@crvouga/dev-fleet 0.1.0 → 0.3.0

package/src/cli/fleet-sync-enrollment.ts

@@ -1,6 +1,5 @@
-import { readFile, mkdir, writeFile, rename, rm } from 'node:fs/promises';
-import { randomUUID } from 'node:crypto';
-import { loadConfig } from '../config';
+import { mkdir, rm } from 'node:fs/promises';
+import { loadRoster } from './roster';
 import { enrolledRoster } from '../definition';
 import { FleetUsageError } from '../errors';
 import { dirname } from 'node:path';
@@ -10,6 +9,7 @@ import { matchComputers } from '../tailnet-matching';
 import { sshArgs, sshFailure } from '../ssh';
 import { ensurePrivateRoot } from '../machine/state';
 import type { FleetNode, Runner } from '../types';
+import { STATE_ROSTER, readRosterText, writeRosterText } from '../state/roster';
 
 /** Interactive enrollment/resume only. Existing paths and explicit identities
  * are preserved. Tailnet candidates never enter the declared membership.
@@ -20,7 +20,7 @@ export async function enrollManager(path: string, run: Runner): Promise<void> {
   const saved =
     original === null
       ? []
-      : enrolledRoster(canonical, await loadConfig(path)).nodes;
+      : enrolledRoster(canonical, await loadRoster(path)).nodes;
   const nodes: FleetNode[] = canonical.workers.map((node) => ({
     id: node.id,
     ssh: node.ssh,
@@ -55,8 +55,6 @@ export async function enrollManager(path: string, run: Runner): Promise<void> {
   process.stderr.write(
     `Enrolling verified SSH connections for canonical targets:\n${enrolled.map((node) => `  ${node.id} → ${node.ssh}; device ${enrollmentIdentity(node)}`).join('\n')}\nMissing targets remain visible and are never replaced by discovered peers.\n`
   );
-  await ensurePrivateRoot(dirname(path));
-  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
   await persistEnrollment(path, original, merged);
 }
 
@@ -95,13 +93,8 @@ function ambiguous(ids: string[], matches: Map<string, FleetNode[]>): boolean {
     ids.length > 1 || (ids.length === 1 && matches.get(ids[0]!)?.length !== 1)
   );
 }
-async function existingEnrollment(path: string): Promise<string | null> {
-  try {
-    return await readFile(path, 'utf8');
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
-    throw error;
-  }
+function existingEnrollment(path: string): Promise<string | null> {
+  return readRosterText(path);
 }
 export function mergeEnrollment(
   saved: FleetNode[],
@@ -123,22 +116,25 @@ async function persistEnrollment(
   original: string | null,
   nodes: FleetNode[]
 ): Promise<void> {
-  const lock = `${path}.enroll.lock`;
-  await mkdir(lock, { mode: 0o700 });
-  const temporary = `${path}.${randomUUID()}.tmp`;
-  try {
+  const write = async (): Promise<void> => {
     if ((await existingEnrollment(path)) !== original)
       throw new FleetUsageError(
         'Enrollment changed during approval. Inspect it and rerun; no connection was overwritten.'
       );
-    await writeFile(
-      temporary,
-      JSON.stringify({ version: 1, nodes }, null, 2) + '\n',
-      { flag: 'wx', mode: 0o600 }
+    await writeRosterText(
+      path,
+      JSON.stringify({ version: 1, nodes }, null, 2) + '\n'
     );
-    await rename(temporary, path);
+  };
+  // The fleet state serializes its own writers; a roster file needs a lock.
+  if (path === STATE_ROSTER) return write();
+  await ensurePrivateRoot(dirname(path));
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  const lock = `${path}.enroll.lock`;
+  await mkdir(lock, { mode: 0o700 });
+  try {
+    await write();
   } finally {
-    await rm(temporary, { force: true });
     await rm(lock, { recursive: true });
   }
 }

package/src/cli/fleet-sync-forward.ts

@@ -91,7 +91,7 @@ export function managerCommand(
           revision,
           ...forwardedFlags(options, undefined),
         ]
-      : ['personal', 'fleet-sync', ...forwardedFlags(options, revision)];
+      : ['devfleet', 'fleet-sync', ...forwardedFlags(options, revision)];
   const color = process.stdout.isTTY && !process.env['NO_COLOR'];
   // A login shell gives the manager's normal PATH (mise, Docker, Tailscale).
   const script = `export ${NO_FORWARD_ENV}=1${color ? ' FORCE_COLOR=1' : ''}; exec ${args.map(shellQuote).join(' ')}`;

