@crvouga/dev-fleet 0.8.0 → 0.9.1

package/src/cli/fleet-node-park.ts

@@ -0,0 +1,238 @@
+import type { FleetDefinition, MachineDefinition } from '../definition';
+import { FleetUsageError } from '../errors';
+import { fleet } from '../fleet-config';
+import { makeReport, renderReport } from '../report';
+import { runCommand } from '../runner';
+import { changeWorkers, readWorkerStates } from '../state/workers';
+import { stateContext, type StateContext } from '../state/sync';
+import type { Check, Runner } from '../types';
+import { duration, workerActivity } from '../worker-activity';
+import type { CommandOutcome } from './contracts';
+import { readRoster } from './roster';
+
+export interface NodeParkOptions {
+  id?: string;
+  /** Park although agent turns are under way, or cannot be counted. */
+  force?: boolean;
+  dryRun?: boolean;
+}
+
+export interface NodeParkServices {
+  run: Runner;
+  /** The roster: the fleet state's, or a file `--config` names. */
+  roster: string;
+  definition: () => FleetDefinition;
+  state: () => StateContext;
+  now: () => Date;
+  /** A normal fleet-sync of one worker, which verifies it. */
+  sync: (id: string) => Promise<CommandOutcome>;
+}
+
+export function parkServices(
+  roster: string,
+  sync: (id: string) => Promise<CommandOutcome>
+): NodeParkServices {
+  return {
+    run: runCommand,
+    roster,
+    definition: () => fleet,
+    state: () => stateContext(runCommand),
+    now: () => new Date(),
+    sync,
+  };
+}
+
+/** A hook may start or stop a machine through an infrastructure tool; it
+ * gets half an hour.
+ */
+const HOOK_TIMEOUT_MS = 1_800_000;
+
+function declared(definition: FleetDefinition, id: string | undefined) {
+  const worker = definition.workers.find((entry) => entry.id === id);
+  if (!worker)
+    throw new FleetUsageError('--id must name a worker fleet.json declares.');
+  return worker;
+}
+
+function outcome(
+  command: string,
+  id: string,
+  checks: Check[],
+  extra: Record<string, unknown> = {}
+): CommandOutcome {
+  const report = { ...makeReport(command, [{ node: id, checks }]), ...extra };
+  return {
+    exitCode: checks.some((check) => check.status === 'fail') ? 1 : 0,
+    data: report,
+    text: renderReport(report),
+  };
+}
+
+/** Runs the declared stop or start command with the worker ID last. */
+async function hook(
+  worker: MachineDefinition,
+  which: 'stop' | 'start',
+  definition: FleetDefinition,
+  run: Runner
+): Promise<Check | null> {
+  const command = definition.parking?.[which];
+  if (!command) return null;
+  const result = await run([...command, worker.id], {
+    timeoutMs: HOOK_TIMEOUT_MS,
+  });
+  return result.ok
+    ? {
+        id: 'worker:park-hook',
+        status: 'pass',
+        summary: `The declared ${which} command ran for ${worker.id}.`,
+      }
+    : {
+        id: 'worker:park-hook',
+        status: 'fail',
+        summary:
+          which === 'stop'
+            ? 'WORKER_STOP_HOOK_FAILED'
+            : 'WORKER_START_HOOK_FAILED',
+        remedy: {
+          action: `The ${which} command parking.${which} in fleet.json names failed for ${worker.id}, so its state was not changed. Run it by hand to see why, then run this command again.`,
+        },
+      };
+}
+
+/** Why a worker must not be parked now, unless forced: agent turns under
+ * way, or a worker that answers but whose turns cannot be counted. A worker
+ * that does not answer is off already.
+ */
+async function busy(
+  worker: MachineDefinition,
+  services: NodeParkServices
+): Promise<Check | null> {
+  const node = (await readRoster(services.roster))?.nodes.find(
+    (entry) => entry.id === worker.id
+  );
+  const activity = node ? await workerActivity(node, services.run) : null;
+  if (!activity || activity.runningSessions === 0) return null;
+  return {
+    id: 'worker:parked',
+    status: 'fail',
+    summary:
+      activity.runningSessions === null
+        ? 'WORKER_ACTIVITY_UNREADABLE'
+        : 'WORKER_BUSY',
+    remedy: {
+      action:
+        activity.runningSessions === null
+          ? `${worker.id}'s T3 could not say whether agent turns are under way, so it was not parked. Look at it, then repeat with --force to park it anyway.`
