@crvouga/dev-fleet 0.8.0 → 0.9.0

package/src/cli/fleet-sync-remote.ts

@@ -2,7 +2,8 @@ import { createHash } from 'node:crypto';
 import { IDES } from '../ide';
 import { enabled, workerChecks } from '../ide/orchestrate';
 import { idesOf } from '../ide/definition';
-import { rememberEnvironment } from '../t3/pairing';
+import { pairIfRequested, rememberEnvironment } from '../t3/pairing';
+import { managerT3 } from '../t3/peer-link';
 import { authorizePrivilege } from './fleet-sync-privilege';
 import { authorizeVault } from './fleet-sync-vault';
 import { managerFailure } from '../manager-failure';
@@ -15,13 +16,32 @@ import { FleetUsageError } from '../errors';
 import { selectNodes } from '../config';
 import { loadRoster } from './roster';
 import { enrolledRoster } from '../definition';
+import { readParked, readWorkerStates } from '../state/workers';
+import { withoutParked } from '../worker-parking';
+import { reconcileRecords } from './fleet-sync-records';
 import type { FleetDefinition } from '../definition';
 import { fleet as definition } from '../fleet-config';
 import { synchronizeManager } from '../manager-sync';
 import { inspectBootstrap } from '../manager-sync';
-import { prepareBootstrap, bootstrapRemote } from '../remote-bootstrap';
+import {
+  prepareBootstrap,
+  bootstrapRemote,
+  readsTailnetKey,
+} from '../remote-bootstrap';
+import { secret } from '../fleet-config';
+import { fleetTailnetControl, type TailnetControl } from '../tailnet-control';
+import { discoverTailnet, type TailnetComputer } from '../tailscale';
+import { deployWorker } from './fleet-sync-worker';
+import { packagePlaybook } from '../platform/ansible';
 import { machineRoot } from './fleet-sync';
-import type { Check, Runner } from '../types';
+import {
+  blocking,
+  type Check,
+  type FleetNode,
+  type NodeReport,
+  type Runner,
+} from '../types';
+import { diagnostic } from '../diagnostics';
 import type { DeployNode, ManagerReport } from '../manager-sync';
 import type { FleetSyncOptions } from './fleet-sync';
 import type { Settings } from './settings';
@@ -39,14 +59,35 @@ export async function selected(
   if (!options.revision)
     throw new FleetUsageError('An approved source revision is required.');
   const canonical = definition;
+  // Workers whose record disappeared are retired first (planned in a
+  // preview), so they are no longer in the roster.
+  const records = await reconcileRecords(canonical, settings.config, run, {
+    apply: Boolean(options.apply),
+  });
   let roster;
   try {
-    roster = enrolledRoster(canonical, await loadRoster(settings.config));
+    const declared = new Set(canonical.workers.map((worker) => worker.id));
+    const loaded = await loadRoster(settings.config);
+    roster = enrolledRoster(canonical, {
+      ...loaded,
+      nodes: loaded.nodes.filter(
+        (node) =>
+          declared.has(node.id) ||
+          readWorkerStates().workers[node.id]?.origin !== 'records'
+      ),
+    });
   } catch {
     return enrollmentRequired(canonical, options.revision);
   }
-  const nodes = selectNodes(roster, options.node ?? []);
-  const scoped = scopeDefinition(canonical, options.node);
+  // A parked worker is not contacted and never the canary.
+  const active = withoutParked(
+    scopeDefinition(canonical, options.node),
+    selectNodes(roster, options.node ?? []),
+    readParked(),
+    new Date()
+  );
+  const { nodes, definition: scoped } = active;
+  const notes = [...records, ...active.checks];
   const ui = interfaceOptions(options);
   const planFingerprint = createHash('sha256')
     .update(
@@ -65,12 +106,16 @@ export async function selected(
         'Manager connection bindings or target policy changed after approval. Inspect a fresh plan and approve it; no source preparation or node mutation occurred.'
       )
     );
-  const payload = options.apply
+  const prepared = options.apply
     ? await prepareBootstrap(machineRoot(), options.revision, run, {
         definition: canonical,
         checkout: settings.workspace,
       })
     : null;
+  const payload =
+    prepared && options.restartBusy
+      ? { ...prepared, restartBusy: true }
+      : prepared;
   const started = Date.now();
   const report = await synchronizeManager(
     {
@@ -79,6 +124,7 @@ export async function selected(
       revision: options.revision,
       apply: Boolean(options.apply),
       ...canary(canonical, options),
+      ...serial(options),
       progress: (node, phase) => ui.progress.step(node, phase),
       finished: (node) => ui.progress.finished(node),
       manager: () =>
@@ -97,12 +143,54 @@ export async function selected(
       ...ui,
       workspace: settings.workspace,
       roster: settings.config,
+      ...rebootOptions(options),
     })
   ).finally(() => ui.progress.stop());
+  if (options.enrollment) reportEnrollment(report, options.enrollment);
+  report.checks.push(...notes);
+  // A worker that could not be retired, like any other failed check of the
+  // fleet, means the run did not converge: it is not recorded as applied.
+  if (notes.some(blocking)) report.ok = false;
   if (settle) report.checks.push(await settle(report));
   return outcome(report, planFingerprint, started);
 }
 