package/src/cli/fleet-sync-manager.ts

@@ -6,11 +6,18 @@ import { convergeProxy } from '../proxy-converge';
 import { attempt } from '../node-converge-shared';
 import { quotaLimited, verifyFleetProviders } from '../agents/fleet-verify';
 import { verifyNativeAgents } from '../agents/native-verify';
+import { accountContext, nodeAccountChecks } from '../accounts/context';
 import { convergeManagerHub } from '../monitoring/manager-hub';
 import { enrollManagerMonitoring } from './fleet-sync-monitoring';
 import { installConfig } from '../fleet-config';
-import { machineProviders } from '../t3/providers';
-import { providerNames } from '../t3/names-check';
+import { IDES } from '../ide';
+import { enabled, managerChecks } from '../ide/orchestrate';
+import { idesOf } from '../ide/definition';
+import macos from '../../ansible/macos/policy.json';
+import { ansibleCommand } from '../platform/ansible';
+import { PACKAGE_ROOT } from '../package-info';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 
 /** The manager converges itself locally (never over SSH) before any worker:
  * it must be the declared manager, stay awake on AC power, and host every
@@ -32,9 +39,17 @@ export async function convergeManager(
   if (identity.status === 'pass') {
     // Launchers and scheduled jobs on the manager read the installed copy.
     if (input.apply) installConfig();
-    checks.push(await managerPower(run));
-    checks.push(await machineProviders(id, input.workspace, input.apply));
-    checks.push(await providerNames(id, input.workspace, input.apply));
+    checks.push(await managerPower(run, input.workspace));
+    checks.push(await managerDocker(run));
+    // Each enabled IDE: its settings, pinned version and policy.
+    checks.push(
+      ...(await managerChecks(enabled(idesOf(definition), IDES), {
+        id,
+        workspace: input.workspace,
+        apply: input.apply,
+        run,
+      }))
+    );
     if (input.apply) {
       // Same provider profiles and the same Vault gateway credential as every
       // worker: the instances above launch from these profiles, and the check
@@ -49,10 +64,17 @@ export async function convergeManager(
       );
       checks.push(...providers);
       // Same agents, versions and shared accounts as every worker.
+      const accounts = await accountContext();
+      checks.push(
+        ...(await attempt('accounts:verification', () =>
+          nodeAccountChecks(accounts)
+        ))
+      );
       checks.push(
         ...(await attempt('agent:verification', () =>
           verifyNativeAgents(id, input.workspace, run, {
             outOfQuota: quotaLimited(providers),
+            ...(accounts ? { accounts } : {}),
           })
         ))
       );
@@ -170,12 +192,22 @@ export async function managerIdentity(id: string, run: Runner): Promise<Check> {
       };
 }
 