+          : `${worker.id} runs ${activity.runningSessions} agent turn(s); stopping it would end them. Wait for them to finish, or repeat with --force.`,
+    },
+  };
+}
+
+/** Parks a worker: it is stopped or destroyed on purpose, so it is no longer
+ * contacted, never the canary and does not fail the fleet. Refuses while
+ * agent turns run on it, unless --force. Runs the declared stop command.
+ */
+export async function fleetNodePark(
+  options: NodeParkOptions,
+  services: NodeParkServices
+): Promise<CommandOutcome> {
+  const definition = services.definition();
+  const worker = declared(definition, options.id);
+  const parkedAt = readWorkerStates().workers[worker.id]?.parkedAt;
+  if (parkedAt)
+    return outcome('fleet-node-park', worker.id, [
+      {
+        id: 'worker:parked',
+        status: 'pass',
+        summary: `${worker.id} is parked since ${parkedAt}.`,
+      },
+    ]);
+  if (!options.force) {
+    const refused = await busy(worker, services);
+    if (refused) return outcome('fleet-node-park', worker.id, [refused]);
+  }
+  if (options.dryRun)
+    return outcome('fleet-node-park', worker.id, [
+      {
+        id: 'worker:parked',
+        status: 'skip',
+        summary: `Planned: ${definition.parking?.stop ? 'run the declared stop command and ' : ''}park ${worker.id}.`,
+      },
+    ]);
+  const stopped = await hook(worker, 'stop', definition, services.run);
+  if (stopped?.status === 'fail')
+    return outcome('fleet-node-park', worker.id, [stopped]);
+  const at = services.now().toISOString();
+  await changeWorkers(services.state(), (current) => ({
+    [worker.id]: { ...current[worker.id], parkedAt: at },
+  }));
+  return outcome('fleet-node-park', worker.id, [
+    ...(stopped ? [stopped] : []),
+    {
+      id: 'worker:parked',
+      status: 'pass',
+      summary: `${worker.id} is parked since ${at}: fleet-sync and fleet-status no longer contact it.`,
+    },
+  ]);
+}
+
+/** Brings a parked worker back: runs the declared start command, marks it
+ * active, then runs a normal fleet-sync of that worker, which verifies it.
+ * The exit code is the sync's.
+ */
+export async function fleetNodeResume(
+  options: NodeParkOptions,
+  services: NodeParkServices
+): Promise<CommandOutcome> {
+  const definition = services.definition();
+  const worker = declared(definition, options.id);
+  const parkedAt = readWorkerStates().workers[worker.id]?.parkedAt;
+  if (options.dryRun)
+    return outcome('fleet-node-resume', worker.id, [
+      {
+        id: 'worker:parked',
+        status: 'skip',
+        summary: parkedAt
+          ? `Planned: ${definition.parking?.start ? 'run the declared start command, ' : ''}mark ${worker.id} active and run fleet-sync --node ${worker.id}.`
+          : `Planned: ${worker.id} is active already; run fleet-sync --node ${worker.id}.`,
+      },
+    ]);
+  const checks: Check[] = [];
+  if (parkedAt) {
+    const started = await hook(worker, 'start', definition, services.run);
+    if (started?.status === 'fail')
+      return outcome('fleet-node-resume', worker.id, [started]);
+    if (started) checks.push(started);
+    await changeWorkers(services.state(), (current) => {
+      const { parkedAt: _parked, ...rest } = current[worker.id] ?? {};
+      return { [worker.id]: rest };
+    });
+    const since = (services.now().getTime() - Date.parse(parkedAt)) / 1000;
+    checks.push({
+      id: 'worker:parked',
+      status: 'pass',
+      summary: `${worker.id} is active again after ${duration(Math.max(0, since))} parked.`,
+    });
+  }
+  const synced = await services.sync(worker.id);
+  const report = synced.data as { ok?: boolean };
+  checks.push(
+    synced.exitCode === 0 && report.ok !== false
+      ? {
+          id: 'rollout:node',
+          status: 'pass',
+          summary: `fleet-sync --node ${worker.id} converged and verified it.`,
+        }
+      : {
+          id: 'rollout:node',
+          status: 'fail',
+          summary: 'WORKER_RESUME_FAILED',
+          remedy: {
+            action: `fleet-sync --node ${worker.id} did not end ready; its report (sync in this output) says why. Fix that, then run devfleet fleet-sync --node ${worker.id}.`,
+          },
+        }
+  );
+  return outcome('fleet-node-resume', worker.id, checks, {
+    sync: synced.data,
+  });
+}

