@crvouga/personal 0.0.0-stage → 0.1.0

package/cli.mjs

@@ -0,0 +1,2327 @@
+#!/usr/bin/env node
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
+};
+
+// packages/personal-cli/src/search.ts
+import Fuse from "fuse.js";
+function searchCommands(commands, term) {
+  const query = term.trim().toLowerCase();
+  if (!query)
+    return commands;
+  const words = query.split(/\s+/);
+  const exact = commands.filter((command) => {
+    const text = [
+      command.id,
+      command.title,
+      command.description,
+      command.group,
+      ...command.keywords
+    ].join(" ").toLowerCase();
+    return words.every((word) => text.includes(word));
+  });
+  const fuzzy = new Fuse(commands, {
+    keys: ["id", "title", "keywords", "description"],
+    threshold: 0.35,
+    ignoreLocation: true
+  }).search(query).map((result) => result.item);
+  return [
+    ...new Map([...exact, ...fuzzy].map((command) => [command.id, command])).values()
+  ];
+}
+var init_search = () => {};
+
+// packages/personal-cli/src/ui-data.ts
+function record2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function clean(value, limit = 2000) {
+  return value.replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, "").replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "").replace(/[\x00-\x1f\x7f-\x9f\u202a-\u202e\u2066-\u2069]/g, " ").slice(0, limit);
+}
+function text(value, fallback = "") {
+  return typeof value === "string" ? clean(value) : fallback;
+}
+function quote(value) {
+  return /^[a-zA-Z0-9_./:=,@-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+function callArgs(session, args) {
+  return [
+    ...args,
+    ...session.workspace ? ["--workspace", session.workspace] : [],
+    ...session.config ? ["--config", session.config] : []
+  ];
+}
+function reproduction(session, args) {
+  return [
+    "personal",
+    ...args,
+    "--workspace",
+    session.workspace ?? session.options.workspace,
+    "--config",
+    session.config ?? session.options.config,
+    "--json"
+  ].map(quote).join(" ");
+}
+function commandChoices(commands, term) {
+  return searchCommands(commands, term).map((command) => ({
+    name: `[${clean(command.group)}] ${clean(command.title)}`,
+    value: `command:${command.id}`,
+    description: `${clean(command.description)}${command.mutation ? " · confirmation required" : ""}`
+  }));
+}
+function reportChecks(data) {
+  if (!record2(data) || !Array.isArray(data["nodes"]))
+    return [];
+  return data["nodes"].flatMap(nodeChecks);
+}
+function nodeChecks(value) {
+  if (!record2(value) || !Array.isArray(value["checks"]))
+    return [];
+  const node = text(value["node"], "controller");
+  return value["checks"].flatMap((check) => {
+    if (!record2(check) || !isStatus(check["status"]))
+      return [];
+    const remedy = record2(check["remedy"]) ? check["remedy"] : {};
+    return [
+      {
+        node,
+        id: text(check["id"], "check"),
+        status: check["status"],
+        summary: text(check["summary"]),
+        remedy: text(remedy["action"]),
+        command: text(remedy["command"])
+      }
+    ];
+  });
+}
+function isStatus(value) {
+  return ["pass", "warn", "fail", "skip"].includes(String(value));
+}
+function isCancellation(error) {
+  if (!record2(error))
+    return false;
+  return ["ExitPromptError", "AbortPromptError", "AbortError"].includes(text(error["name"]));
+}
+function absolutePath2(value) {
+  return value.startsWith("/") && value.length <= 4096 && !/[\x00-\x1f\x7f]/.test(value) || "Enter an absolute POSIX path (no ~ or control characters).";
+}
+var init_ui_data = __esm(() => {
+  init_search();
+});
+
+// packages/personal-cli/src/ui-execute.ts
+async function execute2(session, args, title) {
+  session.display.write(`
+$ ${reproduction(session, args)}`);
+  const progress = session.display.progress(title);
+  try {
+    return await session.options.execute(callArgs(session, args));
+  } catch (error) {
+    if (isCancellation(error))
+      throw error;
+    return { exitCode: 1, data: { ok: false, code: "operation_failed" } };
+  } finally {
+    progress.stop();
+  }
+}
+function successful(outcome) {
+  return outcome.exitCode === 0 && !(record2(outcome.data) && outcome.data["ok"] === false);
+}
+function showOutcome(session, outcome) {
+  const checks = reportChecks(outcome.data);
+  const incomplete = checks.filter((check) => ["warn", "skip"].includes(check.status)).length;
+  const state = successful(outcome) ? incomplete ? "WARNING" : "SUCCESS" : "FAILED";
+  const counts = ["pass", "warn", "fail", "skip"].map((status) => `${checks.filter((check) => check.status === status).length} ${status}`);
+  session.display.panel(state, checks.length ? counts.join(" · ") : outcomeMessage(outcome));
+  if (!successful(outcome))
+    session.display.write("No automatic repair was attempted. Review the command, context and setup.");
+}
+function outcomeMessage(outcome) {
+  if (!successful(outcome))
+    return failureMessage(outcome.data);
+  if (record2(outcome.data) && outcome.data["applied"] === false) {
+    return "Preview only — no changes applied. Review before explicitly authorizing a write.";
+  }
+  return "Command completed. Warnings and skipped checks are not passes.";
+}
+function failureMessage(data) {
+  if (!record2(data))
+    return "Operation failed. Raw errors and subprocess output are intentionally hidden.";
+  const messages = {
+    invalid_usage: "Configuration or arguments need attention. Use Fleet setup, validate, or session context.",
+    config_missing: "No roster found. Add a node in Fleet setup, or run controller-only diagnostics.",
+    operation_failed: "Operation failed safely. Check connectivity and configuration before retrying."
+  };
+  return messages[String(data["code"])] ?? "Operation did not complete. Review setup and the noninteractive command.";
+}
+var init_ui_execute = __esm(() => {
+  init_ui_data();
+});
+
+// packages/personal-cli/src/ui-reports.ts
+async function inspectChecks(session, data) {
+  const checks = reportChecks(data);
+  let node = "*";
+  let status = "*";
+  while (true) {
+    const visible = checks.filter((check) => (node === "*" || check.node === node) && (status === "*" || check.status === status));
+    const choice = await session.prompts.search(`Report · ${visible.length}/${checks.length} checks · node ${node} · status ${status}`, (term) => checkChoices(visible, term));
+    if (choice === "back")
+      return;
+    if (choice === "node")
+      node = await nodeFilter(session, checks);
+    else if (choice === "status")
+      status = await statusFilter(session);
+    else {
+      const check = visible[Number(choice)];
+      if (check)
+        showCheck(session, check);
+    }
+  }
+}
+function checkChoices(checks, term) {
+  const choices = checks.flatMap((check, index) => {
+    const name = `${check.status.toUpperCase()} · ${check.node} · ${check.id}`;
+    return `${name} ${check.summary}`.toLowerCase().includes(term.toLowerCase()) ? [{ name, value: String(index), description: check.summary }] : [];
+  });
+  return [
+    ...choices.length ? choices : [
+      {
+        name: "No matching checks — change search or filters",
+        value: "none"
+      }
+    ],
+    { name: "Filter by node", value: "node" },
+    { name: "Filter by status", value: "status" },
+    { name: "Back to result", value: "back" }
+  ];
+}
+function nodeFilter(session, checks) {
+  return session.prompts.select("Node filter", [
+    { name: "All nodes", value: "*" },
+    ...[...new Set(checks.map((check) => check.node))].map((node) => ({
+      name: node,
+      value: node
+    }))
+  ]);
+}
+function statusFilter(session) {
+  return session.prompts.select("Status filter", [
+    { name: "All statuses (including warnings and skips)", value: "*" },
+    ...["fail", "warn", "skip", "pass"].map((status) => ({
+      name: status.toUpperCase(),
+      value: status
+    }))
+  ]);
+}
+function showCheck(session, check) {
+  session.display.panel(`${check.status.toUpperCase()} · ${check.node} · ${check.id}`, check.summary);
+  session.display.write(`Remedy: ${check.remedy || "No automated remedy. Review this check manually."}`);
+  if (check.command)
+    session.display.write(`Suggested operator command (not executed):
+${check.command}`);
+  session.display.write("Remedies are guidance only. Credentials, SSH and host-key configuration stay operator-owned.");
+}
+async function inspectDetails(session, data) {
+  const sections = detailSections(data);
+  if (!sections.length) {
+    session.display.write("No additional safe display fields. Use the reproducible command for the structured document.");
+    return;
+  }
+  let next = true;
+  while (next) {
+    const selection = await session.prompts.select("Details", [
+      ...sections.map((section, index) => ({
+        name: section.title,
+        value: String(index)
+      })),
+      { name: "Back to result", value: "back" }
+    ]);
+    const section = sections[Number(selection)];
+    if (selection === "back")
+      next = false;
+    else if (section)
+      session.display.panel(section.title, section.body);
+  }
+}
+function detailSections(data) {
+  if (!record2(data))
+    return [];
+  const sections = [
+    "help",
+    "guide",
+    "next",
+    "authorize",
+    "path",
+    "sshTemplate",
+    "workspaceCommand",
+    "verifyCommand",
+    "invocation",
+    "discovery"
+  ].flatMap((key) => typeof data[key] === "string" ? [{ title: key, body: text(data[key]) }] : []);
+  for (const key of ["steps", "targets", "safety", "examples"]) {
+    if (Array.isArray(data[key]))
+      sections.push(...data[key].flatMap((value, index) => typeof value === "string" ? [{ title: `${key} · ${index + 1}`, body: text(value) }] : []));
+  }
+  if (Array.isArray(data["nodes"]))
+    sections.push(...nodeSections(data["nodes"]));
+  if (Array.isArray(data["commands"]))
+    sections.push(...commandSections(data["commands"]));
+  for (const key of ["configuration", "output", "coverage"]) {
+    if (record2(data[key]))
+      sections.push({ title: key, body: safeFields(data[key]) });
+  }
+  if (typeof data["$schema"] === "string")
+    sections.push({
+      title: "JSON schema",
+      body: JSON.stringify(data, null, 2)
+    });
+  return sections;
+}
+function commandSections(commands) {
+  return commands.flatMap((command) => {
+    if (!record2(command))
+      return [];
+    return [
+      {
+        title: text(command["id"], "Command"),
+        body: [
+          text(command["title"]),
+          text(command["description"]),
+          ...Array.isArray(command["examples"]) ? command["examples"].map((value) => text(value)) : []
+        ].filter(Boolean).join(`
+`)
+      }
+    ];
+  });
+}
+function safeFields(value) {
+  return Object.entries(value).flatMap(([key, field]) => typeof field === "string" ? [`${key}: ${text(field)}`] : []).join(`
+`);
+}
+function nodeSections(nodes) {
+  return nodes.flatMap((node) => {
+    if (!record2(node))
+      return [];
+    const id = text(node["id"], text(node["node"], "Node"));
+    const body = ["id", "ssh", "workspace", "runtime"].flatMap((key) => typeof node[key] === "string" ? [`${key}: ${text(node[key])}`] : []);
+    if (Array.isArray(node["required"]))
+      body.push(`required: ${node["required"].map((value) => text(value)).join(", ") || "none"}`);
+    return [
+      ...body.length ? [{ title: id, body: body.join(`
+`) }] : [],
+      ...detailSections({
+        steps: node["steps"],
+        sshTemplate: node["sshTemplate"],
+        verifyCommand: node["verifyCommand"]
+      }).map((section) => ({
+        title: `${id} · ${section.title}`,
+        body: section.body
+      }))
+    ];
+  });
+}
+var init_ui_reports = __esm(() => {
+  init_ui_data();
+});
+
+// packages/personal-cli/src/ui-targets.ts
+async function chooseTargets(session, action) {
+  const selection = await session.prompts.select("Choose target scope", [
+    ...action === "onboard" ? [] : [
+      {
+        name: "Controller only / local",
+        value: "local",
+        description: "No roster or SSH required; uses this session workspace."
