@crvouga/personal 0.0.0-stage → 0.1.1

package/cli.mjs

@@ -0,0 +1,4207 @@
+#!/usr/bin/env node
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
+};
+
+// packages/personal-cli/src/search.ts
+import Fuse from "fuse.js";
+function searchCommands(commands, term) {
+  const query = term.trim().toLowerCase();
+  if (!query)
+    return commands;
+  const words = query.split(/\s+/);
+  const exact = commands.filter((command) => {
+    const text = [
+      command.id,
+      command.title,
+      command.description,
+      command.group,
+      ...command.keywords
+    ].join(" ").toLowerCase();
+    return words.every((word) => text.includes(word));
+  });
+  const fuzzy = new Fuse(commands, {
+    keys: ["id", "title", "keywords", "description"],
+    threshold: 0.35,
+    ignoreLocation: true
+  }).search(query).map((result) => result.item);
+  return [
+    ...new Map([...exact, ...fuzzy].map((command) => [command.id, command])).values()
+  ];
+}
+var init_search = () => {};
+
+// packages/personal-cli/src/ui-data.ts
+function record2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function clean(value, limit = 2000) {
+  return value.replace(/\x1b\][^\x07]*(?:\x07|\x1b\\)/g, "").replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "").replace(/[\x00-\x1f\x7f-\x9f\u202a-\u202e\u2066-\u2069]/g, " ").slice(0, limit);
+}
+function text(value, fallback = "") {
+  return typeof value === "string" ? clean(value) : fallback;
+}
+function quote(value) {
+  return /^[a-zA-Z0-9_./:=,@-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+function callArgs(session, args) {
+  return [
+    ...args,
+    ...session.workspace ? ["--workspace", session.workspace] : [],
+    ...session.config ? ["--config", session.config] : []
+  ];
+}
+function reproduction(session, args) {
+  return [
+    "personal",
+    ...args,
+    "--workspace",
+    session.workspace ?? session.options.workspace,
+    "--config",
+    session.config ?? session.options.config,
+    "--json"
+  ].map(quote).join(" ");
+}
+function commandChoices(commands, term) {
+  return searchCommands(commands, term).map((command) => ({
+    name: `${clean(command.group)}: ${clean(command.title)}`,
+    value: `command:${command.id}`,
+    description: `${clean(command.description)}${command.mutation ? " · confirmation required" : ""}`
+  }));
+}
+function reportChecks(data) {
+  if (!record2(data))
+    return [];
+  const nodes = Array.isArray(data["nodes"]) ? data["nodes"] : [];
+  return [
+    ...nodes.flatMap(nodeChecks),
+    ...nodeChecks({ node: "tailscale", checks: data["checks"] })
+  ];
+}
+function nodeChecks(value) {
+  if (!record2(value) || !Array.isArray(value["checks"]))
+    return [];
+  const node = text(value["node"], "controller");
+  return value["checks"].flatMap((check) => {
+    if (!record2(check) || !isStatus(check["status"]))
+      return [];
+    const remedy = record2(check["remedy"]) ? check["remedy"] : {};
+    return [
+      {
+        node,
+        id: text(check["id"], "check"),
+        status: check["status"],
+        summary: text(check["summary"]),
+        remedy: text(remedy["action"]),
+        command: text(remedy["command"])
+      }
+    ];
+  });
+}
+function isStatus(value) {
+  return ["pass", "warn", "fail", "skip"].includes(String(value));
+}
+function isCancellation(error) {
+  if (!record2(error))
+    return false;
+  return ["ExitPromptError", "AbortPromptError", "AbortError"].includes(text(error["name"]));
+}
+function absolutePath2(value) {
+  return value.startsWith("/") && value.length <= 4096 && !/[\x00-\x1f\x7f]/.test(value) || "Enter an absolute POSIX path (no ~ or control characters).";
+}
+var init_ui_data = __esm(() => {
+  init_search();
+});
+
+// packages/personal-cli/src/ui-repairs.ts
+function showRepairs(session, data) {
+  const catalog = data["command"] === "repairs";
+  const entries = data[catalog ? "recipes" : "steps"];
+  if (!Array.isArray(entries))
+    return;
+  const steps = entries.filter(record2);
+  session.display.table(["Computer / owner", "Repair", "Execution"], steps.slice(0, 15).map((step) => [
+    text(step[catalog ? "owner" : "node"]),
+    text(step["title"]),
+    step["automatic"] === true && (catalog || step["eligible"] === true) ? "Owner command after explicit apply" : "Operator action; inspect instructions"
+  ]));
+  if (steps.length > 15)
+    session.display.write(`Showing 15 of ${steps.length} repair entries. Inspect structured details for the complete plan and native login commands.`);
+  if (!catalog)
+    session.display.write(data["applied"] === true ? `Owner commands completed: ${text(data["completed"])}. Fresh health verified: ${data["healthOk"] === true ? "yes" : "no; review remaining checks"}.` : "Preview only. Review the repair effects and native login instructions in structured details before applying.");
+}
+var init_ui_repairs = __esm(() => {
+  init_ui_data();
+});
+
+// packages/personal-cli/src/ui-execute.ts
+async function execute2(session, args, title) {
+  session.display.write(`
+$ ${reproduction(session, args)}`);
+  const progress = session.display.progress(title);
+  try {
+    return await session.options.execute(callArgs(session, args));
+  } catch (error) {
+    if (isCancellation(error))
+      throw error;
+    return { exitCode: 1, data: { ok: false, code: "operation_failed" } };
+  } finally {
+    progress.stop();
+  }
+}
+function successful(outcome) {
+  return outcome.exitCode === 0 && !(record2(outcome.data) && outcome.data["ok"] === false);
+}
+function showOutcome(session, outcome) {
+  const checks = reportChecks(outcome.data);
+  const incomplete = checks.filter((check) => ["warn", "skip"].includes(check.status)).length;
+  const state = outcomeState(outcome, incomplete);
+  const counts = ["pass", "warn", "fail", "skip"].map((status) => `${checks.filter((check) => check.status === status).length} ${status}`);
+  session.display.panel(state, checks.length ? counts.join(" · ") : outcomeMessage(outcome));
+  showAttention(session, checks);
+  showData(session, outcome);
+  if (!successful(outcome))
+    session.display.write(record2(outcome.data) && outcome.data["applied"] === true ? "Actions were attempted. Review execution results, partial changes and fresh checks before retrying." : "No automatic repair was attempted. Review the command, context and setup.");
+}
+function outcomeMessage(outcome) {
+  if (!successful(outcome))
+    return failureMessage(outcome.data);
+  if (record2(outcome.data) && outcome.data["applied"] === false) {
+    return "Preview only — no changes applied. Review before explicitly authorizing a write.";
+  }
+  return "Command completed. Warnings and skipped checks are not passes.";
+}
+function failureMessage(data) {
+  if (!record2(data))
+    return "Operation failed. Raw errors and subprocess output are intentionally hidden.";
+  if (data["code"] === "invalid_usage" && typeof data["error"] === "string")
+    return clean(data["error"]);
+  const messages = {
+    invalid_usage: "Configuration or arguments need attention. Use Fleet setup, validate, or session context.",
+    config_missing: "No roster found. Add a node in Fleet setup, or run controller-only diagnostics.",
+    operation_failed: "Operation failed safely. Check connectivity and configuration before retrying."
+  };
+  return messages[String(data["code"])] ?? "Operation did not complete. Review setup and the noninteractive command.";
+}
+function showNodes(session, data) {
+  const nodes = Array.isArray(data["nodes"]) ? data["nodes"].filter(record2) : [];
+  if (!nodes.length) {
+    session.display.write("No computers registered yet. Choose Fleet: Register a developer computer to add one, or Fleet: Discover Tailscale computers.");
+    return;
+  }
+  session.display.table(["Computer", "SSH", "Workspace"], nodes.map((node) => [
+    text(node["id"]),
+    text(node["ssh"]),
+    text(node["workspace"])
+  ]));
+}
+function showComputers(session, data) {
+  const computers = Array.isArray(data["computers"]) ? data["computers"].filter(record2) : [];
+  session.display.table(["Computer", "OS", "Online"], computers.map((peer) => [
+    text(peer["dns"]),
+    text(peer["os"]),
+    peer["online"] === true ? "yes" : "no"
+  ]));
+  session.display.write("Visible Tailscale computers only; mobile devices excluded. Register each remote computer with its existing SSH alias and checkout path before full health checks.");
+}
+function showAttention(session, checks) {
+  const attention = checks.filter((check) => check.status !== "pass");
+  if (!attention.length)
+    return;
+  session.display.table(["Computer", "Check", "Status / next step"], attention.slice(0, 15).map((check) => [
+    check.node,
+    check.id,
+    `${check.status}: ${check.remedy ?? check.summary}`
+  ]));
+  if (attention.length > 15)
+    session.display.write(`Showing 15 of ${attention.length} checks needing attention. Explore checks and remedies for the complete report.`);
+}
+function showData(session, outcome) {
+  if (!record2(outcome.data))
+    return;
+  if (["repair", "repairs"].includes(String(outcome.data["command"])))
+    showRepairs(session, outcome.data);
+  if (successful(outcome) && outcome.data["command"] === "nodes")
+    showNodes(session, outcome.data);
+  if (outcome.data["command"] === "discover")
+    showComputers(session, outcome.data);
+}
+function outcomeState(outcome, incomplete) {
+  if (record2(outcome.data) && outcome.data["applied"] === false)
+    return "PREVIEW";
+  if (!successful(outcome))
+    return "FAILED";
+  return incomplete ? "WARNING" : "SUCCESS";
+}
+var init_ui_execute = __esm(() => {
+  init_ui_repairs();
+  init_ui_data();
+});
+
+// packages/personal-cli/src/ui-reports.ts
+async function inspectChecks(session, data) {
+  const checks = reportChecks(data);
+  let node = "*";
+  let status = "*";
+  while (true) {
+    const visible = checks.filter((check) => (node === "*" || check.node === node) && (status === "*" || check.status === status));
+    const choice = await session.prompts.search(`Report · ${visible.length}/${checks.length} checks · node ${node} · status ${status}`, (term) => checkChoices(visible, term));
+    if (choice === "back")
+      return;
+    if (choice === "node")
+      node = await nodeFilter(session, checks);
+    else if (choice === "status")
+      status = await statusFilter(session);
+    else {
+      const check = visible[Number(choice)];
+      if (check)
+        showCheck(session, check);
+    }
+  }
+}
+function checkChoices(checks, term) {
+  const choices = checks.flatMap((check, index) => {
+    const name = `${check.status.toUpperCase()} · ${check.node} · ${check.id}`;
+    return `${name} ${check.summary}`.toLowerCase().includes(term.toLowerCase()) ? [{ name, value: String(index), description: check.summary }] : [];
+  });
+  return [
+    ...choices.length ? choices : [
+      {
+        name: "No matching checks — change search or filters",
+        value: "none"
+      }
+    ],
+    { name: "Filter by node", value: "node" },
+    { name: "Filter by status", value: "status" },
+    { name: "Back to result", value: "back" }
+  ];
+}
+function nodeFilter(session, checks) {
+  return session.prompts.select("Node filter", [
+    { name: "All nodes", value: "*" },
+    ...[...new Set(checks.map((check) => check.node))].map((node) => ({
+      name: node,
+      value: node
+    }))
+  ]);
+}
+function statusFilter(session) {
+  return session.prompts.select("Status filter", [
+    { name: "All statuses (including warnings and skips)", value: "*" },
+    ...["fail", "warn", "skip", "pass"].map((status) => ({
+      name: status.toUpperCase(),
+      value: status
+    }))
+  ]);
+}
+function showCheck(session, check) {
+  session.display.panel(`${check.status.toUpperCase()} · ${check.node} · ${check.id}`, check.summary);
+  session.display.write(`Remedy: ${check.remedy || "No automated remedy. Review this check manually."}`);
+  if (check.command)
+    session.display.write(`Suggested operator command (not executed):
+${check.command}`);
+  session.display.write("Remedies are guidance only. Credentials, SSH and host-key configuration stay operator-owned.");
+}
+async function inspectDetails(session, data) {
+  const sections = detailSections(data);
+  if (!sections.length) {
+    session.display.write("No additional safe display fields. Use the reproducible command for the structured document.");
+    return;
+  }
+  let next = true;
+  while (next) {
+    const selection = await session.prompts.select("Details", [
+      ...sections.map((section, index) => ({
+        name: section.title,
+        value: String(index)
+      })),
+      { name: "Back to result", value: "back" }
+    ]);
+    const section = sections[Number(selection)];
+    if (selection === "back")
+      next = false;
+    else if (section)
+      session.display.panel(section.title, section.body);
+  }
+}
+function detailSections(data) {
+  if (!record2(data))
+    return [];
+  const sections = [
+    "help",
+    "guide",
+    "next",
+    "authorize",
+    "path",
+    "sshTemplate",
+    "workspaceCommand",
+    "verifyCommand",
+    "invocation",
+    "discovery"
+  ].flatMap((key) => typeof data[key] === "string" ? [{ title: key, body: text(data[key]) }] : []);
+  for (const key of ["steps", "targets", "safety", "examples"]) {
+    if (Array.isArray(data[key]))
+      sections.push(...data[key].flatMap((value, index) => typeof value === "string" ? [{ title: `${key} · ${index + 1}`, body: text(value) }] : []));
+  }
+  if (Array.isArray(data["nodes"]))
+    sections.push(...nodeSections(data["nodes"]));
+  if (Array.isArray(data["commands"]))
+    sections.push(...commandSections(data["commands"]));
+  for (const key of ["configuration", "output", "coverage"]) {
+    if (record2(data[key]))
+      sections.push({ title: key, body: safeFields(data[key]) });
+  }
+  if (typeof data["$schema"] === "string")
+    sections.push({
+      title: "JSON schema",
+      body: JSON.stringify(data, null, 2)
+    });
+  return sections;
+}
+function commandSections(commands) {
+  return commands.flatMap((command) => {
+    if (!record2(command))
+      return [];
+    return [
+      {
+        title: text(command["id"], "Command"),
+        body: [
+          text(command["title"]),
+          text(command["description"]),
+          ...Array.isArray(command["examples"]) ? command["examples"].map((value) => text(value)) : []
+        ].filter(Boolean).join(`
+`)
+      }
+    ];
+  });
+}
+function safeFields(value) {
+  return Object.entries(value).flatMap(([key, field]) => typeof field === "string" ? [`${key}: ${text(field)}`] : []).join(`
+`);
+}
+function nodeSections(nodes) {
+  return nodes.flatMap((node) => {
+    if (!record2(node))
+      return [];
+    const id = text(node["id"], text(node["node"], "Node"));
+    const body = ["id", "ssh", "workspace", "runtime"].flatMap((key) => typeof node[key] === "string" ? [`${key}: ${text(node[key])}`] : []);
+    if (Array.isArray(node["required"]))
+      body.push(`required: ${node["required"].map((value) => text(value)).join(", ") || "none"}`);
+    return [
+      ...body.length ? [{ title: id, body: body.join(`
+`) }] : [],
+      ...detailSections({
+        steps: node["steps"],
+        sshTemplate: node["sshTemplate"],
+        verifyCommand: node["verifyCommand"]
+      }).map((section) => ({
+        title: `${id} · ${section.title}`,
+        body: section.body
+      }))
+    ];
+  });
+}
+var init_ui_reports = __esm(() => {
+  init_ui_data();
+});
+
+// packages/personal-cli/src/ui-targets.ts
+async function chooseTargets(session, action) {
+  const selection = await session.prompts.select("Choose target scope", [
+    ...action === "onboard" ? [] : [
+      {
+        name: "Controller only / local",
+        value: "local",
+        description: "No roster or SSH required; uses this session workspace."
