@crvouga/dev-fleet 0.2.0 → 0.4.0

package/src/t3/version.ts

@@ -0,0 +1,119 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { sshArgs } from '../ssh';
+import type { Check, FleetNode, Runner } from '../types';
+
+/** The T3 release every machine runs: `t3_version` in mise.toml. */
+export async function pinnedT3Version(workspace: string): Promise<string> {
+  const toml = await readFile(join(workspace, 'mise.toml'), 'utf8');
+  const version = /^t3_version = "([^"]+)"$/m.exec(toml)?.[1];
+  if (!version) throw new Error('mise.toml pins no T3 version.');
+  return version;
+}
+
+/** Where T3 notes the version it last started as, under its home. */
+export const STARTED_VERSION = 'userdata/desktop-last-started-version';
+
+const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?$/;
+
+/** `t3:version`: the T3 a machine runs is the one the fleet pins, so the
+ * manager and the workers it drives never run different releases.
+ */
+export function versionCheck(
+  running: string | null,
+  pinned: string,
+  where: string,
+  install: string
+): Check {
+  const observed = running?.trim() ?? '';
+  if (!VERSION.test(observed))
+    return {
+      id: 't3:version',
+      status: 'warn',
+      summary: 'T3_VERSION_UNKNOWN',
+      remedy: {
+        action: `T3 on ${where} has not recorded the version it runs. Start T3 there once, then run fleet-sync.`,
+      },
+    };
+  if (observed !== pinned)
+    return {
+      id: 't3:version',
+      status: 'warn',
+      summary: 'T3_VERSION_SKEW',
+      remedy: {
+        action: `T3 on ${where} runs ${observed}; the fleet pins ${pinned}. ${install}`,
+      },
+    };
+  return {
+    id: 't3:version',
+    status: 'pass',
+    summary: `T3 on ${where} runs ${pinned}, the release every machine runs.`,
+  };
+}
+
+export async function managerVersion(
+  t3Home: string,
+  workspace: string
+): Promise<Check> {
+  const running = await readFile(join(t3Home, STARTED_VERSION), 'utf8').catch(
+    () => null
+  );
+  return versionCheck(
+    running,
+    await pinnedT3Version(workspace),
+    'the manager',
+    'Install that release of T3 Code on the manager. With the fleet policy staged (ansible-playbook -K ansible/macos/manager.yml) it no longer updates itself.'
+  );
+}
+
+export async function workerVersion(
+  node: FleetNode,
+  run: Runner,
+  workspace: string
+): Promise<Check> {
+  const result = await run(
+    [...sshArgs(node), `cat "$HOME/.t3/${STARTED_VERSION}"`],
+    { timeoutMs: 15_000 }
+  );
+  return versionCheck(
+    result.ok ? result.stdout : null,
+    await pinnedT3Version(workspace),
+    `worker ${node.id}`,
+    'Run fleet-sync for that worker: it installs the pinned desktop app and restarts T3 when its policy changed.'
+  );
+}
+
+/** Where T3 on macOS reads its administrator policy. */
+export const MACOS_POLICY = '/Library/Application Support/T3Code/policy.json';
+
+/** `t3:updates`: T3's own updater is off by the fleet's policy, so it changes
+ * only when the pin does.
+ */
+export async function updatesCheck(
+  policyPath: string,
+  stage: string
+): Promise<Check> {
+  let mode: unknown;
+  try {
+    const policy = JSON.parse(await readFile(policyPath, 'utf8')) as {
+      limits?: { updates?: { mode?: unknown } };
+    };
+    mode = policy.limits?.updates?.mode;
+  } catch {
+    mode = undefined;
+  }
+  return mode === 'off'
+    ? {
+        id: 't3:updates',
+        status: 'pass',
+        summary: 'T3’s own updater is off by the fleet’s policy.',
+      }
+    : {
+        id: 't3:updates',
+        status: 'warn',
+        summary: 'T3_UPDATES_UNMANAGED',
+        remedy: {
+          action: `T3 on this machine may update itself away from the pinned release. Stage the fleet's policy once, as an administrator: ${stage}`,
+        },
+      };
+}

package/src/t3-linked-check.ts

@@ -103,7 +103,7 @@ function linkedEvidence(
   };
 }
 
-async function observedIdentity(
+export async function observedIdentity(
   node: FleetNode,
   run: Runner
 ): Promise<string | undefined> {