+      },
+      {
+        name: "All roster nodes",
+        value: "all",
+        description: action === "doctor" ? "Controller + every configured node; read-only." : "Every configured remote checkout."
+      }
+    ],
+    { name: "Select roster nodes…", value: "selected" },
+    { name: "Back to palette", value: "back" }
+  ]);
+  if (selection === "back")
+    return;
+  if (selection === "local")
+    return ["--local"];
+  const nodes = await availableNodes(session);
+  if (!nodes.length)
+    return missingRoster2(session, action);
+  if (selection === "all")
+    return [];
+  const selected = await session.prompts.checkbox("Select nodes · space to toggle, enter to continue", nodes);
+  if (!selected.length) {
+    session.display.write("No nodes selected. Nothing ran; returning to the palette.");
+    return;
+  }
+  return selected.flatMap((id) => ["--node", id]);
+}
+async function availableNodes(session) {
+  const outcome = await execute2(session, ["fleet", "nodes"], "Reading local roster (no SSH)");
+  if (!successful(outcome)) {
+    showOutcome(session, outcome);
+    return [];
+  }
+  if (!record2(outcome.data) || !Array.isArray(outcome.data["nodes"]))
+    return [];
+  return outcome.data["nodes"].flatMap((node) => {
+    if (!record2(node) || typeof node["id"] !== "string")
+      return [];
+    return [
+      {
+        name: text(node["id"]),
+        value: node["id"],
+        description: `${text(node["ssh"])} · ${text(node["workspace"])}`
+      }
+    ];
+  });
+}
+async function missingRoster2(session, action) {
+  session.display.panel("Fleet setup needed", [
+    "No usable roster nodes. Return to Fleet setup / add node to register an existing computer.",
+    "Fleet init creates an EXAMPLE only; saving it requires --apply --yes. Edit its aliases and paths before use.",
+    "Controller-only doctor works without a roster or SSH. No login, host-key change or repair is automatic."
+  ].join(`
+`));
+  if (action !== "doctor")
+    return;
+  const choice = await session.prompts.select("Continue without a roster?", [
+    { name: "Run controller-only diagnostics", value: "local" },
+    { name: "Back to palette / Fleet setup", value: "back" }
+  ]);
+  return choice === "local" ? ["--local"] : undefined;
+}
+var init_ui_targets = __esm(() => {
+  init_ui_execute();
+  init_ui_data();
+});
+
+// packages/personal-cli/src/ui-actions.ts
+async function runCommand2(session, command) {
+  session.display.panel(clean(command.title), clean(command.description));
+  const args = await actionArgs(session, command);
+  if (!args)
+    return;
+  const preview = args[0] === "fleet" && ["sync", "init"].includes(args[1] ?? "");
+  if (args[1] === "init")
+    session.display.write("EXAMPLE ONLY: init previews a starter roster, not a configured fleet. Saving requires --apply --yes.");
+  const mutation = !preview && (command.mutation || args.includes("--apply"));
+  if (mutation && !await confirmMutation(session, args))
+    return;
+  await runWithResults(session, args, command.title, { preview, mutation });
+}
+async function actionArgs(session, command) {
+  const args = [...command.args];
+  if (args[0] !== "fleet")
+    return args;
+  if (args.includes("--local"))
+    return args;
+  const action = args[1] ?? "";
+  if (["sync", "init"].includes(action)) {
+    const preview = args.filter((arg) => !["--apply", "--yes"].includes(arg));
+    if (action === "init")
+      return preview;
+    const targets = await chooseTargets(session, action);
+    return targets ? [...preview, ...targets] : undefined;
+  }
+  if (!["doctor", "onboard"].includes(action))
+    return args;
+  const targets = await chooseTargets(session, action);
+  return targets ? [...args, ...targets] : undefined;
+}
+async function runWithResults(session, initialArgs, title, settings = {}) {
+  let args = initialArgs;
+  let outcome = await execute2(session, args, title);
+  let preview = settings.preview === true;
+  let mutation = settings.mutation === true;
+  while (true) {
+    showOutcome(session, outcome);
+    const selection = await session.prompts.select("Next step", resultChoices(outcome, preview));
+    if (selection === "back")
+      return;
+    await inspectSelection(session, outcome, selection);
+    if (selection === "apply") {
+      const appliedArgs = [...args, "--apply", "--yes"];
+      if (!await confirmMutation(session, appliedArgs))
+        continue;
+      args = appliedArgs;
+      preview = false;
+      mutation = true;
+      outcome = await execute2(session, args, title);
+    }
+    if (selection === "retry") {
+      if (mutation && !await confirmMutation(session, args))
+        continue;
+      outcome = await execute2(session, args, title);
+    }
+  }
+}
+async function inspectSelection(session, outcome, selection) {
+  if (selection === "checks")
+    await inspectChecks(session, outcome.data);
+  if (selection === "details")
+    await inspectDetails(session, outcome.data);
+}
+function resultChoices(outcome, preview) {
+  return [
+    ...reportChecks(outcome.data).length ? [{ name: "Explore checks and remedies…", value: "checks" }] : [],
+    { name: "Inspect structured details / plan…", value: "details" },
+    ...preview && successful(outcome) ? [{ name: "Review and explicitly apply…", value: "apply" }] : [],
+    ...!successful(outcome) ? [{ name: "Retry command…", value: "retry" }] : [],
+    { name: "Back to palette", value: "back" }
+  ];
+}
+async function confirmMutation(session, args) {
+  const action = args[1];
+  const warning = action === "sync" ? "Sync runs trusted checkout lifecycle scripts and installs tools/dependencies. Failure can leave partial changes; remote installers may continue after disconnect. Inspect the node before retrying. No automatic repairs or credentials." : "This writes the local roster only. No cloud resources, SSH configuration, credentials or host keys are changed.";
+  session.display.panel("Explicit approval required", [
+    action === "init" ? "Create an EXAMPLE roster only. Replace sample aliases and paths before diagnostics." : warning,
+    `Workspace: ${clean(session.workspace ?? session.options.workspace)}`,
+    `Config: ${clean(session.config ?? session.options.config)}`,
+    `$ ${reproduction(session, args)}`
+  ].join(`
+`));
+  return session.prompts.confirm("Apply this exact command? (default: no)");
+}
+var init_ui_actions = __esm(() => {
+  init_ui_execute();
+  init_ui_data();
+  init_ui_reports();
+  init_ui_targets();
+});
+
+// packages/personal-cli/src/ui-wizard.ts
+async function addNode2(session) {
+  showIntro(session);
+  await registerNode(session);
+}
+function showIntro(session) {
+  session.display.panel("Fleet setup / add node", [
+    "Register an EXISTING computer in your local secret-free roster.",
+    "Use a previously verified SSH alias. This wizard never connects, provisions, logs in or changes host keys.",
+    "Cancel with Ctrl+C. No write occurs until you approve the preview."
+  ].join(`
+`));
+}
+async function registerNode(session) {
+  const id = await session.prompts.input("Node ID (lowercase, e.g. dev-linux)", "", validId);
+  const alias = await session.prompts.input("Existing SSH alias / hostname", id, validAlias);
+  const workspace = await session.prompts.input("Absolute POSIX workspace on the node", "", absolutePath2);
+  const runtime = await session.prompts.input("Optional absolute Node/Bun executable (blank = node on SSH PATH)", "", (value) => value === "" || absolutePath2(value));
+  const capabilities = await session.prompts.checkbox("Required capabilities · space to toggle", CAPABILITIES2.map((capability) => ({
+    name: capability,
+    value: capability,
+    checked: capability !== "vscode"
+  })));
+  const args = [
+    "fleet",
+    "add",
+    "--id",
+    id,
+    "--ssh",
+    alias,
+    "--path",
+    workspace,
+    ...runtime ? ["--runtime", runtime] : [],
+    "--require",
+    capabilities.join(",") || "none",
+    "--apply",
+    "--yes"
+  ];
+  session.display.table(["Field", "Preview"], [
+    ["ID", clean(id)],
+    ["SSH", clean(alias)],
+    ["Workspace", clean(workspace)],
+    ["Runtime", clean(runtime) || "node (remote non-login PATH)"],
+    ["Required", capabilities.join(", ") || "none"]
+  ]);
+  session.display.write(`$ ${reproduction(session, args)}`);
+  if (!await confirmMutation(session, args)) {
+    session.display.write("Cancelled — no roster was written.");
+    return;
+  }
+  await runWithResults(session, args, "Saving roster node (no SSH)", {
+    mutation: true
+  });
+  session.display.write("Next: fleet validate, then fleet onboard for operator-owned SSH / authentication guidance.");
+}
+function validId(value) {
+  return /^[a-z][a-z0-9-]{0,62}$/.test(value) || "Use 1–63 lowercase letters, digits or hyphens; start with a letter.";
+}
+function validAlias(value) {
+  return /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$/.test(value) || "Use an existing plain SSH alias/hostname; no user@host, options or ports.";
+}
+var CAPABILITIES2;
+var init_ui_wizard = __esm(() => {
+  init_ui_actions();
+  init_ui_data();
+  CAPABILITIES2 = ["github", "vault", "t3", "vscode", "toolchain"];
+});
+
+// packages/personal-cli/src/ui-controller.ts
+async function runInteractive(options, prompts, display) {
+  const session = { options, prompts, display };
+  showHeader(session);
+  let running = true;
+  while (running) {
+    try {
+      const choice = await prompts.search("Command palette · type to search · arrows + enter", (term) => paletteChoices(session, term));
+      running = await dispatch(session, choice);
+    } catch (error) {
+      if (isCancellation(error)) {
+        display.write(`
+Goodbye. No further actions will run.`);
+        throw error;
+      }
+      display.write("The interactive session could not continue safely. Use personal commands --json for noninteractive help.");
+      throw new Error("Interactive session failed safely.");
+    }
+  }
+  display.write("Goodbye. Session context was not saved.");
+}
+function showHeader(session) {
+  session.display.panel(`personal · ${clean(session.options.version)} · operator console`, [
+    "Your developer fleet, without the guesswork.",
+    `Workspace: ${clean(session.workspace ?? session.options.workspace)}`,
+    `Config: ${clean(session.config ?? session.options.config)}`,
+    "Read-only first · explicit writes · no automatic repairs",
+    "Search IDs, keywords or descriptions. Ctrl+C exits safely. Nothing is cleared."