+      },
+      {
+        name: allTargetsName(action),
+        value: "all",
+        description: allTargetsDescription(action)
+      }
+    ],
+    { name: "Select roster nodes…", value: "selected" },
+    { name: "Back to palette", value: "back" }
+  ]);
+  if (selection === "back")
+    return;
+  if (selection === "local")
+    return ["--local"];
+  if (selection === "all" && action === "repair")
+    return [];
+  const nodes = await availableNodes(session);
+  if (!nodes.length)
+    return missingRoster2(session, action);
+  if (selection === "all")
+    return [];
+  const selected = await session.prompts.checkbox("Select nodes · space to toggle, enter to continue", nodes);
+  if (!selected.length) {
+    session.display.write("No nodes selected. Nothing ran; returning to the palette.");
+    return;
+  }
+  return selected.flatMap((id) => ["--node", id]);
+}
+async function availableNodes(session) {
+  const outcome = await execute2(session, ["fleet", "nodes"], "Reading local roster (no SSH)");
+  if (!successful(outcome)) {
+    showOutcome(session, outcome);
+    return [];
+  }
+  if (!record2(outcome.data) || !Array.isArray(outcome.data["nodes"]))
+    return [];
+  return outcome.data["nodes"].flatMap((node) => {
+    if (!record2(node) || typeof node["id"] !== "string")
+      return [];
+    return [
+      {
+        name: text(node["id"]),
+        value: node["id"],
+        description: `${text(node["ssh"])} · ${text(node["workspace"])}`
+      }
+    ];
+  });
+}
+async function missingRoster2(session, action) {
+  session.display.panel("Fleet setup needed", [
+    "No usable roster nodes. Return to Fleet setup / add node to register an existing computer.",
+    "Fleet init creates an EXAMPLE only; saving it requires --apply --yes. Edit its aliases and paths before use.",
+    "Controller-only doctor works without a roster or SSH. No login, host-key change or repair is automatic."
+  ].join(`
+`));
+  if (action !== "doctor")
+    return;
+  const choice = await session.prompts.select("Continue without a roster?", [
+    { name: "Run controller-only diagnostics", value: "local" },
+    { name: "Back to palette / Fleet setup", value: "back" }
+  ]);
+  return choice === "local" ? ["--local"] : undefined;
+}
+function allTargetsName(action) {
+  return action === "repair" ? "All visible Tailscale computers" : "All roster nodes";
+}
+function allTargetsDescription(action) {
+  if (action === "doctor")
+    return "Controller + every configured node; read-only.";
+  return action === "repair" ? "Inspect this controller and every visible computer; preview repairs before applying." : "Every configured remote checkout.";
+}
+var init_ui_targets = __esm(() => {
+  init_ui_execute();
+  init_ui_data();
+});
+
+// packages/personal-cli/src/ui-actions.ts
+async function runCommand2(session, command) {
+  session.display.panel(clean(command.title), clean(command.description));
+  const args = await actionArgs(session, command);
+  if (!args)
+    return;
+  const preview = args[0] === "fleet" && ["sync", "init", "repair"].includes(args[1] ?? "");
+  if (args[1] === "init")
+    session.display.write("EXAMPLE ONLY: init previews a starter roster, not a configured fleet. Saving requires --apply --yes.");
+  const mutation = !preview && (command.mutation || args.includes("--apply"));
+  if (mutation && !await confirmMutation(session, args))
+    return;
+  await runWithResults(session, args, command.title, { preview, mutation });
+}
+async function actionArgs(session, command) {
+  const args = [...command.args];
+  if (args[0] !== "fleet")
+    return args;
+  if (args.includes("--local"))
+    return args;
+  const action = args[1] ?? "";
+  if (["sync", "init", "repair"].includes(action)) {
+    const preview = args.filter((arg) => !["--apply", "--yes"].includes(arg));
+    if (action === "init")
+      return preview;
+    const targets = await chooseTargets(session, action);
+    return targets ? [...preview, ...targets] : undefined;
+  }
+  if (!["doctor", "onboard"].includes(action))
+    return args;
+  const targets = await chooseTargets(session, action);
+  return targets ? [...args, ...targets] : undefined;
+}
+async function runWithResults(session, initialArgs, title, settings = {}) {
+  let args = initialArgs;
+  let outcome = await execute2(session, args, title);
+  let preview = settings.preview === true;
+  let mutation = settings.mutation === true;
+  while (true) {
+    showOutcome(session, outcome);
+    const selection = await session.prompts.select("Next step", resultChoices(outcome, preview));
+    if (selection === "back")
+      return;
+    await inspectSelection(session, outcome, selection);
+    if (selection === "apply") {
+      const appliedArgs = applyArgs(args, outcome);
+      if (!await confirmMutation(session, appliedArgs))
+        continue;
+      args = appliedArgs;
+      preview = false;
+      mutation = true;
+      outcome = await execute2(session, args, title);
+    }
+    if (selection === "retry") {
+      if (mutation && !await confirmMutation(session, args))
+        continue;
+      outcome = await execute2(session, args, title);
+    }
+  }
+}
+async function inspectSelection(session, outcome, selection) {
+  if (selection === "checks")
+    await inspectChecks(session, outcome.data);
+  if (selection === "details")
+    await inspectDetails(session, outcome.data);
+}
+function resultChoices(outcome, preview) {
+  return [
+    { name: "Back to commands", value: "back" },
+    ...reportChecks(outcome.data).length ? [{ name: "Explore checks and remedies…", value: "checks" }] : [],
+    { name: "Inspect structured details / plan…", value: "details" },
+    ...preview && successful(outcome) ? [{ name: "Review and explicitly apply…", value: "apply" }] : [],
+    ...!successful(outcome) ? [{ name: "Retry command…", value: "retry" }] : []
+  ];
+}
+async function confirmMutation(session, args) {
+  const action = args[1];
+  const warning = action === "repair" ? "Repair runs the eligible owner actions in the displayed plan, including trusted setup/install scripts. Workstation actions may read this machine’s Vault session and write managed 0600 provider configuration. No login session is transferred between computers. Failures can leave partial changes; fresh diagnostics follow." : action === "sync" ? "Sync runs trusted checkout lifecycle scripts and installs tools/dependencies. Failure can leave partial changes; remote installers may continue after disconnect. Inspect the node before retrying. No automatic repairs or credentials." : "This writes the local roster only. No cloud resources, SSH configuration, credentials or host keys are changed.";
+  session.display.panel("Explicit approval required", [
+    action === "init" ? "Create an EXAMPLE roster only. Replace sample aliases and paths before diagnostics." : warning,
+    `Workspace: ${clean(session.workspace ?? session.options.workspace)}`,
+    `Config: ${clean(session.config ?? session.options.config)}`,
+    `$ ${reproduction(session, args)}`
+  ].join(`
+`));
+  return session.prompts.confirm("Apply this exact command? (default: no)");
+}
+function applyArgs(args, outcome) {
+  const guard = args[1] === "repair" && record2(outcome.data) && typeof outcome.data["planHash"] === "string" ? ["--plan-hash", outcome.data["planHash"]] : [];
+  return [...args, ...guard, "--apply", "--yes"];
+}
+var init_ui_actions = __esm(() => {
+  init_ui_execute();
+  init_ui_data();
+  init_ui_reports();
+  init_ui_targets();
+});
+
+// packages/personal-cli/src/ui-wizard.ts
+async function addNode2(session) {
+  showIntro(session);
+  await registerNode(session);
+}
+function showIntro(session) {
+  session.display.panel("Fleet setup / add node", [
+    "Register an EXISTING computer in your local secret-free roster.",
+    "Use a previously verified SSH alias. This wizard never connects, provisions, logs in or changes host keys.",
+    "Cancel with Ctrl+C. No write occurs until you approve the preview."
+  ].join(`
+`));
+}
+async function registerNode(session) {
+  const id = await session.prompts.input("Node ID (lowercase, e.g. dev-linux)", "", validId);
+  const alias = await session.prompts.input("Existing SSH alias / hostname", id, validAlias);
+  const workspace = await session.prompts.input("Absolute POSIX workspace on the node", "", absolutePath2);
+  const runtime = await session.prompts.input("Optional absolute Node/Bun executable (blank = node on SSH PATH)", "", (value) => value === "" || absolutePath2(value));
+  const capabilities = await session.prompts.checkbox("Required capabilities · space to toggle", CAPABILITIES2.map((capability) => ({
+    name: capability,
+    value: capability,
+    checked: capability !== "vscode"
+  })));
+  const args = [
+    "fleet",
+    "add",
+    "--id",
+    id,
+    "--ssh",
+    alias,
+    "--path",
+    workspace,
+    ...runtime ? ["--runtime", runtime] : [],
+    "--require",
+    capabilities.join(",") || "none",
+    "--apply",
+    "--yes"
+  ];
+  session.display.table(["Field", "Preview"], [
+    ["ID", clean(id)],
+    ["SSH", clean(alias)],
+    ["Workspace", clean(workspace)],
+    ["Runtime", clean(runtime) || "node (remote non-login PATH)"],
+    ["Required", capabilities.join(", ") || "none"]
+  ]);
+  session.display.write(`$ ${reproduction(session, args)}`);
+  if (!await confirmMutation(session, args)) {
+    session.display.write("Cancelled — no roster was written.");
+    return;
+  }
+  await runWithResults(session, args, "Saving roster node (no SSH)", {
+    mutation: true
+  });
+  session.display.write("Next: fleet validate, then fleet onboard for operator-owned SSH / authentication guidance.");
+}
+function validId(value) {
+  return /^[a-z][a-z0-9-]{0,62}$/.test(value) || "Use 1–63 lowercase letters, digits or hyphens; start with a letter.";
+}
+function validAlias(value) {
+  return /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$/.test(value) || "Use an existing plain SSH alias/hostname; no user@host, options or ports.";
+}
+var CAPABILITIES2;
+var init_ui_wizard = __esm(() => {
+  init_ui_actions();
+  init_ui_data();
+  CAPABILITIES2 = ["github", "vault", "t3", "vscode", "toolchain"];
+});
+
+// packages/personal-cli/src/ui-controller.ts
+async function runInteractive(options, prompts, display) {
+  const session = { options, prompts, display };
+  showHeader(session);
+  let running = true;
+  while (running) {
+    try {
+      const choice = await prompts.search("Command palette · type to search · arrows + enter", (term) => paletteChoices(session, term));
+      running = await dispatch(session, choice);
+    } catch (error) {
+      if (isCancellation(error)) {
+        display.write(`
+Goodbye. No further actions will run.`);
+        throw error;
+      }
+      display.write("The interactive session could not continue safely. Use personal commands --json for noninteractive help.");
+      throw new Error("Interactive session failed safely.");
+    }
+  }
+  display.write("Goodbye. Session context was not saved.");
+}
+function showHeader(session) {
+  session.display.panel(`personal · ${clean(session.options.version)} · operator console`, [
+    "Your developer fleet, without the guesswork.",
+    `Workspace: ${clean(session.workspace ?? session.options.workspace)}`,
+    `Config: ${clean(session.config ?? session.options.config)}`,
+    "Read-only first · explicit writes · no automatic repairs",
+    "Search IDs, keywords or descriptions. Ctrl+C exits safely. Nothing is cleared."
+  ].join(`
+`));
+}
+function paletteChoices(session, term) {
+  const commands = commandChoices(session.options.commands, term);
+  const navigation = [
+    {
+      name: "Session: Workspace / config…",
+      value: "context",
+      description: "Session-only overrides; no hidden configuration writes."
+    },
+    { name: "Exit", value: "exit", description: "Close the command palette." }
+  ].filter((choice) => `${choice.name} ${choice.description}`.toLowerCase().includes(term.toLowerCase().trim()));
+  const choices = [...navigation, ...commands].sort((a, b) => a.name.localeCompare(b.name, "en"));
+  return choices.length ? choices : [{ name: "No matching commands — change search", value: "none" }];
+}
+async function dispatch(session, choice) {
+  if (choice === "exit")
+    return false;
+  if (choice === "context")
+    await changeContext(session);
+  if (choice.startsWith("command:"))
+    await openCommand(session, choice.slice(8));
+  return true;
+}
+async function openCommand(session, id) {
+  const command = session.options.commands.find((entry) => entry.id === id);
+  if (!command)
+    return;
+  if (command.args[0] === "fleet" && command.args[1] === "add")
+    await addNode2(session);
+  else
+    await runCommand2(session, command);
+}
+async function changeContext(session) {
+  session.display.write("Session only. Blank inputs reset to startup defaults; no file is written.");
+  const workspace = await session.prompts.input("Workspace override", session.workspace ?? "", validContext);
+  const config = await session.prompts.input("Config override", session.config ?? "", validContext);
+  if (workspace)
+    session.workspace = workspace;
+  else
+    delete session.workspace;
+  if (config)
+    session.config = config;
+  else
+    delete session.config;
+  showHeader(session);
+}
+function validContext(value) {
+  return !/[\x00-\x1f\x7f]/.test(value) || "Control characters are not allowed in paths.";
+}
+var init_ui_controller = __esm(() => {
+  init_ui_actions();
+  init_ui_data();
+  init_ui_wizard();
+});
+
+// packages/personal-cli/src/ui-terminal.ts
+import { checkbox, confirm, input, search, select } from "@inquirer/prompts";
+import { Chalk } from "chalk";
+import ora from "ora";
+import boxen from "boxen";
+import Table from "cli-table3";
+function plainTerminal() {
+  return process.env["NO_COLOR"] !== undefined || process.env["TERM"] === "dumb";
+}
+function pageSize() {
+  return Math.max(3, Math.min(10, (process.stderr.rows || 24) - 10));
+}
+function terminalPrompts() {
+  const context = { output: process.stderr, clearPromptOnDone: false };
+  return {
+    select: (message, choices) => select({ message, choices, pageSize: pageSize(), loop: false }, context),
+    search: (message, source) => search({
+      message,
+      source: (term) => source(term ?? ""),
+      pageSize: pageSize(),
+      theme: { style: { highlight: (value) => value } }
+    }, context),
+    checkbox: (message, choices) => checkbox({ message, choices, pageSize: pageSize(), loop: false }, context),
+    input: (message, initial = "", validate = () => true) => input({ message, default: initial, validate }, context),
+    confirm: (message) => confirm({ message, default: false }, context)
+  };
+}
+function terminalDisplay() {
+  const color = new Chalk({
+    level: !plainTerminal() && process.stderr.isTTY ? 1 : 0
+  });
+  const write = (message) => {
+    process.stderr.write(`${message}
+`);
+  };
+  return {
+    write,
+    panel: (title, body) => {
+      const content = `${color.bold(clean(title))}
+${body}`;
+      if ((process.stderr.columns || 80) < 48 || plainTerminal()) {
+        write(`
+${content}
+`);
+        return;
+      }
+      write(boxen(content, {
+        padding: 1,
+        borderStyle: "round",
+        ...color.level ? { borderColor: "cyan" } : {},
+        width: Math.min(process.stderr.columns || 80, 96)
+      }));
+    },
+    table: (headers, rows) => drawTable(write, headers, rows),
+    progress: (message) => {
+      const spinner = ora({
+        text: message,
+        stream: process.stderr,
+        isEnabled: Boolean(process.stderr.isTTY) && !plainTerminal(),
+        isSilent: !process.stderr.isTTY || plainTerminal(),
+        discardStdin: false
+      });
+      if (spinner.isEnabled)
+        spinner.start();
+      else
+        write(`… ${message}`);
+      return {
+        stop: () => {
+          spinner.stop();
+        }
+      };
+    }
+  };
+}
+function drawTable(write, headers, rows) {
+  if ((process.stderr.columns || 80) < 64 || plainTerminal()) {
+    rows.forEach((row) => write(row.map((cell) => clean(cell)).join(" · ")));
+    return;
+  }
+  const width = Math.floor(((process.stderr.columns || 80) - headers.length * 3 - 1) / headers.length);
+  const table = new Table({
+    head: headers,
+    colWidths: headers.map(() => Math.max(8, width)),
+    wordWrap: true,
+    style: { head: [], border: [] }
+  });
+  table.push(...rows.map((row) => row.map((cell) => clean(cell))));
+  write(table.toString());
+}
+var init_ui_terminal = __esm(() => {
+  init_ui_data();
+});
+
+// packages/personal-cli/src/ui.ts
+async function startInteractive(options) {
+  await runInteractive(options, terminalPrompts(), terminalDisplay());
+}
+var init_ui = __esm(() => {
+  init_ui_controller();
+  init_ui_terminal();
+});
+
+// packages/personal-cli/src/workstation.ts
+import { join } from "node:path";
+
+// packages/fleet/src/runner.ts
+import { spawn } from "node:child_process";
+var MAX_OUTPUT_BYTES = 1024 * 1024;
+function terminate(child) {
+  try {
+    if (process.platform !== "win32" && child.pid)
+      process.kill(-child.pid, "SIGKILL");
+    else
+      child.kill("SIGKILL");
+  } catch {}
+}
+function runCommand(command, options = {}) {
+  return new Promise((resolve) => {
+    const child = spawn(command[0], command.slice(1), {
+      cwd: options.cwd,
+      env: {
+        ...process.env,
+        ...options.env,
+        GIT_TERMINAL_PROMPT: "0",
+        CI: "1"
+      },
+      stdio: "pipe",
+      windowsHide: true,
+      detached: process.platform !== "win32"
+    });
+    let stdout = "";
+    let stderr = "";
+    let bytes = 0;
+    let finished = false;
+    let reason = "exit";
+    const finish = (ok) => {
+      if (finished)
+        return;
+      finished = true;
+      clearTimeout(timer);
+      child.stdin.destroy();
+      child.stdout.destroy();
+      child.stderr.destroy();
+      resolve({ ok, stdout, stderr, reason });
+    };
+    const abort = (cause) => {
+      reason = cause;
+      terminate(child);
+      finish(false);
+    };
+    const timer = setTimeout(() => {
+      abort("timeout");
+    }, options.timeoutMs ?? 15000);
+    const capture = (stream, chunk) => {
+      if (finished)
+        return;
+      bytes += Buffer.byteLength(chunk);
+      if (bytes > MAX_OUTPUT_BYTES) {
+        abort("overflow");
+        return;
+      }
+      if (stream === "stdout")
+        stdout += chunk;
+      else
+        stderr += chunk;
+    };
+    child.stdout.setEncoding("utf8").on("data", (chunk) => capture("stdout", chunk));
+    child.stderr.setEncoding("utf8").on("data", (chunk) => capture("stderr", chunk));
+    child.stdin.on("error", () => {
+      return;
+    });
+    child.on("error", () => {
+      abort("missing");
+    });
+    child.on("close", (code) => {
+      finish(code === 0 && reason === "exit");
+    });
+    child.stdin.end(options.input);
+  });
+}
+
+// packages/personal-cli/src/workstation.ts
+async function workstationCommand(args, settings) {
+  const help = args.length === 0 || args.includes("--help");
+  const result = await runCommand([
+    "bun",
+    join(settings.workspace, "packages/workstation/cli/internal.ts"),
+    ...help ? [...args, "--help"] : [...args, "--json", "--non-interactive"]
+  ], { cwd: settings.workspace, timeoutMs: 1200000 });
+  if (help && result.ok)
+    return {
+      exitCode: 0,
+      data: { version: 1, help: result.stdout },
+      text: result.stdout
+    };
+  if (result.ok) {
+    try {
+      return { exitCode: 0, data: JSON.parse(result.stdout) };
+    } catch {}
+  }
+  return {
+    exitCode: 1,
+    data: {
+      version: 1,
+      ok: false,
+      error: "Workstation operation failed. Check the personal checkout, Bun, conflicts and per-machine authentication."
