@crvouga/dev-fleet 0.2.0 → 0.3.0

package/src/cli/fleet-accounts.ts

@@ -0,0 +1,253 @@
+import { rm } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { FleetUsageError } from '../errors';
+import { fleet } from '../fleet-config';
+import { runCommand } from '../runner';
+import { blocking, type Check, type Runner } from '../types';
+import {
+  nativeLoginCheck,
+  nativeLogins,
+  providerAccountChecks,
+  rosterCurrentCheck,
+} from '../accounts/checks';
+import { exposedVersion, t3Settings } from '../accounts/context';
+import { parseRoster, type ProxyRoster } from '../accounts/roster';
+import { exposedInstances } from '../accounts/sessions';
+import { forwardSourceOperation, ownerCheckout } from './source-operations';
+import type { CommandOutcome } from './contracts';
+import type { Settings } from './settings';
+import { fleetSync } from './fleet-sync';
+
+export interface FleetAccountsOptions {
+  diff?: boolean;
+  add?: boolean;
+  relogin?: boolean;
+  remove?: boolean;
+  removeNativeLogins?: boolean;
+  yes?: boolean;
+}
+
+export interface AccountsDependencies {
+  run?: Runner;
+  /** Runs a proxy command attached to the terminal (a sign-in). */
+  operate?: (args: string[]) => Promise<number>;
+  /** `fleet-sync --only accounts`. */
+  propagate?: () => Promise<CommandOutcome>;
+  home?: string;
+  settingsFile?: string;
+}
+
+const PROVIDER = /^[a-z][a-z0-9-]{0,31}$/;
+
+/** `devfleet fleet-accounts`: the provider account roster the proxy holds,
+ * each account's state, and the account checks. `--add`, `--relogin` and
+ * `--remove` change one account on the proxy and propagate the result to
+ * every node at once.
+ */
+export async function fleetAccounts(
+  options: FleetAccountsOptions,
+  args: string[],
+  settings: Settings,
+  dependencies: AccountsDependencies = {}
+): Promise<CommandOutcome> {
+  const home = dependencies.home ?? homedir();
+  if (options.removeNativeLogins)
+    return removeNativeLogins(Boolean(options.yes), home);
+  const change = lifecycle(options, args);
+  const changed = change
+    ? await applyChange(change, settings, dependencies)
+    : undefined;
+  if (changed && !changed.data) return failedChange();
+  return report(options, settings, dependencies, { change, changed });
+}
+
+async function report(
+  options: FleetAccountsOptions,
+  settings: Settings,
+  dependencies: AccountsDependencies,
+  {
+    change,
+    changed,
+  }: { change: string[] | null; changed: CommandOutcome | undefined }
+): Promise<CommandOutcome> {
+  const home = dependencies.home ?? homedir();
+  const roster = await readRoster(
+    dependencies.run ?? runCommand,
+    settings.workspace
+  );
+  const checks: Check[] = providerAccountChecks(
+    roster,
+    fleet.services.proxy.accounts?.minimumUsable
+  );
+  if (options.diff)
+    checks.push(...(await thisMachine(roster, home, dependencies)));
+  const ok = !checks.some(blocking) && !changed?.exitCode;
+  return {
+    exitCode: ok ? 0 : 1,
+    data: {
+      version: 1,
+      command: 'fleet-accounts',
+      ok,
+      ...listing(roster),
+      checks,
+      ...(change && {
+        changed: change.slice(0, 2),
+        propagation: changed?.data,
+      }),
+    },
+  };
+}
+
+/** The roster as listed: no routing prefix, no file. */
+function listing(roster: ProxyRoster) {
+  return {
+    rosterVersion: roster.rosterVersion,
+    managementApi: roster.managementApi,
+    accounts: roster.accounts.map(
+      ({ provider, index, label, state, until }) => ({
+        provider,
+        index,
+        label,
+        state,
+        until,
+      })
+    ),
+  };
+}
+
+/** Runs the change on the proxy, then propagates it to every node. A change
+ * the proxy did not complete answers with no data: nothing was propagated.
+ */
+async function applyChange(
+  change: string[],
+  settings: Settings,