+  ].join(`
+`));
+}
+function paletteChoices(session, term) {
+  const commands = commandChoices(session.options.commands, term);
+  const navigation = [
+    {
+      name: "Fleet setup / add node…",
+      value: "setup",
+      description: "Register an existing node; preview + explicit approval before saving."
+    },
+    {
+      name: "Session workspace / config…",
+      value: "context",
+      description: "Session-only overrides; no hidden configuration writes."
+    }
+  ].filter((choice) => `${choice.name} ${choice.description}`.toLowerCase().includes(term.toLowerCase().trim()));
+  const groups = term.trim() ? [] : [
+    ...new Set(session.options.commands.map((command) => command.group))
+  ].map((group) => ({
+    name: `Browse ${clean(group)}…`,
+    value: `group:${group}`
+  }));
+  return [
+    ...groups,
+    ...navigation,
+    ...commands,
+    ...!commands.length && !navigation.length && term.trim() ? [
+      {
+        name: "No matching commands — change search or go back",
+        value: "none"
+      }
+    ] : [],
+    { name: "Exit", value: "exit" }
+  ];
+}
+async function dispatch(session, choice) {
+  if (choice === "exit")
+    return false;
+  if (choice === "setup")
+    await addNode2(session);
+  if (choice === "context")
+    await changeContext(session);
+  if (choice.startsWith("group:"))
+    await browseGroup(session, choice.slice(6));
+  if (choice.startsWith("command:"))
+    await openCommand(session, choice.slice(8));
+  return true;
+}
+async function browseGroup(session, group) {
+  const commands = session.options.commands.filter((command) => command.group === group);
+  while (true) {
+    const choice = await session.prompts.search(`${clean(group)} · searchable submenu`, (term) => {
+      const choices = commandChoices(commands, term);
+      return [
+        ...choices.length ? choices : [{ name: "No matches — try another keyword", value: "none" }],
+        { name: "Back to all commands", value: "back" }
+      ];
+    });
+    if (choice === "back")
+      return;
+    if (choice.startsWith("command:"))
+      await openCommand(session, choice.slice(8));
+  }
+}
+async function openCommand(session, id) {
+  const command = session.options.commands.find((entry) => entry.id === id);
+  if (!command)
+    return;
+  if (command.args[0] === "fleet" && command.args[1] === "add")
+    await addNode2(session);
+  else
+    await runCommand2(session, command);
+}
+async function changeContext(session) {
+  session.display.write("Session only. Blank inputs reset to startup defaults; no file is written.");
+  const workspace = await session.prompts.input("Workspace override", session.workspace ?? "", validContext);
+  const config = await session.prompts.input("Config override", session.config ?? "", validContext);
+  if (workspace)
+    session.workspace = workspace;
+  else
+    delete session.workspace;
+  if (config)
+    session.config = config;
+  else
+    delete session.config;
+  showHeader(session);
+}
+function validContext(value) {
+  return !/[\x00-\x1f\x7f]/.test(value) || "Control characters are not allowed in paths.";
+}
+var init_ui_controller = __esm(() => {
+  init_ui_actions();
+  init_ui_data();
+  init_ui_wizard();
+});
+
+// packages/personal-cli/src/ui-terminal.ts
+import { checkbox, confirm, input, search, select } from "@inquirer/prompts";
+import { Chalk } from "chalk";
+import ora from "ora";
+import boxen from "boxen";
+import Table from "cli-table3";
+function plainTerminal() {
+  return process.env["NO_COLOR"] !== undefined || process.env["TERM"] === "dumb";
+}
+function pageSize() {
+  return Math.max(3, Math.min(10, (process.stderr.rows || 24) - 10));
+}
+function terminalPrompts() {
+  const context = { output: process.stderr, clearPromptOnDone: false };
+  return {
+    select: (message, choices) => select({ message, choices, pageSize: pageSize(), loop: false }, context),
+    search: (message, source) => search({
+      message,
+      source: (term) => source(term ?? ""),
+      pageSize: pageSize(),
+      theme: { style: { highlight: (value) => value } }
+    }, context),
+    checkbox: (message, choices) => checkbox({ message, choices, pageSize: pageSize(), loop: false }, context),
+    input: (message, initial = "", validate = () => true) => input({ message, default: initial, validate }, context),
+    confirm: (message) => confirm({ message, default: false }, context)
+  };
+}
+function terminalDisplay() {
+  const color = new Chalk({
+    level: !plainTerminal() && process.stderr.isTTY ? 1 : 0
+  });
+  const write = (message) => {
+    process.stderr.write(`${message}
+`);
+  };
+  return {
+    write,
+    panel: (title, body) => {
+      const content = `${color.bold(clean(title))}
+${body}`;
+      if ((process.stderr.columns || 80) < 48 || plainTerminal()) {
+        write(`
+${content}
+`);
+        return;
+      }
+      write(boxen(content, {
+        padding: 1,
+        borderStyle: "round",
+        ...color.level ? { borderColor: "cyan" } : {},
+        width: Math.min(process.stderr.columns || 80, 96)
+      }));
+    },
+    table: (headers, rows) => drawTable(write, headers, rows),
+    progress: (message) => {
+      const spinner = ora({
+        text: message,
+        stream: process.stderr,
+        isEnabled: Boolean(process.stderr.isTTY) && !plainTerminal(),
+        isSilent: !process.stderr.isTTY || plainTerminal(),
+        discardStdin: false
+      });
+      if (spinner.isEnabled)
+        spinner.start();
+      else
+        write(`… ${message}`);
+      return {
+        stop: () => {
+          spinner.stop();
+        }
+      };
+    }
+  };
+}
+function drawTable(write, headers, rows) {
+  if ((process.stderr.columns || 80) < 64 || plainTerminal()) {
+    rows.forEach((row) => write(row.map((cell) => clean(cell)).join(" · ")));
+    return;
+  }
+  const width = Math.floor(((process.stderr.columns || 80) - headers.length * 3 - 1) / headers.length);
+  const table = new Table({
+    head: headers,
+    colWidths: headers.map(() => Math.max(8, width)),
+    wordWrap: true,
+    style: { head: [], border: [] }
+  });
+  table.push(...rows.map((row) => row.map((cell) => clean(cell))));
+  write(table.toString());
+}
+var init_ui_terminal = __esm(() => {
+  init_ui_data();
+});
+
+// packages/personal-cli/src/ui.ts
+async function startInteractive(options) {
+  await runInteractive(options, terminalPrompts(), terminalDisplay());
+}
+var init_ui = __esm(() => {
+  init_ui_controller();
+  init_ui_terminal();
+});
+
+// packages/personal-cli/src/settings.ts
+import { access } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { homedir } from "node:os";
+async function exists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function findUp(start, name) {
+  let current = resolve(start);
+  while (true) {
+    if (await exists(join(current, name)))
+      return join(current, name);
+    const parent = dirname(current);
+    if (parent === current)
+      return null;
+    current = parent;
+  }
+}
+async function resolveSettings(overrides = {}, cwd = process.cwd(), env = process.env) {
+  const workspace = resolve(overrides.workspace ?? env["PERSONAL_WORKSPACE"] ?? dirname(await findUp(cwd, "mise.toml") ?? join(cwd, "mise.toml")));
+  const config = resolve(overrides.config ?? env["PERSONAL_FLEET_CONFIG"] ?? await findUp(cwd, ".fleet.local.json") ?? join(homedir(), ".config/personal/fleet.json"));
+  return { workspace, config };
+}
+
+// packages/personal-cli/src/registry.ts
+init_search();
+function fleet(command, title, description, keywords) {
+  return {
+    id: `fleet ${command}`,
+    title,
+    description,
+    group: "Fleet",
+    keywords,
+    args: ["fleet", command],
+    examples: [`personal fleet ${command} --json`],
+    mutation: ["add", "sync", "init"].includes(command)
+  };
+}
+var COMMANDS = [
+  fleet("doctor", "Diagnose the entire fleet", "Read-only SSH, authentication, T3, VS Code and dependency checks for this controller and every roster node.", [
+    "health",
+    "ssh",
+    "auth",
+    "github",
+    "vscode",
+    "t3",
+    "dependencies",
+    "diagnose"
+  ]),
+  {
+    ...fleet("doctor", "Diagnose this computer", "Check this process context without a roster or remote connections.", ["local", "controller", "health"]),
+    id: "fleet doctor local",
+    args: ["fleet", "doctor", "--local"],
+    examples: ["personal fleet doctor --local --json"]
+  },
+  fleet("nodes", "Explore fleet nodes", "List registered developer computers and their required capabilities without contacting them.", ["roster", "list", "machines", "computers"]),
+  fleet("add", "Register a developer computer", "Preview or explicitly save an existing SSH alias, checkout path and per-machine capabilities. No SSH or cloud setup.", ["onboarding", "register", "new", "setup"]),
+  fleet("validate", "Validate the roster", "Check local configuration before making any network requests.", ["config", "schema", "verify"]),
+  fleet("onboard", "Explore onboarding instructions", "Get per-node SSH templates, VS Code guidance, authentication steps and safe verification commands.", ["setup", "guide", "instructions", "vscode", "connect"]),
+  fleet("sync", "Plan toolchain and dependency sync", "Preview convergence through the existing mise/workstation owners. Applying requires --apply --yes.", ["drift", "versions", "mise", "install", "dependencies"]),
+  fleet("init", "Preview an example roster", "Inspect a starter configuration; only --apply --yes creates it. Prefer Register for real nodes.", ["setup", "example", "config"]),
+  fleet("schema", "Explore the fleet JSON schema", "Read the versioned roster schema for editors and agents.", ["agent", "config", "json"]),
+  {
+    id: "commands",
+    title: "Explore the command catalog",
+    description: "Search command names, descriptions and keywords; emit the complete machine-readable interface.",
+    group: "Reference",
+    keywords: ["search", "help", "llm", "agent", "api"],
+    args: ["commands"],
+    examples: ["personal commands --json --search ssh"],
+    mutation: false
+  },
+  {
+    id: "agent",
+    title: "Agent integration guide",
+    description: "Noninteractive usage, JSON contracts, exit codes, safety boundaries and reproducible examples.",
+    group: "Reference",
+    keywords: ["llm", "automation", "help", "safety"],
+    args: ["agent"],
+    examples: ["personal agent --json"],
+    mutation: false
+  }
+];
+function commandCatalog(search = "", group) {
+  return searchCommands(COMMANDS, search).filter((command) => !group || command.group.toLowerCase() === group.toLowerCase());
+}
+
+// packages/personal-cli/src/program.ts
+import { Command, CommanderError } from "commander";
+
+// packages/fleet/src/errors.ts
+class FleetUsageError extends Error {
+}
+
+// packages/personal-cli/src/agent-guide.ts
+var AGENT_GUIDE = {
+  version: 1,
+  name: "@crvouga/personal",
+  invocation: "npx --yes @crvouga/personal@<exact-version> <command> --json --non-interactive",
+  discovery: "personal commands --json",
+  configuration: {
+    workspace: "--workspace PATH, PERSONAL_WORKSPACE, closest ancestor mise.toml, then current directory",
+    roster: "--config PATH, PERSONAL_FLEET_CONFIG, closest ancestor .fleet.local.json, then ~/.config/personal/fleet.json"
+  },
+  output: {
+    stdout: "One versioned JSON document with --json. Prompts and progress never contaminate stdout.",
+    exitCodes: {
+      "0": "Success or preview",
+      "1": "Failed check or operation; strict also rejects warnings/skips",
+      "2": "Invalid usage or configuration",
+      "130": "Cancelled"
+    },
+    errors: "{version:1,ok:false,code,error}; raw subprocess output and exception details are withheld",
+    reports: "{version:1,command,ok,generatedAt,nodes:[{node,checks:[{id,status,summary,remedy?}]}],summary,coverage}",
+    statuses: ["pass", "warn", "fail", "skip"],
+    coverage: "Default doctor tests the controller and all configured nodes. --local tests only this controller. A missing roster fails explicitly; configured nodes are not every computer that exists. T3/VS Code end-to-end checks remain manual."