+    }
+  };
+}
+async function forwardWorkstation(args, settings) {
+  const { spawn } = await import("node:child_process");
+  const childArgs = [];
+  let commandSeen = false;
+  for (let index = 0;index < args.length; index++) {
+    if (["--workspace", "--config"].includes(args[index])) {
+      index++;
+      continue;
+    }
+    if (args[index] === "workstation" && !commandSeen) {
+      commandSeen = true;
+      continue;
+    }
+    childArgs.push(args[index]);
+  }
+  return new Promise((resolve) => {
+    const child = spawn("bun", [
+      join(settings.workspace, "packages/workstation/cli/internal.ts"),
+      ...childArgs.length ? childArgs : ["--help"]
+    ], {
+      cwd: settings.workspace,
+      stdio: "inherit",
+      env: process.env
+    });
+    child.on("error", () => {
+      process.stderr.write(`Workstation requires the personal checkout and shared Bun toolchain.
+`);
+      resolve(1);
+    });
+    child.on("exit", (code) => resolve(code ?? 1));
+  });
+}
+
+// packages/personal-cli/src/settings.ts
+import { access } from "node:fs/promises";
+import { dirname, join as join2, resolve } from "node:path";
+import { homedir } from "node:os";
+async function exists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function findUp(start, name) {
+  let current = resolve(start);
+  while (true) {
+    if (await exists(join2(current, name)))
+      return join2(current, name);
+    const parent = dirname(current);
+    if (parent === current)
+      return null;
+    current = parent;
+  }
+}
+async function resolveSettings(overrides = {}, cwd = process.cwd(), env = process.env) {
+  const workspace = resolve(overrides.workspace ?? env["PERSONAL_WORKSPACE"] ?? dirname(await findUp(cwd, "mise.toml") ?? join2(cwd, "mise.toml")));
+  const config = resolve(overrides.config ?? env["PERSONAL_FLEET_CONFIG"] ?? await findUp(cwd, ".fleet.local.json") ?? join2(homedir(), ".config/personal/fleet.json"));
+  return { workspace, config };
+}
+
+// packages/personal-cli/src/node-deployment.ts
+import { join as join3 } from "node:path";
+
+// packages/personal-cli/src/t3/files.ts
+import {
+  lstat,
+  mkdir,
+  readFile,
+  rename,
+  rm,
+  writeFile
+} from "node:fs/promises";
+import { dirname as dirname2, parse } from "node:path";
+import { randomUUID, createHash } from "node:crypto";
+
+// packages/fleet/src/errors.ts
+class FleetUsageError extends Error {
+}
+
+// packages/personal-cli/src/t3/files.ts
+var hash = (value) => createHash("sha256").update(value).digest("hex");
+async function safePath(path) {
+  for (let current = path;current !== parse(current).root; current = dirname2(current)) {
+    try {
+      if ((await lstat(current)).isSymbolicLink())
+        throw new FleetUsageError("Managed T3 paths cannot be symlinks.");
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+  }
+}
+async function read(path) {
+  await safePath(path);
+  try {
+    const info = await lstat(path);
+    if (!info.isFile() || info.size > 4 * 1024 * 1024)
+      throw new FleetUsageError("T3 configuration must be a regular file smaller than 4 MiB.");
+    return await readFile(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw error;
+  }
+}
+async function write(path, contents) {
+  await safePath(path);
+  await mkdir(dirname2(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, contents, { mode: 384, flag: "wx" });
+    await rename(temporary, path);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+function object(raw) {
+  if (raw === null)
+    return {};
+  try {
+    const value = JSON.parse(raw);
+    if (value && typeof value === "object" && !Array.isArray(value))
+      return value;
+  } catch {}
+  throw new FleetUsageError("Invalid T3 JSON object. Repair the file before reconciliation.");
+}
+function canonical(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+
+// packages/personal-cli/src/node-deployment.ts
+async function deployment(root) {
+  const raw = await read(join3(root, "node_modules/.personal-node.json"));
+  if (raw === null)
+    return null;
+  const data = object(raw);
+  if (data["version"] !== 1 || typeof data["revision"] !== "string" || !/^[a-f0-9]{40}$/.test(data["revision"]) || typeof data["node"] !== "string" || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(data["node"]))
+    throw new FleetUsageError("Invalid local node receipt. Restore it before reconciling.");
+  return {
+    workspace: join3(root, "node_modules/.fleet-revisions", data["revision"]),
+    node: data["node"],
+    revision: data["revision"]
+  };
+}
+async function recordDeployment(root, node, revision) {
+  const path = join3(root, "node_modules/.personal-node.json");
+  const content = JSON.stringify({ version: 1, node, revision }) + `
+`;
+  if (await read(path) !== content)
+    await write(path, content);
+}
+
+// packages/personal-cli/src/t3/desired.ts
+import { join as join4, resolve as resolve2 } from "node:path";
+import { homedir as homedir2, hostname } from "node:os";
+function nodeId(value) {
+  const id = value ?? hostname().toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 63);
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(id))
+    throw new FleetUsageError("Invalid node ID. Use --id NAME.");
+  return id;
+}
+function paths(options, workspace) {
+  const base = resolve2(options.t3Home ?? process.env["T3CODE_HOME"] ?? join4(homedir2(), ".t3"));
+  return {
+    settings: join4(base, "userdata/settings.json"),
+    state: join4(base, "userdata/personal-managed.json"),
+    definition: resolve2(options.definition ?? join4(workspace, "packages/workstation/agents/t3.json"))
+  };
+}
+async function desired(path, workspace, id) {
+  const raw = await read(path);
+  if (raw === null)
+    throw new FleetUsageError("T3 definition is missing in this checkout.");
+  const doc = object(raw);
+  if (doc["version"] !== 1 || Object.keys(doc).some((key) => !["version", "instances"].includes(key)))
+    throw new FleetUsageError("Unsupported T3 definition. Expected version 1 and instances.");
+  const instances = object(JSON.stringify(doc["instances"] ?? null));
+  for (const [key, value] of Object.entries(instances))
+    validateInstance(key, value);
+  const agents = process.platform === "win32" ? join4(homedir2(), "AppData/Local/personal/agents") : join4(homedir2(), ".config/personal/agents");
+  const variables = {
+    workspace: resolve2(workspace),
+    agents,
+    node: id
+  };
+  return expand(instances, variables);
+}
+function expand(value, variables) {
+  if (typeof value === "string")
+    return value.replace(/\$\{([^}]+)\}/g, (_, key) => {
+      if (!(key in variables))
+        throw new FleetUsageError("Unknown variable in T3 definition.");
+      return variables[key];
+    });
+  if (Array.isArray(value))
+    return value.map((item) => expand(item, variables));
+  if (value && typeof value === "object")
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, expand(item, variables)]));
+  return value;
+}
+function validateInstance(id, value) {
+  const instance = object(JSON.stringify(value));
+  const config = object(JSON.stringify(instance["config"]));
+  const env = instance["environment"];
+  if (!/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/.test(id) || instance["driver"] !== "codex" || typeof instance["displayName"] !== "string" || typeof instance["enabled"] !== "boolean" || Object.keys(instance).some((key) => !["driver", "displayName", "enabled", "config", "environment"].includes(key)) || !validConfig(config) || !validEnvironment(env))
+    throw new FleetUsageError("Invalid T3 instance definition; only the supported Codex adapter fields are accepted.");
+}
+function validConfig(config) {
+  return Object.keys(config).every((key) => ["binaryPath", "homePath"].includes(key)) && typeof config["binaryPath"] === "string" && typeof config["homePath"] === "string";
+}
+function validEnvironment(env) {
+  if (!Array.isArray(env) || env.length !== 1)
+    return false;
+  const variable = object(JSON.stringify(env[0]));
+  return variable["name"] === "WS_AGENT_NODE" && variable["value"] === "${node}" && variable["sensitive"] === false && Object.keys(variable).length === 3;
+}
+
+// packages/personal-cli/src/t3/reconcile.ts
+import { mkdir as mkdir2, rm as rm2 } from "node:fs/promises";
+import { dirname as dirname3 } from "node:path";
+
+// packages/personal-cli/src/t3/plan.ts
+async function planT3(paths, desired) {
+  const raw = await read(paths.settings);
+  const stateRaw = await read(paths.state);
+  const settings = object(raw);
+  const current = object(JSON.stringify(settings["providerInstances"] ?? {}));
+  const owned = readOwnership(stateRaw, paths.settings);
+  const next = { ...current };
+  const changes = [];
+  for (const [id, instance] of Object.entries(desired)) {
+    const exists = Object.hasOwn(current, id);
+    const action = actionFor(exists, owned.includes(id), current[id], instance);
+    changes.push({ id, action });
+    if (action !== "conflict")
+      next[id] = instance;
+  }
+  for (const id of owned.filter((id) => !Object.hasOwn(desired, id))) {
+    changes.push({
+      id,
+      action: Object.hasOwn(current, id) ? "delete" : "unchanged"
+    });
+    delete next[id];
+  }
+  const settingsChanged = canonical(next) !== canonical(current);
+  const state = ownership(paths.settings, Object.keys(desired));
+  return {
+    raw,
+    stateRaw,
+    settings: settingsChanged ? { ...settings, providerInstances: next } : settings,
+    state,
+    settingsChanged,
+    stateChanged: canonical(object(stateRaw)) !== canonical(state),
+    changes,
+    planHash: hash(canonical({ target: paths.settings, raw, stateRaw, desired }))
+  };
+}
+function ownership(target, ids) {
+  return { version: 1, target, instances: [...ids].sort() };
+}
+function readOwnership(raw, target) {
+  if (raw === null)
+    return [];
+  const state = object(raw);
+  const ids = state["instances"];
+  if (state["version"] !== 1 || state["target"] !== target || !Array.isArray(ids) || ids.some((id) => typeof id !== "string" || !/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/.test(id)) || new Set(ids).size !== ids.length)
+    throw new FleetUsageError("Invalid T3 ownership state; restore its backup before reconciliation.");
+  return ids;
+}
+function actionFor(exists, owned, current, desired) {
+  if (exists && !owned)
+    return "conflict";
+  if (!exists)
+    return "create";
+  return canonical(current) === canonical(desired) ? "unchanged" : "update";
+}
+
+// packages/personal-cli/src/t3/reconcile.ts
+async function reconcileT3(paths, desired, options) {
+  if (!options.apply)
+    return report(await planT3(paths, desired), false);
+  return locked(paths, async () => {
+    const plan = await planT3(paths, desired);
+    if (options.planHash && options.planHash !== plan.planHash)
+      throw new FleetUsageError("T3 plan is stale. Run personal t3-plan again.");
+    if (plan.changes.some((change) => change.action === "conflict"))
+      throw new FleetUsageError("T3 instance already exists without ownership. Review it and use personal t3-import --instance ID.");
+    if (!plan.settingsChanged && !plan.stateChanged)
+      return report(plan, true);
+    await persist(paths, desired, plan);
+    const verified = await planT3(paths, desired);
+    if (verified.settingsChanged || verified.stateChanged)
+      throw new FleetUsageError("T3 changed after apply; reconciliation is incomplete. Replan and retry.");
+    return report(plan, true);
+  });
+}
+async function importT3(paths, id) {
+  return locked(paths, async () => {
+    const raw = await read(paths.settings);
+    const instances = object(JSON.stringify(object(raw)["providerInstances"] ?? {}));
+    if (!Object.hasOwn(instances, id))
+      throw new FleetUsageError("T3 import requires an existing instance ID.");
+    const state = await read(paths.state);
+    const owned = readOwnership(state, paths.settings);
+    if (!owned.includes(id)) {
+      if (state !== null)
+        await write(`${paths.state}.backup`, state);
+      if (await read(paths.settings) !== raw)
+        throw new FleetUsageError("T3 changed during import; retry.");
+      await write(paths.state, canonical(ownership(paths.settings, [...owned, id])) + `
+`);
+    }
+    return { version: 1, ok: true, imported: id, changed: !owned.includes(id) };
+  });
+}
+async function locked(paths, action) {
+  await safePath(paths.state);
+  await mkdir2(dirname3(paths.state), { recursive: true, mode: 448 });
+  const lock = `${paths.state}.lock`;
+  try {
+    await mkdir2(lock, { mode: 448 });
+  } catch {
+    throw new FleetUsageError("Another personal T3 operation holds the lock. Inspect interrupted operations before removing a stale lock.");
+  }
+  try {
+    return await action();
+  } finally {
+    await rm2(lock, { recursive: true });
+  }
+}
+function report(plan, applied) {
+  return {
+    version: 1,
+    ok: !plan.changes.some((change) => change.action === "conflict"),
+    applied,
+    changed: plan.settingsChanged || plan.stateChanged,
+    planHash: plan.planHash,
+    changes: plan.changes,
+    runtime: "T3 watches settings.json; new sessions use the reconciled instances. Active sessions are not restarted."