+/** Maintenance reboots go one worker at a time, and a worker that does not
+ * come back ready stops the others.
+ */
+function serial(options: FleetSyncOptions): { serial?: true } {
+  return options.maintenanceReboot ? { serial: true } : {};
+}
+
+function rebootOptions(options: FleetSyncOptions): {
+  readyBefore: string[];
+  maintenanceReboot?: true;
+  force?: true;
+} {
+  return {
+    readyBefore: options.readyBefore ?? [],
+    ...(options.maintenanceReboot ? { maintenanceReboot: true } : {}),
+    ...(options.force ? { force: true } : {}),
+  };
+}
+
+/** The workers this run enrolled, and why another was not: the checks land
+ * on the worker they are about.
+ */
+export function reportEnrollment(
+  report: ManagerReport,
+  enrollment: NonNullable<FleetSyncOptions['enrollment']>
+): void {
+  report.enrolled = enrollment.enrolled;
+  for (const { node, check } of enrollment.checks) {
+    const entry = report.nodes.find((candidate) => candidate.node === node);
+    if (!entry) continue;
+    entry.checks.unshift(check);
+    entry.diagnostics = entry.checks.map((each) => diagnostic(node, each));
+    if (blocking(check)) report.ok = false;
+  }
+}
+
 /** A revision new to the fleet is proven on one worker before the rest: the
  * one `--canary` or fleet.json names, else the first declared worker, and
  * the next reachable one when that cannot be reached. Repeating a revision
@@ -176,8 +264,15 @@ function deployWithMonitoring(
     workspace: string;
     roster: string;
     passwordLogin: boolean;
+    readyBefore: string[];
+    maintenanceReboot?: boolean;
+    force?: boolean;
   }
 ): DeployNode {
+  // Asked once per run, and only when a worker needs them.
+  let control: Promise<TailnetControl | null> | undefined;
+  let computers: Promise<TailnetComputer[]> | undefined;
+  const converge = convergeWorker(payload, canonical, run, ui);
   return async (node, revision) => {
     if (!payload || payload.revision !== revision)
       return {
@@ -194,10 +289,50 @@ function deployWithMonitoring(
           },
         ],
       };
+    return deployWorker(node, revision, {
+      definition: canonical,
+      playbook: packagePlaybook(run),
+      converge,
+      control: () =>
+        (control ??= fleetTailnetControl(canonical.tailnet, secret)),
+      computers: () =>
+        (computers ??= discoverTailnet(run).then((found) => found.computers)),
+      readyBefore: ui.readyBefore,
+      ...(ui.maintenanceReboot ? { maintenanceReboot: true } : {}),
+      ...(ui.force ? { force: true } : {}),
+      acceptsTailnetKey: readsTailnetKey(payload.script),
+    });
+  };
+}
+
+/** One converge of a worker: privilege, Vault, the bootstrap, then what is
+ * verified from the manager and the worker's monitoring.
+ */
+function convergeWorker(
+  payload: Awaited<ReturnType<typeof prepareBootstrap>>,
+  canonical: FleetDefinition,
+  run: Runner,
+  ui: {
+    progress: SyncProgress;
+    interactiveAuthorization: boolean;
+    workspace: string;
+    roster: string;
+    passwordLogin: boolean;
+  }
+) {
+  return async (
+    node: FleetNode,
+    revision: string,
+    tailnetKey?: string
+  ): Promise<NodeReport> => {
     // Password prompts need a quiet terminal: no spinner while authorizing.
     if (ui.interactiveAuthorization) {
       ui.progress.stop();
-      const checks = await authorizePrivilege(node, payload.authorizeSudo, run);
+      const checks = await authorizePrivilege(
+        node,
+        payload!.authorizeSudo,
+        run
+      );
       if (checks.length) return { node: node.id, checks };
     }
     const vault = {
@@ -207,8 +342,9 @@ function deployWithMonitoring(
     if (ui.interactiveAuthorization) ui.progress.stop();
     const before = await authorizeVault(node, vault, run);
     ui.progress.step(node.id, 'Converging (remote lock, install, verify)');
-    const result = await bootstrapRemote(node, payload, run, {
+    const result = await bootstrapRemote(node, payload!, run, {
       progress: (line) => ui.progress.step(node.id, line),
+      ...(tailnetKey ? { tailnetKey } : {}),
     });
     // A fresh node gets vault from the bootstrap; log it in now. Its provider
     // checks in this run predate the login, so the next sync verifies them.
@@ -226,6 +362,12 @@ function deployWithMonitoring(
         remember: async (id, identity) => {
           await rememberEnvironment(ui.roster, id, identity);
         },
+        pair: (target) =>
+          pairIfRequested(target, {
+            roster: ui.roster,
+            run,
+            manager: managerT3(run),
+          }),
       }))
     );
     if (