package/src/tailscale.ts

@@ -10,6 +10,9 @@ export interface TailnetComputer {
   ips: string[];
   online: boolean;
   self: boolean;
+  /** When the node key expires, in milliseconds since the epoch; absent when
+   * it never does (tagged nodes, or expiry disabled in the admin console). */
+  keyExpiry?: number;
 }
 export interface Tailnet {
   computers: TailnetComputer[];
@@ -103,6 +106,7 @@ function parseComputer(value: unknown, self: boolean): TailnetComputer {
     OS: os,
     TailscaleIPs: ips,
     Online: online,
+    KeyExpiry: keyExpiry,
   } = value;
   if (
     ![id, name, os].every(
@@ -129,6 +133,53 @@ function parseComputer(value: unknown, self: boolean): TailnetComputer {
     ips: ips as string[],
     online,
     self,
+    ...expiry(keyExpiry),
+  };
+}
+
+function expiry(value: unknown): { keyExpiry?: number } {
+  if (typeof value !== 'string') return {};
+  const time = Date.parse(value);
+  // Tailscale writes the zero time for a key that never expires.
+  return Number.isFinite(time) && time > 0 ? { keyExpiry: time } : {};
+}
+
+const DAY_MS = 86_400_000;
+const KEY_EXPIRY = { warnDays: 14, failDays: 3 };
+
+/** A node drops off the tailnet on the day its key expires. The check warns
+ * two weeks ahead and fails three days ahead, like a T3 link that expires.
+ */
+export function keyExpiryCheck(
+  computer: TailnetComputer | undefined,
+  now = Date.now()
+): Check {
+  const id = 'tailscale:key-expiry';
+  if (!computer)
+    return { id, status: 'skip', summary: 'TAILSCALE_KEY_EXPIRY_UNOBSERVED' };
+  if (computer.keyExpiry === undefined)
+    return {
+      id,
+      status: 'pass',
+      summary: 'The Tailscale node key of this machine does not expire.',
+    };
+  const days = Math.floor((computer.keyExpiry - now) / DAY_MS);
+  const remedy = {
+    action: computer.self
+      ? 'Renew the node key of the manager before it expires: tailscale up --force-reauth on the manager, or disable key expiry for it in the Tailscale admin console.'
+      : 'Disable key expiry for the worker in the Tailscale admin console, or tag it (tagged nodes do not expire). After an expiry, re-join it as docs/operations.md describes (Tailscale key expiry).',
+  };
+  if (days < 0)
+    return { id, status: 'fail', summary: 'TAILSCALE_KEY_EXPIRED', remedy };
+  const summary = `TAILSCALE_KEY_EXPIRES_SOON in ${days} days`;
+  if (days <= KEY_EXPIRY.failDays)
+    return { id, status: 'fail', summary, remedy };
+  if (days <= KEY_EXPIRY.warnDays)
+    return { id, status: 'warn', summary, remedy };
+  return {
+    id,
+    status: 'pass',
+    summary: `The Tailscale node key expires in ${days} days.`,
   };
 }
 

package/src/toolchain-checks.ts

@@ -1,11 +1,16 @@
 import { join } from 'node:path';
+import {
+  selectionArguments,
+  type ToolSelection,
+} from '../bootstrap/worker-tools';
 import { record } from './config';
 import type { Check, Runner } from './types';
 
 export async function toolchainChecks(
   root: string,
   run: Runner,
-  worker?: boolean
+  /** A worker's own tool selection; absent on the manager. */
+  worker?: ToolSelection
 ): Promise<Check[]> {
   const result = await run(doctorArguments(root, worker), {
     cwd: root,
@@ -97,12 +102,12 @@ function toolCheck(value: unknown): Check | null {
   };
 }
 
