@crvouga/dev-fleet 0.1.0 → 0.3.0

package/mise.toml

@@ -1,5 +1,7 @@
 # Shared workstation toolchain. Bootstrap installs this globally; projects may override it.
-# See bootstrap/README.md. Commit mise.lock whenever changing these pins.
+# Commit mise.lock whenever changing these pins.
+# min_version is also the exact mise bootstrap/bootstrap.sh installs; bump the
+# mise_*_sha256 digests under [vars] with it.
 min_version = "2026.10.24"
 
 [settings]
@@ -17,6 +19,8 @@ atlas = { version = "1.3.0", os = ["linux", "macos"], lazy = true }
 azure-cli = { version = "2.91.0", lazy = true }
 # CLI proxy backups on the manager (cliproxy/scripts/install-dependencies).
 restic = { version = "0.19.1", os = ["linux", "macos"], lazy = true }
+# Replicates the fleet state database to the storage bucket (src/state).
+litestream = { version = "0.5.18", os = ["linux", "macos"], lazy = true }
 pnpm = "12.16.1"
 "npm:@yarnpkg/cli-dist" = "4.18.1"
 deno = "2.9.8"
@@ -77,10 +81,19 @@ GROK_DISABLE_AUTOUPDATER = "1"
 AGY_CLI_DISABLE_AUTO_UPDATE = "true"
 
 [vars]
-# Official native Ubuntu server distribution; bootstrap/native-t3.ts owns installation.
+# mise itself, installed by bootstrap/bootstrap.sh before mise can read this
+# file: the version is min_version above, these are its release archives
+# (SHASUMS256.txt of that release).
+mise_linux_x64_sha256 = "9a6c9c55f5c6372d0af70a9979fe6d742aea3793267a929e1738022143c466cc"
+mise_linux_arm64_sha256 = "8c8f5d7f748bf3aef431dc50f0ad776270f36025c788aa21c74e2fabdbbd6d3e"
+mise_macos_x64_sha256 = "83a36355bf6ee7c1660300e12dd94464de5c672dab1b8cc33ec4d19356e7ddac"
+mise_macos_arm64_sha256 = "aa2fc59242db108f97ea9fb2d2e2cb42ff1467fcafe3c91e48d51c841ba67a65"
+# Official native server distribution (Ubuntu workers, and the manager's
+# pinned CLI); bootstrap/native-t3.ts owns installation. From the release's SHA256SUMS.
 t3_version = "0.1.8-nightly.20261106.4262"
 t3_linux_x64_sha256 = "5df94ca15c4f68f749fa5540fbb9d5ca879ca8750ac43dd2704f6a18899ed6d5"
 t3_linux_arm64_sha256 = "0649615c4a294eee40bc753c8668e4a83c5c3620794f2163758f8dc48a39b880"
+t3_darwin_arm64_sha256 = "40c81f1d696e7056c0c43e29bdfd2a154ea6f6bd9129826034256751418de633"
 # Official T3 Code desktop .deb (same release). Workers run this GUI app as their
 # only T3 process; it embeds the server. Upstream SHA256SUMS omits .deb files,
 # so these digests were computed from the release assets.

package/package.json

@@ -1,16 +1,21 @@
 {
   "name": "@crvouga/dev-fleet",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Keeps a set of development machines in sync: one manager and many workers",
   "license": "MIT",
   "repository": "github:crvouga/dev-fleet",
   "homepage": "https://github.com/crvouga/dev-fleet#readme",
+  "bugs": {
+    "url": "https://github.com/crvouga/dev-fleet/issues"
+  },
   "type": "module",
   "bin": {
     "devfleet": "./bin/devfleet.mjs"
   },
   "files": [
     "bin",
+    "llms.txt",
+    "docs",
     "src",
     "agents",
     "ansible",
@@ -52,6 +57,9 @@
     "yaml": "^2.8.0"
   },
   "devDependencies": {
+    "@cucumber/cucumber-expressions": "20.1.0",
+    "@cucumber/gherkin": "42.0.1",
+    "@cucumber/messages": "34.2.1",
     "@eslint/js": "^9.25.0",
     "@types/bun": "^1.3.9",
     "@types/node": "^22.15.29",
@@ -63,5 +71,6 @@
   "packageManager": "bun@1.4.4",
   "engines": {
     "node": ">=22"
-  }
+  },
+  "gitHead": "0c583e40a0c32c0db355e9c0bca6903894945310"
 }