+  },
+  safety: [
+    "No arguments opens a menu only on an interactive terminal. --json and --non-interactive never prompt.",
+    "Diagnostics, onboarding instructions, schema, catalog and sync previews are read-only.",
+    "Roster writes and sync require both --apply and --yes. npx --yes only approves downloading the CLI.",
+    "Do not copy credentials, forward SSH agents, bypass host keys, provision infrastructure or execute unreviewed remedies.",
+    "A healthy controller does not prove another machine can connect to it. Run doctor from each intended controller.",
+    "Use exact npm versions for automation. The application never self-updates."
+  ],
+  examples: [
+    "personal fleet doctor --local --workspace /path/to/personal --json",
+    "personal fleet doctor --all --json --strict --timeout 120000",
+    "personal fleet add --id dev-linux --ssh dev-linux --path /home/dev/workspace --require github,t3,toolchain --json",
+    "personal fleet add --id dev-linux --ssh dev-linux --path /home/dev/workspace --apply --yes --json",
+    "personal fleet doctor --node dev-linux --json",
+    "personal fleet sync --node dev-linux --json"
+  ]
+};
+
+// packages/personal-cli/src/fleet.ts
+import { writeFile as writeFile2, mkdir as mkdir3 } from "node:fs/promises";
+import { dirname as dirname3 } from "node:path";
+
+// packages/fleet/src/config.ts
+var CAPABILITIES = [
+  "github",
+  "vault",
+  "t3",
+  "vscode",
+  "toolchain"
+];
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function fields(value, allowed) {
+  if (Object.keys(value).some((key) => !allowed.includes(key))) {
+    throw new FleetUsageError("Unknown configuration field. Run fleet schema.");
+  }
+}
+function absolutePath(value) {
+  return typeof value === "string" && value.startsWith("/") && value.length <= 4096 && !/[\x00-\x1f\x7f]/.test(value);
+}
+function parseNode(value) {
+  if (!record(value))
+    throw new FleetUsageError("Each node must be an object.");
+  fields(value, ["id", "ssh", "workspace", "runtime", "required"]);
+  const names = nodeNames(value);
+  if (!absolutePath(value["workspace"]))
+    throw new FleetUsageError("workspace must be an absolute POSIX path.");
+  if (value["runtime"] !== undefined && !absolutePath(value["runtime"])) {
+    throw new FleetUsageError("runtime must be an absolute POSIX path to Node or Bun.");
+  }
+  return {
+    ...names,
+    workspace: value["workspace"],
+    ...typeof value["runtime"] === "string" ? { runtime: value["runtime"] } : {},
+    required: requiredCapabilities(value["required"])
+  };
+}
+function nodeNames(value) {
+  if (typeof value["id"] !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(value["id"])) {
+    throw new FleetUsageError("Node IDs must be lowercase names (1–63 characters).");
+  }
+  if (typeof value["ssh"] !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$/.test(value["ssh"])) {
+    throw new FleetUsageError("ssh must be a plain SSH alias or hostname, not options or user@host.");
+  }
+  return { id: value["id"], ssh: value["ssh"] };
+}
+function requiredCapabilities(value) {
+  const required = value === undefined ? ["github", "vault", "t3", "toolchain"] : value;
+  if (!Array.isArray(required) || required.some((item) => !CAPABILITIES.includes(item))) {
+    throw new FleetUsageError("required must contain only capability names from fleet schema.");
+  }
+  if (new Set(required).size !== required.length)
+    throw new FleetUsageError("required capabilities must be unique.");
+  return required;
+}
+function parseConfig(value) {
+  if (!record(value))
+    throw new FleetUsageError("Fleet configuration must be an object.");
+  fields(value, ["$schema", "version", "nodes"]);
+  if (value["$schema"] !== undefined && typeof value["$schema"] !== "string")
+    throw new FleetUsageError("$schema must be a string.");
+  if (value["version"] !== 1 || !Array.isArray(value["nodes"])) {
+    throw new FleetUsageError("Expected version 1 and a nodes array.");
+  }
+  if (value["nodes"].length < 1 || value["nodes"].length > 64) {
+    throw new FleetUsageError("Configure between 1 and 64 developer nodes.");
+  }
+  const nodes = value["nodes"].map(parseNode);
+  if (new Set(nodes.map((node) => node.id)).size !== nodes.length) {
+    throw new FleetUsageError("Node IDs must be unique.");
+  }
+  return { version: 1, nodes };
+}
+function selectNodes(config, ids) {
+  if (ids.some((id) => !config.nodes.some((node) => node.id === id))) {
+    throw new FleetUsageError("Unknown node selection. Run fleet nodes --json.");
+  }
+  return ids.length === 0 ? config.nodes : config.nodes.filter((node) => ids.includes(node.id));
+}
+
+// packages/fleet/src/fingerprint.ts
+import { readFile as readFile2, mkdir, writeFile } from "node:fs/promises";
+import { join as join3 } from "node:path";
+
+// packages/fleet/src/input-hashes.ts
+import { createHash } from "node:crypto";
+import { readFile, readdir } from "node:fs/promises";
+import { join as join2 } from "node:path";
+var INPUT_FILES = [
+  "package.json",
+  "bun.lock",
+  "mise.toml",
+  "mise.lock"
+];
+var FINGERPRINT_FILES = [
+  ...INPUT_FILES,
+  "workspace-manifests",
+  "mise-sidecars"
+];
+async function fileHash(path) {
+  try {
+    return digest(await readFile(path));
+  } catch {
+    return null;
+  }
+}
+async function manifestHash(root) {
+  try {
+    const entries = await readdir(join2(root, "packages"), {
+      withFileTypes: true
+    });
+    const hashes = [];
+    for (const entry of entries.filter((item) => item.isDirectory()).sort((left, right) => left.name.localeCompare(right.name, "en"))) {
+      hashes.push(`${entry.name}:${await fileHash(join2(root, "packages", entry.name, "package.json"))}`);
+    }
+    return digest(hashes.join(`
+`));
+  } catch {
+    return null;
+  }
+}
+async function sidecarHash(root) {
+  try {
+    const files = await readdir(join2(root, ".mise/locks"), {
+      recursive: true,
+      withFileTypes: true
+    });
+    if (files.length > 4096 || files.some((entry) => entry.isSymbolicLink()))
+      return null;
+    const hashes = [];
+    const paths = files.filter((entry) => entry.isFile()).map((entry) => join2(entry.parentPath, entry.name)).sort();
+    for (const path of paths) {
+      const hash = await fileHash(path);
+      if (hash === null)
+        return null;
+      const relative = path.slice(join2(root, ".mise/locks").length).replaceAll("\\", "/");
+      hashes.push(`${relative}:${hash}`);
+    }
+    return digest(hashes.join(`
+`));
+  } catch {
+    return null;
+  }
+}
+function digest(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+// packages/fleet/src/fingerprint.ts
+var RECEIPT = "node_modules/.fleet-sync.json";
+async function fingerprint(root, run) {
+  const files = {};
+  for (const name of INPUT_FILES)
+    files[name] = await fileHash(join3(root, name));
+  files["workspace-manifests"] = await manifestHash(root);
+  files["mise-sidecars"] = await sidecarHash(root);
+  const head = await run(["git", "rev-parse", "HEAD"], { cwd: root });
+  return {
+    head: head.ok && /^[a-f0-9]{40,64}\s*$/.test(head.stdout) ? head.stdout.trim() : null,
+    files
+  };
+}
+async function dependencyCheck(root, current) {
+  const remedy = {
+    action: "Review fleet sync, then explicitly apply a frozen toolchain/dependency sync."
+  };
+  try {
+    const receipt = JSON.parse(await readFile2(join3(root, RECEIPT), "utf8"));
+    const matches = record(receipt) && receipt["version"] === 1 && JSON.stringify(receipt["files"]) === JSON.stringify(current.files);
+    return {
+      id: "dependencies",
+      status: matches ? "pass" : "fail",
+      summary: matches ? "Last successful frozen sync matches input hashes; not a full integrity audit." : "Dependency sync receipt is stale or invalid.",
+      ...matches ? {} : { remedy }
+    };
+  } catch {
+    return {
+      id: "dependencies",
+      status: "warn",
+      summary: "No frozen-sync receipt; installed dependencies are unverified.",
+      remedy
+    };
+  }
+}
+async function writeReceipt(root, current) {
+  await mkdir(join3(root, "node_modules"), { recursive: true });
+  await writeFile(join3(root, RECEIPT), JSON.stringify({ version: 1, files: current.files }), { mode: 384 });
+}
+function compareFingerprints(expected, actual) {
+  return [
+    compare("revision", expected.head, actual.head),
+    ...FINGERPRINT_FILES.map((name) => compare(`sync:${name}`, expected.files[name] ?? null, actual.files[name] ?? null))
+  ];
+}
+function compare(id, expected, actual) {
+  const known = expected !== null && actual !== null;
+  const matches = known && expected === actual;
+  return {
+    id,
+    status: matches ? "pass" : "fail",
+    summary: matches ? "Matches the controller checkout." : known ? "Differs from the controller checkout." : "Cannot verify; reference or node input is missing.",
+    ...matches ? {} : {
+      remedy: {
+        action: "Reconcile branches/lockfiles; review fleet sync --pull. Never reset a working tree."
+      }
+    }
+  };
+}
+
+// packages/fleet/src/auth-checks.ts
+import { join as join4 } from "node:path";
+async function authCheck(capability, run, root) {
+  if (capability === "t3")
+    return t3Checks(run);
+  const spec = {
+    github: {
+      command: ["gh", "auth", "status", "--active"],
+      action: "Authenticate on this node with gh auth login, then gh auth setup-git."