-function doctorArguments(root: string, worker?: boolean): string[] {
+function doctorArguments(root: string, worker?: ToolSelection): string[] {
   return [
     'bun',
     join(root, 'bootstrap/doctor.ts'),
     '--json',
     '--docker',
-    ...(worker ? ['--worker'] : []),
+    ...(worker ? ['--worker', ...selectionArguments(worker)] : []),
   ];
 }

package/src/transport.ts

@@ -21,7 +21,7 @@ export async function bundleProbe(): Promise<string> {
 export interface RemoteOptions {
   source: string;
   timeoutMs: number;
-  action: 'probe' | 'sync' | 'repair' | 'configure';
+  action: 'probe' | 'sync' | 'repair' | 'configure' | 'accounts';
   configuration?: ConfigurationRequest;
   repairs?: AutomatedRepair[];
   expected?: Fingerprint;
@@ -41,7 +41,8 @@ export async function inspectRemote(
       return { node: node.id, checks: [sshFailure(preflight)] };
   }
   const target =
-    options.action === 'probe' && options.expected
+    (options.action === 'probe' || options.action === 'accounts') &&
+    options.expected
       ? await managedProbeTarget(node, options.expected.head, run)
       : { node, checks: [] };
   const command = remoteCommand(target.node, {

package/src/worker-capability-checks.ts

@@ -0,0 +1,167 @@
+import policy from '../ansible/ubuntu/policy.json';
+import type { Check, CommandResult, Runner } from './types';
+
+/** What an agent does on a worker, tried the way it does it: start a
+ * container, build an image, launch a headless browser. Each check runs as
+ * the worker's user, in its session, and reports a code and a remedy, never
+ * what a command printed.
+ */
+
+function failure(id: string, summary: string, action: string): Check {
+  return { id, status: 'fail', summary, remedy: { action } };
+}
+
+/** Docker's own words for the causes an agent meets most. */
+function dockerFailure(result: CommandResult): {
+  code: string;
+  action: string;
+} {
+  const said = `${result.stdout}\n${result.stderr}`;
+  if (result.reason === 'timeout')
+    return {
+      code: 'DOCKER_RUN_TIMEOUT',
+      action:
+        'A container did not start and exit in time. Inspect the engine (systemctl status docker) and its disk; rerun fleet-sync.',
+    };
+  if (/permission denied[^\n]*docker\.sock/i.test(said))
+    return {
+      code: 'DOCKER_SOCKET_ACCESS_DENIED',
+      action:
+        "This session cannot use the Docker socket. fleet-sync adds the worker's user to the docker group; a session started before that keeps its old groups. Rerun fleet-sync, then restart the session (log out and in, or restart the T3 service).",
+    };
+  if (/cannot connect to the docker daemon/i.test(said))
+    return {
+      code: 'DOCKER_DAEMON_UNREACHABLE',
+      action:
+        'The Docker engine is not running. Rerun fleet-sync, which starts and enables docker.service.',
+    };
+  if (/no such image|pull access denied|not found/i.test(said))
+    return {
+      code: 'DOCKER_SMOKE_IMAGE_MISSING',
+      action:
+        'The pinned smoke-test image is not cached on this worker. Rerun fleet-sync, which pulls it once so this check works offline.',
+    };
+  if (/no space left on device/i.test(said))
+    return {
+      code: 'DOCKER_DISK_FULL',
+      action:
+        'The image store is full. Free space under /var/lib/docker (the disk GC prunes old images) and rerun fleet-sync.',
+    };
+  return {
+    code: 'DOCKER_RUN_FAILED',
+    action:
+      'Docker answers but cannot run a container here. Inspect cgroups and the engine log (journalctl -u docker), then rerun fleet-sync.',
+  };
+}
+
+/** Runs the pinned image offline, then builds a one-line image from it. */
+export async function dockerRunCheck(run: Runner): Promise<Check> {
+  const id = 'worker:docker-run';
+  const { image, timeoutSeconds } = policy.dockerSmokeTest;
+  const timeoutMs = timeoutSeconds * 1000;
+  const started = await run(
+    [
+      'docker',
+      'run',
+      '--rm',
+      '--network',
+      'none',
+      '--pull',
+      'never',
+      image,
+      'true',
+    ],
+    { timeoutMs }
+  );
+  if (!started.ok) {
+    const { code, action } = dockerFailure(started);
+    return failure(id, code, action);
+  }
+  const built = await run(
+    ['docker', 'build', '--quiet', '--pull=false', '--network', 'none', '-'],
+    { input: `FROM ${image}\nRUN true\n`, timeoutMs }
+  );
+  if (!built.ok) {
+    const { code, action } = dockerFailure(built);
+    return failure(
+      id,
+      code === 'DOCKER_RUN_FAILED' ? 'DOCKER_BUILD_FAILED' : code,
+      code === 'DOCKER_RUN_FAILED'
+        ? 'A container runs but an image does not build. Inspect Buildx (docker buildx ls) and the image store, then rerun fleet-sync.'
+        : action
+    );
+  }
+  return {
+    id,
+    status: 'pass',
+    summary:
+      'A container of the pinned image ran and a one-line image built, offline, in this session.',
+  };
+}
+
+/** Where `ansible/ubuntu/tasks/browser.yml` unpacks the pinned build. */
+export function headlessShell(arch: string = process.arch): string {
+  const { version, amd64, arm64 } = policy.browser.headlessShell;
+  const build = arch === 'arm64' ? arm64 : amd64;
+  const directory = build.archive.split('/').pop()!;
+  return `/opt/personal-fleet/browser/${version}/${directory}/chrome-headless-shell`;
+}
+
+/** A worker with the web profile launches the pinned headless Chromium,
+ * loads a blank page and exits, as a browser test would.
+ */
+export async function browserCheck(
+  run: Runner,
+  web: boolean,
+  arch: string = process.arch
+): Promise<Check> {
+  const id = 'worker:browser';
+  if (!web)
+    return {
+      id,
+      status: 'skip',
+      summary:
+        'This worker does not select the web tool profile, so no browser is installed for tests.',
+    };
+  const launched = await run(
+    [
+      headlessShell(arch),
+      '--headless',
+      '--no-sandbox',
+      '--disable-gpu',
+      '--dump-dom',
+      'about:blank',
+    ],
+    { timeoutMs: policy.browser.launchTimeoutSeconds * 1000 }
+  );
+  if (launched.ok && /<html/i.test(launched.stdout))
+    return {
+      id,
+      status: 'pass',
+      summary: `Headless Chromium ${policy.browser.headlessShell.version} launched, loaded a blank page and exited.`,
+    };
+  const said = `${launched.stdout}\n${launched.stderr}`;
+  if (launched.reason === 'missing')
+    return failure(
+      id,
+      'BROWSER_NOT_INSTALLED',
+      'The pinned headless Chromium is not installed. Rerun fleet-sync, which installs it on workers with the web profile.'
+    );
+  if (/error while loading shared libraries/i.test(said))
+    return failure(
+      id,
+      'BROWSER_LIBRARY_MISSING',
+      'A system library headless Chromium loads is missing. Rerun fleet-sync, which installs the pinned libraries of the web profile.'
+    );
+  if (launched.reason === 'timeout')
+    return failure(
+      id,
+      'BROWSER_LAUNCH_TIMEOUT',
+      'Headless Chromium did not exit in time. Check the worker for memory pressure, then rerun fleet-sync.'
+    );
+  return failure(
+    id,
+    'BROWSER_LAUNCH_FAILED',
+    'Headless Chromium did not load a blank page. Run it by hand with --dump-dom about:blank to see why, then rerun fleet-sync.'
+  );
+}