package/schema/fleet.schema.json

@@ -27,7 +27,8 @@
       "properties": {
         "id": {
           "type": "string",
-          "pattern": "^[a-z][a-z0-9-]{0,62}$"
+          "pattern": "^[a-z][a-z0-9-]{0,62}$",
+          "description": "A short stable id for the manager, used in reports."
         },
         "os": {
           "const": "macOS"
@@ -39,11 +40,13 @@
           "properties": {
             "tailscaleName": {
               "type": "string",
-              "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$"
+              "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$",
+              "description": "The manager's Tailscale MagicDNS name, without the trailing dot (tailscale status --json: .Self.DNSName)."
             },
             "user": {
               "type": "string",
-              "pattern": "^[a-z_][a-z0-9_.-]{0,31}$"
+              "pattern": "^[a-z_][a-z0-9_.-]{0,31}$",
+              "description": "The manager's login name (id -un)."
             }
           }
         },
@@ -64,11 +67,13 @@
         "properties": {
           "id": {
             "type": "string",
-            "pattern": "^[a-z][a-z0-9-]{0,62}$"
+            "pattern": "^[a-z][a-z0-9-]{0,62}$",
+            "description": "A short stable id for the worker. The first worker listed is the canary: a revision new to the fleet must pass there before the others receive it."
           },
           "ssh": {
             "type": "string",
-            "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$"
+            "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$",
+            "description": "The worker's Host alias in the manager's ~/.ssh/config. It must work with BatchMode=yes and a host key already in known_hosts."
           },
           "os": {
             "const": "linux",
@@ -81,21 +86,25 @@
             "properties": {
               "tailscaleName": {
                 "type": "string",
-                "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$"
+                "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$",
+                "description": "The worker's Tailscale MagicDNS name, without the trailing dot."
               },
               "user": {
                 "type": "string",
-                "pattern": "^[a-z_][a-z0-9_-]{0,31}$"
+                "pattern": "^[a-z_][a-z0-9_-]{0,31}$",
+                "description": "The non-root worker account that can use sudo."
               },
               "sshPort": {
                 "type": "integer",
                 "minimum": 1,
-                "maximum": 65535
+                "maximum": 65535,
+                "description": "The port sshd listens on, normally 22."
               },
               "t3Port": {
                 "type": "integer",
                 "minimum": 1,
-                "maximum": 65535
+                "maximum": 65535,
+                "description": "The port the worker T3 server listens on, normally 3773."
               }
             }
           }
@@ -117,6 +126,41 @@
               "type": "string",
               "pattern": "^https://[A-Za-z0-9.-]+$",
               "description": "Public HTTPS origin of the CLI proxy every node uses."
+            },
+            "accounts": {
+              "type": "object",
+              "additionalProperties": false,
+              "description": "How provider accounts signed in on the proxy are watched and chosen. See docs/accounts.md.",
+              "properties": {
+                "minimumUsable": {
+                  "type": "integer",
+                  "minimum": 1,
+                  "description": "proxy:account:<provider> warns when a provider has fewer usable accounts than this (default 2) and fails when it has none."
+                },
+                "selection": {
+                  "type": "object",
+                  "description": "Per provider (claude, codex, antigravity): which account an unpinned request goes to first. Accounts cooling down are always skipped.",
+                  "additionalProperties": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["strategy"],
+                    "properties": {
+                      "strategy": {
+                        "enum": [
+                          "fill-first",
+                          "round-robin",
+                          "least-recently-limited"
+                        ]
+                      },
+                      "order": {
+                        "type": "array",
+                        "items": { "type": "string" },
+                        "description": "Account labels (sign-in emails) first, in this order; the others follow in the order of their routing prefix."
+                      }
+                    }
+                  }
+                }
+              }
             }