+  dependencies: AccountsDependencies
+): Promise<CommandOutcome> {
+  const operate =
+    dependencies.operate ??
+    ((forwarded: string[]) =>
+      forwardSourceOperation(['cliproxy', ...forwarded], settings));
+  if ((await operate(change)) !== 0) return { exitCode: 1, data: null };
+  return (
+    dependencies.propagate ??
+    (() => fleetSync({ only: 'accounts', json: true }, settings))
+  )();
+}
+
+function failedChange(): CommandOutcome {
+  return {
+    exitCode: 1,
+    data: {
+      version: 1,
+      command: 'fleet-accounts',
+      ok: false,
+      error: 'ACCOUNT_CHANGE_FAILED',
+      summary:
+        'The proxy did not complete the change; an interrupted sign-in leaves no credential behind. Nothing was propagated.',
+    },
+  };
+}
+
+/** `--diff`: what this machine offers against the roster. */
+async function thisMachine(
+  roster: ProxyRoster,
+  home: string,
+  dependencies: AccountsDependencies
+): Promise<Check[]> {
+  const exposed = await exposedInstances(
+    dependencies.settingsFile ?? t3Settings()
+  );
+  return [
+    rosterCurrentCheck(roster.rosterVersion, exposedVersion(exposed)),
+    nativeLoginCheck(nativeLogins(home)),
+  ];
+}
+
+/** The proxy command a lifecycle flag stands for, or null for a listing. */
+function lifecycle(
+  options: FleetAccountsOptions,
+  [provider, index]: string[]
+): string[] | null {
+  const chosen = (['add', 'relogin', 'remove'] as const).filter(
+    (flag) => options[flag]
+  );
+  if (chosen.length === 0) return null;
+  if (chosen.length > 1)
+    throw new FleetUsageError('Choose one of --add, --relogin and --remove.');
+  const flag = chosen[0]!;
+  if (!provider || !PROVIDER.test(provider))
+    throw new FleetUsageError(
+      `--${flag} needs a provider, such as claude or codex.`
+    );
+  if (flag === 'add') return ['add-account', provider];
+  if (!index || !/^[1-9][0-9]{0,3}$/.test(index))
+    throw new FleetUsageError(
+      `--${flag} needs the account's index, as devfleet fleet-accounts lists it.`
+    );
+  return [flag === 'relogin' ? 'relogin' : 'remove-account', provider, index];
+}
+
+/** The roster as the proxy on this manager reports it. */
+async function readRoster(
+  run: Runner,
+  workspace: string
+): Promise<ProxyRoster> {
+  const checkout = ownerCheckout(workspace);
+  if (!checkout)
+    throw new FleetUsageError(
+      'The account roster is kept by the proxy on the manager. Run devfleet fleet-accounts there, after a first fleet-sync.'
+    );
+  const result = await run(
+    [
+      'python3',
+      '-B',
+      join(checkout, 'cliproxy/scripts/cli.py'),
+      'accounts',
+      '--json',
+    ],
+    { cwd: checkout, timeoutMs: 60_000 }
+  );
+  try {
+    if (!result.ok) throw new Error();
+    return parseRoster(result.stdout);
+  } catch {
+    throw new FleetUsageError(
+      'The proxy did not report its accounts. Check it with devfleet cliproxy status.'
+    );
+  }
+}
+
+/** Opt-in: deletes the provider logins agent CLIs keep outside the proxy. */
+async function removeNativeLogins(
+  yes: boolean,
+  home: string
+): Promise<CommandOutcome> {
+  const found = nativeLogins(home);
+  if (!yes)
+    return {
+      exitCode: found.length ? 1 : 0,
+      data: {
+        version: 1,
+        command: 'fleet-accounts',
+        ok: found.length === 0,
+        applied: false,
+        checks: [nativeLoginCheck(found)],
+        next: found.length
+          ? 'Add --yes to remove these logins from this machine.'
+          : undefined,
+      },
+    };
+  for (const login of found) await rm(login.path, { force: true });
+  return {
+    exitCode: 0,
+    data: {
+      version: 1,
+      command: 'fleet-accounts',
+      ok: true,
+      applied: true,
+      removed: [...new Set(found.map((login) => login.cli))].sort(),
+      checks: [nativeLoginCheck(nativeLogins(home))],
+    },
+  };
+}