+    },
+    vault: {
+      command: ["vault", "token", "lookup", "-format=json"],
+      action: "Authenticate to the configured Vault on this node. Do not copy a token from another computer."
+    },
+    vscode: {
+      command: ["code", "--list-extensions"],
+      action: "Install the VS Code CLI on PATH and ms-vscode-remote.remote-ssh in the local editor profile."
+    },
+    toolchain: {
+      command: ["bun", join4(root, "scripts/dev/doctor.ts"), "--json"],
+      action: "Run ws tools check --json; use the shared mise setup to reconcile tools."
+    }
+  }[capability];
+  const result = await run(spec.command, {
+    cwd: root,
+    timeoutMs: capability === "toolchain" ? 90000 : 15000
+  });
+  const extensions = result.stdout.toLowerCase().split(/\s+/);
+  const ok = result.ok && (capability !== "vscode" || extensions.includes("ms-vscode-remote.remote-ssh"));
+  return [
+    {
+      id: `auth:${capability}`,
+      status: ok ? "pass" : "fail",
+      summary: ok ? `${capability} check succeeded in this process context.` : `${capability} check failed (${result.reason}); no credential output retained.`,
+      ...ok ? {} : { remedy: { action: spec.action } }
+    }
+  ];
+}
+async function t3Checks(run) {
+  const config = await run(["t3", "status", "--json"]);
+  const checks = [t3Settings(config)];
+  const live = await run(["t3", "environment", "list", "--json"]);
+  checks.push({
+    id: "t3:api",
+    status: live.ok ? "pass" : "fail",
+    summary: live.ok ? "Local T3 API answered a read-only environment listing; peer connectivity is not inferred." : "Local T3 API did not answer the environment listing.",
+    ...!live.ok ? {
+      remedy: {
+        action: "Check t3 service status and t3 status. Inspect linked peers in T3 Settings → Connections; relink only with operator approval."
+      }
+    } : {}
+  });
+  checks.push({
+    id: "t3:end-to-end",
+    status: "skip",
+    summary: "Relay traversal and remote peer authorization require an operator connection test; local settings are not proof."
+  });
+  return checks;
+}
+function t3Settings(config) {
+  const fallback = {
+    id: "t3:settings",
+    status: "fail",
+    summary: "T3 settings unavailable or unsupported CLI response.",
+    remedy: {
+      action: "Run t3 status --json on this node. Complete t3 up --connect as its operator if needed."
+    }
+  };
+  try {
+    const data = JSON.parse(config.stdout);
+    if (config.ok && record(data) && record(data["connect"])) {
+      const enabled = data["connect"]["enabled"] === true && data["connect"]["revoked"] === false;
+      return {
+        id: "t3:settings",
+        status: enabled ? "pass" : "fail",
+        summary: enabled ? "T3 Connect enabled and not marked revoked (settings only)." : "T3 Connect disabled, revoked, or unknown.",
+        ...!enabled ? {
+          remedy: {
+            action: "Review t3 status, then complete t3 up --connect as the operator. Never share pairing tokens."
+          }
+        } : {}
+      };
+    }
+  } catch {}
+  return fallback;
+}
+
+// packages/fleet/src/probe.ts
+async function probe(root, required, run) {
+  const current = await fingerprint(root, run);
+  const checks = [
+    {
+      id: "workspace",
+      status: Object.values(current.files).every(Boolean) && current.head ? "pass" : "fail",
+      summary: "Checkout revision and shared dependency/toolchain input availability."
+    }
+  ];
+  const dirty = await run(["git", "status", "--porcelain"], { cwd: root });
+  checks.push({
+    id: "git:clean",
+    status: dirty.ok ? dirty.stdout.trim() ? "warn" : "pass" : "fail",
+    summary: dirty.ok && !dirty.stdout.trim() ? "Working tree is clean." : "Working tree is dirty or unreadable; sync --pull will refuse."
+  });
+  checks.push(await dependencyCheck(root, current));
+  for (const capability of [
+    "github",
+    "vault",
+    "t3",
+    "vscode",
+    "toolchain"
+  ]) {
+    if (required.includes(capability))
+      checks.push(...await authCheck(capability, run, root));
+    else
+      checks.push({
+        id: `auth:${capability}`,
+        status: "skip",
+        summary: "Not required by this node configuration."
+      });
+  }
+  return {
+    version: 1,
+    platform: process.platform,
+    fingerprint: current,
+    checks
+  };
+}
+
+// packages/fleet/src/report.ts
+function makeReport(command, nodes) {
+  const summary = {
+    pass: 0,
+    warn: 0,
+    fail: 0,
+    skip: 0
+  };
+  for (const node of nodes)
+    for (const check of node.checks)
+      summary[check.status] += 1;
+  return {
+    version: 1,
+    command,
+    ok: summary.fail === 0,
+    generatedAt: new Date().toISOString(),
+    nodes,
+    summary
+  };
+}
+function reportExitCode(report, strict) {
+  return !report.ok || strict && (report.summary.warn > 0 || report.summary.skip > 0) ? 1 : 0;
+}
+function renderReport(report) {
+  const lines = [
+    `Fleet ${report.command}: ${report.ok ? "no failing checks" : "attention needed"}`
+  ];
+  for (const node of report.nodes) {
+    lines.push(`
+${node.node}`);
+    for (const check of node.checks) {
+      lines.push(`  ${check.status.toUpperCase()} ${check.id}: ${check.summary}`);
+      if (check.remedy)
+        lines.push(`    Next: ${check.remedy.action}`);
+    }
+  }
+  lines.push(`
+${report.summary.pass} pass, ${report.summary.warn} warn, ${report.summary.fail} fail, ${report.summary.skip} skip`);
+  return lines.join(`
+`);
+}
+async function mapBounded(items, worker, concurrency = 4) {
+  const results = new Array(items.length);
+  let cursor = 0;
+  const consume = async () => {
+    while (cursor < items.length) {
+      const index = cursor++;
+      results[index] = await worker(items[index]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, consume));
+  return results;
+}
+
+// packages/fleet/src/ssh.ts
+function shellQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function sshArgs(node) {
+  return [
+    "ssh",
+    "-T",
+    "-a",
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    "StrictHostKeyChecking=yes",
+    "-o",
+    "UpdateHostKeys=no",
+    "-o",
+    "ConnectTimeout=8",
+    "-o",
+    "ConnectionAttempts=1",
+    "-o",
+    "ServerAliveInterval=5",
+    "-o",
+    "ServerAliveCountMax=2",
+    "-o",
+    "ClearAllForwardings=yes",
+    "-o",
+    "PermitLocalCommand=no",
+    "-o",
+    "ControlMaster=no",
+    "-o",
+    "ControlPath=none",
+    node.ssh
+  ];
+}
+function remoteCommand(node, request) {
+  const encoded = Buffer.from(JSON.stringify(request)).toString("base64");
+  const command = `cd -- ${shellQuote(node.workspace)} && exec ${shellQuote(node.runtime ?? "node")} --input-type=module - ${shellQuote(encoded)}`;
+  return [...sshArgs(node), command];
+}
+var FAILURES = [
+  {
+    pattern: /REMOTE HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .* host key is known/i,
+    id: "ssh:host-key",
+    summary: "SSH host key is unknown or changed.",
+    action: "Verify the host fingerprint out of band, then update known_hosts manually. Never disable host-key checking."
+  },
+  {
+    pattern: /Could not resolve hostname|Name or service not known|nodename nor servname/i,
+    id: "ssh:dns",
+    summary: "SSH hostname or jump-host resolution failed.",
+    action: "Check the alias in ~/.ssh/config, DNS/VPN/Tailscale connectivity, and ProxyJump host resolution."
+  },
+  {
+    pattern: /Permission denied|sign_and_send_pubkey|agent refused|Too many authentication failures/i,
+    id: "ssh:auth",
+    summary: "SSH key/agent authentication failed.",
+    action: "Use ssh-add -l and ssh -vvv ALIAS locally; check User, IdentityFile, IdentitiesOnly, agent/keychain access and authorized_keys. Do not share debug logs without review."
+  },
+  {
+    pattern: /Connection refused|No route to host|Network is unreachable/i,
+    id: "ssh:network",
+    summary: "SSH endpoint or jump host is unreachable/refused.",
+    action: "Verify the node is awake, VPN is connected, sshd is enabled and the configured port is reachable. Do not open a public SSH port automatically."
+  },
+  {
+    pattern: /(?:bun|node).*not found|No such file or directory|cannot cd|can.t cd/i,
+    id: "ssh:runtime",
+    summary: "Remote workspace or Node/Bun runtime is missing from the non-login SSH environment.",
+    action: "Follow fleet onboard; configure absolute workspace/runtime paths. GUI terminals and SSH shells may have different PATHs."
+  }
+];
+function sshFailure(result) {
+  if (result.reason === "timeout")
+    return {
+      id: "ssh:timeout",
+      status: "fail",
+      summary: "SSH or remote probe exceeded its deadline.",
+      remedy: {
+        action: "Check sleeping nodes, VPN, ProxyJump, network reachability and noninteractive shell startup. Increase --timeout only after diagnosis."
+      }
+    };
+  if (result.reason === "missing")
+    return {
+      id: "ssh:missing",
+      status: "fail",
+      summary: "Cannot launch the local SSH client.",
+      remedy: {
+        action: "Install/enable the OS OpenSSH client and expose it to the terminal/editor PATH."
+      }
+    };
+  const match = FAILURES.find((failure) => failure.pattern.test(result.stderr));
+  return {
+    id: match?.id ?? "ssh:probe",
+    status: "fail",
+    summary: match?.summary ?? `Remote probe failed (${result.reason}); raw output withheld.`,
+    remedy: {
+      action: match?.action ?? "Run ssh ALIAS manually; verify workspace/runtime, shell startup output and CLI compatibility. Never paste credentials or full logs into agent context."