package/src/cli/fleet-node-seed.ts

@@ -2,21 +2,24 @@ import { readFile, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import type { FleetDefinition } from '../definition';
-import { ubuntuRelease } from '../platform/ubuntu-release';
+import { tailscalePins, ubuntuRelease } from '../platform/ubuntu-release';
 import { FleetUsageError } from '../errors';
 import { fleet, secret } from '../fleet-config';
 import type { SecretsProvider } from '../secrets';
-import type { Check } from '../types';
 import {
-  generateHostKey,
-  renderSeed,
-  seedUserData,
-  tailscalePins,
-} from '../worker-seed';
+  controlRemedy,
+  fleetTailnetControl,
+  loginServer,
+  TailnetControlError,
+  type ControlHttp,
+} from '../tailnet-control';
+import type { Check } from '../types';
+import { generateHostKey, renderSeed, seedUserData } from '../worker-seed';
 import type { CommandOutcome } from './contracts';
 import {
   keyName,
   lifecycleServices,
+  pinHostKey,
   type NodeLifecycleServices,
 } from './fleet-node-lifecycle';
 
@@ -31,19 +34,23 @@ export interface NodeSeedOptions {
 
 export interface NodeSeedServices extends Pick<
   NodeLifecycleServices,
-  'run' | 'playbook' | 'knownHosts'
+  'run' | 'playbook' | 'knownHosts' | 'state' | 'now'
 > {
   definition: () => FleetDefinition;
   secret: SecretsProvider;
   home: string;
+  /** The tailnet control plane's HTTP; answered in scenarios. */
+  http?: ControlHttp;
 }
 