package/src/cli/fleet-sync-accounts.ts

@@ -0,0 +1,58 @@
+import { enrolledRoster } from '../definition';
+import { selectNodes } from '../config';
+import { fleet as definition } from '../fleet-config';
+import { bundleProbe } from '../transport';
+import { machineProviders } from '../t3/providers';
+import { accountContext, nodeAccountChecks } from '../accounts/context';
+import { propagateAccounts } from '../accounts/propagate';
+import { loadRoster } from './roster';
+import { ownerCheckout } from './source-operations';
+import type { Check, FleetNode, Runner } from '../types';
+import type { FleetSyncOptions } from './fleet-sync';
+import type { Settings } from './settings';
+import type { CommandOutcome } from './contracts';
+
+/** `fleet-sync --only accounts` on the manager. */
+export async function syncAccounts(
+  options: FleetSyncOptions,
+  settings: Settings,
+  { revision, run }: { revision: string; run: Runner }
+): Promise<CommandOutcome> {
+  let nodes: FleetNode[] = [];
+  try {
+    nodes = selectNodes(
+      enrolledRoster(definition, await loadRoster(settings.config)),
+      options.node ?? []
+    );
+  } catch {
+    // No enrolled worker yet: the manager alone.
+  }
+  return propagateAccounts({
+    nodes,
+    revision,
+    source: await bundleProbe(),
+    manager: () => managerAccounts(settings.workspace),
+    run,
+  });
+}
+
+/** The manager's own account instances, from the checkout it runs. */
+export async function managerAccounts(workspace: string): Promise<Check[]> {
+  const checkout = ownerCheckout(workspace);
+  if (!checkout)
+    return [
+      {
+        id: 't3:providers',
+        status: 'fail',
+        summary: 'No revision is applied on the manager yet.',
+        remedy: {
+          action: 'Run a full fleet-sync first.',
+          command: 'devfleet fleet-sync',
+        },
+      },
+    ];
+  return [
+    await machineProviders(definition.manager.id, checkout, true),
+    ...(await nodeAccountChecks(await accountContext())),
+  ];
+}

package/src/cli/fleet-sync-manager.ts

@@ -6,11 +6,13 @@ import { convergeProxy } from '../proxy-converge';
 import { attempt } from '../node-converge-shared';
 import { quotaLimited, verifyFleetProviders } from '../agents/fleet-verify';
 import { verifyNativeAgents } from '../agents/native-verify';
+import { accountContext, nodeAccountChecks } from '../accounts/context';
 import { convergeManagerHub } from '../monitoring/manager-hub';
 import { enrollManagerMonitoring } from './fleet-sync-monitoring';
 import { installConfig } from '../fleet-config';
-import { machineProviders } from '../t3/providers';
-import { providerNames } from '../t3/names-check';
+import { IDES } from '../ide';
+import { enabled, managerChecks } from '../ide/orchestrate';
+import { idesOf } from '../ide/definition';
 import macos from '../../ansible/macos/policy.json';
 import { ansibleCommand } from '../platform/ansible';
 import { PACKAGE_ROOT } from '../package-info';
@@ -39,8 +41,15 @@ export async function convergeManager(
     if (input.apply) installConfig();
     checks.push(await managerPower(run, input.workspace));
     checks.push(await managerDocker(run));
-    checks.push(await machineProviders(id, input.workspace, input.apply));
-    checks.push(await providerNames(id, input.workspace, input.apply));
+    // Each enabled IDE: its settings, pinned version and policy.
+    checks.push(
+      ...(await managerChecks(enabled(idesOf(definition), IDES), {
+        id,
+        workspace: input.workspace,
+        apply: input.apply,
+        run,
+      }))
+    );
     if (input.apply) {
       // Same provider profiles and the same Vault gateway credential as every
       // worker: the instances above launch from these profiles, and the check
@@ -55,10 +64,17 @@ export async function convergeManager(
       );
       checks.push(...providers);
       // Same agents, versions and shared accounts as every worker.
+      const accounts = await accountContext();
+      checks.push(
+        ...(await attempt('accounts:verification', () =>
+          nodeAccountChecks(accounts)
+        ))
+      );
       checks.push(
         ...(await attempt('agent:verification', () =>
           verifyNativeAgents(id, input.workspace, run, {
             outOfQuota: quotaLimited(providers),
+            ...(accounts ? { accounts } : {}),
           })
         ))
       );

package/src/cli/fleet-sync-output.ts

@@ -19,9 +19,10 @@ const COLUMNS: { title: string; matches: (id: string) => boolean }[] = [
     matches: (id) =>
       [
         't3:service',
-        't3:policy',
+        't3:policy-staged',
+        't3:policy-loaded',
+        't3:running-version',
         't3:providers',
-        't3:antigravity-key',
         't3:private-route',
         'worker:t3-recovery',
         'worker:t3-health',

