@crvouga/dev-fleet 0.7.0 → 0.9.0

package/src/cli/fleet.ts

@@ -16,13 +16,37 @@ import { probeSource } from './probe-source';
 import { executeRepairCommand } from './repair';
 import { scheduleCheck } from '../schedule-check';
 import { readHistory } from '../state/history';
+import { withUsage } from '../worker-activity';
+import { activeNodes, appendUsage } from './worker-usage-report';
+import { fleet, secret } from '../fleet-config';
+import { appendTailnetLeftovers } from '../tailnet-cleanup';
+import { fleetTailnetControl, type TailnetControl } from '../tailnet-control';
+import { packageInfo } from '../package-info';
+import { managerRuns } from './fleet-sync-checkout';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
 
 export interface FleetServices {
   run: Runner;
   source: () => Promise<string>;
+  /** The tailnet control plane fleet.json declares, asked for devices
+   * tagged as workers that no declared worker accounts for. Absent, or null,
+   * fleet-status says nothing about them.
+   */
+  tailnet?: () => Promise<TailnetControl | null>;
+  /** The commit the running package names; absent or null in a checkout. */
+  revision?: string | null;
+  /** Where the manager keeps its fleet-owned checkout of each revision. */
+  runs?: string;
 }
 
-const SERVICES: FleetServices = { run: runCommand, source: probeSource };
+const SERVICES: FleetServices = {
+  run: runCommand,
+  source: probeSource,
+  tailnet: () => fleetTailnetControl(fleet.tailnet, secret),
+  revision: packageInfo().revision,
+  runs: managerRuns(),
+};
 
 export async function executeFleet(
   command: string,
@@ -114,11 +138,14 @@ async function diagnose(
   settings: Settings & { missingRoster: boolean },
   services: FleetServices
 ): Promise<CommandOutcome> {
-  const source = nodes.length ? await services.source() : undefined;
+  // A parked worker is not contacted; it is listed as parked.
+  const active = activeNodes(nodes);
+  const source = active.length ? await services.source() : undefined;
+  const root = statusRoot(settings, services);
   const reports = await doctor(
-    nodes,
+    active,
     {
-      root: settings.workspace,
+      root,
       local: options.local === true,
       required: capabilities(options.require),
       timeoutMs: timeout(options),
@@ -126,11 +153,23 @@ async function diagnose(
     },
     services.run
   );
+  explainMissingCheckout(reports, root);
   if (!options.local && settings.missingRoster) reports.push(missingRoster());
   const schedule = scheduleCheck(readHistory(), new Date());
   if (schedule) reports[0]?.checks.push(schedule);
+  // What each worker is doing, unless only this manager is checked.
+  const usage = await usageOf(
+    reports,
+    active,
+    services.run,
+    skipsFleet(options, settings)
+  );
+  // Devices tagged as workers that are no declared worker (#123).
+  if (!skipsFleet(options, settings))
+    await appendTailnetLeftovers(reports, fleet, services.tailnet, nodes);
   const report = {
     ...makeReport('doctor', reports),
+    ...(usage ?? {}),
     coverage: {
       scope: options.local
         ? 'local'
@@ -146,10 +185,53 @@ async function diagnose(
   return {
     exitCode: reportExitCode(report, options.strict === true),
     data: report,
-    text: renderReport(report),
+    text: withUsage(renderReport(report), usage),
+  };
+}
+
+/** What the manager and the workers are measured against. The published
+ * package holds no Git history and no bun.lock, and whatever repository
+ * surrounds it is the consumer's project: from a package it is the
+ * fleet-owned checkout fleet-sync made of the commit the package names. A
+ * checkout (development) is its own reference.
+ */
+function statusRoot(settings: Settings, services: FleetServices): string {
+  const { revision, runs } = services;
+  return revision && runs ? join(runs, revision) : settings.workspace;
+}
+
+/** The manager has not run fleet-sync at this package's commit yet (a
+ * checkout is its own reference, so it always exists).
+ */
+function explainMissingCheckout(reports: NodeReport[], root: string): void {
+  if (existsSync(root)) return;
+  const check = reports[0]?.checks.find((item) => item.id === 'workspace');
+  if (!check) return;
+  check.summary =
+    'This manager has no fleet-owned checkout of the commit this package names; it is made by fleet-sync.';
+  check.remedy = {
+    action:
+      'Run devfleet fleet-sync from the project that holds your fleet.json, then fleet-status again.',
   };
 }
 