+    }
+  };
+}
+
+// packages/fleet/src/protocol.ts
+var STATUSES = ["pass", "warn", "fail", "skip"];
+function validCheck(value) {
+  if (!record(value) || typeof value["id"] !== "string" || !/^[a-z0-9:._-]{1,100}$/.test(value["id"]) || !STATUSES.includes(String(value["status"])) || typeof value["summary"] !== "string" || value["summary"].length > 2000)
+    return false;
+  const remedy = value["remedy"];
+  return remedy === undefined || validRemedy(remedy);
+}
+function validRemedy(value) {
+  return record(value) && typeof value["action"] === "string" && value["action"].length < 2000 && (value["command"] === undefined || typeof value["command"] === "string");
+}
+function validSnapshot(value) {
+  if (!record(value) || value["version"] !== 1 || typeof value["platform"] !== "string" || !Array.isArray(value["checks"]) || value["checks"].length > 200 || !value["checks"].every(validCheck))
+    return false;
+  return validFingerprint(value["fingerprint"]);
+}
+function validFingerprint(value) {
+  if (!record(value) || !record(value["files"]))
+    return false;
+  if (!Object.keys(value["files"]).every((key) => FINGERPRINT_FILES.includes(key)))
+    return false;
+  const head = value["head"];
+  return (head === null || typeof head === "string" && /^[a-f0-9]{40,64}$/.test(head)) && Object.values(value["files"]).every(validHash);
+}
+function validHash(value) {
+  return value === null || typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+}
+function decodeSnapshot(output) {
+  try {
+    const data = JSON.parse(output);
+    return validSnapshot(data) ? cleanSnapshot(data) : null;
+  } catch {
+    return null;
+  }
+}
+function cleanCheck(check) {
+  return {
+    id: check.id,
+    status: check.status,
+    summary: check.summary,
+    ...check.remedy ? {
+      remedy: {
+        action: check.remedy.action,
+        ...check.remedy.command ? { command: check.remedy.command } : {}
+      }
+    } : {}
+  };
+}
+function cleanSnapshot(snapshot) {
+  return {
+    version: 1,
+    platform: snapshot.platform,
+    fingerprint: {
+      head: snapshot.fingerprint.head,
+      files: snapshot.fingerprint.files
+    },
+    checks: snapshot.checks.map(cleanCheck)
+  };
+}
+
+// packages/fleet/src/transport.ts
+import { fileURLToPath } from "node:url";
+async function bundleProbe() {
+  const result = await Bun.build({
+    entrypoints: [fileURLToPath(new URL("./remote-entry.ts", import.meta.url))],
+    target: "node",
+    minify: true
+  });
+  if (!result.success || !result.outputs[0])
+    throw new Error("Cannot bundle the fleet probe.");
+  return result.outputs[0].text();
+}
+async function inspectRemote(node, options, run) {
+  const command = remoteCommand(node, {
+    action: options.action,
+    node,
+    apply: options.action === "sync",
+    pull: options.pull === true
+  });
+  const result = await run(command, {
+    input: options.source,
+    timeoutMs: options.timeoutMs
+  });
+  if (!result.ok)
+    return { node: node.id, checks: [sshFailure(result)] };
+  if (options.action === "sync")
+    return decodeSync(node.id, result.stdout);
+  const snapshot = decodeSnapshot(result.stdout);
+  if (!snapshot)
+    return protocolFailure(node.id);
+  return {
+    node: node.id,
+    snapshot,
+    checks: [
+      {
+        id: "ssh:session",
+        status: "pass",
+        summary: "Fresh noninteractive SSH session and Node-compatible probe succeeded with verified host keys and no agent forwarding."
+      },
+      ...snapshot.checks,
+      {
+        id: "vscode:forwarding",
+        status: "skip",
+        summary: "VS Code Remote-SSH tunnel/server installation is not tested by a shell session. Use the onboarding forwarding test."
+      }
+    ]
+  };
+}
+function decodeSync(node, output) {
+  try {
+    const data = JSON.parse(output);
+    if (record(data) && data["version"] === 1 && Array.isArray(data["checks"]) && data["checks"].length <= 200 && data["checks"].every(validCheck)) {
+      return { node, checks: data["checks"].map(cleanCheck) };
+    }
+  } catch {
+    return protocolFailure(node);
+  }
+  return protocolFailure(node);
+}
+function protocolFailure(node) {
+  return {
+    node,
+    checks: [
+      {
+        id: "ssh:protocol",
+        status: "fail",
+        summary: "Remote response is not a supported fleet JSON document.",
+        remedy: {
+          action: "Remove stdout banners from noninteractive shell startup; check the Node/Bun runtime. No raw remote output is retained."
+        }
+      }
+    ]
+  };
+}
+
+// packages/fleet/src/controller.ts
+async function doctor(nodes, options, run) {
+  const local = await probe(options.root, options.required, run);
+  const agent = await run(["ssh-add", "-l"]);
+  const reports = [
+    {
+      node: "controller",
+      snapshot: local,
+      checks: [
+        ...local.checks,
+        {
+          id: "ssh:agent",
+          status: agent.ok ? "pass" : "warn",
+          summary: agent.ok ? "SSH agent exposes at least one identity." : "No accessible SSH agent identities; explicit IdentityFile keys may still work.",
+          ...!agent.ok ? {
+            remedy: {
+              action: "Unlock/load the intended key in the controller session. Check SSH_AUTH_SOCK and GUI/editor agent visibility; do not copy private keys."
+            }
+          } : {}
+        }
+      ]
+    }
+  ];
+  if (options.local || nodes.length === 0)
+    return reports;
+  const source = options.source ?? await bundleProbe();
+  const reference = await fingerprint(options.root, run);
+  const remote = await mapBounded(nodes, async (node) => {
+    const report = await inspectRemote(node, { action: "probe", source, timeoutMs: options.timeoutMs }, run);
+    if (report.snapshot)
+      report.checks.push(...compareFingerprints(reference, report.snapshot.fingerprint));
+    return report;
+  });
+  return [...reports, ...remote];
+}
+
+// packages/fleet/src/sync.ts
+import { unlink } from "node:fs/promises";
+import { join as join5 } from "node:path";
+function syncPlan(pull) {
+  return [
+    "Validate the checkout and shared input files; invalidate any prior sync receipt.",
+    ...pull ? [
+      "Refuse dirty or detached checkouts; git pull --ff-only (no reset, stash, force or rebase)."
+    ] : [],
+    "Run mise exec --locked bun -- bun scripts/dev/setup.ts --non-interactive (shared tools, user mise/PATH, frozen dependencies).",
+    "Record input hashes only after every step succeeds.",
+    "Run fleet doctor afterward; workstation/provider configuration and logins remain explicit ws/operator actions."
+  ];
+}
+async function syncWorkspace(root, pull, run) {
+  const before = await fingerprint(root, run);
+  if (!completeFingerprint(before)) {
+    return failed("Not a complete workspace checkout. Follow fleet onboard first.");
+  }
+  if (pull) {
+    const dirty = await run(["git", "status", "--porcelain"], { cwd: root });
+    const branch = await run(["git", "symbolic-ref", "--quiet", "HEAD"], {
+      cwd: root
+    });
+    if (!dirty.ok || dirty.stdout.trim() || !branch.ok)
+      return failed("Refusing pull: dirty, detached, or unreadable checkout. Reconcile manually.");
+  }
+  await unlink(join5(root, "node_modules/.fleet-sync.json")).catch(() => {
+    return;
+  });
+  if (pull) {
+    const result = await run(["git", "pull", "--ff-only"], {
+      cwd: root,
+      timeoutMs: 120000
+    });
+    if (!result.ok)
+      return failed("Fast-forward pull failed. Inspect upstream/network/auth manually; nothing was reset.");
+  }
+  const expected = await fingerprint(root, run);
+  const result = await run([
+    "mise",
+    "exec",
+    "--locked",
+    "bun",
+    "--",
+    "bun",
+    "scripts/dev/setup.ts",
+    "--non-interactive"
+  ], { cwd: root, timeoutMs: 1200000 });
+  if (!result.ok)
+    return failed(`Shared toolchain/dependency sync failed (${result.reason}). Inspect setup locally; partial installs are possible.`);
+  const after = await fingerprint(root, run);
+  if (JSON.stringify(expected) !== JSON.stringify(after))
+    return failed("Checkout inputs changed during sync. Retry from a stable checkout.");
+  await writeReceipt(root, after);
+  return [
+    {
+      id: "sync",
+      status: "pass",
+      summary: "Shared setup succeeded; frozen-sync receipt recorded. Auth and live connectivity still need doctor checks."
+    }
+  ];
+}
+function failed(summary) {
+  return [
+    {
+      id: "sync",
+      status: "fail",
+      summary,
+      remedy: {
+        action: "Resolve locally using scripts/dev/README.md, then review and retry fleet sync."
+      }
+    }
+  ];
+}
+function completeFingerprint(value) {
+  return value.head !== null && Object.values(value.files).every(Boolean);
+}
+
+// packages/fleet/src/onboard.ts
+function onboarding(node, launcher = "bun run fleet") {
+  return {
+    version: 1,
+    node: node.id,
+    applied: false,
+    steps: [
+      "On the new node, review and run scripts/dev/bootstrap.sh (or bootstrap.ps1 for native Windows). Use scripts/dev/README.md. This installs the shared locked toolchain; it does not enable SSH.",
+      "Enable the OS SSH service as the operator on a trusted private network. Do not expose SSH publicly or create cloud resources.",
+      "Create a distinct per-machine SSH key and authorize its PUBLIC key on the destination. Verify host fingerprints out of band. Keep private keys and auth tokens on their original machines.",
+      "In the controller SSH config, configure this alias with the real HostName, User, IdentityFile, optional Port/ProxyJump and IdentitiesOnly yes. Fleet will not write or overwrite SSH configuration.",
+      "Test ssh ALIAS manually once after fingerprint verification. Ensure noninteractive shell startup writes no stdout. Set runtime to an absolute Node/Bun executable/shim if SSH PATH omits it.",
+      "Authenticate separately on the node: gh auth login; gh auth setup-git; vault login using the approved method. Configure coding-provider sessions independently; never copy auth directories.",
+      "For T3 Connect, review t3 status and t3 service status, then complete t3 up --connect and operator pairing/linking. T3 pairing/auth state is not an SSH credential.",
+      "For VS Code, install Remote-SSH in the LOCAL editor profile, use the same SSH alias/client/config, enable the login terminal temporarily, and read Output → Remote - SSH. Restart the editor after PATH/agent changes.",
+      "VS Code needs TCP forwarding and compatible remote server prerequisites. Test with ssh -N -L 127.0.0.1:18080:127.0.0.1:REMOTE_PORT ALIAS against a known loopback service, then curl localhost:18080 from a second terminal. Review server policy; never loosen it automatically.",
+      "Run fleet doctor --node NODE --json from every intended controller. This is directed connectivity, not an all-pairs proof. Review skipped T3/VS Code end-to-end checks manually."
