${bundle}`;
+}
+
 async function cachedRevision(
   node: FleetNode,
   revision: string,

package/src/repair-catalog.ts

@@ -47,7 +47,7 @@ export const REPAIR_RECIPES: RepairRecipe[] = [
     owner: 'dev-fleet',
     automatic: true,
     action:
-      'Links ~/.local/bin/devfleet to this checkout. Nothing is copied and no configuration is changed.',
+      'Links ~/.local/bin/devfleet to this checkout of dev-fleet (refused for an installed package, which is not one). Nothing is copied and no configuration is changed.',
     commands: [['sh', 'bootstrap/install-launcher.sh']],
   },
   {

package/src/runner.ts

@@ -24,7 +24,7 @@ export function runCommand(
     const child = spawn(command[0]!, command.slice(1), {
       cwd: options.cwd,
       env: {
-        ...process.env,
+        ...(options.isolatedEnv ? {} : process.env),
         ...options.env,
         GIT_TERMINAL_PROMPT: '0',
         CI: '1',