package/src/cli/fleet-sync-schedule.ts

@@ -9,13 +9,19 @@ import {
   recordSchedule,
   type ScheduleRecord,
 } from '../state/history';
-import { scheduleCheck, SCHEDULE_INTERVAL_SECONDS } from '../schedule-check';
+import macos from '../../ansible/macos/policy.json';
+import { fleet } from '../fleet-config';
+import {
+  scheduleCheck,
+  scheduleIntervals,
+  SCHEDULE_INTERVAL_SECONDS,
+} from '../schedule-check';
 import type { Runner } from '../types';
 import type { CommandOutcome } from './contracts';
 import { machineRoot } from './fleet-sync';
 
 /** The launchd label and systemd unit already on running managers. */
-export const SCHEDULE_LABEL = 'personal-fleet-sync';
+export const SCHEDULE_LABEL = macos.fleetSync.label;
 const LABEL = SCHEDULE_LABEL;
 export type ScheduleAction =
   'enable' | 'pause' | 'resume' | 'disable' | 'status';
@@ -31,6 +37,8 @@ interface ScheduleInput {
   /** The manager's caches; tests name their own. */
   root?: string;
   now?: Date;
+  /** How often the schedule runs; `manager.schedule.syncMinutes` otherwise. */
+  intervalSeconds?: number;
 }
 
 /** The published package a schedule installs and runs: its name, exact
@@ -205,14 +213,16 @@ async function enableSchedule(
     return required(
       'The exact CLI package could not be installed in the managed manager runtime. No schedule was enabled.'
     );
+  const intervalSeconds =
+    input.intervalSeconds ?? scheduleIntervals(fleet.manager).syncSeconds;
   const result = platform.installScheduledJob({
     label: LABEL,
-    intervalSeconds: SCHEDULE_INTERVAL_SECONDS,
+    intervalSeconds,
     command: scheduledCommand(published, input.revision, prefix),
     logDir: join(root, 'logs'),
     env: scheduledEnvironment(),
   });
-  if (result.ok) remember(input, true);
+  if (result.ok) remember(input, true, intervalSeconds);
   return {
     exitCode: result.ok ? 0 : 1,
     data: {