+    ],
+    sshTemplate: `Host ${node.ssh}
+  HostName REPLACE_WITH_PRIVATE_HOST
+  User REPLACE_WITH_USER
+  IdentityFile ~/.ssh/REPLACE_WITH_NODE_KEY
+  IdentitiesOnly yes
+  ForwardAgent no
+`,
+    vscodeSettings: {
+      "remote.SSH.path": "REPLACE_WITH_SAME_OPENSSH_BINARY",
+      "remote.SSH.configFile": "REPLACE_WITH_ABSOLUTE_SSH_CONFIG",
+      "remote.SSH.showLoginTerminal": true
+    },
+    workspaceCommand: `cd -- ${shellQuote(node.workspace)}`,
+    verifyCommand: `${launcher} doctor --node ${node.id} --json`,
+    sync: {
+      command: `${launcher} sync --node ${node.id}`,
+      steps: syncPlan(false)
+    }
+  };
+}
+
+// packages/fleet/src/runner.ts
+import { spawn } from "node:child_process";
+var MAX_OUTPUT_BYTES = 1024 * 1024;
+function terminate(child) {
+  try {
+    if (process.platform !== "win32" && child.pid)
+      process.kill(-child.pid, "SIGKILL");
+    else
+      child.kill("SIGKILL");
+  } catch {}
+}
+function runCommand(command, options = {}) {
+  return new Promise((resolve) => {
+    const child = spawn(command[0], command.slice(1), {
+      cwd: options.cwd,
+      env: {
+        ...process.env,
+        ...options.env,
+        GIT_TERMINAL_PROMPT: "0",
+        CI: "1"
+      },
+      stdio: "pipe",
+      windowsHide: true,
+      detached: process.platform !== "win32"
+    });
+    let stdout = "";
+    let stderr = "";
+    let bytes = 0;
+    let finished = false;
+    let reason = "exit";
+    const finish = (ok) => {
+      if (finished)
+        return;
+      finished = true;
+      clearTimeout(timer);
+      child.stdin.destroy();
+      child.stdout.destroy();
+      child.stderr.destroy();
+      resolve({ ok, stdout, stderr, reason });
+    };
+    const abort = (cause) => {
+      reason = cause;
+      terminate(child);
+      finish(false);
+    };
+    const timer = setTimeout(() => {
+      abort("timeout");
+    }, options.timeoutMs ?? 15000);
+    const capture = (stream, chunk) => {
+      if (finished)
+        return;
+      bytes += Buffer.byteLength(chunk);
+      if (bytes > MAX_OUTPUT_BYTES) {
+        abort("overflow");
+        return;
+      }
+      if (stream === "stdout")
+        stdout += chunk;
+      else
+        stderr += chunk;
+    };
+    child.stdout.setEncoding("utf8").on("data", (chunk) => capture("stdout", chunk));
+    child.stderr.setEncoding("utf8").on("data", (chunk) => capture("stderr", chunk));
+    child.stdin.on("error", () => {
+      return;
+    });
+    child.on("error", () => {
+      abort("missing");
+    });
+    child.on("close", (code) => {
+      finish(code === 0 && reason === "exit");
+    });
+    child.stdin.end(options.input);
+  });
+}
+// packages/fleet/schema.json
+var schema_default = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  title: "Developer fleet roster (not infrastructure inventory)",
+  type: "object",
+  additionalProperties: false,
+  required: ["version", "nodes"],
+  properties: {
+    $schema: { type: "string" },
+    version: { const: 1 },
+    nodes: {
+      type: "array",
+      minItems: 1,
+      maxItems: 64,
+      items: {
+        type: "object",
+        additionalProperties: false,
+        required: ["id", "ssh", "workspace"],
+        properties: {
+          id: { type: "string", pattern: "^[a-z][a-z0-9-]{0,62}$" },
+          ssh: {
+            type: "string",
+            pattern: "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$"
+          },
+          workspace: {
+            type: "string",
+            maxLength: 4096,
+            pattern: "^/[^\\u0000-\\u001f\\u007f]*$"
+          },
+          runtime: {
+            type: "string",
+            maxLength: 4096,
+            pattern: "^/[^\\u0000-\\u001f\\u007f]*$"
+          },
+          required: {
+            type: "array",
+            uniqueItems: true,
+            default: ["github", "vault", "t3", "toolchain"],
+            items: {
+              enum: ["github", "vault", "t3", "vscode", "toolchain"]
+            }
+          }
+        }
+      }
+    }
+  }
+};
+// packages/fleet/fleet.example.json
+var fleet_example_default = {
+  $schema: "./schema.json",
+  version: 1,
+  nodes: [
+    {
+      id: "dev-linux",
+      ssh: "dev-linux",
+      workspace: "/home/developer/workspace",
+      runtime: "/home/developer/.local/share/mise/shims/node",
+      required: ["github", "vault", "t3", "toolchain"]
+    }
+  ]
+};
+
+// packages/personal-cli/src/options.ts
+function capabilities(value) {
+  const values = value === "none" ? [] : value?.split(",") ?? CAPABILITIES;
+  if (values.some((entry) => !CAPABILITIES.includes(entry)))
+    throw new FleetUsageError("--require expects github,vault,t3,vscode,toolchain or none.");
+  return [...new Set(values)];
+}
+function timeout(options) {
+  const value = Number(options.timeout ?? (options.apply ? 1500000 : 120000));
+  if (!Number.isInteger(value) || value < 1000 || value > 1800000)
+    throw new FleetUsageError("--timeout must be 1000–1800000 milliseconds.");
+  return value;
+}
+function validateOptions(command, options) {
+  validateMutation(command, options);
+  validateScope(command, options);
+  if (options.timeout !== undefined)
+    timeout(options);
+}
+function validateMutation(command, options) {
+  if (options.apply && !["add", "init", "sync"].includes(command))
+    throw new FleetUsageError("--apply is only valid for fleet add, init or sync.");
+  if (options.apply && !options.yes)
+    throw new FleetUsageError("Mutation requires both --apply and --yes.");
+  if (options.pull && command !== "sync")
+    throw new FleetUsageError("--pull is only valid for fleet sync.");
+}
+function validateScope(command, options) {
+  if (options.local && !["doctor", "sync"].includes(command))
+    throw new FleetUsageError("--local is only valid for fleet doctor or sync.");
+  validateExclusive(options);
+  if (options.all && command !== "doctor")
+    throw new FleetUsageError("--all is only valid for fleet doctor; sync already targets all configured nodes by default.");
+}
+function validateExclusive(options) {
+  const selected = [
+    options.local,
+    options.all,
+    Boolean(options.node?.length)
+  ].filter(Boolean);
+  if (selected.length > 1)
+    throw new FleetUsageError("Choose --local, --all, or --node, not a combination.");
+}
+
+// packages/personal-cli/src/roster.ts
+import { lstat, mkdir as mkdir2, open, readFile as readFile3, rename, unlink as unlink2 } from "node:fs/promises";
+import { dirname as dirname2 } from "node:path";
+import { randomUUID } from "node:crypto";
+async function readRoster(path) {
+  try {
+    const info = await lstat(path);
+    if (!info.isFile() || info.size > 1024 * 1024)
+      throw new FleetUsageError("Roster must be a regular file smaller than 1 MiB; symlinks are not supported.");
+    return parseConfig(JSON.parse(await readFile3(path, "utf8")));
+  } catch (error) {
+    if (record(error) && error["code"] === "ENOENT")
+      return null;
+    if (error instanceof FleetUsageError)
+      throw error;
+    throw new FleetUsageError("Cannot read a valid roster. Use fleet schema or choose --config PATH.");
+  }
+}
+function nodeFromOptions(options) {
+  if (!options.id || !options.ssh || !options.path)
+    throw new FleetUsageError("fleet add requires --id NAME --ssh ALIAS --path /absolute/checkout.");
+  const node = {
+    id: options.id,
+    ssh: options.ssh,
+    workspace: options.path,
+    ...options.runtime ? { runtime: options.runtime } : {},
+    required: capabilities(options.require ?? "github,vault,t3,toolchain")
+  };
+  return parseConfig({ version: 1, nodes: [node] }).nodes[0];
+}
+function appendNode(existing, node) {
+  return parseConfig({ version: 1, nodes: [...existing?.nodes ?? [], node] });
+}
+async function addNode(path, node, apply) {
+  if (!apply)
+    return appendNode(await readRoster(path), node);
+  await mkdir2(dirname2(path), { recursive: true, mode: 448 });
+  const lock = await acquireLock(path);
+  try {
+    const roster = appendNode(await readRoster(path), node);
+    await atomicWrite(path, roster);
+    return roster;
+  } finally {
+    await lock.close();
+    await unlink2(`${path}.lock`);
+  }
+}
+async function acquireLock(path) {
+  try {
+    return await open(`${path}.lock`, "wx", 384);
+  } catch {
+    throw new FleetUsageError("Roster is locked or unwritable. Check permissions and concurrent writers; remove a stale .lock only after verifying no operation is running.");
+  }
+}
+async function atomicWrite(path, roster) {
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  const handle = await open(temporary, "wx", 384);
+  try {
+    await handle.writeFile(`${JSON.stringify(roster, null, 2)}
+`);
+    await handle.sync();
+    await handle.close();
+    await rename(temporary, path);
+  } finally {
+    await handle.close();
+    await unlink2(temporary).catch(() => {
+      return;
+    });
+  }
+}
+
+// packages/personal-cli/src/probe-source.ts
+import { readFile as readFile4 } from "node:fs/promises";
+async function probeSource() {
+  if (typeof Bun !== "undefined")
+    return bundleProbe();
+  return readFile4(new URL("./probe.mjs", import.meta.url), "utf8");
+}
+
+// packages/personal-cli/src/fleet.ts
+var SERVICES = { run: runCommand, source: probeSource };
+async function executeFleet(command, options, settings, services = SERVICES) {
+  validateOptions(command, options);
+  if (command === "schema")
+    return result(schema_default);
+  if (command === "init")
+    return initialize(settings, options);
+  if (command === "add")
+    return register(settings, options);
+  const roster = options.local ? null : await readRoster(settings.config);
+  const nodes = resolveNodes(command, options, roster);
+  if (["nodes", "validate", "onboard"].includes(command))
+    return result({
+      version: 1,
+      command,
+      ok: true,
+      nodes: command === "onboard" ? nodes.map((node) => onboarding(node, "personal fleet")) : nodes
+    });
+  if (command === "sync")
+    return synchronize(nodes, options, settings, services);
+  return diagnose(nodes, options, { ...settings, missingRoster: !roster }, services);
+}
+function resolveNodes(command, options, roster) {
+  if (!roster && !options.local && command !== "doctor")
+    throw new FleetUsageError("No fleet roster. Use fleet add or the interactive Register action; use fleet doctor --local for this machine.");
+  if (options.node?.length && !roster)
+    throw new FleetUsageError("Cannot select nodes without a roster. Use fleet add first.");
+  return roster ? selectNodes(roster, options.node ?? []) : [];
+}
+function result(data, text) {
+  return { exitCode: 0, data, ...text ? { text } : {} };
+}
+async function register(settings, options) {
+  const node = nodeFromOptions(options);
+  const config = await addNode(settings.config, node, options.apply === true);
+  return result({
+    version: 1,
+    command: "add",
+    ok: true,
+    applied: options.apply === true,
+    path: settings.config,
+    node,
+    nodes: config.nodes,
+    next: options.apply ? "Run fleet onboard, then fleet doctor --all --json." : "Review this preview, then repeat with --apply --yes."