+  };
+}
+async function persist(paths, desired, plan) {
+  if (plan.raw !== null && plan.settingsChanged)
+    await write(`${paths.state}.settings-backup`, plan.raw);
+  if (plan.stateRaw !== null)
+    await write(`${paths.state}.backup`, plan.stateRaw);
+  if (await read(paths.settings) !== plan.raw || await read(paths.state) !== plan.stateRaw)
+    throw new FleetUsageError("T3 configuration changed during apply. Replan and retry.");
+  const previous = readOwnership(plan.stateRaw, paths.settings);
+  await write(paths.state, canonical(ownership(paths.settings, [
+    ...new Set([...previous, ...Object.keys(desired)])
+  ])) + `
+`);
+  if (plan.settingsChanged) {
+    if (await read(paths.settings) !== plan.raw)
+      throw new FleetUsageError("T3 changed during apply. Ownership intent was saved; replan and retry.");
+    await write(paths.settings, JSON.stringify(plan.settings, null, 2) + `
+`);
+  }
+  await write(paths.state, canonical(plan.state) + `
+`);
+}
+
+// packages/personal-cli/src/t3/command.ts
+async function t3Command(command, options, settings) {
+  const deployed = options.definition ? null : await deployment(settings.workspace);
+  const workspace = deployed?.workspace ?? settings.workspace;
+  const target = paths(options, workspace);
+  if (command === "t3-import")
+    return importCommand(target, options);
+  const instances = command === "t3-cleanup" ? {} : await desired(target.definition, workspace, nodeId(options.id ?? deployed?.node));
+  const apply = shouldApply(command, options);
+  if (apply)
+    requireSupportedPlatform(instances);
+  const data = await reconcileT3(target, instances, {
+    apply,
+    ...options.planHash ? { planHash: options.planHash } : {}
+  });
+  return {
+    exitCode: outcomeCode(command, data),
+    data: { command, ...data }
+  };
+}
+async function importCommand(target, options) {
+  if (options.dryRun)
+    throw new FleetUsageError("t3-import is an explicit ownership operation; inspect t3-plan first.");
+  if (!options.instance || !/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/.test(options.instance))
+    throw new FleetUsageError("t3-import requires --instance ID. Import authorizes management of that entire provider instance.");
+  return { exitCode: 0, data: await importT3(target, options.instance) };
+}
+function shouldApply(command, options) {
+  return ["t3-apply", "t3-cleanup"].includes(command) && !options.dryRun;
+}
+function outcomeCode(command, data) {
+  return !data.ok || command === "t3-status" && data.changed ? 1 : 0;
+}
+function requireSupportedPlatform(instances) {
+  if (process.platform === "win32" && Object.keys(instances).length)
+    throw new FleetUsageError("Managed Codex proxy execution requires macOS/Linux/WSL; native Windows settings were preserved.");
+}
+
+// packages/personal-cli/src/t3/register.ts
+var T3_COMMANDS = [
+  ["t3-plan", "Preview creates, updates and owned removals"],
+  ["t3-apply", "Reconcile declared T3 provider instances"],
+  ["t3-status", "Check managed T3 configuration for drift"],
+  [
+    "t3-cleanup",
+    "Remove only provider instances recorded in personal ownership state"
+  ],
+  ["t3-import", "Adopt an existing provider instance into personal ownership"]
+];
+function registerT3(program, defaults, complete) {
+  for (const [name, description] of T3_COMMANDS) {
+    program.command(name).description(description).option("--id <name>", "Node ID; defaults to hostname").option("--t3-home <path>", "T3 base directory; defaults to T3CODE_HOME or ~/.t3").option("--definition <path>", "Version 1 declarative T3 provider definition").option("--plan-hash <sha256>", "Reject any changes since the reviewed plan").option("--dry-run", "Preview without writing configuration or state").option("--instance <id>", "Existing instance to adopt with t3-import").action(async (_options, command) => {
+      const options = command.optsWithGlobals();
+      const settings = await resolveSettings({ ...defaults, ...options });
+      complete(await t3Command(name, options, settings));
+    });
+  }
+}
+
+// packages/personal-cli/src/registry.ts
+init_search();
+function fleet(command, title, description, keywords) {
+  return {
+    id: `fleet ${command}`,
+    title,
+    description,
+    group: "Fleet",
+    keywords,
+    args: ["fleet", command],
+    examples: [`personal fleet ${command} --json`],
+    mutation: ["add", "sync", "init", "repair"].includes(command)
+  };
+}
+var COMMANDS = [
+  ...T3_COMMANDS.map(([id, description]) => ({
+    id,
+    title: description,
+    description,
+    group: "T3",
+    keywords: ["t3", "configuration", "terraform", "drift"],
+    args: [id],
+    examples: [`personal ${id} --json`],
+    mutation: ["t3-apply", "t3-cleanup", "t3-import"].includes(id)
+  })),
+  {
+    id: "workstation",
+    title: "Workstation configuration",
+    description: "Tools, editor configuration, agent profiles, notifications and launcher lifecycle.",
+    group: "Workstation",
+    keywords: ["tools", "agents", "opencode", "install"],
+    args: ["workstation"],
+    examples: ["personal workstation --help"],
+    mutation: false
+  },
+  ...[
+    [
+      "fleet-node-sync",
+      "Sync this node",
+      "Upsert and reconcile locked tools and the Codex proxy profile on this machine. Applies by default; --dry-run previews."
+    ],
+    [
+      "fleet-status",
+      "Fleet status",
+      "Check this machine and all registered computers without changing them."
+    ],
+    [
+      "fleet-discover",
+      "Discover computers",
+      "List computers visible through Tailscale."
+    ]
+  ].map(([id, title, description]) => ({
+    id,
+    title,
+    description,
+    group: "Fleet",
+    keywords: ["node", "sync", "proxy", "status"],
+    args: [id],
+    examples: [`personal ${id} --json`],
+    mutation: id === "fleet-node-sync"
+  })),
+  fleet("repairs", "Explore repairs and login commands", "List existing tool owners, automated repairs, native per-machine login commands and shared Vault access guidance. No roster or credentials required.", ["fix", "repair", "login", "credentials", "sharing", "vault", "resources"]),
+  fleet("repair", "Repair tools and configuration", "Inspect visible Tailscale computers and preview owner-managed repairs. --apply --yes executes eligible tools/config repairs and reruns diagnostics. Logins and host trust remain explicit operator steps.", [
+    "fix",
+    "repair",
+    "sync",
+    "setup",
+    "versions",
+    "config",
+    "login",
+    "credentials"
+  ]),
+  fleet("health", "Check all Tailscale computers", "Discover every visible non-mobile Tailscale computer, test reachability, pinned tools, configuration and service logins. Offline, unregistered and unverified computers fail coverage.", [
+    "tailscale",
+    "tailnet",
+    "all",
+    "health",
+    "versions",
+    "codex",
+    "claude",
+    "login",
+    "auth"
+  ]),
+  fleet("discover", "Discover Tailscale computers", "List all computers visible to this Tailscale account, including offline devices. Excludes iOS, Android and tvOS; never writes a roster.", ["tailscale", "tailnet", "computers", "discover", "machines"]),
+  fleet("doctor", "Diagnose the entire fleet", "Read-only SSH, authentication, T3, VS Code and dependency checks for this controller and every roster node.", [
+    "health",
+    "ssh",
+    "auth",
+    "github",
+    "vscode",
+    "t3",
+    "dependencies",
+    "diagnose"
+  ]),
+  {
+    ...fleet("doctor", "Diagnose this computer", "Check this process context without a roster or remote connections.", ["local", "controller", "health"]),
+    id: "fleet doctor local",
+    args: ["fleet", "doctor", "--local"],
+    examples: ["personal fleet doctor --local --json"]
+  },
+  fleet("nodes", "Explore fleet nodes", "List registered developer computers and their required capabilities without contacting them.", ["roster", "list", "machines", "computers"]),
+  fleet("add", "Register a developer computer", "Preview or explicitly save an existing SSH alias, checkout path and per-machine capabilities. No SSH or cloud setup.", ["onboarding", "register", "new", "setup"]),
+  fleet("validate", "Validate the roster", "Check local configuration before making any network requests.", ["config", "schema", "verify"]),
+  fleet("onboard", "Explore onboarding instructions", "Get per-node SSH templates, VS Code guidance, authentication steps and safe verification commands.", ["setup", "guide", "instructions", "vscode", "connect"]),
+  fleet("sync", "Plan toolchain and dependency sync", "Preview convergence through the existing mise/workstation owners. Applying requires --apply --yes.", ["drift", "versions", "mise", "install", "dependencies"]),
+  fleet("init", "Preview an example roster", "Inspect a starter configuration; only --apply --yes creates it. Prefer Register for real nodes.", ["setup", "example", "config"]),
+  fleet("schema", "Explore the fleet JSON schema", "Read the versioned roster schema for editors and agents.", ["agent", "config", "json"]),
+  {
+    id: "commands",
+    title: "Explore the command catalog",
+    description: "Search command names, descriptions and keywords; emit the complete machine-readable interface.",
+    group: "Reference",
+    keywords: ["search", "help", "llm", "agent", "api"],
+    args: ["commands"],
+    examples: ["personal commands --json --search ssh"],
+    mutation: false
+  },
+  {
+    id: "agent",
+    title: "Agent integration guide",
+    description: "Noninteractive usage, JSON contracts, exit codes, safety boundaries and reproducible examples.",
+    group: "Reference",
+    keywords: ["llm", "automation", "help", "safety"],
+    args: ["agent"],
+    examples: ["personal agent --json"],
+    mutation: false
+  }
+];
+function commandCatalog(search = "", group) {
+  return searchCommands(COMMANDS, search).filter((command) => !group || command.group.toLowerCase() === group.toLowerCase());
+}
+
+// packages/personal-cli/src/program.ts
+import { Command, CommanderError } from "commander";
+
+// packages/personal-cli/src/fleet.ts
+import { writeFile as writeFile3, mkdir as mkdir5 } from "node:fs/promises";
+import { dirname as dirname5 } from "node:path";
+
+// packages/fleet/src/config.ts
+var CAPABILITIES = [
+  "github",
+  "vault",
+  "t3",
+  "vscode",
+  "toolchain",
+  "codex",
+  "claude",
+  "services",
+  "workstation"
+];
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function fields(value, allowed) {
+  if (Object.keys(value).some((key) => !allowed.includes(key))) {
+    throw new FleetUsageError("Unknown configuration field. Run fleet schema.");
+  }
+}
+function absolutePath(value) {
+  return typeof value === "string" && value.startsWith("/") && value.length <= 4096 && !/[\x00-\x1f\x7f]/.test(value);
+}
+function parseNode(value) {
+  if (!record(value))
+    throw new FleetUsageError("Each node must be an object.");
+  fields(value, ["id", "ssh", "workspace", "runtime", "required"]);
+  const names = nodeNames(value);
+  if (!absolutePath(value["workspace"]))
+    throw new FleetUsageError("workspace must be an absolute POSIX path.");
+  if (value["runtime"] !== undefined && !absolutePath(value["runtime"])) {
+    throw new FleetUsageError("runtime must be an absolute POSIX path to Node or Bun.");
+  }
+  return {
+    ...names,
+    workspace: value["workspace"],
+    ...typeof value["runtime"] === "string" ? { runtime: value["runtime"] } : {},
+    required: requiredCapabilities(value["required"])
+  };
+}
+function nodeNames(value) {
+  if (typeof value["id"] !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(value["id"])) {
+    throw new FleetUsageError("Node IDs must be lowercase names (1–63 characters).");
+  }
+  if (typeof value["ssh"] !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$/.test(value["ssh"])) {
+    throw new FleetUsageError("ssh must be a plain SSH alias or hostname, not options or user@host.");
+  }
+  return { id: value["id"], ssh: value["ssh"] };
+}
+function requiredCapabilities(value) {
+  const required = value === undefined ? ["github", "vault", "t3", "toolchain"] : value;
+  if (!Array.isArray(required) || required.some((item) => !CAPABILITIES.includes(item))) {
+    throw new FleetUsageError("required must contain only capability names from fleet schema.");
+  }
+  if (new Set(required).size !== required.length)
+    throw new FleetUsageError("required capabilities must be unique.");
+  return required;
+}
+function parseConfig(value) {
+  if (!record(value))
+    throw new FleetUsageError("Fleet configuration must be an object.");
+  fields(value, ["$schema", "version", "nodes"]);
+  if (value["$schema"] !== undefined && typeof value["$schema"] !== "string")
+    throw new FleetUsageError("$schema must be a string.");
+  if (value["version"] !== 1 || !Array.isArray(value["nodes"])) {
+    throw new FleetUsageError("Expected version 1 and a nodes array.");
+  }
+  if (value["nodes"].length < 1 || value["nodes"].length > 64) {
+    throw new FleetUsageError("Configure between 1 and 64 developer nodes.");
+  }
+  const nodes = value["nodes"].map(parseNode);
+  if (new Set(nodes.map((node) => node.id)).size !== nodes.length) {
+    throw new FleetUsageError("Node IDs must be unique.");
+  }
+  return { version: 1, nodes };
+}
+function selectNodes(config, ids) {
+  if (ids.some((id) => !config.nodes.some((node) => node.id === id))) {
+    throw new FleetUsageError("Unknown node selection. Run fleet nodes --json.");
+  }
+  return ids.length === 0 ? config.nodes : config.nodes.filter((node) => ids.includes(node.id));
+}
+
+// packages/fleet/src/fingerprint.ts
+import { readFile as readFile3, mkdir as mkdir3, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+
+// packages/fleet/src/input-hashes.ts
+import { createHash as createHash2 } from "node:crypto";
+import { readFile as readFile2, readdir } from "node:fs/promises";
+import { join as join5 } from "node:path";
+var INPUT_FILES = [
+  "package.json",
+  "bun.lock",
+  "mise.toml",
+  "mise.lock"
+];
+var FINGERPRINT_FILES = [
+  ...INPUT_FILES,
+  "workspace-manifests",
+  "mise-sidecars"
+];
+async function fileHash(path) {
+  try {
+    return digest(await readFile2(path));
+  } catch {
+    return null;
+  }
+}
+async function manifestHash(root) {
+  try {
+    const entries = await readdir(join5(root, "packages"), {
+      withFileTypes: true
+    });
+    const hashes = [];
+    for (const entry of entries.filter((item) => item.isDirectory()).sort((left, right) => left.name.localeCompare(right.name, "en"))) {
+      hashes.push(`${entry.name}:${await fileHash(join5(root, "packages", entry.name, "package.json"))}`);
+    }
+    return digest(hashes.join(`
+`));
+  } catch {
+    return null;
+  }
+}
+async function sidecarHash(root) {
+  try {
+    const files = await readdir(join5(root, ".mise/locks"), {
+      recursive: true,
+      withFileTypes: true
+    });
+    if (files.length > 4096 || files.some((entry) => entry.isSymbolicLink()))
+      return null;
+    const hashes = [];
+    const paths = files.filter((entry) => entry.isFile()).map((entry) => join5(entry.parentPath, entry.name)).sort();
+    for (const path of paths) {
+      const hash = await fileHash(path);
+      if (hash === null)
+        return null;
+      const relative = path.slice(join5(root, ".mise/locks").length).replaceAll("\\", "/");
+      hashes.push(`${relative}:${hash}`);
+    }
+    return digest(hashes.join(`
+`));
+  } catch {
+    return null;
+  }
+}
+function digest(value) {
+  return createHash2("sha256").update(value).digest("hex");
+}
+
+// packages/fleet/src/fingerprint.ts
+var RECEIPT = "node_modules/.fleet-sync.json";
+async function fingerprint(root, run) {
+  const files = {};
+  for (const name of INPUT_FILES)
+    files[name] = await fileHash(join6(root, name));
+  files["workspace-manifests"] = await manifestHash(root);
+  files["mise-sidecars"] = await sidecarHash(root);
+  const head = await run(["git", "rev-parse", "HEAD"], { cwd: root });
+  return {
+    head: head.ok && /^[a-f0-9]{40,64}\s*$/.test(head.stdout) ? head.stdout.trim() : null,
+    files
+  };
+}
+async function dependencyCheck(root, current) {
+  const remedy = {
+    action: "Review fleet sync, then explicitly apply a frozen toolchain/dependency sync."
