@crvouga/dev-fleet 0.1.0 → 0.3.0

package/src/monitoring/beszel.ts

@@ -1,4 +1,5 @@
 import { fleet } from '../fleet-config';
+import lock from '../../ansible/monitoring/lock.json';
 import type { Check } from '../types';
 
 export interface BeszelEvidence {
@@ -31,7 +32,7 @@ function check(
 /** Public dashboard hostname served through the Cloudflare
  * tunnel `beszel`. Agents and the manager keep using the private hub URL.
  */
-export const PUBLIC_HUB_URL = fleet.services.monitoring.publicUrl;
+export const publicHubUrl = (): string => fleet.services.monitoring.publicUrl;
 
 export function privateHub(value: string): string {
   const url = new URL(value);
@@ -49,7 +50,8 @@ export function privateHub(value: string): string {
   return url.origin;
 }
 
-/** Read-only PocketBase endpoints, verified against upstream Beszel v0.21.1.
+/** Read-only PocketBase endpoints, verified against the upstream Beszel
+ * release `ansible/monitoring/lock.json` pins.
  * Never return raw records: they may contain tokens, hosts or user information.
  */
 export async function verifyBeszel(
@@ -63,7 +65,7 @@ export async function verifyBeszel(
   const result: BeszelEvidence = { dashboardUrl, checks: [], receivedAt: null };
   try {
     const info = await request('/api/beszel/info');
-    if (!object(info) || info['v'] !== '0.21.1') {
+    if (!object(info) || info['v'] !== lock.version) {
       result.checks.push(
         check(
           'version',
@@ -75,7 +77,12 @@ export async function verifyBeszel(
       return result;
     }
     result.checks.push(
-      check('version', 'pass', 'Authenticated hub reports 0.21.1.', 'None.')
+      check(
+        'version',
+        'pass',
+        `Authenticated hub reports ${lock.version}.`,
+        'None.'
+      )
     );
     const filter = encodeURIComponent(`name="${node}"`);
     const records = items(

package/src/monitoring/enroll.ts

@@ -1,6 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { record } from '../config';
 import { privateHub } from './beszel';
+import lock from '../../ansible/monitoring/lock.json';
 
 export type HubRequest = (path: string, body?: object) => Promise<unknown>;
 export interface AgentEnrollment {
@@ -101,7 +102,7 @@ async function hubInfo(
   const info = await request('/api/beszel/info');
   if (
     !record(info) ||
-    info['v'] !== '0.21.1' ||
+    info['v'] !== lock.version ||
     typeof info['key'] !== 'string' ||
     !info['key'].startsWith('ssh-ed25519 ')
   )

package/src/monitoring/hub-access.ts

@@ -7,14 +7,15 @@ import { fleet, secret } from '../fleet-config';
  * Its password is the fleet's monitoring-account-password secret. A fresh hub on the
  * manager creates the account itself on first start (hub-darwin.yml).
  */
-export const BESZEL_FLEET_IDENTITY = fleet.services.monitoring.managerAccount;
+export const fleetIdentity = (): string =>
+  fleet.services.monitoring.managerAccount;
 
 /** Read-only Beszel user the hub signs every visitor in as (AUTO_LOGIN), so the
  * dashboard needs no login. Create it once in the hub (Settings > Users, role
  * "Read-only"); it holds no secret and must never be an admin. If the account
  * does not exist the hub simply shows its normal login page.
  */
-export const BESZEL_PUBLIC_VIEWER_IDENTITY =
+export const publicViewerIdentity = (): string =>
   fleet.services.monitoring.viewerAccount;
 
 /** Accept the plain password, or a legacy JSON identity/password pair. */
@@ -39,7 +40,7 @@ export function fleetCredentials(secret: string): {
       throw new Error('BESZEL_ACCOUNT_INVALID');
     return { identity: parsed['identity'], password: parsed['password'] };
   }
-  return { identity: BESZEL_FLEET_IDENTITY, password: value };
+  return { identity: fleetIdentity(), password: value };
 }
 
 /** The fleet login from the manager's Vault session, or null when absent.