           }
         },
@@ -163,7 +207,8 @@
         "architectures": {
           "const": ["amd64", "arm64"]
         }
-      }
+      },
+      "description": "The supported worker release and architectures (fixed)."
     },
     "worker": {
       "type": "object",
@@ -191,15 +236,18 @@
               "workstation",
               "worker"
             ]
-          }
+          },
+          "description": "Readiness checks every worker must pass; normally all six."
         },
         "githubLogin": {
           "type": "string",
-          "pattern": "^[a-zA-Z0-9-]{1,39}$"
+          "pattern": "^[a-zA-Z0-9-]{1,39}$",
+          "description": "The GitHub login every worker must be signed in as."
         },
         "vaultUser": {
           "type": "string",
-          "pattern": "^[a-zA-Z0-9_.-]{1,64}$"
+          "pattern": "^[a-zA-Z0-9_.-]{1,64}$",
+          "description": "The Vault user each worker's own token is issued for."
         },
         "toolchain": {
           "const": "mise.lock"
@@ -216,13 +264,14 @@
         "neverSleep": {
           "const": true
         }
-      }
+      },
+      "description": "Policy every worker must meet. All but the two logins and the capabilities are fixed."
     },
     "source": {
       "type": "object",
       "additionalProperties": false,
       "required": ["repository"],
-      "description": "The Git repository that holds this fleet's configuration and pins. Nodes only accept source from it.",
+      "description": "The Git repository machines take dev-fleet's code from: the one the package you run was published from, or your fork. Nodes only accept source from it.",
       "properties": {
         "repository": {
           "type": "string",
@@ -230,6 +279,79 @@
         }
       }
     },
+    "ides": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "enum": ["t3"] },
+      "description": "The IDEs every machine runs. Defaults to [\"t3\"]; the README's support matrix lists the supported ones."
+    },
+    "t3": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "What every machine's T3 Code holds beyond the provider instances generated from the proxy's accounts.",
+      "properties": {
+        "profile": {
+          "type": "object",
+          "description": "Top-level T3 settings every machine holds the same (tool servers, projects, selected preferences). Keys not named here stay local; a key edited on a machine since dev-fleet last wrote it is reported as a conflict, never overwritten.",
+          "propertyNames": {
+            "pattern": "^[a-zA-Z][a-zA-Z0-9_-]{0,63}$",
+            "not": { "const": "providerInstances" }
+          }
+        },
+        "requiredModels": {
+          "type": "object",
+          "description": "Models T3 must offer, and the proxy must serve, for every account of a tool, by tool (claude, codex, opencode).",
+          "propertyNames": { "pattern": "^[a-zA-Z][a-zA-Z0-9_-]{0,63}$" },
+          "additionalProperties": {
+            "type": "array",
+            "items": { "type": "string", "pattern": "^[A-Za-z0-9._:-]{1,128}$" }
+          }
+        }
+      }
+    },
+    "state": {
+      "description": "The bucket that holds the fleet state (the roster, the approved revision and the configuration last applied). Any S3-compatible service, or a directory. Never credentials: a devfleet command reads those from DEVFLEET_BUCKET_ACCESS_KEY_ID and DEVFLEET_BUCKET_SECRET_ACCESS_KEY.",
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["bucket"],
+          "properties": {
+            "bucket": {
+              "type": "string",
+              "pattern": "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$"
+            },
+            "endpoint": {
+              "type": "string",
+              "description": "The https origin of the S3 service; omit for AWS S3.",
+              "pattern": "^https://[A-Za-z0-9.-]{1,253}(:[0-9]{1,5})?$"
+            },
+            "region": {
+              "type": "string",
+              "pattern": "^[a-z0-9-]{1,32}$"
+            },
+            "prefix": {
+              "type": "string",
+              "description": "Key prefix, so one bucket can hold several fleets. Default: dev-fleet.",
+              "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{0,199}$"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["directory"],
+          "properties": {
+            "directory": {
+              "type": "string",
+              "description": "An absolute path on an attached disk or a mounted share.",
+              "pattern": "^/"
+            }
+          }
+        }
+      ]
+    },
     "secrets": {
       "description": "Where this fleet keeps its secrets. env: DEVFLEET_SECRET_<NAME>; file: one file per secret; sops: one encrypted document; vault: a KV v2 location per secret.",
       "oneOf": [