+  });
+}
+async function initialize(settings, options) {
+  const config = {
+    ...fleet_example_default,
+    $schema: new URL("./schema.json", import.meta.url).href
+  };
+  if (options.apply) {
+    await mkdir3(dirname3(settings.config), { recursive: true, mode: 448 });
+    try {
+      await writeFile2(settings.config, `${JSON.stringify(config, null, 2)}
+`, {
+        flag: "wx",
+        mode: 384
+      });
+    } catch {
+      throw new FleetUsageError("Cannot create roster. Existing files are never overwritten; use --config PATH.");
+    }
+  }
+  return result({
+    version: 1,
+    command: "init",
+    ok: true,
+    applied: options.apply === true,
+    path: settings.config,
+    config,
+    next: "This is example data, not discovered machines. Edit placeholders before doctor, or use fleet add to register real nodes."
+  });
+}
+async function diagnose(nodes, options, settings, services) {
+  const source = nodes.length ? await services.source() : undefined;
+  const reports = await doctor(nodes, {
+    root: settings.workspace,
+    local: options.local === true,
+    required: capabilities(options.require),
+    timeoutMs: timeout(options),
+    ...source ? { source } : {}
+  }, services.run);
+  if (!options.local && settings.missingRoster)
+    reports.push(missingRoster());
+  const report = {
+    ...makeReport("doctor", reports),
+    coverage: {
+      scope: options.local ? "local" : options.node?.length ? "selected" : "all-configured",
+      controller: true,
+      configuredNodesTested: nodes.map((node) => node.id),
+      rosterAvailable: !settings.missingRoster,
+      note: "Directed SSH checks from this controller only. T3 relay/peer and VS Code forwarding require operator tests."
+    }
+  };
+  return {
+    exitCode: reportExitCode(report, options.strict === true),
+    data: report,
+    text: renderReport(report)
+  };
+}
+function missingRoster() {
+  return {
+    node: "fleet",
+    checks: [
+      {
+        id: "fleet:roster",
+        status: "fail",
+        summary: "No developer fleet roster is configured. Only this controller could be checked; fleet-wide health is unknown.",
+        remedy: {
+          action: "Open personal and choose Register a developer computer, or run personal fleet add --help. Then run fleet doctor --all."
+        }
+      }
+    ]
+  };
+}
+async function synchronize(nodes, options, settings, services) {
+  if (!options.apply)
+    return result({
+      version: 1,
+      command: "sync",
+      ok: true,
+      applied: false,
+      targets: options.local ? ["local"] : nodes.map((node) => node.id),
+      steps: syncPlan(options.pull === true),
+      authorize: "Review the plan; repeat with --apply --yes to authorize changes."
+    });
+  const reports = options.local ? [
+    {
+      node: "local",
+      checks: await syncWorkspace(settings.workspace, options.pull === true, services.run)
+    }
+  ] : await syncRemotes(nodes, options, services);
+  const report = makeReport("sync", reports);
+  return {
+    exitCode: reportExitCode(report, options.strict === true),
+    data: report,
+    text: renderReport(report)
+  };
+}
+async function syncRemotes(nodes, options, services) {
+  const source = await services.source();
+  return mapBounded(nodes, (node) => inspectRemote(node, {
+    source,
+    action: "sync",
+    timeoutMs: timeout(options),
+    pull: options.pull === true
+  }, services.run), 1);
+}
+
+// packages/personal-cli/src/program.ts
+var GLOBAL_OPTIONS = [
+  {
+    flag: "--json",
+    description: "One versioned JSON document on stdout; never prompt"
+  },
+  { flag: "--non-interactive", description: "Never open interactive prompts" },
+  {
+    flag: "--workspace <path>",
+    description: "Existing controller checkout; does not clone or change it"
+  },
+  { flag: "--config <path>", description: "Local, secret-free fleet roster" }
+];
+function common(command) {
+  return command.option("--node <id>", "Select an existing node; repeat for multiple nodes", collect, []).option("--local", "Controller only; no roster or SSH required").option("--all", "All configured nodes and the controller (doctor default)").option("--require <capabilities>", "Controller capabilities, comma separated, or none").option("--timeout <ms>", "Per-node deadline, 1000–1800000 milliseconds").option("--strict", "Warnings and skipped checks also produce exit 1").option("--pull", "Sync only: explicitly request a clean, fast-forward pull").option("--apply", "Authorize the displayed roster/sync mutation; requires --yes").option("--yes", "Confirm an explicitly requested --apply operation");
+}
+function collect(value, previous) {
+  return [...previous, value];
+}
+function createProgram(version, output) {
+  const program = new Command().name("personal").description("Developer command center · interactive for people, structured for agents").version(version).exitOverride().configureOutput({ writeOut: output, writeErr: () => {
+    return;
+  } }).showSuggestionAfterError(false).option("--interactive", "Open the interactive terminal application (TTY required)");
+  for (const option of GLOBAL_OPTIONS)
+    program.option(option.flag, option.description);
+  return program;
+}
+function fleetCommands(program) {
+  const fleet = program.command("fleet").description("Diagnose, explore and onboard developer computers");
+  const definitions = commandCatalog().filter((entry) => entry.group === "Fleet" && entry.id !== "fleet doctor local");
+  return definitions.map((entry) => {
+    const command = common(fleet.command(entry.args[1]).description(entry.description));
+    if (entry.args[1] === "add")
+      command.requiredOption("--id <name>", "Unique lowercase node ID").requiredOption("--ssh <alias>", "Existing OpenSSH alias; never writes SSH configuration").requiredOption("--path <path>", "Absolute POSIX checkout path on the node").option("--runtime <path>", "Optional absolute Node/Bun runtime; defaults to node on SSH PATH");
+    command.addHelpText("after", `
+Example: ${entry.examples[0]}
+Writes require both --apply and --yes. Diagnostics never log in or repair automatically.`);
+    return command;
+  });
+}
+function catalog(options, version) {
+  const commands = commandCatalog(options.search, options.group);
+  return {
+    exitCode: 0,
+    data: {
+      version: 1,
+      cliVersion: version,
+      command: "commands",
+      ok: true,
+      commands,
+      globalOptions: GLOBAL_OPTIONS,
+      agentGuide: "personal agent --json",
+      schema: "personal fleet schema --json"
+    },
+    text: [
+      "Personal command catalog",
+      ...commands.map((entry) => `
+  ${entry.id}
+    ${entry.description}`),
+      `
+Run personal for the interactive application; add --json for agents.`
+    ].join(`
+`)
+  };
+}
+async function execute(args, defaults, version) {
+  let outcome;
+  let output = "";
+  const program = createProgram(version, (text) => {
+    output += text;
+  });
+  const commands = fleetCommands(program);
+  for (const command of commands)
+    command.action(async () => {
+      const options = command.optsWithGlobals();
+      const settings = await resolveSettings({
+        ...defaults,
+        ...settingsOverrides(options)
+      });
+      outcome = await executeFleet(command.name(), options, settings);
+    });
+  program.command("commands").description("Search the complete command catalog").option("--search <text>", "Filter names, descriptions and keywords").option("--group <name>", "Filter category, for example Fleet or Reference").action((_options, command) => {
+    outcome = catalog(command.optsWithGlobals(), version);
+  });
+  program.command("agent").description("Machine-readable usage and safety contract").action(() => {
+    outcome = { exitCode: 0, data: AGENT_GUIDE };
+  });
+  program.action(() => {
+    outcome = catalog(program.opts(), version);
+  });
+  try {
+    await program.parseAsync(args, { from: "user" });
+    return outcome ?? {
+      exitCode: 0,
+      data: { version: 1, help: output.trim() },
+      text: output.trim()
+    };
+  } catch (error) {
+    return commandError(error, output);
+  }
+}
+function settingsOverrides(options) {
+  return {
+    ...options.workspace ? { workspace: options.workspace } : {},
+    ...options.config ? { config: options.config } : {}
+  };
+}
+function commandError(error, output) {
+  if (error instanceof CommanderError && error.exitCode === 0)
+    return {
+      exitCode: 0,
+      data: { version: 1, help: output.trim() },
+      text: output.trim()
+    };
+  const usage = error instanceof CommanderError || error instanceof FleetUsageError;
+  return {
+    exitCode: usage ? 2 : 1,
+    data: {
+      version: 1,
+      ok: false,
+      code: usage ? "invalid_usage" : "operation_failed",
+      error: error instanceof FleetUsageError ? error.message : usage ? "Invalid command or option. Run personal --help or personal commands --json." : "Operation failed. Inspect configuration and permissions locally; raw errors are withheld to protect credentials."
+    }
+  };
+}
+
+// packages/personal-cli/src/app.ts
+import { parseArgs } from "node:util";
+var VERSION = "0.1.0";
+function wantsInteractive(args, terminal, ci) {
+  if (args.includes("--json") || args.includes("--non-interactive"))
+    return false;
+  return terminal && (args.includes("--interactive") || contextOnly(args) && !ci);
+}
+function startup(args) {
+  return parseArgs({
+    args,
+    allowPositionals: true,
+    strict: false,
+    options: {
+      workspace: { type: "string" },
+      config: { type: "string" },
+      interactive: { type: "boolean" },
+      json: { type: "boolean" },
+      "non-interactive": { type: "boolean" }
+    }
+  });
+}
+function contextOnly(args) {
+  const parsed = startup(args);
+  return parsed.positionals.length === 0 && Object.keys(parsed.values).every((key) => ["workspace", "config", "interactive"].includes(key));
+}
+async function main(args = process.argv.slice(2)) {
+  const { values } = startup(args);
+  const settings = await resolveSettings({
+    ...typeof values.workspace === "string" ? { workspace: values.workspace } : {},
+    ...typeof values.config === "string" ? { config: values.config } : {}
+  });
+  const terminal = process.stdin.isTTY === true && process.stderr.isTTY === true;
+  if (args.includes("--interactive") && !terminal) {
+    process.stdout.write(`${JSON.stringify({ version: 1, ok: false, code: "tty_required", error: "Interactive mode needs a terminal. Use personal commands --json or fleet doctor --local --json." })}
+`);
+    return 2;
+  }
+  if (wantsInteractive(args, terminal, Boolean(process.env["CI"]))) {
+    await Promise.resolve().then(() => init_ui());
+    await startInteractive({
+      ...settings,
+      version: VERSION,
+      commands: COMMANDS,
+      execute: (command) => execute(command, settings, VERSION)
+    });
+    return 0;
+  }
+  const outcome = await execute(args.filter((arg) => arg !== "--interactive"), settings, VERSION);
+  const text = args.includes("--json") ? JSON.stringify(outcome.data, null, 2) : outcome.text ?? JSON.stringify(outcome.data, null, 2);
+  process.stdout.write(`${text}
+`);
+  return outcome.exitCode;
+}
+
+// packages/personal-cli/src/cli.ts
+try {
+  process.exitCode = await main();
+} catch (error) {
+  const cancelled = error instanceof Error && ["ExitPromptError", "AbortPromptError"].includes(error.name);
+  process.stdout.write(`${JSON.stringify({
+    version: 1,
+    ok: false,
+    code: cancelled ? "cancelled" : "operation_failed",
+    error: cancelled ? "Cancelled; no further actions will run." : "Command failed. Inspect the local setup; raw errors are withheld to protect credentials."
+  })}
+`);
+  process.exitCode = cancelled ? 130 : 1;
+}