package/src/worker-capacity.ts

@@ -1,11 +1,14 @@
 import { join } from 'node:path';
+import { clockCheck } from './clock';
 import { healthChecks, parseProbe } from './machine-health';
 import type { Check, Runner } from './types';
 
 export async function workerCapacity(
   root: string,
   node: string,
-  run: Runner
+  run: Runner,
+  /** The manager's clock in seconds since the epoch, when it sent one. */
+  reference?: number
 ): Promise<Check[]> {
   const result = await run(['sh', join(root, 'ansible/net/remote-probe.sh')], {
     timeoutMs: 10_000,
@@ -25,10 +28,19 @@ export async function workerCapacity(
         summary: 'Required CPU, memory and disk evidence is unavailable.',
       },
     ];
-  return healthChecks(sample, node).map((check) => ({
-    id: `worker:capacity:${check.id}`,
-    status: check.severity,
-    summary: check.detail,
-    ...(check.fix ? { remedy: { action: check.fix } } : {}),
-  }));
+  return [
+    ...healthChecks(sample, node).map((check) => ({
+      id: `worker:capacity:${check.id}`,
+      status: check.severity,
+      summary: check.detail,
+      ...(check.fix ? { remedy: { action: check.fix } } : {}),
+    })),
+    clockCheck(
+      'worker:clock',
+      sample,
+      reference === undefined || sample.epoch === undefined
+        ? undefined
+        : sample.epoch - reference
+    ),
+  ];
 }