package/src/cli/fleet-sync-state.ts

@@ -1,6 +1,6 @@
 import type { Enrollment } from '../machine/state';
 import { replicaCheck } from '../state/check';
-import { storeEnrollment } from '../state/enrollment';
+import { loadEnrollment, storeEnrollment } from '../state/enrollment';
 import { adoptEarlier } from '../state/legacy';
 import { databasePath, stateRoot } from '../state/paths';
 import { writeDocument } from '../state/store';
@@ -23,9 +23,10 @@ export interface RunRecord {
   approve(): void;
   /** Once the result is known. The check says whether the bucket holds it.
    * `applied` is the revision each worker that converged now holds: it is
-   * kept even when the fleet as a whole is not ready.
+   * kept even when the fleet as a whole is not ready, and it is all a run
+   * scoped with --node records.
    */
-  settle(converged: boolean, applied?: Record<string, string>): Promise<Check>;
+  settle(ready: boolean, applied?: Record<string, string>): Promise<Check>;
   /** For a run that stopped before its result: its approval is still uploaded. */
   abandon(): Promise<void>;
 }
@@ -42,6 +43,10 @@ export function runRecord(
      * worker, a replacement manager) uses the one last applied.
      */
     definition?: string;
+    /** A run scoped with --node covers only the workers it selected: it
+     * records their revisions, never one applied for the whole fleet.
+     */
+    scoped?: boolean;
   }
 ): RunRecord {
   const env = state.env ?? process.env;
@@ -73,26 +78,33 @@ export function runRecord(
       }
       claimLease(state.context);
     },
-    async settle(converged, applied = {}) {
+    async settle(ready, applied = {}) {
       settled = true;
-      const workers = Object.keys(applied).length
-        ? { workers: { ...previous?.workers, ...applied } }
-        : {};
-      if (!converged && workers.workers)
-        storeEnrollment({ ...approval, ...workers }, env);
-      if (converged)
+      const converged = ready && state.scoped !== true;
+      if (converged || Object.keys(applied).length) {
+        // What was recorded since the approval stands: the run itself
+        // retires a worker whose record was removed, and another command
+        // may have. Only what this run decided is written over it.
+        const stored = (await loadEnrollment(null, env)) ?? approval;
         storeEnrollment(
           {
-            ...approval,
-            ...workers,
-            appliedRevision: revision,
-            ...(previous?.appliedRevision &&
-            previous.appliedRevision !== revision
-              ? { previousRevision: previous.appliedRevision }
+            ...stored,
+            ...(Object.keys(applied).length
+              ? { workers: { ...stored.workers, ...applied } }
+              : {}),
+            ...(converged
+              ? {
+                  appliedRevision: revision,
+                  ...(previous?.appliedRevision &&
+                  previous.appliedRevision !== revision
+                    ? { previousRevision: previous.appliedRevision }
+                    : {}),
+                }
               : {}),
           },
           env
         );
+      }
       // The fleet converged either way: a bucket problem is reported, not fatal.
       return replicaCheck(await publish().catch(() => 'unreachable' as const), {
         advisory: true,

package/src/cli/fleet-sync-vault.ts

@@ -1,8 +1,11 @@
 import { spawnSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
 import { fleet as definition } from '../fleet-config';
 import { sshArgs, shellQuote } from '../ssh';
 import { resolveVaultConfig, usesVault } from '../vault-config';
 import { workerTokenLocation } from '../worker-credentials';
+import { runAnsible } from '../platform/ansible';
 import type { Check, FleetNode, Runner } from '../types';
 
 const TOOL_PATH =
@@ -213,3 +216,77 @@ function required(node: FleetNode): Check {
     },
   };
 }
+
+/**
+ * The manager's own Vault session renews itself every ten minutes, like each
+ * worker's: `ansible/macos/vault-renew.yml`, applied on every applying sync.
+ * Measured as the session answering and the job being loaded; a lapsed
+ * session needs one login by a person, and until then agents on the manager
+ * use the proxy client key they last read (src/agents/secrets.ts).
+ */
+export async function holdManagerVault(
+  run: Runner,
+  options: {
+    apply: boolean;
+    root: string;
+    home?: string;
+    uid?: number;
+    scratch?: string;
+  }
+): Promise<Check[]> {
+  if (!usesVault()) return [];
+  const { addr } = resolveVaultConfig();
+  const home = options.home ?? homedir();
+  if (options.apply)
+    await runAnsible(
+      run,
+      join(options.root, 'ansible/macos/vault-renew.yml'),
+      {
+        input: JSON.stringify({
+          vault_address: addr,
+          mise: join(home, '.local/bin/mise'),
+        }),
+        timeoutMs: 120_000,
+      },
+      options.scratch
+    );
+  const loaded = (
+    await run(
+      [
+        'launchctl',
+        'print',
+        `gui/${options.uid ?? process.getuid?.() ?? 0}/${MANAGER_VAULT_RENEWAL}`,
+      ],
+      { timeoutMs: 10_000 }
+    )
+  ).ok;
+  const session = (await run(lookup(), { timeoutMs: 20_000 })).ok;
+  return [vaultRenewalCheck(session, loaded, addr)];
+}
+
+function vaultRenewalCheck(
+  session: boolean,
+  loaded: boolean,
+  addr: string
+): Check {
+  if (session && loaded)
+    return {
+      id: 'manager:vault-renewal',
+      status: 'pass',
+      summary:
+        'The manager is logged in to Vault and renews its session every ten minutes.',
+    };
+  return {
+    id: 'manager:vault-renewal',
+    status: 'fail',
+    summary: session ? 'VAULT_RENEWAL_MISSING' : 'VAULT_LOGIN_REQUIRED',
+    remedy: {
+      action: session
+        ? `The manager's Vault session is not renewed and lapses at its TTL. Run devfleet fleet-sync on the manager; it loads ${MANAGER_VAULT_RENEWAL}.`
+        : `Log the manager in once, in your own terminal: vault login -address=${addr} -method=userpass username=${definition.worker?.vaultUser ?? 'YOUR_USERNAME'}. Then run devfleet fleet-sync. Until then the manager's agents use the proxy client key they last read, and new worker tokens cannot be issued.`,
+    },
+  };
+}
+
+/** The launchd label of the manager's Vault renewal job (vault-renew.yml). */
+export const MANAGER_VAULT_RENEWAL = 'dev.devfleet.vault-renew';