+/** Only this manager is checked: what is said of the fleet is skipped. */
+function skipsFleet(
+  options: CliOptions,
+  settings: { missingRoster: boolean }
+): boolean {
+  return Boolean(options.local || settings.missingRoster);
+}
+
+function usageOf(
+  reports: NodeReport[],
+  nodes: FleetNode[],
+  run: Runner,
+  skip: boolean
+) {
+  return skip ? Promise.resolve(null) : appendUsage(reports, nodes, { run });
+}
+
 function missingRoster(): NodeReport {
   return {
     node: 'fleet',

package/src/cli/managed-health.ts

@@ -3,6 +3,7 @@ import { verifyT3Endpoint } from '../t3-endpoint';
 import type { Check, NodeReport, Runner } from '../types';
 import { fleet as definition } from '../fleet-config';
 import { enrolledRoster } from '../definition';
+import { readParked } from '../state/workers';
 import type { Tailnet } from '../tailscale';
 import type { FleetNode } from '../types';
 import {
@@ -12,6 +13,7 @@ import {
 } from '../monitoring/beszel';
 import { hubAccess } from '../monitoring/hub-access';
 import { hubUrl } from '../topology';
+import { leftoverSystems, listSystems } from '../monitoring/systems';
 
 export interface DashboardAccess {
   (hub: string): Promise<{ request: BeszelRequest }>;
@@ -76,6 +78,7 @@ async function nodeEvidence(
         ) ?? dashboard;
       report.checks.push(...evidence.checks);
     }
+    dashboard.checks.push(...(await leftovers(request)));
   } catch (error) {
     dashboard.checks.push({
       id: 'beszel:access',
@@ -92,6 +95,21 @@ async function nodeEvidence(
   }
 }
 
+/** Systems the hub watches that no declared worker (parked ones included)
+ * and not the manager is named after. A hub whose list cannot be read says
+ * nothing here; its access is reported above.
+ */
+async function leftovers(request: BeszelRequest): Promise<Check[]> {
+  try {
+    return leftoverSystems(await listSystems(request), [
+      definition.manager.id,
+      ...definition.workers.map((worker) => worker.id),
+    ]);
+  } catch {
+    return [];
+  }
+}
+
 async function hubReachable(
   hub: string,
   fetcher: typeof fetch
@@ -155,7 +173,13 @@ export function managedHealthScope(
   roster: FleetNode[],
   includeManager = true
 ) {
-  const canonical = definition;
+  // A parked worker is off on purpose: it is not audited, not missing and
+  // its device is not expected online (fleet-status lists it as parked).
+  const parked = readParked();
+  const canonical = {
+    ...definition,
+    workers: definition.workers.filter((entry) => !parked[entry.id]),
+  };
   const declared = roster.filter((node) =>
     canonical.workers.some((entry) => entry.id === node.id)
   );

package/src/cli/register-fleet.ts

@@ -10,9 +10,33 @@ import { fleetState, type FleetStateOptions } from './fleet-state';
 import { fleetAccounts, type FleetAccountsOptions } from './fleet-accounts';
 import { fleetReport, type FleetReportOptions } from './fleet-report';
 import { fleetWatch, watchServices } from './fleet-watch';
-import type { NodeReport } from '../types';
+import type { Check, NodeReport } from '../types';
+import { fleet } from '../fleet-config';
 import { registerGithubVerify } from './github-verify';
 import { fleetRestore, type FleetRestoreOptions } from './fleet-restore';
+import { fleetValidate, type FleetValidateOptions } from './fleet-validate';
+import {
+  fleetManifest,
+  manifestServices,
+  type FleetManifestOptions,
+} from './fleet-manifest';
+import {
+  fleetNodeSeed,
+  seedServices,
+  type NodeSeedOptions,
+} from './fleet-node-seed';
+import {
+  fleetNodeReplace,
+  fleetNodeRetire,
+  lifecycleServices,
+  type NodeLifecycleOptions,
+} from './fleet-node-lifecycle';
+import {
+  fleetNodePark,
+  fleetNodeResume,
+  parkServices,
+  type NodeParkOptions,
+} from './fleet-node-park';
 
 type Complete = (outcome: CommandOutcome) => void;
 
