@crvouga/dev-fleet 0.2.0 → 0.4.0

package/src/cli/fleet-sync-plan.ts

@@ -0,0 +1,200 @@
+import { join } from 'node:path';
+import type { Standing } from '../state/sync';
+import type { Runner } from '../types';
+
+/** A tool whose pin changes between the applied and the selected revision. */
+export interface ToolChange {
+  tool: string;
+  from: string | null;
+  to: string | null;
+}
+
+/** Something a sync restarts, and whether that ends work in progress. */
+export interface Restart {
+  service: string;
+  reason: string;
+  endsRunningTurns: boolean;
+}
+
+/** What `fleet-sync --dry-run` says a sync would change. It is read from
+ * Git (the two revisions' tool pins and the files between them) and the
+ * fleet state; nothing on a machine is changed to find it out.
+ */
+export interface SyncPlan {
+  /** How the fleet state stood with the bucket when the plan was made. */
+  state: Standing;
+  revision: { from: string | null; to: string };
+  /** False when the applied revision could not be read: the changes are
+   * then unknown, not absent.
+   */
+  known: boolean;
+  tools: ToolChange[];
+  restarts: Restart[];
+  nodes: { node: string; from: string | null; to: string; changes: boolean }[];
+}
+
+/** The coding agents' CLIs: a new version is used by the next session, and a
+ * running one keeps the binary it started with.
+ */
+const AGENT_TOOLS = [
+  'claude',
+  'codex',
+  'gemini',
+  'copilot',
+  'aqua:anomalyco/opencode',
+  'http:grok',
+  'http:antigravity',
+];
+
+function section(text: string, name: string): string {
+  const start = text.search(new RegExp(`^\\[${name}\\]\\s*$`, 'm'));
+  if (start < 0) return '';
+  const rest = text.slice(start).split('\n').slice(1);
+  const end = rest.findIndex((line) => /^\[/.test(line));
+  return (end < 0 ? rest : rest.slice(0, end)).join('\n');
+}
+
+/** The exact pins under [tools], and T3's under [vars]. */
+export function pins(miseToml: string): Map<string, string> {
+  const found = new Map<string, string>();
+  for (const line of section(miseToml, 'tools').split('\n')) {
+    const match =
+      /^\s*"?([A-Za-z0-9@:/._-]+)"?\s*=\s*(?:"([^"]+)"|\{.*?\bversion\s*=\s*"([^"]+)")/.exec(
+        line
+      );
+    if (match) found.set(match[1]!, (match[2] ?? match[3])!);
+  }
+  const t3 = /^\s*t3_version\s*=\s*"([^"]+)"/m.exec(section(miseToml, 'vars'));
+  if (t3) found.set('t3', t3[1]!);
+  return found;
+}
+
+export function toolChanges(
+  before: Map<string, string>,
+  after: Map<string, string>
+): ToolChange[] {
+  const names = [...new Set([...before.keys(), ...after.keys()])].sort();
+  return names
+    .filter((tool) => before.get(tool) !== after.get(tool))
+    .map((tool) => ({
+      tool,
+      from: before.get(tool) ?? null,
+      to: after.get(tool) ?? null,
+    }));
+}
+
+/** What restarts follow from the changes, as the playbooks and the toolchain
+ * setup act on them.
+ */
+export function restarts(tools: ToolChange[], files: string[]): Restart[] {
+  const found: Restart[] = [];
+  if (tools.some((change) => change.tool === 't3'))
+    found.push({
+      service: 't3',
+      reason:
+        'T3 is upgraded and restarted on every machine; its running agent turns end.',
+      endsRunningTurns: true,
+    });
+  else if (
+    files.some((file) =>
+      /^(agents\/|ansible\/ubuntu\/(t3-policy\.yml|t3\/))/.test(file)
+    )
+  )
+    found.push({
+      service: 't3',
+      reason:
+        'The managed T3 policy may change: a T3 that has not loaded it is restarted, and its running agent turns end.',
+      endsRunningTurns: true,
+    });
+  const agents = tools.filter((change) => AGENT_TOOLS.includes(change.tool));
+  if (agents.length)
+    found.push({
+      service: 'agent-clis',
+      reason: `New sessions use the new ${agents.map((change) => change.tool).join(', ')}; running turns keep the version they started with.`,
+      endsRunningTurns: false,
+    });
+  return found;
+}
+
+async function read(
+  run: Runner,
+  cwd: string,
+  args: string[]
+): Promise<string | null> {
+  const result = await run(['git', ...args], { cwd, timeoutMs: 20_000 });
+  return result.ok ? result.stdout : null;
+}
+
+/** Read-only: the plan of a sync from `from` (the revision the fleet last
+ * applied) to `to`. Git objects come from the checkout this runs in or the
+ * manager's cache of the source repository; nothing is fetched.
+ */
+export async function syncPlan(
+  input: {
+    from: string | null;
+    to: string;
+    state: Standing;
+    nodes: string[];
+    sources: string[];
+  },
+  run: Runner
+): Promise<SyncPlan> {
+  let changes: { tools: ToolChange[]; files: string[] } | null =
+    input.from === input.to ? { tools: [], files: [] } : null;
+  for (const cwd of input.from && !changes ? input.sources : []) {
+    const before = await read(run, cwd, ['show', `${input.from}:mise.toml`]);
+    const after = await read(run, cwd, ['show', `${input.to}:mise.toml`]);
+    const files = await read(run, cwd, [
+      'diff',
+      '--name-only',
+      input.from!,
+      input.to,
+    ]);
+    if (before === null || after === null || files === null) continue;
+    changes = {
+      tools: toolChanges(pins(before), pins(after)),
+      files: files.split('\n').filter(Boolean),
+    };
+    break;
+  }
+  const differs = input.from !== input.to;
+  return {
+    state: input.state,
+    revision: { from: input.from, to: input.to },
+    known: changes !== null,
+    tools: changes?.tools ?? [],
+    restarts: changes ? restarts(changes.tools, changes.files) : [],
+    nodes: input.nodes.map((node) => ({
+      node,
+      from: input.from,
+      to: input.to,
+      changes: differs,
+    })),
+  };
+}
+
+export const planSources = (workspace: string, root: string): string[] => [
+  workspace,
+  join(root, 'source'),
+];
+
+/** The plan, for people: one line per change. */
+export function planText(plan: SyncPlan): string {
+  const short = (revision: string | null) => revision?.slice(0, 12) ?? 'none';
+  const lines = [
+    plan.revision.from === plan.revision.to
+      ? `Plan: the fleet stays at ${short(plan.revision.to)}.`
+      : `Plan: ${short(plan.revision.from)} → ${short(plan.revision.to)} on ${plan.nodes.map((node) => node.node).join(', ') || 'no machine'}.`,
+  ];
+  if (!plan.known)
+    lines.push(
+      '  The applied revision is not in a local repository: tool and restart changes are unknown.'
+    );
+  for (const change of plan.tools)
+    lines.push(
+      `  ${change.tool} ${change.from ?? 'not installed'} → ${change.to ?? 'removed'}`
+    );
+  for (const restart of plan.restarts)
+    lines.push(`  Restarts ${restart.service}: ${restart.reason}`);
+  return lines.join('\n');
+}