-/** Workers depend on the manager's services, so it never sleeps on AC power. */
-export async function managerPower(run: Runner): Promise<Check> {
+/** Workers depend on the manager's services, so it never sleeps on AC power.
+ * Measures every setting `ansible/macos/manager.yml` declares, from the same
+ * policy file the playbook applies.
+ */
+export async function managerPower(
+  run: Runner,
+  workspace = '.'
+): Promise<Check> {
   const result = await run(['pmset', '-g', 'custom']);
   const ac = result.ok ? (result.stdout.split('AC Power:')[1] ?? '') : '';
-  const sleep = /^\s*sleep\s+(\d+)/m.exec(ac)?.[1];
-  return sleep === '0'
+  const observed = (key: string) =>
+    new RegExp(`^\\s*${key}\\s+(\\S+)`, 'm').exec(ac)?.[1];
+  const drifted = Object.entries(macos.pmset)
+    .filter(([key, value]) => observed(key) !== value)
+    .map(([key]) => key);
+  return drifted.length === 0
     ? {
         id: 'manager:power',
         status: 'pass',
@@ -184,10 +216,50 @@ export async function managerPower(run: Runner): Promise<Check> {
     : {
         id: 'manager:power',
         status: 'fail',
-        summary: 'MANAGER_SLEEPS_ON_POWER',
+        summary: drifted.includes('sleep')
+          ? 'MANAGER_SLEEPS_ON_POWER'
+          : `MANAGER_POWER_POLICY_DRIFT ${drifted.join(' ')}`,
         remedy: {
-          action:
-            'Workers lose the CLI proxy and Beszel hub while the manager sleeps. Apply the manager power policy once: ansible-playbook -K ansible/macos/manager.yml',
+          action: `Workers lose the CLI proxy and Beszel hub while the manager sleeps. Apply the manager power policy once, as an administrator: cd ${workspace} && ${ansibleCommand().join(' ')} -K ansible/macos/manager.yml`,
         },
       };
 }
+
+/** The Docker Desktop release `mise.toml` pins, as the engine names itself. */
+export function pinnedDockerDesktop(root = PACKAGE_ROOT): string {
+  const { vars } = Bun.TOML.parse(
+    readFileSync(join(root, 'mise.toml'), 'utf8')
+  ) as { vars: Record<string, string> };
+  return `Docker Desktop ${vars['docker_desktop_version']} (${vars['docker_desktop_build']})`;
+}
+
+/** The manager's services run in Docker Desktop, which no playbook installs
+ * and which updates itself: the pinned release is measured, and a different
+ * one warns instead of failing the run.
+ */
+export async function managerDocker(
+  run: Runner,
+  pinned = pinnedDockerDesktop()
+): Promise<Check> {
+  const result = await run(
+    ['docker', 'version', '--format', '{{.Server.Platform.Name}}'],
+    { timeoutMs: 20_000 }
+  );
+  const observed = result.ok ? result.stdout.trim() : '';
+  if (observed === pinned)
+    return {
+      id: 'manager:docker',
+      status: 'pass',
+      summary: `The manager runs the pinned ${pinned}.`,
+    };
+  return {
+    id: 'manager:docker',
+    status: 'warn',
+    summary: observed
+      ? 'MANAGER_DOCKER_DESKTOP_DRIFT'
+      : 'MANAGER_DOCKER_DESKTOP_UNOBSERVED',
+    remedy: {
+      action: `The manager's services are tested on ${pinned}. Install that release and turn off its automatic updates, or expect differences; fleet-sync does not install or replace Docker Desktop.`,
+    },
+  };
+}

package/src/cli/fleet-sync-monitoring.ts

@@ -2,7 +2,7 @@ import type { FleetNode, Runner, Check } from '../types';
 import type { FleetDefinition } from '../definition';
 import { hubUrl, roleOf } from '../topology';
 import { discoverTailnet } from '../tailscale';
-import { BESZEL_FLEET_IDENTITY, hubAccess } from '../monitoring/hub-access';
+import { fleetIdentity, hubAccess } from '../monitoring/hub-access';
 import { enrollBeszel } from '../monitoring/enroll';
 import { verifyBeszel } from '../monitoring/beszel';
 import { installRemoteAgent } from '../monitoring/remote';
@@ -142,15 +142,15 @@ async function hubReachable(hub: string, run: Runner): Promise<boolean> {
   return probe.ok;
 }
 
-const REMEDIES: Record<string, string> = {
-  BESZEL_ACCOUNT_REQUIRED: `The hub rejected the fleet login ${BESZEL_FLEET_IDENTITY}. A new hub on the manager creates it on first start from BESZEL_FLEET_AUTH; an older hub needs it once, by its superuser, as a verified users record with that Vault password. Never paste the password on a command line.`,
+const remedies = (): Record<string, string> => ({
+  BESZEL_ACCOUNT_REQUIRED: `The hub rejected the fleet login ${fleetIdentity()}. A new hub on the manager creates it on first start from BESZEL_FLEET_AUTH; an older hub needs it once, by its superuser, as a verified users record with that Vault password. Never paste the password on a command line.`,
   BESZEL_HUB_UNREACHABLE:
     'The hub runs on the manager; keep it awake and Docker Desktop running, then rerun fleet-sync from the manager so it converges the hub first.',
   BESZEL_NODE_TAILNET_REQUIRED:
     'The worker is not visible on the tailnet. Sign it in to Tailscale and record its tailscaleId in the local roster, then rerun fleet-sync.',
   BESZEL_NOT_ENROLLED:
     'Only workers declared in fleet.json run the agent over SSH; fleet-sync installs the manager’s own agent locally after its hub.',
-};
+});
 function unavailable(code: string): Check[] {
   return [
     {
@@ -159,7 +159,7 @@ function unavailable(code: string): Check[] {
       summary: code,
       remedy: {
         action:
-          REMEDIES[code] ??
+          remedies()[code] ??
           "Verify the manager's private hub is running and the manager has BESZEL_FLEET_AUTH through existing Vault authorization. The normal hub account must access these systems. Inspect duplicate registration/host conflicts before retry; no token or raw response is printed.",
       },
     },