@@ -181,12 +205,28 @@ function registerSync({ program, defaults, complete }: Registration) {
       '--revision <sha>',
       'Converge to an exact source commit; defaults to the commit the dev-fleet package you run was published from'
     )
+    .option(
+      '--rollback',
+      'Converge to the revision applied before the current one (fleet state); the revision, tools and T3 go back, system packages roll forward only'
+    )
     .option(
       '--node <id>',
       'Explicit enrolled remote target; repeatable',
       collect,
       []
     )
+    .option(
+      '--vault-password-login',
+      'Opt-in: log a worker without a token of its own in with the shared Vault user, on its own terminal'
+    )
+    .option(
+      '--restart-busy',
+      'Restart a worker T3 for a new release or policy even while agent turns run, which ends them; by default the restart waits until T3 is idle'
+    )
+    .option(
+      '--canary <id>',
+      'The worker that proves a new revision first when it is reachable; defaults to canary in fleet.json, then the first worker'
+    )
     .option(
       '--all',
       'Explicit spelling of the default enrolled fleet scope; never discovered peers'
@@ -200,6 +240,14 @@ function registerSync({ program, defaults, complete }: Registration) {
       'Accepted for compatibility; fleet-sync applies by default (schedule writes still need --apply --yes)'
     )
     .option('--yes', 'Accepted for compatibility with --apply')
+    .option(
+      '--maintenance-reboot',
+      'Reboot each worker whose installed updates wait for a reboot: one at a time, canary first, only while it runs no agent turn, verified ready before the next'
+    )
+    .option(
+      '--force',
+      'With --maintenance-reboot: reboot a worker even while agent turns run (they end)'
+    )
     .option(
       '--take-over',
       'Make this machine the manager while another one still holds the manager lease'
@@ -284,11 +332,11 @@ function registerState({ program, complete }: Registration) {
     .option('--yes', 'With --restore: discard changes the bucket does not hold')
     .option(
       '--timestamp <time>',
-      'With --restore: the version the bucket held at this time, uploaded again as the current one (a damaged replica)'
+      'With --restore: the version the bucket held at this time, uploaded again as the current one (a damaged replica); refused while another manager holds the manager lease, unless with --take-over'
     )
     .option(
       '--take-over',
-      'With --init or --import: change the fleet state while another manager still holds the manager lease'
+      'With --init, --import or --restore --timestamp: change the fleet state while another manager still holds the manager lease'
     )
     .addHelpText(
       'after',
@@ -336,10 +384,52 @@ function registerWatch({ program, defaults, complete }: Registration) {
         const data = report.data as { nodes?: NodeReport[] };
         return data.nodes ?? [];
       };
+      const autoPark = async (reports: NodeReport[]): Promise<Check[]> => {
+        const checks: Check[] = [];
+        for (const report of reports) {
+          if (
+            !report.checks.some(
+              (check) => check.id === 'worker:idle' && check.status === 'warn'
+            )
+          )
+            continue;
+          const worker = fleet.workers.find(
+            (entry) =>
+              entry.id === report.node ||
+              entry.network?.tailscaleName === report.node
+          );
+          if (!worker) continue;
+          const parked = await fleetNodePark(
+            { id: worker.id },
+            parkServices(settings.config, () =>
+              Promise.reject(new Error('fleet-watch never resumes a worker'))
+            )
+          );
+          checks.push({
+            id: 'worker:auto-park',
+            status: parked.exitCode === 0 ? 'pass' : 'warn',
+            summary:
+              parked.exitCode === 0
+                ? `${worker.id} was idle longer than declared and is parked.`
+                : 'WORKER_AUTO_PARK_REFUSED',
+            ...(parked.exitCode === 0
+              ? {}
+              : {
+                  remedy: {
+                    action: `fleet-node-park refused ${worker.id}; run devfleet fleet-node-park --id ${worker.id} to see why.`,
+                  },
+                }),
+          });
+        }
+        return checks;
+      };
       complete(
         await fleetWatch(
           { ...(options.test ? { test: true } : {}) },
-          watchServices(status)
+          {
+            ...watchServices(status),
+            ...(fleet.parking?.autoPark ? { autoPark } : {}),
+          }
         )
       );
     });
@@ -362,6 +452,160 @@ function registerRestore({ program, complete }: Registration) {
     });
 }
 