package/src/cli/fleet-sync-remote.ts

@@ -1,7 +1,8 @@
-import { verifyT3Linked } from '../t3-linked-check';
-import { T3_RESTARTED_SUMMARY } from '../platform/t3-policy';
 import { createHash } from 'node:crypto';
-import { verifyT3Endpoint } from '../t3-endpoint';
+import { IDES } from '../ide';
+import { enabled, workerChecks } from '../ide/orchestrate';
+import { idesOf } from '../ide/definition';
+import { rememberEnvironment } from '../t3/pairing';
 import { authorizePrivilege } from './fleet-sync-privilege';
 import { authorizeVault } from './fleet-sync-vault';
 import { managerFailure } from '../manager-failure';
@@ -92,7 +93,11 @@ export async function selected(
         ),
     },
     run,
-    deployWithMonitoring(payload, canonical, run, ui)
+    deployWithMonitoring(payload, canonical, run, {
+      ...ui,
+      workspace: settings.workspace,
+      roster: settings.config,
+    })
   ).finally(() => ui.progress.stop());
   if (settle) report.checks.push(await settle(report));
   return outcome(report, planFingerprint, started);
@@ -157,6 +162,9 @@ function deployWithMonitoring(
   ui: {
     progress: SyncProgress;
     interactiveAuthorization: boolean;
+    /** The manager's checkout, and the roster an identity is recorded in. */
+    workspace: string;
+    roster: string;
   }
 ): DeployNode {
   return async (node, revision) => {
@@ -194,16 +202,15 @@ function deployWithMonitoring(
     // Workers are Linux by definition.
     ui.progress.step(node.id, 'Verifying SSH, OS and T3');
     result.checks.push(...(await inspectBootstrap(node, run, 'linux')));
-    result.checks.push(...(await verifyT3Endpoint(node, run)));
-    // A worker T3 restarted by this sync (idle policy heal) needs a minute or
-    // two before the manager's link reconnects.
-    const restarted = result.checks.some(
-      (check) => check.summary === T3_RESTARTED_SUMMARY
-    );
     result.checks.push(
-      await verifyT3Linked(node, run, {
-        reconnectMs: restarted ? 180_000 : 0,
-      })
+      ...(await workerChecks(enabled(idesOf(canonical), IDES), node, {
+        run,
+        workspace: ui.workspace,
+        earlier: result.checks,
+        remember: async (id, identity) => {
+          await rememberEnvironment(ui.roster, id, identity);
+        },
+      }))
     );
     if (
       result.checks.some(

package/src/cli/fleet-sync.ts

@@ -36,6 +36,7 @@ import { FleetLockError } from '../machine/lock-error';
 import { selected } from './fleet-sync-remote';
 import { managerIdentity } from './fleet-sync-manager';
 import { managerRunScript, rehome } from './fleet-sync-checkout';
+import { syncAccounts } from './fleet-sync-accounts';
 import { packageInfo } from '../package-info';
 import {
   forwardingDisabled,
@@ -53,6 +54,8 @@ export interface FleetSyncOptions {
   node?: string[];
   all?: boolean;
   schedule?: ScheduleAction;
+  /** `accounts`: only the account-derived configuration, on every node. */
+  only?: string;
   /** Internal: this revision already converged the whole fleet, so no canary
    * has to prove it first and every worker converges at once.
    */
@@ -80,6 +83,7 @@ export async function fleetSync(
   if (!(await onManager(run)))
     return offManager(options, settings, run, forward);
   if (options.schedule === 'status') return scheduleStatus(settings, run);
+  if (options.only === 'accounts') return onlyAccounts(options, settings, run);
   return managerSync(options, settings, {
     run,
     root: machineRoot(),
@@ -289,11 +293,43 @@ function validate(options: FleetSyncOptions): void {
     throw new FleetUsageError(
       '--revision requires an exact lowercase 40-character commit SHA.'
     );
+  validateOnly(options);
   if (options.dryRun && (options.apply || options.yes))
     throw new FleetUsageError(
       '--dry-run cannot be combined with apply confirmation.'
     );
 }
+function validateOnly(options: FleetSyncOptions): void {
+  if (options.only !== undefined && options.only !== 'accounts')
+    throw new FleetUsageError('--only takes one scope: accounts.');
+  if (options.only && (options.dryRun || options.schedule))
+    throw new FleetUsageError(
+      '--only accounts applies at once; it takes neither --dry-run nor --schedule.'
+    );
+}
+
+/** `--only accounts`: workers keep the revision they run; only their
+ * accounts change.
+ */
+async function onlyAccounts(
+  options: FleetSyncOptions,
+  settings: Settings,
+  run: Runner
+): Promise<CommandOutcome> {
+  const root = machineRoot();
+  await ensurePrivateRoot(root);
+  const state = await loadEnrollment(legacyHome() ? root : null);
+  const revision =
+    state?.approvedRevision ??
+    (await selectedRevision(options.revision, undefined, settings, run));
+  if (!isRevision(revision))
+    return actionRequired(
+      'FLEET_REVISION_REQUIRED',
+      'No revision is applied yet. Run a full fleet-sync first.'
+    );
+  return syncAccounts(options, settings, { revision, run });
+}
+
 function interactive(options: FleetSyncOptions): boolean {
   return (
     ![