+  };
+  try {
+    const receipt = JSON.parse(await readFile3(join6(root, RECEIPT), "utf8"));
+    const matches = record(receipt) && receipt["version"] === 1 && JSON.stringify(receipt["files"]) === JSON.stringify(current.files);
+    return {
+      id: "dependencies",
+      status: matches ? "pass" : "fail",
+      summary: matches ? "Last successful frozen sync matches input hashes; not a full integrity audit." : "Dependency sync receipt is stale or invalid.",
+      ...matches ? {} : { remedy }
+    };
+  } catch {
+    return {
+      id: "dependencies",
+      status: "warn",
+      summary: "No frozen-sync receipt; installed dependencies are unverified.",
+      remedy
+    };
+  }
+}
+async function writeReceipt(root, current) {
+  await mkdir3(join6(root, "node_modules"), { recursive: true });
+  await writeFile2(join6(root, RECEIPT), JSON.stringify({ version: 1, files: current.files }), { mode: 384 });
+}
+function compareFingerprints(expected, actual) {
+  return [
+    compare("revision", expected.head, actual.head),
+    ...FINGERPRINT_FILES.map((name) => compare(`sync:${name}`, expected.files[name] ?? null, actual.files[name] ?? null))
+  ];
+}
+function compare(id, expected, actual) {
+  const known = expected !== null && actual !== null;
+  const matches = known && expected === actual;
+  return {
+    id,
+    status: matches ? "pass" : "fail",
+    summary: matches ? "Matches the controller checkout." : known ? "Differs from the controller checkout." : "Cannot verify; reference or node input is missing.",
+    ...matches ? {} : {
+      remedy: {
+        action: "Reconcile branches/lockfiles; review fleet sync --pull. Never reset a working tree."
+      }
+    }
+  };
+}
+
+// packages/fleet/src/service-auth.ts
+function json(result) {
+  try {
+    const data = JSON.parse(result.stdout);
+    return record(data) ? data : null;
+  } catch {
+    return null;
+  }
+}
+async function codingAuth(id, run) {
+  return [
+    await serviceCheck(id === "codex" ? {
+      id,
+      command: ["codex", "login", "status"],
+      action: "Run codex login on this computer as its operator.",
+      valid: (result) => /^Logged in using (ChatGPT|an API key|API key)\b/im.test(`${result.stdout}
+${result.stderr}`)
+    } : {
+      id,
+      command: ["claude", "auth", "status", "--json"],
+      action: "Run claude auth login on this computer as its operator.",
+      valid: (result) => json(result)?.["loggedIn"] === true
+    }, run)
+  ];
+}
+async function serviceAuth(run) {
+  const services = [
+    {
+      id: "railway",
+      command: ["railway", "whoami", "--json"],
+      action: "Run railway login on this computer.",
+      valid: (result) => typeof json(result)?.["id"] === "string"
+    },
+    {
+      id: "vercel",
+      command: ["vercel", "whoami"],
+      action: "Run vercel login on this computer.",
+      valid: (result) => /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,100}$/.test(result.stdout.trim())
+    },
+    {
+      id: "cloudflare",
+      command: ["wrangler", "whoami", "--json"],
+      action: "Run wrangler login on this computer.",
+      valid: (result) => json(result)?.["loggedIn"] === true
+    },
+    {
+      id: "aws",
+      command: [
+        "aws",
+        "sts",
+        "get-caller-identity",
+        "--output",
+        "json",
+        "--no-cli-pager"
+      ],
+      action: "Select and authenticate the intended AWS profile on this computer.",
+      valid: (result) => typeof json(result)?.["Account"] === "string" && typeof json(result)?.["Arn"] === "string"
+    },
+    {
+      id: "npm",
+      command: ["npm", "whoami", "--registry=https://registry.npmjs.org/"],
+      action: "Run npm login only if this computer should publish packages.",
+      valid: (result) => /^[a-z0-9][a-z0-9._-]{0,213}$/.test(result.stdout.trim())
+    }
+  ];
+  const checks = [];
+  for (const service of services)
+    checks.push(await serviceCheck(service, run));
+  for (const id of ["gemini", "copilot", "opencode"])
+    checks.push({
+      id: `auth:${id}`,
+      status: "skip",
+      summary: `${id} provider authorization has no verified noninteractive status adapter in this CLI. Installed binaries or saved keys are not proof of access.`,
+      remedy: {
+        action: `Verify ${id} provider access locally using its supported account diagnostics. No prompt or billable request was made.`
+      }
+    });
+  return checks;
+}
+async function serviceCheck(service, run) {
+  const result = await run(service.command, { timeoutMs: 15000 });
+  const ok = result.ok && service.valid(result);
+  return {
+    id: `auth:${service.id}`,
+    status: ok ? "pass" : "fail",
+    summary: ok ? `${service.id} reports an authenticated session in this process context; no credential or account output retained.` : `${service.id} login is missing or could not be verified (${result.reason}); no credential output retained.`,
+    ...!ok ? { remedy: { action: service.action } } : {}
+  };
+}
+
+// packages/fleet/src/workstation-checks.ts
+async function workstationChecks(root, run) {
+  const result = await run(["personal", "workstation", "doctor", "--json", "--non-interactive"], {
+    cwd: root,
+    timeoutMs: 20000
+  });
+  const fallback = {
+    id: "workstation:configuration",
+    status: "fail",
+    summary: "Managed workstation configuration could not be verified.",
+    remedy: {
+      action: "Run personal workstation doctor --json on this computer. Review managed links, PATH, coding-tool/provider configuration and notification settings; apply personal workstation sync only explicitly."
+    }
+  };
+  try {
+    const data = JSON.parse(result.stdout);
+    if (!record(data) || !Array.isArray(data["checks"]) || !data["checks"].length || data["checks"].length > 100)
+      return [fallback];
+    const checks = data["checks"].map(configurationCheck);
+    if (checks.some((check) => check === null))
+      return [fallback];
+    return [
+      ...!result.ok || data["ok"] !== true ? [fallback] : [],
+      ...checks
+    ];
+  } catch {
+    return [fallback];
+  }
+}
+function configurationCheck(value) {
+  if (!record(value) || typeof value["id"] !== "string" || !/^[a-zA-Z0-9:._-]{1,75}$/.test(value["id"]) || !["pass", "warn", "fail"].includes(String(value["severity"])))
+    return null;
+  const ok = value["severity"] === "pass";
+  return {
+    id: `workstation:${value["id"].toLowerCase()}`,
+    status: value["severity"],
+    summary: ok ? "Managed configuration check succeeded (configuration presence; provider authorization is checked separately)." : "Managed configuration is missing, conflicting or unverified.",
+    ...!ok ? {
+      remedy: {
+        action: "Inspect personal workstation doctor --json on this computer. Use explicit personal workstation sync only after reviewing the configuration changes."
+      }
+    } : {}
+  };
+}
+
+// packages/fleet/src/toolchain-checks.ts
+import { join as join7 } from "node:path";
+async function toolchainChecks(root, run) {
+  const result = await run(["bun", join7(root, "scripts/dev/doctor.ts"), "--json", "--docker"], { cwd: root, timeoutMs: 90000 });
+  const fallback = {
+    id: "auth:toolchain",
+    status: "fail",
+    summary: "Pinned tool/dependency and Docker checks could not be verified.",
+    remedy: {
+      action: "Run the checkout scripts/dev/doctor.ts --json --docker on this computer. Reconcile versions only through the shared mise setup."
+    }
+  };
+  try {
+    const data = JSON.parse(result.stdout);
+    if (!record(data) || typeof data["ok"] !== "boolean" || !Array.isArray(data["checks"]) || !data["checks"].length || data["checks"].length > 150)
+      return [fallback];
+    const checks = data["checks"].map(toolCheck);
+    if (checks.some((check) => check === null))
+      return [fallback];
+    return [
+      ...!result.ok || !data["ok"] ? [fallback] : [],
+      ...checks
+    ];
+  } catch {
+    return [fallback];
+  }
+}
+function toolCheck(value) {
+  if (!record(value) || typeof value["id"] !== "string" || !/^[a-zA-Z0-9@:/._-]{1,75}$/.test(value["id"]) || !["pass", "fail", "warn", "skip"].includes(String(value["status"])))
+    return null;
+  const ok = value["status"] === "pass";
+  const version = typeof value["detail"] === "string" && /^v?\d{1,6}(?:\.\d{1,6}){1,3}$/.test(value["detail"]) ? ` ${value["detail"]}` : "";
+  return {
+    id: `tool:${value["id"].toLowerCase().replace(/[^a-z0-9:._-]/g, "_")}`,
+    status: value["status"],
+    summary: ok ? `Expected tool version or runtime check succeeded${version}.` : "Expected tool version, runtime or authentication check did not pass.",
+    ...!ok ? {
+      remedy: {
+        action: "Review scripts/dev/doctor.ts --json --docker locally. Use shared mise/workstation setup to reconcile this computer."
+      }
+    } : {}
+  };
+}
+
+// packages/fleet/src/auth-checks.ts
+async function authCheck(capability, run, root) {
+  if (capability === "t3")
+    return t3Checks(run);
+  if (capability === "codex" || capability === "claude")
+    return codingAuth(capability, run);
+  if (capability === "services")
+    return serviceAuth(run);
+  if (capability === "workstation")
+    return workstationChecks(root, run);
+  if (capability === "toolchain")
+    return toolchainChecks(root, run);
+  return basicAuth(capability, run, root);
+}
+async function basicAuth(capability, run, root) {
+  const spec = {
+    github: {
+      command: ["gh", "auth", "status", "--active"],
+      action: "Authenticate on this node with gh auth login, then gh auth setup-git."
+    },
+    vault: {
+      command: ["vault", "token", "lookup", "-format=json"],
+      action: "Authenticate to the configured Vault on this node. Do not copy a token from another computer."
+    },
+    vscode: {
+      command: ["code", "--list-extensions"],
+      action: "Install the VS Code CLI on PATH and ms-vscode-remote.remote-ssh in the local editor profile."
+    }
+  }[capability];
+  const result = await run(spec.command, {
+    cwd: root,
+    timeoutMs: 15000
+  });
+  const extensions = result.stdout.toLowerCase().split(/\s+/);
+  const ok = result.ok && (capability !== "vscode" || extensions.includes("ms-vscode-remote.remote-ssh"));
+  return [
+    {
+      id: `auth:${capability}`,
+      status: ok ? "pass" : "fail",
+      summary: ok ? `${capability} check succeeded in this process context.` : `${capability} check failed (${result.reason}); no credential output retained.`,
+      ...ok ? {} : { remedy: { action: spec.action } }
+    }
+  ];
+}
+async function t3Checks(run) {
+  const config = await run(["t3", "status", "--json"]);
+  const checks = [t3Settings(config)];
+  const live = await run(["t3", "environment", "list", "--json"]);
+  checks.push({
+    id: "t3:api",
+    status: live.ok ? "pass" : "fail",
+    summary: live.ok ? "Local T3 API answered a read-only environment listing; peer connectivity is not inferred." : "Local T3 API did not answer the environment listing.",
+    ...!live.ok ? {
+      remedy: {
+        action: "Check t3 service status and t3 status. Inspect linked peers in T3 Settings → Connections; relink only with operator approval."
+      }
+    } : {}
+  });
+  checks.push({
+    id: "t3:end-to-end",
+    status: "skip",
+    summary: "Relay traversal and remote peer authorization require an operator connection test; local settings are not proof."
+  });
+  return checks;
+}
+function t3Settings(config) {
+  const fallback = {
+    id: "t3:settings",
+    status: "fail",
+    summary: "T3 settings unavailable or unsupported CLI response.",
+    remedy: {
+      action: "Run t3 status --json on this node. Complete t3 up --connect as its operator if needed."
+    }
+  };
+  try {
+    const data = JSON.parse(config.stdout);
+    if (config.ok && record(data) && record(data["connect"])) {
+      const enabled = data["connect"]["enabled"] === true && data["connect"]["revoked"] === false;
+      return {
+        id: "t3:settings",
+        status: enabled ? "pass" : "fail",
+        summary: enabled ? "T3 Connect enabled and not marked revoked (settings only)." : "T3 Connect disabled, revoked, or unknown.",
+        ...!enabled ? {
+          remedy: {
+            action: "Review t3 status, then complete t3 up --connect as the operator. Never share pairing tokens."
+          }
+        } : {}
+      };
+    }
+  } catch {}
+  return fallback;
+}
+
+// packages/fleet/src/probe.ts
+async function probe(root, required, run) {
+  const current = await fingerprint(root, run);
+  const checks = [
+    {
+      id: "workspace",
+      status: Object.values(current.files).every(Boolean) && current.head ? "pass" : "fail",
+      summary: "Checkout revision and shared dependency/toolchain input availability."
+    }
+  ];
+  const dirty = await run(["git", "status", "--porcelain"], { cwd: root });
+  checks.push({
+    id: "git:clean",
+    status: dirty.ok ? dirty.stdout.trim() ? "warn" : "pass" : "fail",
+    summary: dirty.ok && !dirty.stdout.trim() ? "Working tree is clean." : "Working tree is dirty or unreadable; sync --pull will refuse."
+  });
+  checks.push(await dependencyCheck(root, current));
+  for (const capability of CAPABILITIES) {
+    if (required.includes(capability))
+      checks.push(...await authCheck(capability, run, root));
+    else
+      checks.push({
+        id: `auth:${capability}`,
+        status: "skip",
+        summary: "Not required by this node configuration."