+function registerValidate({ program, complete }: Registration) {
+  program
+    .command('fleet-validate')
+    .description(
+      'Validate fleet.json and name the field that breaks a rule; contacts nothing'
+    )
+    .option(
+      '--file <path>',
+      'The fleet.json to validate; defaults to the project’s'
+    )
+    .option(
+      '--ansible',
+      'Also render the Ansible inventory and syntax-check every playbook with the pinned Ansible'
+    )
+    .action(async (_options, command: Command) => {
+      complete(
+        await fleetValidate(command.optsWithGlobals<FleetValidateOptions>())
+      );
+    });
+}
+
+function registerLifecycle({ program, defaults, complete }: Registration) {
+  const action =
+    (name: 'replace' | 'retire') =>
+    async (_options: unknown, command: Command) => {
+      const options = command.optsWithGlobals<
+        NodeLifecycleOptions & CliOptions
+      >();
+      const settings = await withSettings(defaults, options);
+      const services = lifecycleServices(settings.config);
+      complete(
+        name === 'replace'
+          ? await fleetNodeReplace(options, services)
+          : await fleetNodeRetire(options, services)
+      );
+    };
+  program
+    .command('fleet-node-replace')
+    .description(
+      'Put a fresh machine in place of a worker under the same id; writes need --apply --yes'
+    )
+    .requiredOption('--id <name>', 'The declared worker being replaced')
+    .option(
+      '--host-key <key>',
+      'The new machine’s SSH host key, "TYPE BASE64", verified out of band or printed by fleet-node-seed'
+    )
+    .option('--apply', 'Change the manager and Vault; requires --yes')
+    .option('--yes', 'Confirm an explicitly requested --apply operation')
+    .action(action('replace'));
+  program
+    .command('fleet-node-retire')
+    .description(
+      'Take a worker out of the fleet: revoke its token, forget its host key and roster entry; writes need --apply --yes'
+    )
+    .requiredOption('--id <name>', 'The declared worker to retire')
+    .option(
+      '--apply',
+      'Change the manager, Vault and the fleet state; requires --yes'
+    )
+    .option('--yes', 'Confirm an explicitly requested --apply operation')
+    .action(action('retire'));
+  const parking =
+    (name: 'park' | 'resume') =>
+    async (_options: unknown, command: Command) => {
+      const options = command.optsWithGlobals<NodeParkOptions & CliOptions>();
+      const settings = await withSettings(defaults, options);
+      const services = parkServices(settings.config, (id) =>
+        fleetSync(
+          {
+            node: [id],
+            apply: true,
+            yes: true,
+            nonInteractive: true,
+            ...(options.json ? { json: true } : {}),
+          },
+          {
+            ...defaults,
+            ...(options.config ? { config: options.config } : {}),
+          }
+        )
+      );
+      complete(
+        name === 'park'
+          ? await fleetNodePark(options, services)
+          : await fleetNodeResume(options, services)
+      );
+    };
+  program
+    .command('fleet-node-park')
+    .description(
+      'Park a worker that is stopped or destroyed on purpose: it is no longer contacted, never the canary and does not fail the fleet'
+    )
+    .requiredOption('--id <name>', 'The declared worker to park')
+    .option(
+      '--force',
+      'Park although agent turns are under way on it, or cannot be counted'
+    )
+    .option('--dry-run', 'Say what would change; change nothing')
+    .action(parking('park'));
+  program
+    .command('fleet-node-resume')
+    .description(
+      'Bring a parked worker back: run the declared start command, then fleet-sync that worker and verify it'
+    )
+    .requiredOption('--id <name>', 'The declared worker to resume')
+    .option('--dry-run', 'Say what would change; change nothing')
+    .action(parking('resume'));
+  program
+    .command('fleet-node-seed')
+    .description(
+      'Write cloud-init (or autoinstall) user data a new worker joins the fleet with by itself'
+    )
+    .requiredOption('--id <name>', 'The declared worker to seed')
+    .requiredOption(
+      '--output <path>',
+      'Where to write the seed (mode 600); it holds a single-use auth key and is never printed'
+    )
+    .option(
+      '--public-key <path>',
+      'The manager public key to authorize; default ~/.ssh/id_ed25519.pub'
+    )
+    .option('--autoinstall', 'An Ubuntu autoinstall file, for bare metal')
+    .option(
+      '--apply',
+      'Also pin the seed host key on this manager; requires --yes'
+    )
+    .option('--yes', 'Confirm an explicitly requested --apply operation')
+    .action(async (_options: unknown, command: Command) => {
+      const options = command.optsWithGlobals<NodeSeedOptions & CliOptions>();
+      const settings = await withSettings(defaults, options);
+      complete(await fleetNodeSeed(options, seedServices(settings.config)));
+    });
+}
+
+function registerManifest({ program, defaults, complete }: Registration) {
+  program
+    .command('fleet-manifest')
+    .description(
+      'Measure what a worker is made of and check it against the pins and a fresh build'
+    )
+    .requiredOption('--id <name>', 'The enrolled worker to measure')
+    .option(
+      '--reference <path>',
+      'A fleet-manifest --json of a fresh build of the same revision'
+    )
+    .action(async (_options: unknown, command: Command) => {
+      const options = command.optsWithGlobals<
+        FleetManifestOptions & CliOptions
+      >();
+      const settings = await withSettings(defaults, options);
+      complete(await fleetManifest(options, manifestServices(settings.config)));
+    });
+}
+
 export function registerFleet(
   program: Command,
   defaults: Settings,
@@ -379,6 +623,9 @@ export function registerFleet(
   registerReport(registration);
   registerWatch(registration);
   registerRestore(registration);
+  registerValidate(registration);
+  registerLifecycle(registration);
+  registerManifest(registration);
   registerRepair(registration);
   registerNodes(registration);
   registerAccounts(registration);