 export function seedServices(roster: string): NodeSeedServices {
-  const { run, playbook, knownHosts } = lifecycleServices(roster);
+  const { run, playbook, knownHosts, state, now } = lifecycleServices(roster);
   return {
     run,
     playbook,
     knownHosts,
+    state,
+    now,
     definition: () => fleet,
     secret,
     home: homedir(),
@@ -75,11 +82,8 @@ export async function fleetNodeSeed(
       `No manager public key at ${keyFile}; name one with --public-key PATH.`
     );
   });
-  const authKey = await services.secret('tailnet-auth-key');
-  if (!authKey)
-    throw new FleetUsageError(
-      'The secrets provider holds no tailnet-auth-key. Store a short-lived, single-use, tagged Tailscale auth key there first.'
-    );
+  const tailnet = services.definition().tailnet;
+  const authKey = await seedAuthKey(worker.id, services);
   const release = ubuntuRelease(services.definition().ubuntu.release);
   if (!release)
     throw new FleetUsageError(
@@ -92,36 +96,20 @@ export async function fleetNodeSeed(
       managerKey,
       authKey,
       hostKey,
-      tailscale: await tailscalePins(),
+      tailscale: tailscalePins(release),
       codename: release.codename,
+      ...(loginServer(tailnet) ? { loginServer: loginServer(tailnet)! } : {}),
     }),
     Boolean(options.autoinstall)
   );
   await writeFile(options.output, seed, { mode: 0o600 });
   const host = await keyName(worker, services.run);
   const publicKey = hostKey.public.split(' ').slice(0, 2).join(' ');
+  // Pinned before the machine answers: in the fleet state for a worker
+  // reached from declared data, else in the operator's known_hosts.
   const pin: Check =
     options.apply && options.yes
-      ? (await services.playbook('macos/worker-host-key.yml', {
-          host,
-          pin: 'present',
-          key: publicKey,
-          known_hosts: services.knownHosts,
-        }))
-        ? {
-            id: 'ssh:host-key',
-            status: 'pass',
-            summary: `The manager trusts the seed's host key for ${host}.`,
-          }
-        : {
-            id: 'ssh:host-key',
-            status: 'fail',
-            summary: 'SSH_HOST_KEY_NOT_CHANGED',
-            remedy: {
-              action:
-                'The pinned Ansible could not change known_hosts; run the command again.',
-            },
-          }
+      ? await pinHostKey(worker, host, publicKey, services)
       : {
           id: 'ssh:host-key',
           status: 'skip',
@@ -149,3 +137,31 @@ export async function fleetNodeSeed(
     ].join('\n'),
   };
 }
+
+/** The key the seed carries: one minted for this worker by the control plane
+ * fleet.json declares, or else the secret tailnet-auth-key.
+ */
+async function seedAuthKey(
+  worker: string,
+  services: NodeSeedServices
+): Promise<string> {
+  const config = services.definition().tailnet;
+  if (config)
+    try {
+      const control = await fleetTailnetControl(
+        config,
+        services.secret,
+        services.http
+      );
+      return (await control!.createAuthKey({ worker })).key;
+    } catch (error) {
+      if (!(error instanceof TailnetControlError)) throw error;
+      throw new FleetUsageError(`${error.code}: ${controlRemedy(error.code)}`);
+    }
+  const key = await services.secret('tailnet-auth-key');
+  if (!key)
+    throw new FleetUsageError(
+      'The secrets provider holds no tailnet-auth-key. Declare tailnet in fleet.json with the secret tailnet-admin so a key is minted per worker, or store a short-lived, single-use, tagged Tailscale auth key there first.'
+    );
+  return key;
+}

package/src/cli/fleet-state.ts

@@ -486,13 +486,14 @@ async function restore(
   options: FleetStateOptions,
   services: FleetStateServices
 ): Promise<CommandOutcome> {
-  const target = context(services);
+  const target = context(services, options);
   if (!target.bucket)
     throw new FleetUsageError(
       'No bucket is configured, so there is nothing to restore from. Name it under "state" in fleet.json, or run devfleet fleet-state --init --bucket NAME --endpoint https://HOST.'
     );
   if (options.timestamp !== undefined) {
     // The bucket's current version is replaced too: --yes is the consent.
+    // Another manager's lease is not, and needs --take-over.
     if (!options.yes)
       throw new FleetUsageError(
         '--restore --timestamp replaces the fleet state in the bucket and on this machine with an earlier version. Repeat with --yes.'

package/src/cli/fleet-sync-checkout.ts

@@ -1,5 +1,6 @@
 import { spawn } from 'node:child_process';
 import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { prepareSource } from '../machine/source';
 import { PACKAGE_ROOT, packageInfo } from '../package-info';
@@ -16,6 +17,12 @@ export const RUN_CHECKOUT_ENV = 'PERSONAL_FLEET_RUN_CHECKOUT';
 
 const RUN_SCRIPT = 'bootstrap/fleet-manager-run.sh';
 