package/src/cli/fleet-sync-worker.ts

@@ -0,0 +1,214 @@
+import type { FleetDefinition } from '../definition';
+import {
+  controlRemedy,
+  TailnetControlError,
+  type TailnetControl,
+} from '../tailnet-control';
+import type { TailnetComputer } from '../tailscale';
+import type { PackagePlaybook } from '../platform/ansible';
+import type { Check, FleetNode, NodeReport } from '../types';
+import { createWorkerAccount } from '../worker-account';
+import {
+  rebootNeeded,
+  rebootWorker,
+  updatesPending,
+  type RebootReason,
+} from '../worker-reboot';
+
+/** What one worker's deployment needs around its converge: the converge
+ * itself (bootstrap, verification, monitoring), the tailnet control plane
+ * when the fleet declares one, the tailnet as the manager sees it, and what
+ * the run was asked to do.
+ */
+export interface WorkerDeployment {
+  definition: FleetDefinition;
+  /** Applies a playbook of the package from the manager. */
+  playbook: PackagePlaybook;
+  /** One converge of the worker; `tailnetKey` is handed to its bootstrap. */
+  converge: (
+    node: FleetNode,
+    revision: string,
+    tailnetKey?: string
+  ) => Promise<NodeReport>;
+  /** Null when the fleet declares no tailnet control plane. */
+  control: () => Promise<TailnetControl | null>;
+  /** The devices of the tailnet, as the manager's Tailscale lists them. */
+  computers: () => Promise<TailnetComputer[]>;
+  /** The workers that converged in an earlier run. */
+  readyBefore: string[];
+  maintenanceReboot?: boolean;
+  force?: boolean;
+  /** Whether the bootstrap of this revision reads a tailnet key. */
+  acceptsTailnetKey: boolean;
+}
+
+/** Deploys one worker and, around its converge: hands a worker that is not
+ * on the tailnet a single-use key, keeps an enrolled worker's node key from
+ * expiring, creates the declared account on an image that lets only root
+ * in, and reboots the worker once when its first converge needs it (or for
+ * maintenance, when asked), converging it again to verify it.
+ */
+export async function deployWorker(
+  node: FleetNode,
+  revision: string,
+  deployment: WorkerDeployment
+): Promise<NodeReport> {
+  const before: Check[] = [];
+  const key = await enrolmentKey(node, deployment, before);
+  before.push(...(await keyExpiry(node, deployment)));
+  let target = node;
+  let result = await deployment.converge(target, revision, key);
+  const account = await rootOnly(node, result, deployment);
+  if (account) {
+    before.push(account.check);
+    if (account.node) {
+      target = account.node;
+      result = await deployment.converge(target, revision, key);
+    }
+  }
+  const reason = rebootReason(node.id, result.checks, deployment);
+  if (reason) {
+    const reboot = await rebootWorker(
+      target,
+      {
+        revision,
+        reason,
+        ...(reason === 'maintenance' && deployment.force
+          ? { force: true }
+          : {}),
+      },
+      deployment.playbook
+    );
+    if (reboot.status === 'pass')
+      result = await deployment.converge(target, revision);
+    result.checks.unshift(reboot);
+  }
+  result.checks.unshift(...before);
+  return result;
+}
+
+/** Why this worker is rebooted now, if it is. A worker that converged
+ * before is never rebooted for its first converge; only an explicit
+ * maintenance run reboots it.
+ */
+function rebootReason(
+  id: string,
+  checks: Check[],
+  deployment: WorkerDeployment
+): RebootReason | null {
+  if (deployment.maintenanceReboot && updatesPending(checks))
+    return 'maintenance';
+  if (!deployment.readyBefore.includes(id) && rebootNeeded(checks))