package/src/cli/registry.ts

@@ -116,6 +116,18 @@ export const COMMANDS: CommandSpec[] = [
       ['manager', 'restore', 'replace', 'lost', 'recovery'],
       true,
     ],
+    [
+      'fleet-validate',
+      'Validate the fleet configuration',
+      'Read-only: judge fleet.json without contacting anything. An invalid file names the first rule it breaks as {code, path, expected, actual}. --ansible also renders the Ansible inventory and syntax-checks every playbook with the pinned Ansible.',
+      ['validate', 'lint', 'schema', 'fleet.json', 'configuration', 'ansible'],
+    ],
+    [
+      'fleet-manifest',
+      'Measure a worker and compare it with a fresh build',
+      'Read-only over verified SSH: every installed package, the active mise tools and the state of each always-on service, with a digest that is the same for two workers built from the same revision. The check worker:manifest reports every difference from the declared pins and, with --reference, from a fresh build.',
+      ['manifest', 'drift', 'reproducible', 'rebuild', 'packages', 'audit'],
+    ],
     [
       'fleet-node-sync',
       'Sync this node',
@@ -181,6 +193,41 @@ export const COMMANDS: CommandSpec[] = [
       ['github', 'verify', 'pull request', 'push', 'permissions', 'workflow'],
       true,
     ],
+    [
+      'fleet-node-replace',
+      'Replace a worker with a fresh machine',
+      'Preview, or with --apply --yes carry out, putting a fresh machine in place of a declared worker under the same id: verify the new device on the tailnet, pin its host key (--host-key), bind the roster entry to it and issue it a Vault token of its own, revoking the old one. Then fleet-sync --node ID converges it. Running it again changes nothing.',
+      ['replace', 'rebuild', 'reinstall', 'host key', 'token', 'device'],
+      true,
+    ],
+    [
+      'fleet-node-seed',
+      'Seed a new worker that joins by itself',
+      'Write cloud-init user data (or an Ubuntu autoinstall file with --autoinstall) for a declared worker to a private file: its account with the manager key, the privilege rule, a host key generated for it, the pinned Tailscale and a short-lived single-use auth key from the secrets provider (tailnet-auth-key). --apply --yes also pins that host key on the manager, so there is no trust on first use.',
+      ['seed', 'cloud-init', 'autoinstall', 'new', 'bootstrap', 'provision'],
+      true,
+    ],
+    [
+      'fleet-node-park',
+      'Park a worker that is off on purpose',
+      'Record in the fleet state that a declared worker is stopped or destroyed on purpose (a rented machine nobody uses): fleet-sync and fleet-status list it as parked with the time since, never contact it or make it the canary, and it does not change the exit code. Refuses while agent turns run on it, unless --force. Runs the stop command fleet.json declares under parking.stop with the worker ID. --dry-run previews.',
+      ['park', 'stop', 'pause', 'idle', 'cost', 'rented', 'shutdown'],
+      true,
+    ],
+    [
+      'fleet-node-resume',
+      'Resume a parked worker',
+      'Run the start command fleet.json declares under parking.start with the worker ID, mark the worker active in the fleet state, then run fleet-sync --node ID, which converges and verifies it. The exit code is the sync’s. --dry-run previews.',
+      ['resume', 'start', 'unpark', 'wake', 'rented'],
+      true,
+    ],
+    [
+      'fleet-node-retire',
+      'Retire a worker',
+      'Preview, or with --apply --yes carry out, taking a worker out of the fleet: revoke its Vault token, forget its pinned host key, remove its roster entry and record a tombstone in the fleet state. Then remove it from fleet.json.',
+      ['retire', 'remove', 'decommission', 'revoke', 'delete'],
+      true,
+    ],
   ]),
   ...group('T3', [
     [