package/src/worker-host-checks.ts

@@ -4,6 +4,7 @@ import { verifyUbuntuBoot } from './platform/ubuntu-verify';
 import { verifyResourceSafety } from './platform/resource-verify';
 import policy from '../ansible/ubuntu/policy.json';
 import { userInfo } from 'node:os';
+import { T3_HEALTH_SCRIPT, runningVersionCheck } from './platform/t3-service';
 import type { Check, Runner } from './types';
 
 function check(id: string, ok: boolean, summary: string): Check {
@@ -94,6 +95,7 @@ export async function workerHostChecks(
       )
     );
   }
+  checks.push(await rebootPendingCheck(audit.rebootPending, run));
   checks.push(...(await recoveryChecks(run)));
   checks.push(...(await verifyUbuntuBoot(user, run)));
   checks.push(...(await verifyResourceSafety(userInfo().homedir, run)));
@@ -120,18 +122,13 @@ async function recoveryChecks(run: Runner): Promise<Check[]> {
     )
   );
   checks.push(await t3HealthCheck(run));
+  checks.push(await runningVersionCheck(run, userInfo().uid));
   const renewal = await run([
     'systemctl',
     '--user',
     'is-active',
     'personal-worker-auth.timer',
   ]);
-  const recovery = await run([
-    'systemctl',
-    '--user',
-    'is-active',
-    'personal-worker-recovery.timer',
-  ]);
   checks.push(
     check(
       'credential-renewal',
@@ -139,17 +136,44 @@ async function recoveryChecks(run: Runner): Promise<Check[]> {
       'Worker credential renewal timer is active.'
     )
   );
-  checks.push(
-    check(
-      'service-recovery',
-      recovery.ok,
-      'Worker service recovery timer is active.'
-    )
-  );
+  checks.push(await serviceRecoveryCheck(run));
   checks.push(await powerRecoveryCheck(run));
   return checks;
 }
 
+/** The recovery timer is active, the script its unit runs exists, and the
+ * last run of the unit succeeded: a watchdog that fails on every tick is not
+ * recovery. */
+export async function serviceRecoveryCheck(run: Runner): Promise<Check> {
+  const timer = await run([
+    'systemctl',
+    '--user',
+    'is-active',
+    'personal-worker-recovery.timer',
+  ]);
+  const script = await run(['test', '-r', T3_HEALTH_SCRIPT]);
+  const unit = await run([
+    'systemctl',
+    '--user',
+    'show',
+    'personal-worker-recovery.service',
+    '--property=Result',
+  ]);
+  const result = /^Result=(.*)$/m.exec(unit.stdout)?.[1] ?? 'unknown';
+  const summary = !timer.ok
+    ? 'WORKER_RECOVERY_TIMER_INACTIVE'
+    : !script.ok
+      ? 'WORKER_RECOVERY_SCRIPT_MISSING'
+      : !unit.ok || result !== 'success'
+        ? `WORKER_RECOVERY_LAST_RUN_FAILED (${/^[\w-]+$/.test(result) ? result : 'unknown'})`
+        : 'Worker service recovery timer is active and its last run succeeded.';
+  return check(
+    'service-recovery',
+    timer.ok && script.ok && unit.ok && result === 'success',
+    summary
+  );
+}
+
 /** The server answers its local API now, not merely that a process exists. */
 async function t3HealthCheck(run: Runner): Promise<Check> {
   const probe = await run(
@@ -179,3 +203,34 @@ async function t3HealthCheck(run: Runner): Promise<Check> {
     'T3 local API answers with its environment identity within 10 seconds.'
   );
 }
+
+const DAY_SECONDS = 86_400;
+
+/** Kernel and library updates apply only after a reboot. A pending reboot
+ * warns with its age, and fails once it is older than `policy.json` allows.
+ */
+export async function rebootPendingCheck(
+  pending: boolean,
+  run: Runner,
+  now = Date.now()
+): Promise<Check> {
+  const id = 'worker:reboot-pending';
+  if (!pending) return { id, status: 'pass', summary: 'No reboot is pending.' };
+  const since = await run(['stat', '-c', '%Y', '/var/run/reboot-required']);
+  const seconds = Number(since.stdout.trim());
+  const days =
+    since.ok && /^\d+$/.test(since.stdout.trim())
+      ? Math.max(0, Math.floor((now / 1000 - seconds) / DAY_SECONDS))
+      : null;
+  const age = days === null ? '' : ` for ${days} days`;
+  return {
+    id,
+    status:
+      days !== null && days > policy.rebootPendingFailDays ? 'fail' : 'warn',
+    summary: `REBOOT_PENDING${age}: installed updates apply only after a reboot.`,
+    remedy: {
+      action:
+        'Reboot the worker when no agent turn is running (sudo systemctl reboot on the worker), then confirm it returns to ready with devfleet fleet-status --workers.',
+    },
+  };
+}