package/src/monitoring/hub-backup.ts

@@ -0,0 +1,121 @@
+import { record } from '../config';
+import type { Check } from '../types';
+import {
+  LOCAL_HUB,
+  api,
+  superuserToken,
+  type HubLogin,
+  type Session,
+} from './hub-viewer';
+
+/** A scheduled backup older than this means the schedule is not running. */
+export const BACKUP_MAX_AGE_MS = 48 * 60 * 60 * 1000;
+
+function backupCheck(
+  status: Check['status'],
+  summary: string,
+  action?: string
+): Check {
+  return {
+    id: 'beszel:backup',
+    status,
+    summary,
+    ...(action ? { remedy: { action } } : {}),
+  };
+}
+
+const SETTINGS =
+  'Open the hub as its superuser (/_/ on the manager), Settings > Backups.';
+
+/** Reads, never changes, the hub's own backup settings and its list of
+ * backups through the stock PocketBase API of the pinned release (superuser
+ * only: GET /api/settings and GET /api/backups). Backups are configured in
+ * the hub's UI; this says whether they are scheduled, kept off the manager
+ * and recent. Storage names, keys and endpoints are never reported.
+ */
+export async function verifyHubBackups(
+  login: HubLogin | null,
+  fetcher: typeof fetch = fetch,
+  base: string = LOCAL_HUB,
+  now: number = Date.now()
+): Promise<Check> {
+  if (!login)
+    return backupCheck(
+      'skip',
+      'BESZEL_BACKUP_UNVERIFIED',
+      "The fleet admin login is unavailable, so the hub's backups were not read. Log the manager's Vault session in and rerun fleet-sync."
+    );
+  let settings: unknown;
+  let backups: unknown;
+  try {
+    const anonymous: Session = { fetcher, base, token: '' };
+    const session = {
+      ...anonymous,
+      token: await superuserToken(anonymous, login),
+    };
+    settings = await api(session, 'GET', '/api/settings');
+    backups = await api(session, 'GET', '/api/backups');
+  } catch {
+    return backupCheck(
+      'warn',
+      'BESZEL_BACKUP_UNVERIFIED',
+      `The hub's backup settings could not be read with the fleet admin login. ${SETTINGS} Details are withheld.`
+    );
+  }
+  const policy = backupPolicy(settings);
+  if (!policy || !Array.isArray(backups))
+    return backupCheck(
+      'warn',
+      'BESZEL_BACKUP_UNVERIFIED',
+      `The hub answered in a form this release does not expect. ${SETTINGS}`
+    );
+  if (!policy.cron)
+    return backupCheck(
+      'warn',
+      'BESZEL_BACKUP_UNSCHEDULED',
+      `The hub takes no scheduled backups, so its history, settings and machine identities are lost with the manager. ${SETTINGS} Set a schedule and how many to keep.`
+    );
+  if (!policy.offHost)
+    return backupCheck(
+      'warn',
+      'BESZEL_BACKUP_OFFHOST_REQUIRED',
+      `Scheduled backups stay on the manager's disk, which is not disaster recovery. ${SETTINGS} Store them in existing encrypted S3-compatible storage you already approved; do not create new storage or reuse unrelated credentials.`
+    );
+  const newest = newestBackup(backups);
+  if (newest === null || now - newest > BACKUP_MAX_AGE_MS)
+    return backupCheck(
+      'warn',
+      'BESZEL_BACKUP_STALE',
+      `No backup newer than ${BACKUP_MAX_AGE_MS / 3_600_000} hours is listed although a schedule is set. ${SETTINGS} Check the schedule and the storage's credentials, then create a backup by hand.`
+    );
+  return backupCheck(
+    'pass',
+    `Scheduled backups go to off-host storage, keeping ${policy.keep}; the newest is from ${new Date(newest).toISOString()}.`
+  );
+}
+
+function backupPolicy(
+  settings: unknown
+): { cron: string; keep: number; offHost: boolean } | null {
+  if (!record(settings) || !record(settings['backups'])) return null;
+  const backups = settings['backups'];
+  const s3 = record(backups['s3']) ? backups['s3'] : {};
+  return {
+    cron: typeof backups['cron'] === 'string' ? backups['cron'].trim() : '',
+    keep:
+      typeof backups['cronMaxKeep'] === 'number' ? backups['cronMaxKeep'] : 0,
+    offHost: s3['enabled'] === true,
+  };
+}
+
+/** PocketBase lists `modified` as "2006-01-02 15:04:05.000Z". */
+function newestBackup(backups: unknown[]): number | null {
+  const times = backups
+    .map((entry) =>
+      record(entry) && typeof entry['modified'] === 'string'
+        ? Date.parse(entry['modified'].replace(' ', 'T'))
+        : NaN
+    )
+    .filter(Number.isFinite);
+  return times.length ? Math.max(...times) : null;
+}

package/src/monitoring/hub-viewer.ts

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { record } from '../config';
 import type { Check } from '../types';
-import { BESZEL_PUBLIC_VIEWER_IDENTITY } from './hub-access';
+import { publicViewerIdentity } from './hub-access';
 