+    return 'first-converge';
+  return null;
+}
+
+/** A single-use, pre-authorised, tagged key for a worker the roster has no
+ * tailnet identity for yet. The key is never reported.
+ */
+async function enrolmentKey(
+  node: FleetNode,
+  deployment: WorkerDeployment,
+  checks: Check[]
+): Promise<string | undefined> {
+  if (node.tailscaleId || !deployment.acceptsTailnetKey) return undefined;
+  try {
+    const control = await deployment.control();
+    if (!control) return undefined;
+    const minted = await control.createAuthKey({ worker: node.id });
+    checks.push({
+      id: 'tailscale:enrolment-key',
+      status: 'pass',
+      summary: `A single-use, pre-authorised key tagged ${deployment.definition.tailnet!.tag}, expiring within minutes, was handed to the worker on the bootstrap's stdin.`,
+    });
+    return minted.key;
+  } catch (error) {
+    if (!(error instanceof TailnetControlError)) throw error;
+    checks.push(controlFailure('tailscale:enrolment-key', error));
+    return undefined;
+  }
+}
+
+/** An enrolled worker's node key never expires: the control plane disables
+ * expiry for a worker whose key has one (tagged workers have none on the
+ * hosted Tailscale). The tailscale:key-expiry check still measures it.
+ */
+async function keyExpiry(
+  node: FleetNode,
+  deployment: WorkerDeployment
+): Promise<Check[]> {
+  if (!node.tailscaleId) return [];
+  try {
+    const control = await deployment.control();
+    if (!control) return [];
+    const peer = (await deployment.computers()).find(
+      (computer) => computer.id === node.tailscaleId
+    );
+    if (peer?.keyExpiry === undefined) return [];
+    await control.disableKeyExpiry(node.tailscaleId);
+    return [
+      {
+        id: 'tailscale:key-expiry-policy',
+        status: 'pass',
+        summary:
+          'Key expiry of this worker was disabled through the tailnet control plane; tailscale:key-expiry measures it again on the next run.',
+      },
+    ];
+  } catch (error) {
+    if (!(error instanceof TailnetControlError)) throw error;
+    return [
+      {
+        ...controlFailure('tailscale:key-expiry-policy', error),
+        status: 'warn',
+      },
+    ];
+  }
+}
+
+function controlFailure(id: string, error: TailnetControlError): Check {
+  return {
+    id,
+    status: 'fail',
+    summary: error.code,
+    remedy: { action: controlRemedy(error.code) },
+  };
+}
+
+/** The bootstrap refused to run as root: the alias logs in as root. With a
+ * declared account, it is created over that login and the run continues as
+ * it (`user@alias`); the next runs need the alias to name it, since the SSH
+ * policy turns root login off.
+ */
+async function rootOnly(
+  node: FleetNode,
+  result: NodeReport,
+  deployment: WorkerDeployment
+): Promise<{ check: Check; node?: FleetNode } | null> {
+  if (
+    !result.checks.some(
+      (check) => check.summary === 'ROOT_DEVELOPMENT_USER_REJECTED'
+    )
+  )
+    return null;
+  const user = deployment.definition.workers.find(
+    (worker) => worker.id === node.id
+  )?.network?.user;
+  const check = await createWorkerAccount(
+    { id: node.id, ssh: node.ssh, login: '' },
+    user,
+    deployment.playbook
+  );
+  if (check.status !== 'pass') return { check };
+  return {
+    check: {
+      ...check,
+      status: 'warn',
+      summary: `${check.summary} This run continued as ${user}@${node.ssh}; set User ${user} for the SSH alias ${node.ssh}, since root login is turned off.`,
+    },
+    node: {
+      ...node,
+      ssh: `${user}@${node.ssh}`,
+      workspace: `/home/${user}/.local/share/personal/fleet`,
+    },
+  };
+}