+      });
+  }
+  return {
+    version: 1,
+    platform: process.platform,
+    fingerprint: current,
+    checks
+  };
+}
+
+// packages/fleet/src/report.ts
+function makeReport(command, nodes) {
+  const summary = {
+    pass: 0,
+    warn: 0,
+    fail: 0,
+    skip: 0
+  };
+  for (const node of nodes)
+    for (const check of node.checks)
+      summary[check.status] += 1;
+  return {
+    version: 1,
+    command,
+    ok: summary.fail === 0,
+    generatedAt: new Date().toISOString(),
+    nodes,
+    summary
+  };
+}
+function reportExitCode(report, strict) {
+  return !report.ok || strict && (report.summary.warn > 0 || report.summary.skip > 0) ? 1 : 0;
+}
+function renderReport(report) {
+  const lines = [
+    `Fleet ${report.command}: ${report.ok ? "no failing checks" : "attention needed"}`
+  ];
+  for (const node of report.nodes) {
+    lines.push(`
+${node.node}`);
+    for (const check of node.checks) {
+      lines.push(`  ${check.status.toUpperCase()} ${check.id}: ${check.summary}`);
+      if (check.remedy)
+        lines.push(`    Next: ${check.remedy.action}`);
+    }
+  }
+  lines.push(`
+${report.summary.pass} pass, ${report.summary.warn} warn, ${report.summary.fail} fail, ${report.summary.skip} skip`);
+  return lines.join(`
+`);
+}
+async function mapBounded(items, worker, concurrency = 4) {
+  const results = new Array(items.length);
+  let cursor = 0;
+  const consume = async () => {
+    while (cursor < items.length) {
+      const index = cursor++;
+      results[index] = await worker(items[index]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, consume));
+  return results;
+}
+
+// packages/fleet/src/ssh.ts
+function shellQuote(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function sshArgs(node) {
+  return [
+    "ssh",
+    "-T",
+    "-a",
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    "StrictHostKeyChecking=yes",
+    "-o",
+    "UpdateHostKeys=no",
+    "-o",
+    "ConnectTimeout=8",
+    "-o",
+    "ConnectionAttempts=1",
+    "-o",
+    "ServerAliveInterval=5",
+    "-o",
+    "ServerAliveCountMax=2",
+    "-o",
+    "ClearAllForwardings=yes",
+    "-o",
+    "PermitLocalCommand=no",
+    "-o",
+    "ControlMaster=no",
+    "-o",
+    "ControlPath=none",
+    node.ssh
+  ];
+}
+function remoteCommand(node, request) {
+  const encoded = Buffer.from(JSON.stringify(request)).toString("base64");
+  const command = `cd -- ${shellQuote(node.workspace)} && exec ${shellQuote(node.runtime ?? "node")} --input-type=module - ${shellQuote(encoded)}`;
+  return [...sshArgs(node), command];
+}
+var FAILURES = [
+  {
+    pattern: /REMOTE HOST IDENTIFICATION HAS CHANGED|Host key verification failed|No .* host key is known/i,
+    id: "ssh:host-key",
+    summary: "SSH host key is unknown or changed.",
+    action: "Verify the host fingerprint out of band, then update known_hosts manually. Never disable host-key checking."
+  },
+  {
+    pattern: /Could not resolve hostname|Name or service not known|nodename nor servname/i,
+    id: "ssh:dns",
+    summary: "SSH hostname or jump-host resolution failed.",
+    action: "Check the alias in ~/.ssh/config, DNS/VPN/Tailscale connectivity, and ProxyJump host resolution."
+  },
+  {
+    pattern: /Permission denied|sign_and_send_pubkey|agent refused|Too many authentication failures/i,
+    id: "ssh:auth",
+    summary: "SSH key/agent authentication failed.",
+    action: "Use ssh-add -l and ssh -vvv ALIAS locally; check User, IdentityFile, IdentitiesOnly, agent/keychain access and authorized_keys. Do not share debug logs without review."
+  },
+  {
+    pattern: /Connection refused|No route to host|Network is unreachable/i,
+    id: "ssh:network",
+    summary: "SSH endpoint or jump host is unreachable/refused.",
+    action: "Verify the node is awake, VPN is connected, sshd is enabled and the configured port is reachable. Do not open a public SSH port automatically."
+  },
+  {
+    pattern: /(?:bun|node).*not found|No such file or directory|cannot cd|can.t cd/i,
+    id: "ssh:runtime",
+    summary: "Remote workspace or Node/Bun runtime is missing from the non-login SSH environment.",
+    action: "Follow fleet onboard; configure absolute workspace/runtime paths. GUI terminals and SSH shells may have different PATHs."
+  }
+];
+function sshFailure(result) {
+  if (result.reason === "timeout")
+    return {
+      id: "ssh:timeout",
+      status: "fail",
+      summary: "SSH or remote probe exceeded its deadline.",
+      remedy: {
+        action: "Check sleeping nodes, VPN, ProxyJump, network reachability and noninteractive shell startup. Increase --timeout only after diagnosis."
+      }
+    };
+  if (result.reason === "missing")
+    return {
+      id: "ssh:missing",
+      status: "fail",
+      summary: "Cannot launch the local SSH client.",
+      remedy: {
+        action: "Install/enable the OS OpenSSH client and expose it to the terminal/editor PATH."
+      }
+    };
+  const match = FAILURES.find((failure) => failure.pattern.test(result.stderr));
+  return {
+    id: match?.id ?? "ssh:probe",
+    status: "fail",
+    summary: match?.summary ?? `Remote probe failed (${result.reason}); raw output withheld.`,
+    remedy: {
+      action: match?.action ?? "Run ssh ALIAS manually; verify workspace/runtime, shell startup output and CLI compatibility. Never paste credentials or full logs into agent context."
+    }
+  };
+}
+
+// packages/fleet/src/protocol.ts
+var STATUSES = ["pass", "warn", "fail", "skip"];
+function validCheck(value) {
+  if (!record(value) || typeof value["id"] !== "string" || !/^[a-z0-9:._-]{1,100}$/.test(value["id"]) || !STATUSES.includes(String(value["status"])) || typeof value["summary"] !== "string" || value["summary"].length > 2000)
+    return false;
+  const remedy = value["remedy"];
+  return remedy === undefined || validRemedy(remedy);
+}
+function validRemedy(value) {
+  return record(value) && typeof value["action"] === "string" && value["action"].length < 2000 && (value["command"] === undefined || typeof value["command"] === "string");
+}
+function validSnapshot(value) {
+  if (!record(value) || value["version"] !== 1 || typeof value["platform"] !== "string" || !Array.isArray(value["checks"]) || value["checks"].length > 200 || !value["checks"].every(validCheck))
+    return false;
+  return validFingerprint(value["fingerprint"]);
+}
+function validFingerprint(value) {
+  if (!record(value) || !record(value["files"]))
+    return false;
+  if (!Object.keys(value["files"]).every((key) => FINGERPRINT_FILES.includes(key)))
+    return false;
+  const head = value["head"];
+  return (head === null || typeof head === "string" && /^[a-f0-9]{40,64}$/.test(head)) && Object.values(value["files"]).every(validHash);
+}
+function validHash(value) {
+  return value === null || typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+}
+function decodeSnapshot(output) {
+  try {
+    const data = JSON.parse(output);
+    return validSnapshot(data) ? cleanSnapshot(data) : null;
+  } catch {
+    return null;
+  }
+}
+function cleanCheck(check) {
+  return {
+    id: check.id,
+    status: check.status,
+    summary: check.summary,
+    ...check.remedy ? {
+      remedy: {
+        action: check.remedy.action,
+        ...check.remedy.command ? { command: check.remedy.command } : {}
+      }
+    } : {}
+  };
+}
+function cleanSnapshot(snapshot) {
+  return {
+    version: 1,
+    platform: snapshot.platform,
+    fingerprint: {
+      head: snapshot.fingerprint.head,
+      files: snapshot.fingerprint.files
+    },
+    checks: snapshot.checks.map(cleanCheck)
+  };
+}
+
+// packages/fleet/src/transport.ts
+import { fileURLToPath } from "node:url";
+async function bundleProbe() {
+  const result = await Bun.build({
+    entrypoints: [fileURLToPath(new URL("./remote-entry.ts", import.meta.url))],
+    target: "node",
+    minify: true
+  });
+  if (!result.success || !result.outputs[0])
+    throw new Error("Cannot bundle the fleet probe.");
+  return result.outputs[0].text();
+}
+async function inspectRemote(node, options, run) {
+  const command = remoteCommand(node, {
+    action: options.action,
+    configuration: options.configuration,
+    node,
+    apply: options.action !== "probe",
+    repairs: options.repairs,
+    expected: options.expected,
+    pull: options.pull === true
+  });
+  const result = await run(command, {
+    input: options.source,
+    timeoutMs: options.timeoutMs
+  });
+  if (!result.ok)
+    return { node: node.id, checks: [sshFailure(result)] };
+  if (options.action !== "probe")
+    return decodeSync(node.id, result.stdout);
+  const snapshot = decodeSnapshot(result.stdout);
+  if (!snapshot)
+    return protocolFailure(node.id);
+  return {
+    node: node.id,
+    snapshot,
+    checks: [
+      {
+        id: "ssh:session",
+        status: "pass",
+        summary: "Fresh noninteractive SSH session and Node-compatible probe succeeded with verified host keys and no agent forwarding."
+      },
+      ...snapshot.checks,
+      {
+        id: "vscode:forwarding",
+        status: "skip",
+        summary: "VS Code Remote-SSH tunnel/server installation is not tested by a shell session. Use the onboarding forwarding test."
+      }
+    ]
+  };
+}
+function decodeSync(node, output) {
+  try {
+    const data = JSON.parse(output);
+    if (record(data) && data["version"] === 1 && Array.isArray(data["checks"]) && data["checks"].length > 0 && data["checks"].length <= 200 && data["checks"].every(validCheck)) {
+      return { node, checks: data["checks"].map(cleanCheck) };
+    }
+  } catch {
+    return protocolFailure(node);
+  }
+  return protocolFailure(node);
+}
+function protocolFailure(node) {
+  return {
+    node,
+    checks: [
+      {
+        id: "ssh:protocol",
+        status: "fail",
+        summary: "Remote response is not a supported fleet JSON document.",
+        remedy: {
+          action: "Remove stdout banners from noninteractive shell startup; check the Node/Bun runtime. No raw remote output is retained."
+        }
+      }
+    ]
+  };
+}
+
+// packages/fleet/src/controller.ts
+async function doctor(nodes, options, run) {
+  const local = await probe(options.root, options.required, run);
+  const agent = await run(["ssh-add", "-l"]);
+  const reports = [
+    {
+      node: "controller",
+      snapshot: local,
+      checks: [
+        ...local.checks,
+        {
+          id: "ssh:agent",
+          status: agent.ok ? "pass" : "warn",
+          summary: agent.ok ? "SSH agent exposes at least one identity." : "No accessible SSH agent identities; explicit IdentityFile keys may still work.",
+          ...!agent.ok ? {
+            remedy: {
+              action: "Unlock/load the intended key in the controller session. Check SSH_AUTH_SOCK and GUI/editor agent visibility; do not copy private keys."
+            }
+          } : {}
+        }
+      ]
+    }
+  ];
+  if (options.local || nodes.length === 0)
+    return reports;
+  const source = options.source ?? await bundleProbe();
+  const reference = await fingerprint(options.root, run);
+  const remote = await mapBounded(nodes, async (node) => {
+    const report = await inspectRemote(node, { action: "probe", source, timeoutMs: options.timeoutMs }, run);
+    if (report.snapshot)
+      report.checks.push(...compareFingerprints(reference, report.snapshot.fingerprint));
+    return report;
+  });
+  return [...reports, ...remote];
+}
+
+// packages/fleet/src/sync.ts
+import { unlink } from "node:fs/promises";
+import { join as join8 } from "node:path";
+function syncPlan(pull) {
+  return [
+    "Validate the checkout and shared input files; invalidate any prior sync receipt.",
+    ...pull ? [
+      "Refuse dirty or detached checkouts; git pull --ff-only (no reset, stash, force or rebase)."
+    ] : [],
+    "Run mise exec --locked bun -- bun scripts/dev/setup.ts --non-interactive (shared tools, user mise/PATH, frozen dependencies).",
+    "Record input hashes only after every step succeeds.",
+    "Run fleet doctor afterward; workstation/provider configuration and logins remain explicit ws/operator actions."
+  ];
+}
+async function syncWorkspace(root, pull, run) {
+  const before = await fingerprint(root, run);
+  if (!completeFingerprint(before)) {
+    return failed("Not a complete workspace checkout. Follow fleet onboard first.");
+  }
+  if (pull) {
+    const dirty = await run(["git", "status", "--porcelain"], { cwd: root });
+    const branch = await run(["git", "symbolic-ref", "--quiet", "HEAD"], {
+      cwd: root
+    });
+    if (!dirty.ok || dirty.stdout.trim() || !branch.ok)
+      return failed("Refusing pull: dirty, detached, or unreadable checkout. Reconcile manually.");
+  }
+  await unlink(join8(root, "node_modules/.fleet-sync.json")).catch(() => {
+    return;
+  });
+  if (pull) {
+    const result = await run(["git", "pull", "--ff-only"], {
+      cwd: root,
+      timeoutMs: 120000
+    });
+    if (!result.ok)
+      return failed("Fast-forward pull failed. Inspect upstream/network/auth manually; nothing was reset.");
+  }
+  const expected = await fingerprint(root, run);
+  const result = await run([
+    "mise",
+    "exec",
+    "--locked",
+    "bun",
+    "--",
+    "bun",
+    "scripts/dev/setup.ts",
+    "--non-interactive"
+  ], { cwd: root, timeoutMs: 1200000 });
+  if (!result.ok)
+    return failed(`Shared toolchain/dependency sync failed (${result.reason}). Inspect setup locally; partial installs are possible.`);
+  const after = await fingerprint(root, run);
+  if (JSON.stringify(expected) !== JSON.stringify(after))
+    return failed("Checkout inputs changed during sync. Retry from a stable checkout.");
+  await writeReceipt(root, after);
+  return [
+    {
+      id: "sync",
+      status: "pass",
+      summary: "Shared setup succeeded; frozen-sync receipt recorded. Auth and live connectivity still need doctor checks."
+    }
+  ];
+}
+function failed(summary) {
+  return [
+    {
+      id: "sync",
+      status: "fail",
+      summary,
+      remedy: {
+        action: "Resolve locally using scripts/dev/README.md, then review and retry fleet sync."
+      }
+    }
+  ];
+}
+function completeFingerprint(value) {
+  return value.head !== null && Object.values(value.files).every(Boolean);
+}
+
+// packages/fleet/src/onboard.ts
+function onboarding(node, launcher = "bun run fleet") {
+  return {
+    version: 1,
+    node: node.id,
+    applied: false,
+    steps: [
+      "On the new node, review and run scripts/dev/bootstrap.sh (or bootstrap.ps1 for native Windows). Use scripts/dev/README.md. This installs the shared locked toolchain; it does not enable SSH.",
+      "Enable the OS SSH service as the operator on a trusted private network. Do not expose SSH publicly or create cloud resources.",
+      "Create a distinct per-machine SSH key and authorize its PUBLIC key on the destination. Verify host fingerprints out of band. Keep private keys and auth tokens on their original machines.",
+      "In the controller SSH config, configure this alias with the real HostName, User, IdentityFile, optional Port/ProxyJump and IdentitiesOnly yes. Fleet will not write or overwrite SSH configuration.",
+      "Test ssh ALIAS manually once after fingerprint verification. Ensure noninteractive shell startup writes no stdout. Set runtime to an absolute Node/Bun executable/shim if SSH PATH omits it.",
+      "Authenticate separately on the node: gh auth login; gh auth setup-git; vault login using the approved method. Configure coding-provider sessions independently; never copy auth directories.",
+      "For T3 Connect, review t3 status and t3 service status, then complete t3 up --connect and operator pairing/linking. T3 pairing/auth state is not an SSH credential.",
+      "For VS Code, install Remote-SSH in the LOCAL editor profile, use the same SSH alias/client/config, enable the login terminal temporarily, and read Output → Remote - SSH. Restart the editor after PATH/agent changes.",
+      "VS Code needs TCP forwarding and compatible remote server prerequisites. Test with ssh -N -L 127.0.0.1:18080:127.0.0.1:REMOTE_PORT ALIAS against a known loopback service, then curl localhost:18080 from a second terminal. Review server policy; never loosen it automatically.",
+      "Run fleet doctor --node NODE --json from every intended controller. This is directed connectivity, not an all-pairs proof. Review skipped T3/VS Code end-to-end checks manually."