 /** Loopback address of the hub container on the manager. */
 export const LOCAL_HUB = 'http://127.0.0.1:8090';
@@ -25,13 +25,13 @@ function viewerCheck(
   };
 }
 
-interface Session {
+export interface Session {
   fetcher: Fetcher;
   base: string;
   token: string;
 }
 
-async function api(
+export async function api(
   session: Session,
   method: string,
   path: string,
@@ -52,7 +52,7 @@ async function api(
   return response.json() as Promise<unknown>;
 }
 
-async function superuserToken(
+export async function superuserToken(
   session: Session,
   login: HubLogin
 ): Promise<string> {
@@ -70,7 +70,7 @@ async function superuserToken(
 async function findViewer(
   session: Session
 ): Promise<{ id: string; role: unknown } | null> {
-  const filter = encodeURIComponent(`email="${BESZEL_PUBLIC_VIEWER_IDENTITY}"`);
+  const filter = encodeURIComponent(`email="${publicViewerIdentity()}"`);
   const list = await api(
     session,
     'GET',
@@ -86,7 +86,7 @@ async function findViewer(
 async function createViewer(session: Session): Promise<void> {
   const password = randomBytes(24).toString('base64url');
   await api(session, 'POST', '/api/collections/users/records', {
-    email: BESZEL_PUBLIC_VIEWER_IDENTITY,
+    email: publicViewerIdentity(),
     username: 'public-viewer',
     password,
     passwordConfirm: password,
@@ -130,13 +130,13 @@ export async function ensurePublicViewer(
     if (verified?.role !== 'readonly') throw new Error('BESZEL_VIEWER_ROLE');
     return viewerCheck(
       'pass',
-      `Visitors are signed in automatically as ${BESZEL_PUBLIC_VIEWER_IDENTITY} (read-only).`
+      `Visitors are signed in automatically as ${publicViewerIdentity()} (read-only).`
     );
   } catch {
     return viewerCheck(
       'warn',
       'BESZEL_VIEWER_UNVERIFIED',
-      `Could not create or verify the read-only ${BESZEL_PUBLIC_VIEWER_IDENTITY} user with the fleet admin login. Create it in the hub (Settings > Users, role Read-only); never make it an admin. Details are withheld.`
+      `Could not create or verify the read-only ${publicViewerIdentity()} user with the fleet admin login. Create it in the hub (Settings > Users, role Read-only); never make it an admin. Details are withheld.`
     );
   }
 }

package/src/monitoring/hub.ts

@@ -1,6 +1,6 @@
 import { record } from '../config';
 import type { Check, Runner } from '../types';
-import { PUBLIC_HUB_URL } from './beszel';
+import { publicHubUrl } from './beszel';
 import { secretVia } from '../fleet-config';
 
 /** Shared Beszel hub helpers. The hub runs only on the manager; see
@@ -11,14 +11,14 @@ export function publicEndpointCheck(connected: boolean): Check {
     ? {
         id: 'beszel:public-endpoint',
         status: 'pass',
-        summary: `Cloudflare connector for ${PUBLIC_HUB_URL} was started from the Vault credential.`,
+        summary: `Cloudflare connector for ${publicHubUrl()} was started from the Vault credential.`,
       }
     : {
         id: 'beszel:public-endpoint',
         status: 'warn',
         summary: 'BESZEL_TUNNEL_CREDENTIAL_UNAVAILABLE',
         remedy: {
-          action: `Create the Cloudflare tunnel and store its token in the fleet's secrets, then log the manager's Vault session in with read access to secret/beszel/tunnel and rerun fleet-sync. The private dashboard is unaffected; ${PUBLIC_HUB_URL} stays offline until then.`,
+          action: `Create the Cloudflare tunnel and store its token in the fleet's secrets, then log the manager's Vault session in with read access to secret/beszel/tunnel and rerun fleet-sync. The private dashboard is unaffected; ${publicHubUrl()} stays offline until then.`,
         },
       };
 }

package/src/monitoring/manager-hub.ts

@@ -1,19 +1,23 @@
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { delimiter, join, resolve } from 'node:path';
+import { runAnsible } from '../platform/ansible';
 import { runAnsibleWithReceipt } from '../platform/ansible-receipt';
 import { failure, inspectRoute, publicEndpointCheck, tunnelToken } from './hub';
-import { BESZEL_PUBLIC_VIEWER_IDENTITY, fleetAccount } from './hub-access';
+import { publicViewerIdentity, fleetAccount } from './hub-access';
 import { ensurePublicViewer, type HubLogin } from './hub-viewer';
+import { verifyHubBackups } from './hub-backup';
 import type { FleetDefinition } from '../definition';
 import { hostId, hubUrl } from '../topology';
-import { PUBLIC_HUB_URL, privateHub } from './beszel';
+import { publicHubUrl, privateHub } from './beszel';
 import type { Check, Runner } from '../types';
 