+/** Where the run script keeps the manager's fleet-owned checkouts, one per
+ * revision (`$fleet/manager-runs/<revision>`).
+ */
+export const managerRuns = (): string =>
+  join(homedir(), '.local/share/personal/fleet/manager-runs');
+
 export const inRunCheckout = (revision: string): boolean =>
   process.env[RUN_CHECKOUT_ENV] === revision;
 

package/src/cli/fleet-sync-enrollment.ts

@@ -1,21 +1,58 @@
 import { mkdir, rm } from 'node:fs/promises';
 import { loadRoster } from './roster';
-import { enrolledRoster } from '../definition';
+import { enrolledRoster, sshTarget, type FleetDefinition } from '../definition';
 import { FleetUsageError } from '../errors';
 import { dirname } from 'node:path';
-import { fleet as definition } from '../fleet-config';
+import { fleet } from '../fleet-config';
 import { discoverTailnet } from '../tailscale';
 import { matchComputers } from '../tailnet-matching';
 import { sshArgs, sshFailure } from '../ssh';
 import { ensurePrivateRoot } from '../machine/state';
-import type { FleetNode, Runner } from '../types';
+import { createWorkerAccount } from '../worker-account';
+import { packagePlaybook, type PackagePlaybook } from '../platform/ansible';
+import type { Check, FleetNode, Runner } from '../types';
 import { STATE_ROSTER, readRosterText, writeRosterText } from '../state/roster';
+import { readParked } from '../state/workers';
 