+    ],
+    sshTemplate: `Host ${node.ssh}
+  HostName REPLACE_WITH_PRIVATE_HOST
+  User REPLACE_WITH_USER
+  IdentityFile ~/.ssh/REPLACE_WITH_NODE_KEY
+  IdentitiesOnly yes
+  ForwardAgent no
+`,
+    vscodeSettings: {
+      "remote.SSH.path": "REPLACE_WITH_SAME_OPENSSH_BINARY",
+      "remote.SSH.configFile": "REPLACE_WITH_ABSOLUTE_SSH_CONFIG",
+      "remote.SSH.showLoginTerminal": true
+    },
+    workspaceCommand: `cd -- ${shellQuote(node.workspace)}`,
+    verifyCommand: `${launcher} doctor --node ${node.id} --json`,
+    sync: {
+      command: `${launcher} sync --node ${node.id}`,
+      steps: syncPlan(false)
+    }
+  };
+}
+// packages/fleet/schema.json
+var schema_default = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  title: "Developer fleet roster (not infrastructure inventory)",
+  type: "object",
+  additionalProperties: false,
+  required: ["version", "nodes"],
+  properties: {
+    $schema: { type: "string" },
+    version: { const: 1 },
+    nodes: {
+      type: "array",
+      minItems: 1,
+      maxItems: 64,
+      items: {
+        type: "object",
+        additionalProperties: false,
+        required: ["id", "ssh", "workspace"],
+        properties: {
+          id: { type: "string", pattern: "^[a-z][a-z0-9-]{0,62}$" },
+          ssh: {
+            type: "string",
+            pattern: "^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$"
+          },
+          workspace: {
+            type: "string",
+            maxLength: 4096,
+            pattern: "^/[^\\u0000-\\u001f\\u007f]*$"
+          },
+          runtime: {
+            type: "string",
+            maxLength: 4096,
+            pattern: "^/[^\\u0000-\\u001f\\u007f]*$"
+          },
+          required: {
+            type: "array",
+            uniqueItems: true,
+            default: ["github", "vault", "t3", "toolchain"],
+            items: {
+              enum: [
+                "github",
+                "vault",
+                "t3",
+                "vscode",
+                "toolchain",
+                "codex",
+                "claude",
+                "services",
+                "workstation"
+              ]
+            }
+          }
+        }
+      }
+    }
+  }
+};
+// packages/fleet/fleet.example.json
+var fleet_example_default = {
+  $schema: "./schema.json",
+  version: 1,
+  nodes: [
+    {
+      id: "dev-linux",
+      ssh: "dev-linux",
+      workspace: "/home/developer/workspace",
+      runtime: "/home/developer/.local/share/mise/shims/node",
+      required: ["github", "vault", "t3", "toolchain"]
+    }
+  ]
+};
+
+// packages/personal-cli/src/options.ts
+function capabilities(value) {
+  const values = value === "none" ? [] : value?.split(",") ?? CAPABILITIES;
+  if (values.some((entry) => !CAPABILITIES.includes(entry)))
+    throw new FleetUsageError(`--require expects ${CAPABILITIES.join(",")} or none.`);
+  return [...new Set(values)];
+}
+function timeout(options) {
+  const value = Number(options.timeout ?? (options.apply ? 1500000 : 120000));
+  if (!Number.isInteger(value) || value < 1000 || value > 1800000)
+    throw new FleetUsageError("--timeout must be 1000–1800000 milliseconds.");
+  return value;
+}
+function validateOptions(command, options) {
+  validateMutation(command, options);
+  validateRepair(command, options);
+  validateScope(command, options);
+  if (["discover", "health", "repair"].includes(command) && options.require !== undefined)
+    throw new FleetUsageError("Tailscale health always checks the complete capability set; --require is not supported.");
+  if (options.timeout !== undefined)
+    timeout(options);
+}
+function validateMutation(command, options) {
+  if (options.apply && !["add", "init", "sync", "repair"].includes(command))
+    throw new FleetUsageError("--apply is only valid for fleet add, init, sync or repair.");
+  if (options.apply && !options.yes)
+    throw new FleetUsageError("Mutation requires both --apply and --yes.");
+  if (options.pull && command !== "sync")
+    throw new FleetUsageError("--pull is only valid for fleet sync.");
+}
+function validateScope(command, options) {
+  if (["discover", "health"].includes(command) && (options.local || options.all || options.node?.length))
+    throw new FleetUsageError("Tailscale discovery and health always cover all visible computers; scope filters are not supported.");
+  if (options.local && !["doctor", "sync", "repair"].includes(command))
+    throw new FleetUsageError("--local is only valid for fleet doctor, sync or repair.");
+  validateExclusive(options);
+  if (options.all && !["doctor", "repair"].includes(command))
+    throw new FleetUsageError("--all is only valid for fleet doctor or repair; sync already targets all configured nodes by default.");
+}
+function validateExclusive(options) {
+  const selected = [
+    options.local,
+    options.all,
+    Boolean(options.node?.length)
+  ].filter(Boolean);
+  if (selected.length > 1)
+    throw new FleetUsageError("Choose --local, --all, or --node, not a combination.");
+}
+function validateRepair(command, options) {
+  if (options.planHash !== undefined && !/^[a-f0-9]{64}$/.test(options.planHash))
+    throw new FleetUsageError("--plan-hash expects the SHA-256 value from a repair preview.");
+  if ((options.repair !== undefined || options.script || options.planHash !== undefined) && command !== "repair")
+    throw new FleetUsageError("--repair and --script are only valid for fleet repair.");
+  if (options.script && options.apply)
+    throw new FleetUsageError("--script only generates a preview; run a reviewed repair separately with --apply --yes.");
+  validateCatalogScope(command, options);
+}
+function validateCatalogScope(command, options) {
+  if (command === "repairs" && (options.local || options.node?.length || options.all || options.require !== undefined))
+    throw new FleetUsageError("fleet repairs is a static catalog and does not accept target or capability filters.");
+}
+
+// packages/personal-cli/src/roster.ts
+import { lstat as lstat2, mkdir as mkdir4, open, readFile as readFile4, rename as rename2, unlink as unlink2 } from "node:fs/promises";
+import { dirname as dirname4 } from "node:path";
+import { randomUUID as randomUUID2 } from "node:crypto";
+async function readRoster(path) {
+  try {
+    const info = await lstat2(path);
+    if (!info.isFile() || info.size > 1024 * 1024)
+      throw new FleetUsageError("Roster must be a regular file smaller than 1 MiB; symlinks are not supported.");
+    return parseConfig(JSON.parse(await readFile4(path, "utf8")));
+  } catch (error) {
+    if (record(error) && error["code"] === "ENOENT")
+      return null;
+    if (error instanceof FleetUsageError)
+      throw error;
+    throw new FleetUsageError("Cannot read a valid roster. Use fleet schema or choose --config PATH.");
+  }
+}
+function nodeFromOptions(options) {
+  if (!options.id || !options.ssh || !options.path)
+    throw new FleetUsageError("fleet add requires --id NAME --ssh ALIAS --path /absolute/checkout.");
+  const node = {
+    id: options.id,
+    ssh: options.ssh,
+    workspace: options.path,
+    ...options.runtime ? { runtime: options.runtime } : {},
+    required: capabilities(options.require ?? "github,vault,t3,toolchain")
+  };
+  return parseConfig({ version: 1, nodes: [node] }).nodes[0];
+}
+function appendNode(existing, node) {
+  return parseConfig({ version: 1, nodes: [...existing?.nodes ?? [], node] });
+}
+async function addNode(path, node, apply) {
+  if (!apply)
+    return appendNode(await readRoster(path), node);
+  await mkdir4(dirname4(path), { recursive: true, mode: 448 });
+  const lock = await acquireLock(path);
+  try {
+    const roster = appendNode(await readRoster(path), node);
+    await atomicWrite(path, roster);
+    return roster;
+  } finally {
+    await lock.close();
+    await unlink2(`${path}.lock`);
+  }
+}
+async function acquireLock(path) {
+  try {
+    return await open(`${path}.lock`, "wx", 384);
+  } catch {
+    throw new FleetUsageError("Roster is locked or unwritable. Check permissions and concurrent writers; remove a stale .lock only after verifying no operation is running.");
+  }
+}
+async function atomicWrite(path, roster) {
+  const temporary = `${path}.${randomUUID2()}.tmp`;
+  const handle = await open(temporary, "wx", 384);
+  try {
+    await handle.writeFile(`${JSON.stringify(roster, null, 2)}
+`);
+    await handle.sync();
+    await handle.close();
+    await rename2(temporary, path);
+  } finally {
+    await handle.close();
+    await unlink2(temporary).catch(() => {
+      return;
+    });
+  }
+}
+
+// packages/fleet/src/tailscale.ts
+import { isIP } from "node:net";
+async function discoverTailnet(run) {
+  const result = await run(["tailscale", "status", "--json"], {
+    timeoutMs: 15000
+  });
+  if (!result.ok)
+    return unavailable("Tailscale status is unavailable; check the CLI, daemon and account login.");
+  try {
+    return parseTailnet(JSON.parse(result.stdout));
+  } catch {
+    return unavailable("Tailscale returned an unsupported status document. Update the CLI and check its daemon.");
+  }
+}
+function parseTailnet(data) {
+  if (!record(data) || data["BackendState"] !== "Running")
+    return unavailable("Tailscale is not running and signed in. Review tailscale status locally.");
+  validateStatusFields(data);
+  const peers = Object.values(data["Peer"] ?? {});
+  if (peers.length > 1024)
+    throw new Error("Too many peers");
+  const all = [
+    parseComputer(data["Self"], true),
+    ...peers.map((peer) => parseComputer(peer, false))
+  ];
+  if (new Set(all.map((peer) => peer.id)).size !== all.length)
+    throw new Error("Duplicate peer");
+  const mobile = (peer) => ["ios", "android", "tvos"].includes(peer.os.toLowerCase());
+  const computers = all.filter((peer) => !mobile(peer)).sort((a, b) => a.name.localeCompare(b.name, "en"));
+  const healthy = healthyDiscovery(data, computers.length);
+  return {
+    computers,
+    excludedMobile: all.filter(mobile).length,
+    checks: [
+      {
+        id: "tailscale:discovery",
+        status: healthy ? "pass" : "fail",
+        summary: healthy ? "Signed-in Tailscale daemon returned its visible computer inventory." : "Tailscale reports a daemon/coordination health problem or no computers; discovery may be incomplete.",
+        ...!healthy ? {
+          remedy: {
+            action: "Review tailscale status and network connectivity. Resolve coordination/daemon health before claiming complete coverage."
+          }
+        } : {}
+      }
+    ]
+  };
+}
+function healthyDiscovery(data, count) {
+  const health = data["Health"] ?? [];
+  return health.length === 0 && count > 0;
+}
+function validateStatusFields(data) {
+  const health = data["Health"] ?? [];
+  const peers = data["Peer"] ?? {};
+  if (!record(data["Self"]) || !record(peers) || !Array.isArray(health))
+    throw new Error("Unsupported Tailscale status");
+}
+function parseComputer(value, self) {
+  if (!record(value))
+    throw new Error("Invalid peer");
+  const {
+    ID: id,
+    HostName: name,
+    DNSName: dns,
+    OS: os,
+    TailscaleIPs: ips,
+    Online: online
+  } = value;
+  if (![id, name, os].every((field) => typeof field === "string" && field.length > 0 && field.length <= 256 && !/[\x00-\x1f\x7f]/.test(field)) || typeof dns !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9.-]{0,252}\.?$/.test(dns) || !Array.isArray(ips) || ips.length < 1 || ips.length > 16 || !ips.every((ip) => typeof ip === "string" && isIP(ip) !== 0) || typeof online !== "boolean")
+    throw new Error("Invalid peer fields");
+  return {
+    id,
+    name,
+    dns: dns.replace(/\.$/, "").toLowerCase(),
+    os,
+    ips,
+    online,
+    self
+  };
+}
+function unavailable(summary) {
+  return {
+    computers: [],
+    excludedMobile: 0,
+    checks: [{ id: "tailscale:discovery", status: "fail", summary }]
+  };
+}
+
+// packages/fleet/src/tailnet-matching.ts
+function matchesComputer(host, peer) {
+  const name = host.toLowerCase().replace(/\.$/, "");
+  return [peer.dns, peer.dns.split(".")[0], ...peer.ips].includes(name);
+}
+async function matchComputers(nodes, peers, run) {
+  const matches = new Map(peers.map((peer) => [peer.id, []]));
+  for (const node of nodes) {
+    const resolved = await run([
+      "ssh",
+      "-G",
+      "-o",
+      "CanonicalizeHostname=no",
+      "-o",
+      "PermitLocalCommand=no",
+      node.ssh
+    ], { timeoutMs: 5000 });
+    const hostname = resolved.ok ? /^hostname ([^\r\n]+)$/im.exec(resolved.stdout)?.[1]?.trim() : undefined;
+    const targets = peers.filter((peer) => matchesComputer(hostname ?? node.ssh, peer));
+    for (const peer of targets)
+      matches.get(peer.id).push(node);
+  }
+  return matches;
+}
+
+// packages/fleet/src/tailnet-health.ts
+var HEALTH_CAPABILITIES = [
+  "github",
+  "vault",
+  "t3",
+  "toolchain",
+  "codex",
+  "claude",
+  "services",
+  "workstation"
+];
+async function tailnetHealth(tailnet, nodes, options, run) {
+  const controller = await probe(options.root, HEALTH_CAPABILITIES, run);
+  const matches = await matchComputers(nodes, tailnet.computers, run);
+  let source;
+  const reports = await mapBounded(tailnet.computers, async (peer) => {
+    const checks = await connectivity(peer, run);
+    if (peer.self)
+      return {
+        node: peer.dns,
+        snapshot: controller,
+        checks: [...checks, ...controller.checks]
+      };
+    const candidates = matches.get(peer.id);
+    if (!uniqueMapping(candidates, matches))
+      return missingMapping(peer, checks, candidates.length);
+    if (!peer.online)
+      return { node: peer.dns, checks };
+    const node = candidates[0];
+    const report = await inspectComputer({
+      ...node,
+      required: [...new Set([...node.required, ...HEALTH_CAPABILITIES])]
+    }, {
+      action: "probe",
+      source: source ??= Promise.resolve().then(options.source),
+      timeoutMs: options.timeoutMs
+    }, run);
+    return combine(peer, checks, report, controller);
+  });
+  const absent = nodes.filter((node) => ![...matches.values()].some((matched) => matched.includes(node)));
+  return [
+    { node: "tailscale", checks: tailnet.checks },
+    ...!tailnet.computers.some((peer) => peer.self) ? [
+      {
+        node: "controller",
+        snapshot: controller,
+        checks: controller.checks
+      }
+    ] : [],
+    ...reports,
+    ...absent.map((node) => ({
+      node: node.id,
+      checks: [
+        {
+          id: "tailscale:membership",
+          status: "fail",
+          summary: "Registered node is absent from visible Tailscale inventory. It was not silently omitted.",
+          remedy: {
+            action: "Check the node account, tailnet visibility, and the registered SSH alias."