 /** Bundled CLI of the Tailscale macOS app when no `tailscale` is on PATH. */
 export const TAILSCALE_APP_CLI =
   '/Applications/Tailscale.app/Contents/MacOS/Tailscale';
 const LOCAL_HUB = 'http://127.0.0.1:8090';
+/** The one place the route is declared; `hub-route-darwin.yml` receives it. */
+export const HUB_ROUTE = { port: '8443', proxy: LOCAL_HUB };
 
 /** Per-user hub paths on the manager. Data stays in the human's home (and its
  * normal backups); it is never copied to a worker.
@@ -52,12 +56,15 @@ export interface ManagerHubOptions {
   receipts?: string;
   /** Ensures the read-only AUTO_LOGIN user; defaults to the loopback hub API. */
   viewer?: (login: HubLogin | null) => Promise<Check>;
+  /** Reads the hub's backup settings; defaults to the loopback hub API. */
+  backups?: (login: HubLogin | null) => Promise<Check>;
 }
 
 /** Converges the singleton Beszel hub locally on the manager: pinned Compose
  * under Docker Desktop, the connector token from the manager's own Vault
  * session (private variables file, never argv or output), a private Tailscale
- * Serve route, then independent health checks locally and over the tailnet.
+ * Serve route (its own playbook), then independent health checks locally and
+ * over the tailnet.
  */
 export async function convergeManagerHub(
   root: string,
@@ -105,7 +112,7 @@ export async function convergeManagerHub(
       'Inspect Docker Desktop, the Compose image, file sharing for ~/Library/Application Support and disk space. Existing data is never deleted.'
     );
   const route = await servePrivateRoute(
-    hub,
+    { hub, monitoring },
     run,
     options.tailscale === undefined ? tailscaleCommand() : options.tailscale
   );
@@ -120,6 +127,7 @@ export async function convergeManagerHub(
     },
     publicEndpointCheck(tunnel !== null),
     await ensureViewer(options, account),
+    await (options.backups ?? verifyHubBackups)(account),
   ];
 }
 
@@ -131,8 +139,8 @@ function hubVariables(
 ): Record<string, string> {
   return {
     beszel_hub_url: hub,
-    beszel_public_url: PUBLIC_HUB_URL,
-    beszel_auto_login: BESZEL_PUBLIC_VIEWER_IDENTITY,
+    beszel_public_url: publicHubUrl(),
+    beszel_auto_login: publicViewerIdentity(),
     beszel_data_dir: paths.data,
     beszel_tunnel_dir: paths.tunnel,
     ...(tunnel ? { beszel_tunnel_token: tunnel } : {}),
@@ -175,8 +183,11 @@ async function preconditions(
   return null;
 }
 
+/** `hub-route-darwin.yml` publishes the route when its port has no owner; this
+ * refuses a conflicting owner beforehand and measures the result.
+ */
 async function servePrivateRoute(
-  hub: string,
+  { hub, monitoring }: { hub: string; monitoring: string },
   run: Runner,
   cli: string | null
 ): Promise<Check[] | null> {
@@ -191,21 +202,26 @@ async function servePrivateRoute(
       'BESZEL_PRIVATE_ROUTE_UNVERIFIED',
       'Inspect Tailscale Serve permission and existing private routes before retry.'
     );
-  const route = inspectRoute(status.stdout, hub);
+  const route = inspectRoute(status.stdout, hub, HUB_ROUTE);
   if (Array.isArray(route)) return route;
   if (!route) {
-    const serve = [cli, 'serve', '--bg', '--https=8443', LOCAL_HUB] as const;
-    const applied =
-      (await run([...serve], { timeoutMs: 20_000 })).ok ||
-      (await run(['sudo', '-n', ...serve], { timeoutMs: 20_000 })).ok;
-    if (!applied)
+    const published = await runAnsible(run, 'hub-route-darwin.yml', {
+      cwd: monitoring,
+      input: JSON.stringify({
+        beszel_tailscale_cli: cli,
+        beszel_route_port: HUB_ROUTE.port,
+        beszel_route_target: HUB_ROUTE.proxy,
+      }),
+      timeoutMs: 120_000,
+    });
+    if (!published.ok)
       return failure(
         'BESZEL_PRIVATE_ROUTE_REQUIRED',
         'Allow Tailscale Serve (HTTPS certificates) for this tailnet and approve it in the Tailscale app if asked; no tailnet policy or public ingress is changed.'
       );
   }
   const verified = await run([cli, 'serve', 'status', '--json']);
-  if (!verified.ok || inspectRoute(verified.stdout, hub) !== true)
+  if (!verified.ok || inspectRoute(verified.stdout, hub, HUB_ROUTE) !== true)
     return failure(
       'BESZEL_PRIVATE_ROUTE_UNVERIFIED',
       'The requested route was not independently observed after application. Inspect Serve permissions and configuration; installer success is insufficient.'