package/src/worker-policy.ts

@@ -1,6 +1,7 @@
 import { CAPABILITIES, record } from './config';
 import { FleetUsageError } from './errors';
 import type { Capability } from './types';
+import { TOOL_PROFILES, type ToolProfile } from '../bootstrap/worker-tools';
 
 export interface WorkerPolicy {
   requiredCapabilities: Capability[];
@@ -12,6 +13,10 @@ export interface WorkerPolicy {
   unattendedSudo: true;
   persistentT3: true;
   neverSleep: true;
+  /** Tool profiles every worker installs on top of the base tools. */
+  toolProfiles?: ToolProfile[];
+  /** Single tools pinned in dev-fleet's mise.toml every worker installs. */
+  tools?: string[];
 }
 const REQUIRED = [
   'github',
@@ -41,8 +46,11 @@ function validPolicy(value: Record<string, unknown>): boolean {
         'unattendedSudo',
         'persistentT3',
         'neverSleep',
+        'toolProfiles',
+        'tools',
       ].includes(key)
     ) &&
+    validTools(value) &&
     validCapabilities(value['requiredCapabilities']) &&
     typeof value['githubLogin'] === 'string' &&
     /^[a-zA-Z0-9-]{1,39}$/.test(value['githubLogin']) &&
@@ -55,6 +63,31 @@ function validPolicy(value: Record<string, unknown>): boolean {
     )
   );
 }
+/** A list of known tool profiles, each once; null when it is not one. */
+export function toolProfiles(value: unknown): ToolProfile[] | null {
+  return Array.isArray(value) &&
+    new Set(value).size === value.length &&
+    value.every((item) => TOOL_PROFILES.includes(item as ToolProfile))
+    ? (value as ToolProfile[])
+    : null;
+}
+/** The optional tool profiles and single tools every worker adds. */
+function validTools(value: Record<string, unknown>): boolean {
+  return (
+    (value['toolProfiles'] === undefined ||
+      toolProfiles(value['toolProfiles']) !== null) &&
+    (value['tools'] === undefined || toolNames(value['tools']))
+  );
+}
+function toolNames(value: unknown): boolean {
+  return (
+    Array.isArray(value) &&
+    new Set(value).size === value.length &&
+    value.every(
+      (item) => typeof item === 'string' && /^[a-z0-9@:/._-]{1,75}$/i.test(item)
+    )
+  );
+}
 export function parseWorkerPolicy(value: unknown): WorkerPolicy {
   if (!record(value) || !validPolicy(value))
     throw new FleetUsageError(

package/src/worker-readiness.ts

@@ -1,7 +1,10 @@
 import { workerCapacity } from './worker-capacity';
 import { userInfo, hostname } from 'node:os';
 import { hostId } from './topology';
-import { configPath } from './fleet-config';
+import { configPath, fleet } from './fleet-config';
+import { workerSelection } from '../bootstrap/worker-tools';
+import { browserCheck, dockerRunCheck } from './worker-capability-checks';
+import { gitChecks } from './git-identity';
 import type { Check, Runner } from './types';
 import { workerHostChecks } from './worker-host-checks';
 import { workerAccessChecks } from './worker-access-checks';
@@ -59,6 +62,12 @@ export async function workerReadiness(
     ...host,
     ...access,
     proxy,
+    await dockerRunCheck(run),
+    await browserCheck(
+      run,
+      workerSelection(fleet, nodeId).profiles.includes('web')
+    ),
+    ...(await gitChecks(fleet.git, run)),
     ...(await workerCapacity(root, nodeId, run)),
   ];
 }