package/src/cli/fleet-sync-output.ts

@@ -19,9 +19,10 @@ const COLUMNS: { title: string; matches: (id: string) => boolean }[] = [
     matches: (id) =>
       [
         't3:service',
-        't3:policy',
+        't3:policy-staged',
+        't3:policy-loaded',
+        't3:running-version',
         't3:providers',
-        't3:antigravity-key',
         't3:private-route',
         'worker:t3-recovery',
         'worker:t3-health',
@@ -30,7 +31,10 @@ const COLUMNS: { title: string; matches: (id: string) => boolean }[] = [
   },
   {
     title: 'LINK',
-    matches: (id) => ['t3:manager-endpoint', 't3:paired-access'].includes(id),
+    matches: (id) =>
+      ['t3:manager-endpoint', 't3:manager-origin', 't3:paired-access'].includes(
+        id
+      ),
   },
   {
     title: 'PROXY',

package/src/cli/fleet-sync-remote.ts

@@ -1,7 +1,8 @@
-import { verifyT3Linked } from '../t3-linked-check';
-import { T3_RESTARTED_SUMMARY } from '../platform/t3-policy';
 import { createHash } from 'node:crypto';
-import { verifyT3Endpoint } from '../t3-endpoint';
+import { IDES } from '../ide';
+import { enabled, workerChecks } from '../ide/orchestrate';
+import { idesOf } from '../ide/definition';
+import { rememberEnvironment } from '../t3/pairing';
 import { authorizePrivilege } from './fleet-sync-privilege';
 import { authorizeVault } from './fleet-sync-vault';
 import { managerFailure } from '../manager-failure';
@@ -11,7 +12,8 @@ import { saveReport } from './fleet-sync-report';
 import { synchronizeMonitoring } from './fleet-sync-monitoring';
 import { convergeManager } from './fleet-sync-manager';
 import { FleetUsageError } from '../errors';
-import { loadConfig, selectNodes } from '../config';
+import { selectNodes } from '../config';
+import { loadRoster } from './roster';
 import { enrolledRoster } from '../definition';
 import type { FleetDefinition } from '../definition';
 import { fleet as definition } from '../fleet-config';
@@ -19,23 +21,27 @@ import { synchronizeManager } from '../manager-sync';
 import { inspectBootstrap } from '../manager-sync';
 import { prepareBootstrap, bootstrapRemote } from '../remote-bootstrap';
 import { machineRoot } from './fleet-sync';
-import type { Runner } from '../types';
-import type { DeployNode } from '../manager-sync';
+import type { Check, Runner } from '../types';
+import type { DeployNode, ManagerReport } from '../manager-sync';
 import type { FleetSyncOptions } from './fleet-sync';
 import type { Settings } from './settings';
 import type { CommandOutcome } from './contracts';
 
+/** `settle` runs once the fleet's result is known and before it is reported:
+ * it records the result and returns the check that says so.
+ */
 export async function selected(
   options: FleetSyncOptions,
   settings: Settings,
-  run: Runner
+  run: Runner,
+  settle?: (report: ManagerReport) => Promise<Check>
 ): Promise<CommandOutcome> {
   if (!options.revision)
     throw new FleetUsageError('An approved source revision is required.');
   const canonical = definition;
   let roster;
   try {
-    roster = enrolledRoster(canonical, await loadConfig(settings.config));
+    roster = enrolledRoster(canonical, await loadRoster(settings.config));
   } catch {
     return enrollmentRequired(canonical, options.revision);
   }
@@ -87,8 +93,13 @@ export async function selected(
         ),
     },
     run,
-    deployWithMonitoring(payload, canonical, run, ui)
+    deployWithMonitoring(payload, canonical, run, {
+      ...ui,
+      workspace: settings.workspace,
+      roster: settings.config,
+    })
   ).finally(() => ui.progress.stop());
+  if (settle) report.checks.push(await settle(report));
   return outcome(report, planFingerprint, started);
 }
 