package/src/cli/fleet-sync-remote.ts

@@ -1,7 +1,8 @@
-import { verifyT3Linked } from '../t3-linked-check';
-import { T3_RESTARTED_SUMMARY } from '../platform/t3-policy';
 import { createHash } from 'node:crypto';
-import { verifyT3Endpoint } from '../t3-endpoint';
+import { IDES } from '../ide';
+import { enabled, workerChecks } from '../ide/orchestrate';
+import { idesOf } from '../ide/definition';
+import { rememberEnvironment } from '../t3/pairing';
 import { authorizePrivilege } from './fleet-sync-privilege';
 import { authorizeVault } from './fleet-sync-vault';
 import { managerFailure } from '../manager-failure';
@@ -92,7 +93,11 @@ export async function selected(
         ),
     },
     run,
-    deployWithMonitoring(payload, canonical, run, ui)
+    deployWithMonitoring(payload, canonical, run, {
+      ...ui,
+      workspace: settings.workspace,
+      roster: settings.config,
+    })
   ).finally(() => ui.progress.stop());
   if (settle) report.checks.push(await settle(report));
   return outcome(report, planFingerprint, started);
@@ -157,6 +162,9 @@ function deployWithMonitoring(
   ui: {
     progress: SyncProgress;
     interactiveAuthorization: boolean;
+    /** The manager's checkout, and the roster an identity is recorded in. */
+    workspace: string;
+    roster: string;
   }
 ): DeployNode {
   return async (node, revision) => {
@@ -185,7 +193,9 @@ function deployWithMonitoring(
     if (ui.interactiveAuthorization) ui.progress.stop();
     const before = await authorizeVault(node, vault, run);
     ui.progress.step(node.id, 'Converging (remote lock, install, verify)');
-    const result = await bootstrapRemote(node, payload, run);
+    const result = await bootstrapRemote(node, payload, run, {
+      progress: (line) => ui.progress.step(node.id, line),
+    });
     // A fresh node gets vault from the bootstrap; log it in now. Its provider
     // checks in this run predate the login, so the next sync verifies them.
     result.checks.push(
@@ -194,16 +204,15 @@ function deployWithMonitoring(
     // Workers are Linux by definition.
     ui.progress.step(node.id, 'Verifying SSH, OS and T3');
     result.checks.push(...(await inspectBootstrap(node, run, 'linux')));
-    result.checks.push(...(await verifyT3Endpoint(node, run)));
-    // A worker T3 restarted by this sync (idle policy heal) needs a minute or
-    // two before the manager's link reconnects.
-    const restarted = result.checks.some(
-      (check) => check.summary === T3_RESTARTED_SUMMARY
-    );
     result.checks.push(
-      await verifyT3Linked(node, run, {
-        reconnectMs: restarted ? 180_000 : 0,
-      })
+      ...(await workerChecks(enabled(idesOf(canonical), IDES), node, {
+        run,
+        workspace: ui.workspace,
+        earlier: result.checks,
+        remember: async (id, identity) => {
+          await rememberEnvironment(ui.roster, id, identity);
+        },
+      }))
     );
     if (
       result.checks.some(