package/src/node-converge-linux.ts

@@ -6,12 +6,19 @@ import { verifyUbuntuBoot } from './platform/ubuntu-verify';
 import { verifyResourceSafety } from './platform/resource-verify';
 import { convergeT3Route, T3_ROUTE } from './platform/t3-route';
 import { convergeProxy } from './proxy-converge';
-import { providerNames } from './t3/names-check';
-import { machineProviders } from './t3/providers';
+import { IDES } from './ide';
+import { enabled, settingsChecks } from './ide/orchestrate';
+import { idesOf } from './ide/definition';
+import { fleet } from './fleet-config';
 import { quotaLimited, verifyFleetProviders } from './agents/fleet-verify';
 import { verifyNativeAgents } from './agents/native-verify';
+import { accountContext, nodeAccountChecks } from './accounts/context';
 import { managedT3, managedT3Desktop } from '../bootstrap/native-t3';
-import { convergeT3Service, t3StartedAt } from './platform/t3-service';
+import {
+  convergeT3Service,
+  runningVersionCheck,
+  t3StartedAt,
+} from './platform/t3-service';
 import { userInfo } from 'node:os';
 import { resolve } from 'node:path';
 import { auditUbuntu } from './platform/ubuntu-audit';
@@ -74,10 +81,19 @@ export async function convergeLinux(
     verifyFleetProviders(node)
   );
   checks.push(...providers);
+  const accounts = await accountContext();
+  checks.push(
+    ...(await attempt('accounts:verification', () =>
+      nodeAccountChecks(accounts)
+    ))
+  );
   checks.push(
     ...(await attempt('agent:verification', () =>
       verifyNativeAgents(node, root, run, {
         outOfQuota: quotaLimited(providers),
+        // Where T3 starts them: the environment of its user service.
+        t3Service: true,
+        ...(accounts ? { accounts } : {}),
       })
     ))
   );
@@ -234,13 +250,20 @@ async function convergeT3(
         restarted: startedAt !== (await t3StartedAt(run)),
       })
     );
-  // Settings are watched by T3: providers arrive and stale ones leave at once.
-  checks.push(await machineProviders(node, root, true));
-  // Names live in the same settings, so they conform without a restart.
-  checks.push(await providerNames(node, root, true));
+  // Settings are watched by T3: providers, names and the profile apply
+  // without a restart.
+  checks.push(
+    ...(await settingsChecks(enabled(idesOf(fleet), IDES), {
+      id: node,
+      workspace: root,
+      apply: true,
+      run,
+    }))
+  );
   const serviceReady = checks.some(
     (check) => check.id === 't3:service' && check.status === 'pass'
   );
+  if (serviceReady) checks.push(await runningVersionCheck(run, userInfo().uid));
   if (serviceReady)
     checks.push(
       ...(await convergeT3Route(run, () => publishT3Route(root, run)))