-/** Interactive enrollment/resume only. Existing paths and explicit identities
- * are preserved. Tailnet candidates never enter the declared membership.
+/** What an enrollment did: the workers whose roster entry it added or
+ * completed, and the checks that say why another one was not enrolled (or
+ * what was done to reach it).
  */
-export async function enrollManager(path: string, run: Runner): Promise<void> {
-  const canonical = definition;
+export interface EnrollmentResult {
+  enrolled: string[];
+  checks: { node: string; check: Check }[];
+}
+
+export interface EnrollmentOptions {
+  /** A person is at the terminal and sees the list of what is enrolled. */
+  interactive: boolean;
+  /** A worker not on the tailnet yet joins it during this run: the fleet
+   * declares a tailnet control plane that issues single-use keys.
+   */
+  joinable?: boolean;
+  definition?: FleetDefinition;
+  /** Applies a playbook of the package from the manager. */
+  playbook?: PackagePlaybook;
+  /** When each parked worker was parked; default the fleet state's. */
+  parked?: Record<string, string>;
+}
+
+/** Enrolls declared workers, and resumes earlier enrollments. Existing paths
+ * and explicit identities are preserved. Tailnet candidates never enter the
+ * declared membership. An interactive run enrolls what a fresh
+ * host-key-verified SSH session reaches. A run without a person enrolls a
+ * worker only when every fact is verified: its pinned host key matched (the
+ * session is strict), `sudo -n` works, and exactly one tailnet device matches
+ * it, or none when this run joins it to the tailnet itself. Anything
+ * ambiguous stays out, with the code that says why; nothing prompts.
+ */
+export async function enrollManager(
+  path: string,
+  run: Runner,
+  options: EnrollmentOptions = { interactive: true }
+): Promise<EnrollmentResult> {
+  const canonical = options.definition ?? fleet;
+  const result: EnrollmentResult = { enrolled: [], checks: [] };
   const original = await existingEnrollment(path);
   const saved =
     original === null
@@ -23,54 +60,178 @@ export async function enrollManager(path: string, run: Runner): Promise<void> {
       : enrolledRoster(canonical, await loadRoster(path)).nodes;
   const nodes: FleetNode[] = canonical.workers.map((node) => ({
     id: node.id,
-    ssh: node.ssh,
+    ssh: sshTarget(node),
     workspace: '/',
     required: ['t3', 'toolchain', 'workstation'],
   }));
+  // A parked worker is off on purpose: it is enrolled once it is resumed.
+  const parked = options.parked ?? readParked();
   const pending = nodes.filter(
-    (node) => !saved.find((entry) => entry.id === node.id)?.tailscaleId
+    (node) =>
+      !parked[node.id] &&
+      !saved.find((entry) => entry.id === node.id)?.tailscaleId
   );
-  if (!pending.length) return;
+  if (!pending.length) return result;
   const tailnet = await discoverTailnet(run);
   const matches = await matchComputers(nodes, tailnet.computers, run);
   const enrolled: FleetNode[] = [];
   for (const node of pending) {
-    const peers = tailnet.computers.filter((peer) =>
-      matches.get(peer.id)?.some((candidate) => candidate.id === node.id)
-    );
-    if (
-      ambiguous(
-        peers.map((peer) => peer.id),
-        matches
-      )
-    )
-      continue;
-    const connection = await inspectConnection(node, peers[0]?.id, run);
+    // A worker already in the roster reports its own state in the run.
+    const known = saved.some((entry) => entry.id === node.id);
+    const connection = await enrollOne(node, {
+      run,
+      options,
+      peers: tailnet.computers
+        .filter((peer) =>
+          matches.get(peer.id)?.some((candidate) => candidate.id === node.id)
+        )
+        .map((peer) => peer.id),
+      matches,
+      user: canonical.workers.find((worker) => worker.id === node.id)?.network
+        ?.user,
+      note: (check) => {
+        if (!known) result.checks.push({ node: node.id, check });
+      },
+    });
     if (connection) enrolled.push(connection);
   }
   const merged = mergeEnrollment(saved, enrolled);
-  if (JSON.stringify(merged) === JSON.stringify(saved)) return;
+  if (JSON.stringify(merged) === JSON.stringify(saved)) return result;
   // Only canonical nodes reached over host-key-verified SSH get here, so
   // enrollment needs no extra confirmation; the list is still shown.
-  process.stderr.write(
-    `Enrolling verified SSH connections for canonical targets:\n${enrolled.map((node) => `  ${node.id} → ${node.ssh}; device ${enrollmentIdentity(node)}`).join('\n')}\nMissing targets remain visible and are never replaced by discovered peers.\n`
-  );
+  if (options.interactive)
+    process.stderr.write(
+      `Enrolling verified SSH connections for canonical targets:\n${enrolled.map((node) => `  ${node.id} → ${node.ssh}; device ${enrollmentIdentity(node)}`).join('\n')}\nMissing targets remain visible and are never replaced by discovered peers.\n`
+    );
   await persistEnrollment(path, original, merged);
+  result.enrolled = merged
+    .filter(
+      (node) =>
+        JSON.stringify(node) !==
+        JSON.stringify(saved.find((entry) => entry.id === node.id))
+    )
+    .map((node) => node.id);
+  return result;
 }
 