package/src/cli/fleet-sync-schedule.ts

@@ -1,13 +1,22 @@
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { currentPlatform } from '../platform';
 import type { Platform } from '../platform/types';
+import { PACKAGE_ROOT, packageInfo, type PackageInfo } from '../package-info';
+import {
+  readHistory,
+  recordSchedule,
+  type ScheduleRecord,
+} from '../state/history';
+import { scheduleCheck, SCHEDULE_INTERVAL_SECONDS } from '../schedule-check';
 import type { Runner } from '../types';
 import type { CommandOutcome } from './contracts';
 import { machineRoot } from './fleet-sync';
 
-const LABEL = 'personal-fleet-sync';
-declare const PERSONAL_VERSION: string | undefined;
-declare const PERSONAL_SOURCE_REVISION: string | null;
+/** The launchd label and systemd unit already on running managers. */
+export const SCHEDULE_LABEL = 'personal-fleet-sync';
+const LABEL = SCHEDULE_LABEL;
 export type ScheduleAction =
   'enable' | 'pause' | 'resume' | 'disable' | 'status';
 interface ScheduleInput {
@@ -15,33 +24,145 @@ interface ScheduleInput {
   revision: string;
   config: string;
   authorized: boolean;
+  /** The package this CLI runs from; the schedule installs the same one. */
+  release?: Release;
+  /** Where the schedule is recorded in the fleet state; tests replace it. */
+  record?: (schedule: ScheduleRecord) => void;
+  /** The manager's caches; tests name their own. */
+  root?: string;
+  now?: Date;
 }
+
+/** The published package a schedule installs and runs: its name, exact
+ * version and the entry point its manifest declares.
+ */
+export interface Release extends PackageInfo {
+  bin: string | null;
+}
+
+export function release(root = PACKAGE_ROOT): Release {
+  let bin: unknown = null;
+  try {
+    const manifest = JSON.parse(
+      readFileSync(join(root, 'package.json'), 'utf8')
+    ) as { bin?: unknown };
+    bin = typeof manifest.bin === 'string' ? manifest.bin : null;
+    if (typeof manifest.bin === 'object' && manifest.bin !== null)
+      bin = (manifest.bin as Record<string, unknown>)['devfleet'] ?? null;
+  } catch {
+    bin = null;
+  }
+  return {
+    ...packageInfo(root),
+    bin: typeof bin === 'string' ? bin.replace(/^\.\//, '') : null,
+  };
+}
+
+/** Only a published release can be scheduled: it names an exact version and
+ * the commit it was built from, so every unattended run is the same code.
+ */
+export function publishedRelease(release: Release): boolean {
+  return (
+    /^\d+\.\d+\.\d+$/.test(release.version) &&
+    release.revision !== null &&
+    release.bin !== null &&
+    !release.bin.split('/').includes('..')
+  );
+}
+
+/** What launchd (or the systemd timer) runs: the installed package's own
+ * entry point under Node, with the tools fleet-sync installs on PATH. No path
+ * into the project or the package the operator ran is written into it.
+ */
+export function scheduledCommand(
+  release: Release,
+  revision: string,
+  prefix: string
+): string[] {
+  return [
+    '/usr/bin/env',
+    'node',
+    join(prefix, 'node_modules', release.name, release.bin ?? ''),
+    'fleet-sync',
+    '--revision',
+    revision,
+    '--apply',
+    '--yes',
+    '--non-interactive',
+    '--json',
+  ];
+}
+
+export function scheduledEnvironment(home = homedir()): Record<string, string> {
+  return {
+    PATH: [
+      join(home, '.local/share/mise/shims'),
+      join(home, '.local/bin'),
+      '/opt/homebrew/bin',
+      '/usr/local/bin',
+      '/usr/bin',
+      '/bin',
+    ].join(':'),
+    DEVFLEET_TRIGGER: 'schedule',
+  };
+}
+
 export async function managerSchedule(
   input: ScheduleInput,