package/src/package-info.ts

@@ -0,0 +1,45 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/** Where this code's own files live: the published package, or a checkout. */
+export const PACKAGE_ROOT = fileURLToPath(new URL('..', import.meta.url));
+
+export interface PackageInfo {
+  name: string;
+  version: string;
+  /** The commit this package was published from; null in a checkout. */
+  revision: string | null;
+  /** Where a defect or a feature request is raised (`bugs` in the manifest). */
+  issues: string | null;
+}
+
+function issueTracker(bugs: unknown): string | null {
+  const url =
+    typeof bugs === 'object' && bugs !== null
+      ? (bugs as { url?: unknown }).url
+      : bugs;
+  return typeof url === 'string' && /^https:\/\/\S+$/.test(url) ? url : null;
+}
+
+/** What the running package says about itself. The release workflow stamps
+ * the version and the commit (`gitHead`) into the package it publishes, so an
+ * installed dev-fleet knows which revision every machine has to run. A
+ * checkout carries neither: its revision is its own HEAD. The issue tracker
+ * comes from the manifest too, so a fork sends its users to its own.
+ */
+export function packageInfo(root = PACKAGE_ROOT): PackageInfo {
+  const manifest = JSON.parse(
+    readFileSync(join(root, 'package.json'), 'utf8')
+  ) as { name?: unknown; version?: unknown; gitHead?: unknown; bugs?: unknown };
+  const { gitHead } = manifest;
+  return {
+    name: String(manifest.name),
+    version: String(manifest.version),
+    revision:
+      typeof gitHead === 'string' && /^[a-f0-9]{40}$/.test(gitHead)
+        ? gitHead
+        : null,
+    issues: issueTracker(manifest.bugs),
+  };
+}

package/src/platform/ansible.ts

@@ -1,27 +1,31 @@
 import { mkdir, mkdtemp, writeFile, rm } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
-import { delimiter, join } from 'node:path';
+import { join } from 'node:path';
 import { homedir } from 'node:os';
-import macos from '../../ansible/macos/policy.json';
+import { PACKAGE_ROOT } from '../package-info';
 import type { Runner, CommandOptions, CommandResult } from '../types';
 
-/** Ubuntu provides ansible-core through APT; macOS runs the pinned release through
- * uv's isolated tool runner so no global Python environment is modified.
+/** The Ansible each machine runs playbooks with, pinned either way. A worker
+ * has the exact `ansible-core` package the Ubuntu policy names. The manager
+ * runs the project in `ansible/` (`pyproject.toml`, `uv.lock`): one release on
+ * one Python, every dependency checked against its locked hash, in a
+ * throwaway environment. No global Python environment is modified, nothing is
+ * written into the checkout, and an `ansible-playbook` that happens to be on
+ * PATH is never used.
  */
 export function ansibleCommand(
-  path = process.env['PATH'] ?? '',
-  exists: (candidate: string) => boolean = existsSync
+  platform: NodeJS.Platform = process.platform,
+  root = PACKAGE_ROOT
 ): string[] {
-  const found = path
-    .split(delimiter)
-    .filter(Boolean)
-    .some((directory) => exists(join(directory, 'ansible-playbook')));
-  return found
+  return platform === 'linux'
     ? ['ansible-playbook']
     : [
-        'uvx',
-        '--from',
-        `ansible-core==${macos.ansibleCore}`,
+        'uv',
+        'run',
+        '--project',
+        join(root, 'ansible'),
+        '--locked',
+        '--isolated',
+        '--quiet',
         'ansible-playbook',
       ];
 }

package/src/platform/darwin.ts

@@ -176,19 +176,6 @@ export class DarwinPlatform implements Platform {
     );
   }
 
-  vscodeSettingsPath(): string | null {
-    return join(
-      homedir(),
-      'Library/Application Support/Code/User/settings.json'
-    );
-  }
-
-  vscodeCliBinaries(): readonly string[] {
-    return [
-      '/Applications/Visual Studio Code.app/Contents/Resources/app/bin/code',
-    ].filter((p) => existsSync(p));
-  }
-
   installScheduledJob(job: ScheduledJob): NotifierTestResult {
     return installLaunchdJob(job);
   }

package/src/platform/fallback.ts

@@ -78,14 +78,6 @@ export class FallbackPlatform implements Platform {
     return [];
   }
 
-  vscodeSettingsPath(): string | null {
-    return null;
-  }
-
-  vscodeCliBinaries(): readonly string[] {
-    return [];
-  }
-
   installScheduledJob(job: ScheduledJob): NotifierTestResult {
     return {
       ok: false,

package/src/platform/linux.ts

@@ -115,16 +115,6 @@ export class LinuxPlatform implements Platform {
     );
   }
 
-  vscodeSettingsPath(): string | null {
-    const base =
-      process.env['XDG_CONFIG_HOME']?.trim() || join(homedir(), '.config');
-    return join(base, 'Code/User/settings.json');
-  }
-
-  vscodeCliBinaries(): readonly string[] {
-    return ['/usr/share/code/bin/code'].filter((p) => existsSync(p));
-  }
-
   installScheduledJob(job: ScheduledJob): NotifierTestResult {
     return installSystemdJob(job);
   }