package/src/accounts/checks.ts

@@ -0,0 +1,220 @@
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import type { Check } from '../types';
+import type { ProxyRoster, RosterAccount } from './roster';
+
+/** Fewer usable accounts than this warns unless the fleet says otherwise. */
+export const MINIMUM_USABLE = 2;
+
+/** `proxy:account:<provider>`: fails when a provider has no usable account,
+ * warns below the fleet's minimum. Accounts are named by their opaque index
+ * and counts only, never by an identifier.
+ */
+export function providerAccountChecks(
+  roster: ProxyRoster,
+  minimumUsable = MINIMUM_USABLE
+): Check[] {
+  const providers = new Map<string, RosterAccount[]>();
+  for (const account of roster.accounts)
+    if (account.state !== 'removed')
+      providers.set(account.provider, [
+        ...(providers.get(account.provider) ?? []),
+        account,
+      ]);
+  return [...providers.entries()]
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([provider, accounts]) =>
+      providerCheck(provider, accounts, minimumUsable)
+    );
+}
+
+/** "account 2 needs-login, account 3 cooling-down until …" */
+const describe = (accounts: RosterAccount[]): string[] =>
+  accounts
+    .filter((account) => account.state !== 'usable')
+    .map(
+      (account) =>
+        `account ${account.index} ${account.state}${account.until ? ` until ${account.until}` : ''}`
+    );
+
+function reloginRemedy(provider: string, accounts: RosterAccount[]) {
+  const login = accounts.find((account) => account.state === 'needs-login');
+  return login
+    ? {
+        action: `Sign ${provider} account ${login.index} in again. Signing in is the only manual step.`,
+        command: `devfleet fleet-accounts --relogin ${provider} ${login.index}`,
+      }
+    : undefined;
+}
+
+function providerCheck(
+  provider: string,
+  accounts: RosterAccount[],
+  minimumUsable: number
+): Check {
+  const usable = accounts.filter((account) => account.state === 'usable');
+  const id = `proxy:account:${provider}`;
+  const detail = describe(accounts);
+  const counted = `${usable.length} of ${accounts.length} ${provider} accounts usable${detail.length ? ` (${detail.join(', ')})` : ''}`;
+  const remedy = reloginRemedy(provider, accounts);
+  if (usable.length === 0) return noneUsable(provider, accounts);
+  if (usable.length < minimumUsable)
+    return {
+      id,
+      status: 'warn',
+      summary: `${counted}; one limit or expired login away from none.`,
+      remedy: remedy ?? {
+        action: `Add a ${provider} account: devfleet fleet-accounts --add ${provider}.`,
+      },
+    };
+  return {
+    id,
+    status: 'pass',
+    summary: `${counted}.`,
+    ...(remedy ? { remedy } : {}),
+  };
+}
+
+/** No usable account: say why, and when the first cooldown clears. */
+function noneUsable(provider: string, accounts: RosterAccount[]): Check {
+  const clears = accounts
+    .map((account) => account.until)
+    .filter((until): until is string => until !== null)
+    .sort()[0];
+  const cooling = accounts.every((account) => account.state === 'cooling-down');
+  const wait = `Wait until ${clears ?? 'the provider lifts the limit'}, or add an account: devfleet fleet-accounts --add ${provider}.`;
+  return {
+    id: `proxy:account:${provider}`,
+    status: 'fail',
+    summary: cooling
+      ? `No usable ${provider} account: every one is cooling down${clears ? `; the first clears at ${clears}` : ''}.`
+      : `No usable ${provider} account (${describe(accounts).join(', ')}).`,
+    remedy: reloginRemedy(provider, accounts) ?? {
+      action: cooling
+        ? wait
+        : `Inspect the ${provider} accounts with devfleet fleet-accounts.`,
+    },
+  };
+}
+
+/** `accounts:roster-current`: this node offers exactly the accounts the
+ * proxy holds. `proxy` is the proxy's roster version (null: unreadable),
+ * `node` the version of the account instances the node exposes.
+ */
+export function rosterCurrentCheck(proxy: string | null, node: string): Check {
+  if (proxy === null)
+    return {
+      id: 'accounts:roster-current',