   run: Runner,
   platform: Platform = currentPlatform()
 ): Promise<CommandOutcome> {
-  if (input.action === 'status')
-    return {
-      exitCode: 0,
-      data: {
-        version: 2,
-        command: 'fleet-sync',
-        execution: 'manager-push',
-        scheduling: scheduleStatus(platform),
-      },
-    };
+  if (input.action === 'status') return statusReport(platform, input.now);
   if (!input.authorized)
     return required('Manager scheduling changes require --apply --yes.');
   if (input.action === 'pause' || input.action === 'disable')
     return removeSchedule(input, platform);
   return enableSchedule(input, run, platform);
 }
+
+function statusReport(platform: Platform, now = new Date()): CommandOutcome {
+  const history = readHistory();
+  const check = scheduleCheck(history, now);
+  return {
+    exitCode: 0,
+    data: {
+      version: 2,
+      command: 'fleet-sync',
+      execution: 'manager-push',
+      scheduling: scheduleStatus(platform),
+      intervalSeconds:
+        history.schedule?.intervalSeconds ?? SCHEDULE_INTERVAL_SECONDS,
+      runs: history.runs
+        .filter((entry) => entry.trigger === 'schedule')
+        .slice(-3)
+        .reverse(),
+      ...(check ? { checks: [check] } : {}),
+    },
+  };
+}
+
+function remember(
+  input: ScheduleInput,
+  enabled: boolean,
+  intervalSeconds = SCHEDULE_INTERVAL_SECONDS
+): void {
+  try {
+    (input.record ?? recordSchedule)({
+      enabled,
+      intervalSeconds,
+      changedAt: (input.now ?? new Date()).toISOString(),
+    });
+  } catch {
+    // The schedule changed either way; the next run records it again.
+  }
+}
+
 function removeSchedule(
   input: ScheduleInput,
   platform: Platform
 ): CommandOutcome {
   const result = platform.removeScheduledJob(LABEL);
+  if (result.ok) remember(input, false);
   return {
     exitCode: result.ok ? 0 : 1,
     data: {
@@ -60,15 +181,12 @@ async function enableSchedule(
   run: Runner,
   platform: Platform
 ): Promise<CommandOutcome> {
-  if (
-    typeof PERSONAL_VERSION !== 'string' ||
-    !/^\d+\.\d+\.\d+$/.test(PERSONAL_VERSION) ||
-    typeof PERSONAL_SOURCE_REVISION !== 'string'
-  )
+  const published = input.release ?? release();
+  if (!publishedRelease(published))
     return required(
       'Scheduling requires a published CLI with clean source provenance; dirty review artifacts cannot enable unattended deployment.'
     );
-  const root = machineRoot();
+  const root = input.root ?? machineRoot();
   const prefix = join(root, 'runtime');
   const installed = await run(
     [
@@ -79,7 +197,7 @@ async function enableSchedule(
       '--ignore-scripts',
       '--no-audit',
       '--no-fund',
-      `dev-fleet@${PERSONAL_VERSION}`,
+      `${published.name}@${published.version}`,
     ],
     { timeoutMs: 120_000 }
   );
@@ -89,23 +207,12 @@ async function enableSchedule(
     );
   const result = platform.installScheduledJob({
     label: LABEL,
-    intervalSeconds: 1800,
-    command: [
-      process.execPath,
-      join(prefix, 'node_modules/dev-fleet/cli.mjs'),
-      'fleet-sync',
-      '--config',
-      input.config,
-      '--revision',
-      input.revision,
-      '--apply',
-      '--yes',
-      '--non-interactive',
-      '--json',
-    ],
+    intervalSeconds: SCHEDULE_INTERVAL_SECONDS,
+    command: scheduledCommand(published, input.revision, prefix),
     logDir: join(root, 'logs'),
-    env: { PATH: process.env['PATH'] ?? '/usr/bin:/bin' },
+    env: scheduledEnvironment(),
   });
+  if (result.ok) remember(input, true);
   return {
     exitCode: result.ok ? 0 : 1,
     data: {