package/src/cli/register-fleet.ts

@@ -7,6 +7,7 @@ import { executeFleet } from './fleet';
 import { fleetSync, type FleetSyncOptions } from './fleet-sync';
 import { syncNode, type NodeSyncOptions } from './node-sync';
 import { fleetState, type FleetStateOptions } from './fleet-state';
+import { fleetAccounts, type FleetAccountsOptions } from './fleet-accounts';
 
 type Complete = (outcome: CommandOutcome) => void;
 
@@ -198,6 +199,10 @@ function registerSync({ program, defaults, complete }: Registration) {
       '--schedule <action>',
       'Manager-only schedule: enable, pause, resume, disable, status'
     )
+    .option(
+      '--only <scope>',
+      'accounts: only the account-derived configuration, on every node at once, without a full sync'
+    )
     .action(async (_options, command: Command) => {
       const options = command.optsWithGlobals<
         FleetSyncOptions & Partial<Settings>
@@ -293,4 +298,34 @@ export function registerFleet(
   registerState(registration);
   registerRepair(registration);
   registerNodes(registration);
+  registerAccounts(registration);
+}
+
+function registerAccounts({ program, defaults, complete }: Registration) {
+  program
+    .command('fleet-accounts [args...]')
+    .description(
+      'List the provider accounts signed in on the CLI proxy and their state; add, sign in again or remove one'
+    )
+    .option('--diff', 'Also compare what this machine offers with the roster')
+    .option('--add', 'Sign a new account in: --add PROVIDER')
+    .option('--relogin', 'Sign one account in again: --relogin PROVIDER INDEX')
+    .option('--remove', 'Remove one account: --remove PROVIDER INDEX')
+    .option(
+      '--remove-native-logins',
+      'Remove provider logins agent CLIs keep outside the proxy on this machine; needs --yes'
+    )
+    .option('--yes', 'Confirm --remove-native-logins')
+    .action(async (args: string[], _options, command: Command) => {
+      const options = command.optsWithGlobals<
+        FleetAccountsOptions & CliOptions
+      >();
+      complete(
+        await fleetAccounts(
+          options,
+          args,
+          await withSettings(defaults, options)
+        )
+      );
+    });
 }

package/src/cli/registry.ts

@@ -135,6 +135,19 @@ export const COMMANDS: CommandSpec[] = [
       ['onboarding', 'register', 'new', 'setup', 'add'],
       true,
     ],
+    [
+      'fleet-accounts',
+      'List provider accounts and their state',
+      'Read-only: the provider accounts signed in on the CLI proxy (provider, index, label, state, when a cooldown clears), the roster version and the proxy:account:<provider> checks. --diff also compares what this machine offers with the roster.',
+      ['accounts', 'providers', 'login', 'quota', 'cooldown', 'roster'],
+    ],
+    [
+      'fleet-accounts --add',
+      'Add, sign in again or remove a provider account',
+      '--add PROVIDER, --relogin PROVIDER INDEX or --remove PROVIDER INDEX changes one account on the CLI proxy (signing in is the only manual step), then propagates the accounts to every node with fleet-sync --only accounts.',
+      ['accounts', 'login', 'relogin', 'remove', 'add', 'sign in'],
+      true,
+    ],
   ]),
   ...group('T3', [
     [