+      status: 'warn',
+      summary: `The proxy's account roster could not be read; this node offers roster version ${node}.`,
+      remedy: {
+        action: 'Check proxy:reachable-from, then run fleet-status again.',
+      },
+    };
+  return proxy === node
+    ? {
+        id: 'accounts:roster-current',
+        status: 'pass',
+        summary: `This node offers the proxy's account roster (version ${node}).`,
+      }
+    : {
+        id: 'accounts:roster-current',
+        status: 'fail',
+        summary: `This node offers account roster version ${node}; the proxy holds ${proxy}.`,
+        remedy: {
+          action: 'Propagate the accounts to every node without a full sync.',
+          command: 'devfleet fleet-sync --only accounts',
+        },
+      };
+}
+
+/** Where agent CLIs keep a provider login of their own, relative to home. */
+export const NATIVE_LOGINS: Record<string, string[]> = {
+  claude: ['.claude/.credentials.json'],
+  codex: ['.codex/auth.json'],
+  gemini: ['.gemini/oauth_creds.json'],
+  opencode: ['.local/share/opencode/auth.json'],
+  grok: ['.grok/auth.json'],
+};
+
+/** The provider logins found on this node outside the proxy path. */
+export function nativeLogins(
+  home = homedir(),
+  exists: (path: string) => boolean = existsSync
+): { cli: string; path: string }[] {
+  return Object.entries(NATIVE_LOGINS).flatMap(([cli, paths]) =>
+    paths
+      .map((path) => join(home, path))
+      .filter((path) => exists(path))
+      .map((path) => ({ cli, path }))
+  );
+}
+
+/** `accounts:native-login`: a node holds no provider login of its own, so it
+ * can use no account the proxy does not know. Names the CLIs only.
+ */
+export function nativeLoginCheck(found: { cli: string }[]): Check {
+  const clis = [...new Set(found.map((login) => login.cli))].sort();
+  return clis.length === 0
+    ? {
+        id: 'accounts:native-login',
+        status: 'pass',
+        summary:
+          'No agent CLI on this node holds a provider login of its own; every account comes from the proxy.',
+      }
+    : {
+        id: 'accounts:native-login',
+        status: 'warn',
+        summary: `Provider logins outside the proxy path: ${clis.join(', ')}.`,
+        remedy: {
+          action:
+            'Provider accounts belong on the proxy. Remove these logins (opt-in), and sign the account in on the proxy if it is needed.',
+          command: 'devfleet fleet-accounts --remove-native-logins --yes',
+        },
+      };
+}
+
+/** `proxy:reachable-from`: this node reaches the proxy, and how fast. */
+export async function proxyReachableCheck(
+  endpoint: string,
+  send: typeof fetch = fetch,
+  clock: () => number = () => performance.now()
+): Promise<Check> {
+  const started = clock();
+  try {
+    // Unauthenticated: the proxy refuses it, which proves it answered.
+    const response = await send(endpoint + '/v1/models', {
+      redirect: 'error',
+      signal: AbortSignal.timeout(10_000),
+    });
+    await response.body?.cancel().catch(() => undefined);
+    const latency = Math.round(clock() - started);
+    const answered = response.status < 500;
+    return {
+      id: 'proxy:reachable-from',
+      status: !answered ? 'fail' : latency > 2000 ? 'warn' : 'pass',
+      summary: answered
+        ? `The proxy answered in ${latency} ms.`
+        : 'PROXY_UNREACHABLE: the route to the proxy answered, the proxy did not.',
+      ...(answered
+        ? {}
+        : {
+            remedy: {
+              action:
+                'Agents retry for about a minute and then report "proxy unreachable". Check the proxy on the manager: devfleet cliproxy status.',
+            },
+          }),
+    };
+  } catch {
+    return {
+      id: 'proxy:reachable-from',
+      status: 'fail',
+      summary: 'PROXY_UNREACHABLE: no answer from the proxy.',
+      remedy: {
+        action:
+          'Agents retry for about a minute and then report "proxy unreachable". Check this node’s tailnet and the proxy on the manager: devfleet cliproxy status.',
+      },
+    };
+  }
+}