+/** One worker's connection, when every fact this run needs is verified. */
+async function enrollOne(
+  node: FleetNode,
+  context: {
+    run: Runner;
+    options: EnrollmentOptions;
+    /** The tailnet devices that match this worker. */
+    peers: string[];
+    matches: Map<string, FleetNode[]>;
+    user: string | undefined;
+    note: (check: Check) => void;
+  }
+): Promise<FleetNode | null> {
+  const { run, options, peers, note } = context;
+  if (ambiguous(peers, context.matches)) {
+    if (!options.interactive) note(IDENTITY_CONFLICT);
+    return null;
+  }
+  if (!options.interactive && !peers.length && !options.joinable) {
+    note(NOT_ON_TAILNET);
+    return null;
+  }
+  const connection = await inspectConnection(node, peers[0], {
+    run,
+    options,
+    user: context.user,
+    note,
+    quiet: !options.interactive,
+  });
+  if (!connection || options.interactive) return connection;
+  const privilege = await passwordlessSudo(connection, run);
+  if (privilege) note(privilege);
+  return privilege ? null : connection;
+}
+
+const IDENTITY_CONFLICT: Check = {
+  id: 'tailscale:identity',
+  status: 'fail',
+  summary: 'TAILSCALE_IDENTITY_CONFLICT',
+  remedy: {
+    action:
+      'More than one tailnet device matches this worker, so it was not enrolled. Remove the stale device from the tailnet, then rerun fleet-sync.',
+  },
+};
+
+const NOT_ON_TAILNET: Check = {
+  id: 'tailscale:enrolled-identity',
+  status: 'fail',
+  summary: 'TAILSCALE_ENROLLMENT_REQUIRED',
+  remedy: {
+    action:
+      'No tailnet device matches this worker and fleet.json declares no tailnet control plane to join it with, so a run without a person did not enroll it. Declare tailnet with the secret tailnet-admin, join the machine yourself, or run fleet-sync once in a terminal.',
+  },
+};
+
+/** A run without a person never prompts for sudo: the account has it, or the
+ * worker is not enrolled.
+ */
+async function passwordlessSudo(
+  node: FleetNode,
+  run: Runner
+): Promise<Check | null> {
+  const result = await run([...sshArgs(node), 'sudo -n true'], {
+    timeoutMs: 15_000,
+  });
+  if (result.ok) return null;
+  if (result.reason !== 'exit' || !/sudo:/i.test(result.stderr))
+    return sshFailure(result);
+  return {
+    id: 'bootstrap:privilege',
+    status: 'fail',
+    summary: 'SUDO_AUTHORIZATION_REQUIRED',
+    remedy: {
+      action:
+        'The worker account has no passwordless sudo, so a run without a person did not enroll it. Grant it (a fleet-node-seed seed does), or run fleet-sync once in a terminal to authorize it.',
+    },
+  };
+}
+
+/** The account's home over a fresh strict session. A machine whose image
+ * lets only root in refuses the declared account: it is created once over
+ * the root login, and the session is opened again.
+ */
 async function inspectConnection(
   node: FleetNode,
   peerId: string | undefined,
-  run: Runner
+  context: {
+    run: Runner;
+    options: EnrollmentOptions;
+    user: string | undefined;
+    note: (check: Check) => void;
+    quiet: boolean;
+  }
 ): Promise<FleetNode | null> {
-  const home = await run([...sshArgs(node), 'printf "%s" "$HOME"'], {
-    timeoutMs: 20_000,
-  });
+  const { run } = context;
+  const probe = () =>
+    run([...sshArgs(node), 'printf "%s" "$HOME"'], { timeoutMs: 20_000 });
+  let home = await probe();
+  if (!home.ok && sshFailure(home).id === 'ssh:auth' && context.user) {
+    const account = await createWorkerAccount(
+      { id: node.id, ssh: node.ssh, login: 'root' },
+      context.user,
+      context.options.playbook ?? packagePlaybook(run)
+    );
+    // Only an account that was created is reported here: a root login that
+    // is refused as well stays the SSH failure below.
+    if (account.status === 'pass') {
+      context.note(account);
+      home = await probe();
+    }
+  }
   if (!home.ok) {
     const check = sshFailure(home);
-    process.stderr.write(
-      `[${node.id}] ${check.id}: ${check.summary} ${check.remedy?.action ?? ''}\n`
-    );
+    if (context.quiet) context.note(check);
+    else
+      process.stderr.write(
+        `[${node.id}] ${check.id}: ${check.summary} ${check.remedy?.action ?? ''}\n`
+      );
     return null;
   }
   if (!/^\/[^\x00-\x1f\x7f]{1,4000}$/.test(home.stdout)) return null;