@@ -151,6 +162,9 @@ function deployWithMonitoring(
   ui: {
     progress: SyncProgress;
     interactiveAuthorization: boolean;
+    /** The manager's checkout, and the roster an identity is recorded in. */
+    workspace: string;
+    roster: string;
   }
 ): DeployNode {
   return async (node, revision) => {
@@ -188,16 +202,15 @@ function deployWithMonitoring(
     // Workers are Linux by definition.
     ui.progress.step(node.id, 'Verifying SSH, OS and T3');
     result.checks.push(...(await inspectBootstrap(node, run, 'linux')));
-    result.checks.push(...(await verifyT3Endpoint(node, run)));
-    // A worker T3 restarted by this sync (idle policy heal) needs a minute or
-    // two before the manager's link reconnects.
-    const restarted = result.checks.some(
-      (check) => check.summary === T3_RESTARTED_SUMMARY
-    );
     result.checks.push(
-      await verifyT3Linked(node, run, {
-        reconnectMs: restarted ? 180_000 : 0,
-      })
+      ...(await workerChecks(enabled(idesOf(canonical), IDES), node, {
+        run,
+        workspace: ui.workspace,
+        earlier: result.checks,
+        remember: async (id, identity) => {
+          await rememberEnvironment(ui.roster, id, identity);
+        },
+      }))
     );
     if (
       result.checks.some(

package/src/cli/fleet-sync-state.ts

@@ -0,0 +1,86 @@
+import type { Enrollment } from '../machine/state';
+import { replicaCheck } from '../state/check';
+import { storeEnrollment } from '../state/enrollment';
+import { adoptEarlier } from '../state/legacy';
+import { databasePath, stateRoot } from '../state/paths';
+import { writeDocument } from '../state/store';
+import { pending, push, type Standing, type StateContext } from '../state/sync';
+import type { Check } from '../types';
+
+/** What one fleet-sync run records in the fleet state: the revision it was
+ * approved for and the configuration it runs with, then what it applied, then
+ * an upload so the bucket holds all of it.
+ */
+export interface RunRecord {
+  /** Before any machine changes: this revision is the approved one. */
+  approve(): void;
+  /** Once the result is known. The check says whether the bucket holds it. */
+  settle(converged: boolean): Promise<Check>;
+  /** For a run that stopped before its result: its approval is still uploaded. */
+  abandon(): Promise<void>;
+}
+
+export function runRecord(
+  previous: Enrollment | null,
+  revision: string,
+  state: {
+    context: StateContext;
+    standing: Standing;
+    env?: NodeJS.ProcessEnv;
+    /** The configuration this run reads from a project's fleet.json. Stored
+     * so that a run started anywhere else (the schedule, a hand-off from a
+     * worker, a replacement manager) uses the one last applied.
+     */
+    definition?: string;
+  }
+): RunRecord {
+  const env = state.env ?? process.env;
+  const approval: Enrollment = {
+    ...previous,
+    version: 1,
+    id: 'manager',
+    approvedRevision: revision,
+  };
+  let settled = false;
+  /** Uploads only what this run changed; otherwise the bucket stands as it
+   * did when the run started.
+   */
+  const publish = (): Promise<Standing> =>
+    pending(state.context)
+      ? push(state.context)
+      : Promise.resolve(state.standing);
+  return {
+    approve: () => {
+      storeEnrollment(approval, env);
+      if (state.definition === undefined) return;
+      adoptEarlier(env);
+      writeDocument(
+        databasePath(stateRoot(env)),
+        'definition',
+        state.definition
+      );
+    },
+    async settle(converged) {
+      settled = true;
+      if (converged)
+        storeEnrollment(
+          {
+            ...approval,
+            appliedRevision: revision,
+            ...(previous?.appliedRevision &&
+            previous.appliedRevision !== revision
+              ? { previousRevision: previous.appliedRevision }
+              : {}),
+          },
+          env
+        );
+      // The fleet converged either way: a bucket problem is reported, not fatal.
+      return replicaCheck(await publish().catch(() => 'unreachable' as const), {
+        advisory: true,
+      });
+    },
+    async abandon() {
+      if (!settled) await publish().catch(() => undefined);
+    },
+  };
+}