package/src/accounts/context.ts

@@ -0,0 +1,76 @@
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { accountPrefix, discoverAccounts } from '../agents/accounts';
+import { proxyKey } from '../agents/secrets';
+import { registry } from '../agents/registry';
+import type { AccountContext } from '../agents/native-verify';
+import type { Check } from '../types';
+import {
+  nativeLoginCheck,
+  nativeLogins,
+  proxyReachableCheck,
+  rosterCurrentCheck,
+} from './checks';
+import { liveVersion, rosterVersion } from './roster';
+import { exposedInstances, type Instance } from './sessions';
+
+/** This machine's T3 settings, where its account instances are written. */
+export const t3Settings = (): string =>
+  join(
+    resolve(process.env['T3CODE_HOME'] ?? join(homedir(), '.t3')),
+    'userdata/settings.json'
+  );
+
+/** A short digest of the client key: its version, never its value. */
+export const keyVersion = (key: string): string =>
+  createHash('sha256').update(key).digest('hex').slice(0, 12);
+
+/** The roster version of the instances a node offers. */
+export function exposedVersion(instances: Instance[]): string {
+  return rosterVersion(
+    instances.flatMap((instance) => {
+      try {
+        return [accountPrefix(instance.tool, instance.account)];
+      } catch {
+        return [];
+      }
+    })
+  );
+}
+
+/** The proxy's accounts and what this node offers, read with this node's
+ * own key; undefined when the proxy or the key is unavailable (the provider
+ * checks report that).
+ */
+export async function accountContext(
+  settings = t3Settings()
+): Promise<AccountContext | undefined> {
+  try {
+    const key = await proxyKey();
+    const live = await discoverAccounts(key);
+    return {
+      live,
+      exposed: await exposedInstances(settings),
+      rosterVersion: liveVersion(live),
+      keyVersion: keyVersion(key),
+    };
+  } catch {
+    return undefined;
+  }
+}
+
+/** What a node measures about accounts: it reaches the proxy, it offers
+ * the proxy's roster, and it holds no provider login of its own.
+ */
+export async function nodeAccountChecks(
+  context: AccountContext | undefined,
+  settings = t3Settings()
+): Promise<Check[]> {
+  const exposed = context?.exposed ?? (await exposedInstances(settings));
+  return [
+    await proxyReachableCheck(registry.proxy.endpoint),
+    rosterCurrentCheck(context?.rosterVersion ?? null, exposedVersion(exposed)),
+    nativeLoginCheck(nativeLogins()),
+  ];
+}

package/src/accounts/propagate.ts

@@ -0,0 +1,62 @@
+import { blocking, type Check, type FleetNode, type Runner } from '../types';
+import { inspectRemote } from '../transport';
+import type { CommandOutcome } from '../cli/contracts';
+
+export interface Propagation {
+  /** The enrolled workers. */
+  nodes: FleetNode[];
+  /** The approved revision every worker runs. */
+  revision: string;
+  /** The bundled remote entry sent to each worker. */
+  source: string;
+  /** The manager's own account instances, applied locally. */
+  manager: () => Promise<Check[]>;
+  run: Runner;
+}
+
+/** `fleet-sync --only accounts`: the account-derived configuration and
+ * nothing else, on the manager and on every worker at once. Each node
+ * re-reads the proxy's roster and rewrites only its per-account T3
+ * instances; T3 watches its settings, so nothing restarts and no running
+ * turn ends. Instance ids derive from the account's routing prefix, so they
+ * stay the same and existing threads keep working. A node that cannot be
+ * reached is reported; it catches up on the next propagation or sync, and
+ * reports the roster version it has (`accounts:roster-current`) until then.
+ */
+export async function propagateAccounts(
+  input: Propagation
+): Promise<CommandOutcome> {
+  const started = Date.now();
+  const [manager, ...workers] = await Promise.all([
+    input.manager().then((checks) => ({ node: 'manager', checks })),
+    ...input.nodes.map((node) =>
+      inspectRemote(
+        node,
+        {
+          source: input.source,
+          timeoutMs: 180_000,
+          action: 'accounts',
+          expected: { head: input.revision, files: {} },
+        },
+        input.run
+      )
+    ),
+  ]);
+  const nodes = [manager!, ...workers].map((report) => ({
+    node: report.node,
+    checks: report.checks,
+  }));
+  const ok = nodes.every((node) => !node.checks.some(blocking));
+  return {
+    exitCode: ok ? 0 : 1,
+    data: {
+      version: 1,
+      command: 'fleet-sync',
+      only: 'accounts',
+      ok,
+      revision: input.revision,
+      durationMs: Date.now() - started,
+      nodes,
+    },
+  };
+}