package/src/cli/tailnet.ts

@@ -5,13 +5,19 @@ import {
   appendManagerLinks,
   appendDashboardEvidence,
 } from './managed-health';
-import { discoverTailnet } from '../tailscale';
+import { discoverTailnet, type Tailnet } from '../tailscale';
+import type { FleetNode, NodeReport } from '../types';
+import { appendPublicReachability } from '../public-reachability';
 import { tailnetHealth } from '../tailnet-health';
 import { makeReport, renderReport, reportExitCode } from '../report';
 import { readRoster } from './roster';
 import { publicHubUrl } from '../monitoring/beszel';
 import { stableUrls } from './fleet-sync-output';
 import { timeout } from './options';
+import { appendUsage } from './worker-usage-report';
+import { appendTailnetLeftovers } from '../tailnet-cleanup';
+import { fleet } from '../fleet-config';
+import { withUsage } from '../worker-activity';
 import type { FleetServices } from './fleet';
 import type { Settings } from './settings';
 import type { CliOptions } from './options';
@@ -57,12 +63,21 @@ export async function executeTailnet(
   );
   if (options.managed)
     await appendManagerLinks(nodes, registered, services.run);
+  // From the manager, outside the tailnet: optional, it never blocks readiness.
+  if (options.workers) await appendPublicReachability(nodes, services.run);
   // The hub runs on the manager, which worker scope deliberately filters out of
   // `tailnet`; its visibility comes from the unfiltered discovery.
   const dashboard = options.workers
-    ? await appendDashboardEvidence(nodes, discovered)
+    ? await workerFleetEvidence(nodes, discovered, registered, services)
     : null;
-  const report = makeReport('health', nodes);
+  // Parked workers, and what each active one is doing (uptime, agent turns).
+  const usage = options.managed
+    ? await appendUsage(nodes, registered, {
+        run: services.run,
+        computers: discovered.computers,
+      })
+    : null;
+  const report = { ...makeReport('health', nodes), ...(usage ?? {}) };
   const exitCode = reportExitCode(report, true);
   const verified = exitCode === 0;
   return {
@@ -77,16 +92,34 @@ export async function executeTailnet(
         inspected: nodes.filter((node) => node.snapshot).length,
       },
     },
-    text: options.workers
-      ? workerHealthText(
-          { ...report, ok: verified },
-          coverage,
-          publicDashboard(dashboard)
-        )
-      : `${stableUrls(renderReport({ ...report, ok: verified }))}\nCoverage: ${coverage.computers} visible computers; ${coverage.excludedMobile} mobile devices excluded.\n${coverage.limitation}`,
+    text: withUsage(
+      options.workers
+        ? workerHealthText(
+            { ...report, ok: verified },
+            coverage,
+            publicDashboard(dashboard)
+          )
+        : `${stableUrls(renderReport({ ...report, ok: verified }))}\nCoverage: ${coverage.computers} visible computers; ${coverage.excludedMobile} mobile devices excluded.\n${coverage.limitation}`,
+      usage
+    ),
   };
 }
 
+/** What the canonical worker fleet is checked for beyond each worker: the
+ * dashboard's evidence, and devices tagged as workers that are no declared
+ * worker (#123). Returns the private hub address.
+ */
+async function workerFleetEvidence(
+  nodes: NodeReport[],
+  discovered: Tailnet,
+  registered: FleetNode[],
+  services: FleetServices
+): Promise<string | null> {
+  const dashboard = await appendDashboardEvidence(nodes, discovered);
+  await appendTailnetLeftovers(nodes, fleet, services.tailnet, registered);
+  return dashboard;
+}
+
 /** Shown to people: the stable public name, never the tailnet address. */
 function publicDashboard(privateHub: string | null): string | null {
   return privateHub ? publicHubUrl() : null;

package/src/cli/ui-data.ts

@@ -86,7 +86,9 @@ function nodeChecks(value: unknown): CheckRow[] {
 }
 
 export function isStatus(value: unknown): value is string {
-  return ['pass', 'warn', 'fail', 'skip'].includes(String(value));
+  return ['pass', 'warn', 'fail', 'skip', 'not-applicable'].includes(
+    String(value)
+  );
 }
 
 export function isCancellation(error: unknown): boolean {