+          }
+        }
+      ]
+    }))
+  ];
+}
+function uniqueMapping(candidates, matches) {
+  return candidates.length === 1 && [...matches.values()].filter((nodes) => nodes.includes(candidates[0])).length === 1;
+}
+async function inspectComputer(node, options, run) {
+  try {
+    return await inspectRemote(node, { ...options, source: await options.source }, run);
+  } catch {
+    return {
+      node: node.id,
+      checks: [
+        {
+          id: "fleet:probe",
+          status: "fail",
+          summary: "The current remote probe could not be prepared or completed; this computer remains unverified.",
+          remedy: {
+            action: "Reinstall the validated Personal CLI package and retry. No raw exception or remote output is retained."
+          }
+        }
+      ]
+    };
+  }
+}
+async function connectivity(peer, run) {
+  const online = {
+    id: "tailscale:online",
+    status: peer.online ? "pass" : "fail",
+    summary: peer.online ? "Computer is online in Tailscale status." : "Computer is offline or Tailscale cannot confirm its online state."
+  };
+  if (peer.self || !peer.online)
+    return [online];
+  const ping = await run(["tailscale", "ping", "--c=1", "--timeout=5s", peer.ips[0]], { timeoutMs: 8000 });
+  return [
+    online,
+    {
+      id: "tailscale:reachability",
+      status: ping.ok ? "pass" : "fail",
+      summary: ping.ok ? "Tailscale peer answered a bounded reachability probe." : "Tailscale peer did not answer; online inventory is not proof of connectivity."
+    }
+  ];
+}
+function missingMapping(peer, checks, count) {
+  return {
+    node: peer.dns,
+    checks: [
+      ...checks,
+      {
+        id: "fleet:registration",
+        status: "fail",
+        summary: count ? "Roster mapping is ambiguous between entries or computers; no SSH probe was run." : "Computer is not registered with a verified SSH alias and checkout path; dependencies and authentication are unverified.",
+        remedy: {
+          action: "Use Fleet: Register a developer computer with its existing SSH alias and actual checkout path, then rerun Fleet: Check all Tailscale computers."
+        }
+      }
+    ]
+  };
+}
+function combine(peer, checks, report, reference) {
+  return {
+    ...report,
+    node: peer.dns,
+    checks: [
+      ...checks,
+      ...report.checks,
+      ...report.snapshot ? compareFingerprints(reference.fingerprint, report.snapshot.fingerprint) : []
+    ]
+  };
+}
+
+// packages/personal-cli/src/tailnet.ts
+async function executeTailnet(command, options, settings, services) {
+  const tailnet = await discoverTailnet(services.run);
+  const coverage = {
+    scope: "tailscale-visible-computers",
+    computers: tailnet.computers.length,
+    excludedMobile: tailnet.excludedMobile,
+    limitation: "This controller can inspect only devices visible to its Tailscale account/ACLs. Other tailnets, hidden devices and all-pairs connectivity are not verified."
+  };
+  if (command === "discover") {
+    const ok = tailnet.checks.every((check) => check.status === "pass");
+    return {
+      exitCode: ok ? 0 : 1,
+      data: {
+        version: 1,
+        command,
+        ok,
+        coverage,
+        computers: tailnet.computers,
+        checks: tailnet.checks
+      }
+    };
+  }
+  const roster = await readRoster(settings.config);
+  const nodes = await tailnetHealth(tailnet, roster?.nodes ?? [], {
+    root: settings.workspace,
+    timeoutMs: timeout({ ...options, timeout: options.timeout ?? "300000" }),
+    source: services.source
+  }, services.run);
+  const report = makeReport("health", nodes);
+  const exitCode = reportExitCode(report, true);
+  const verified = exitCode === 0;
+  return {
+    exitCode,
+    data: {
+      ...report,
+      ok: verified,
+      coverage: {
+        ...coverage,
+        verified,
+        inspected: nodes.filter((node) => node.snapshot).length
+      }
+    },
+    text: `${renderReport({ ...report, ok: verified })}
+Coverage: ${coverage.computers} visible computers; ${coverage.excludedMobile} mobile devices excluded.
+${coverage.limitation}`
+  };
+}
+
+// packages/personal-cli/src/probe-source.ts
+import { readFile as readFile5 } from "node:fs/promises";
+async function probeSource() {
+  if (typeof Bun !== "undefined")
+    return bundleProbe();
+  return readFile5(new URL("./probe.mjs", import.meta.url), "utf8");
+}
+
+// packages/fleet/src/repair-catalog.ts
+var login = (id, title, commands, action) => ({
+  id: `login:${id}`,
+  title,
+  owner: `${id} native CLI`,
+  automatic: false,
+  action,
+  commands
+});
+var REPAIR_RECIPES = [
+  {
+    id: "workspace",
+    title: "Install locked tools and frozen dependencies",
+    owner: "mise / scripts/dev/setup.ts",
+    automatic: true,
+    action: "Runs the existing shared setup and trusted checkout lifecycle scripts. Updates user mise/PATH configuration and writes a sync receipt. Does not pull or reset Git.",
+    commands: [
+      [
+        "mise",
+        "exec",
+        "--locked",
+        "bun",
+        "--",
+        "bun",
+        "scripts/dev/setup.ts",
+        "--non-interactive"
+      ]
+    ]
+  },
+  {
+    id: "workstation",
+    title: "Install launcher and converge managed workstation configuration",
+    owner: "workstation",
+    automatic: true,
+    action: "Runs personal:install --yes: frozen install, launcher/PATH, managed links, notifications and provider configuration. Reads available provider keys from this machine’s Vault session and writes owner-managed 0600 configuration. Conflicting unmanaged files fail.",
+    commands: [["bun", "run", "personal:install", "--yes"]]
+  },
+  {
+    id: "providers",
+    title: "Refresh shared provider configuration from Vault",
+    owner: "workstation / secret-store",
+    automatic: true,
+    action: "Uses this machine’s own Vault authorization to fetch the existing permitted provider keys. The workstation owner writes its 0600 tool configuration; no credentials are copied from another computer. Missing provider keys may remain skipped.",
+    commands: [
+      [
+        "bun",
+        "packages/workstation/cli/internal.ts",
+        "opencode",
+        "sync",
+        "--strict",
+        "--json",
+        "--non-interactive",
+        "--yes"
+      ]
+    ]
+  },
+  login("codex", "Sign in to Codex on this machine", [["codex", "login", "--device-auth"]], "Approve the device flow in your browser. Run codex login status afterward; retain this machine’s own credential store."),
+  login("claude", "Sign in to Claude Code on this machine", [["claude", "auth", "login"]], "Complete the native browser login, then run claude auth status --json. API-key and subscription contexts can differ."),
+  login("github", "Sign in to GitHub and configure Git", [
+    [
+      "gh",
+      "auth",
+      "login",
+      "--hostname",
+      "github.com",
+      "--web",
+      "--git-protocol",
+      "https"
+    ],
+    ["gh", "auth", "setup-git"]
+  ], "Approve GitHub in the browser on the intended account, then run gh auth status --active. Environment tokens can override stored login; inspect their source locally."),
+  login("vault", "Authorize this machine for the shared Vault", [], "Run vault login -method=userpass username=YOUR_USERNAME in your own terminal. The native CLI prompts privately for the password. Use the existing permitted project/config; never copy VAULT_TOKEN between computers."),
+  login("railway", "Sign in to Railway", [["railway", "login", "--browserless"]], "Complete the browserless native flow, then run railway whoami --json."),
+  login("vercel", "Sign in to Vercel", [["vercel", "login"]], "Complete native login, then run vercel whoami. Select the intended team/project separately; do not create resources as a login repair."),
+  login("cloudflare", "Sign in to Cloudflare", [["wrangler", "login", "--browser=false"]], "Complete native OAuth login, then run wrangler whoami --json. For headless SSH, prefer an existing scoped API token injected by the approved Vault config. --browser=false suppresses browser launch; it does not make a remote loopback callback reachable. Any OAuth callback tunnel needs explicit operator setup. Resource access still depends on account permissions."),
+  login("aws", "Refresh the selected AWS SSO session", [["aws", "sso", "login"]], "Configure the intended profile with aws configure sso first if needed. Login and the health check use this shell’s current profile; no access keys are cloned."),
+  login("npm", "Sign in to npm on this machine", [
+    [
+      "npm",
+      "login",
+      "--auth-type=web",
+      "--registry=https://registry.npmjs.org/"
+    ]
+  ], "Complete the specific CLI approval and run npm whoami. Prefer the existing trusted-publisher CI workflow for releases."),
+  login("opencode", "Authorize an OpenCode provider", [["opencode", "auth", "login"]], "Prefer the existing Vault-backed providers repair for managed API keys. Native auth login handles an operator-owned OAuth provider. Credential listing alone does not prove live provider access."),
+  login("copilot", "Sign in to Copilot", [["copilot", "login"]], "Complete native login; provider authorization still needs supported operator diagnostics. No model prompt is used for health checking."),
+  login("gemini", "Sign in to Gemini", [], "Open Gemini interactively and choose its supported sign-in flow. Provider authorization remains unverified without a supported read-only status adapter."),
+  {
+    id: "t3",
+    title: "Enable and authorize T3 Connect",
+    owner: "T3",
+    automatic: false,
+    action: "Run t3 up --connect in this machine’s terminal and approve the intended connection. Treat pairing material as private. Then check t3 status --json and perform an operator peer test.",
+    commands: [["t3", "up", "--connect"]]
+  },
+  {
+    id: "docker",
+    title: "Start the intended Docker runtime",
+    owner: "OS / Docker",
+    automatic: false,
+    action: "Start Docker Desktop on desktop systems, or the already-installed Docker service using the OS service manager on Linux. Confirm the intended context with docker context ls. This repair never installs a daemon, invokes sudo, changes contexts or exposes a TCP socket.",
+    commands: [
+      ["docker", "context", "ls"],
+      ["docker", "info"]
+    ]
+  },
+  {
+    id: "password-manager",
+    title: "Review shared human login onboarding",
+    owner: "password-manager / Bitwarden",
+    automatic: false,
+    action: "Use the existing password-manager doctor and actions list on this computer. Its setup guides native consent and Bitwarden enrollment. Keep its private state and OS credential store local. Password vault access does not authorize native CLI OAuth sessions; imports and rotations remain separate reviewed workflows.",
+    commands: [
+      ["bun", "run", "password-manager", "doctor"],
+      ["bun", "run", "password-manager", "actions", "list"]
+    ]
+  },
+  {
+    id: "operator",
+    title: "Resolve the check with its owning tool",
+    owner: "operator / existing owner",
+    automatic: false,
+    action: "Follow the check’s remedy on the affected machine. Verify host fingerprints, register real SSH aliases/checkouts, reconcile Git changes, or perform the named end-to-end test. Infrastructure changes remain OpenTofu-owned.",
+    commands: []
+  }
+];
+var AUTOMATED_REPAIRS = [
+  "workspace",
+  "workstation",
+  "providers"
+];
+function recipe(id) {
+  return REPAIR_RECIPES.find((entry) => entry.id === id) ?? REPAIR_RECIPES.find((entry) => entry.id === "operator");
+}
+
+// packages/fleet/src/repair-plan.ts
+function repairId(check) {
+  if (check.id.startsWith("tool:docker-"))
+    return "docker";
+  if (check.id.startsWith("tool:github-auth"))
+    return "login:github";
+  if (["dependencies", "auth:toolchain"].includes(check.id))
+    return "workspace";
+  if (check.id.startsWith("tool:"))
+    return "workspace";
+  if (check.id.startsWith("workstation:"))
+    return "workstation";
+  if (check.id.startsWith("auth:") && !["auth:vscode", "auth:workstation"].includes(check.id))
+    return `login:${check.id.slice(5)}`;
+  if (check.id === "t3:settings" || check.id === "t3:api")
+    return "t3";
+  return "operator";
+}
+function repairPlan(reports, targets) {
+  const steps = [];
+  for (const report of reports) {
+    const groups = new Map;
+    for (const check of report.checks.filter((entry) => entry.status !== "pass")) {
+      const repair = recipe(repairId(check)).id;
+      groups.set(repair, [...groups.get(repair) ?? [], check]);
+    }
+    for (const [id, checks] of groups)
+      steps.push({
+        ...recipe(id),
+        node: report.node,
+        eligible: targets.some((target) => target.name === report.node) && report.snapshot !== undefined,
+        checks: checks.map((check) => check.id),
+        next: [
+          ...new Set(checks.flatMap((check) => check.remedy ? [check.remedy.action] : [check.summary]))
+        ]
+      });
+  }
+  return steps;
+}
+function automaticRepairs(steps, node) {
+  return AUTOMATED_REPAIRS.flatMap((id) => steps.filter((step) => step.node === node && step.id === id && step.automatic && step.eligible));
+}
+
+// packages/personal-cli/src/repair-inspect.ts
+async function inspectRepair(options, settings, services) {
+  if (options.local)
+    return inspectLocal(settings, services);
+  const roster = await readRoster(settings.config);
+  if (options.node?.length)
+    return inspectSelected(options, roster, services);
+  return inspectTailnet(options, settings, roster, services);
+}
+async function inspectLocal(settings, services) {
+  const snapshot = await probe(settings.workspace, HEALTH_CAPABILITIES, services.run);
+  return {
+    reports: [{ node: "local", snapshot, checks: snapshot.checks }],
+    targets: [
+      {
+        name: "local",
+        root: settings.workspace,
+        fingerprint: snapshot.fingerprint
+      }
+    ],
+    coverage: {
+      scope: "local",
+      limitation: "Only this process context was tested."
+    }
+  };
+}
+async function inspectSelected(options, roster, services) {
+  if (!roster)
+    throw new FleetUsageError("Register real SSH aliases and checkout paths before selecting remote repairs.");
+  const nodes = selectNodes(roster, options.node ?? []);
+  const source = await services.source();
+  const reports = await mapBounded(nodes, (node) => inspectRemote({
+    ...node,
+    required: [...new Set([...node.required, ...HEALTH_CAPABILITIES])]
+  }, { action: "probe", source, timeoutMs: timeout(options) }, services.run));
+  return {
+    reports,
+    targets: nodes.map((node) => attachFingerprint({ name: node.id, root: node.workspace, node }, reports)),
+    coverage: {
+      scope: "selected",
+      limitation: "Only selected roster computers were tested; other devices are unverified."
+    }
+  };
+}
+async function inspectTailnet(options, settings, roster, services) {
+  const tailnet = await discoverTailnet(services.run);
+  const reports = await tailnetHealth(tailnet, roster?.nodes ?? [], {
+    root: settings.workspace,
+    timeoutMs: timeout(options),
+    source: services.source
+  }, services.run);
+  const matches = await matchComputers(roster?.nodes ?? [], tailnet.computers, services.run);
+  const targets = [];
+  for (const peer of tailnet.computers) {
+    if (peer.self)
+      targets.push({ name: peer.dns, root: settings.workspace });
+    else if (peer.online && uniqueMapping(matches.get(peer.id), matches)) {
+      const node = matches.get(peer.id)[0];
+      targets.push({ name: peer.dns, root: node.workspace, node });
+    }
+  }
+  if (!tailnet.computers.some((peer) => peer.self))
+    targets.push({ name: "controller", root: settings.workspace });
+  return {
+    reports,
+    targets: targets.map((target) => attachFingerprint(target, reports)),
+    coverage: {
+      scope: "tailscale-visible-computers",
+      limitation: "Only devices visible to this Tailscale account/ACLs. Offline, unregistered or ambiguous computers cannot be repaired. No credentials, host keys or resources are cloned."
+    }
+  };
+}
+function attachFingerprint(target, reports) {
+  const snapshot = reports.find((report) => report.node === target.name)?.snapshot;
+  return {
+    ...target,
+    ...snapshot ? { fingerprint: snapshot.fingerprint } : {}
+  };
+}
+
+// packages/fleet/src/repair-runner.ts
+function validRepairs(value) {
+  return Array.isArray(value) && value.length > 0 && value.length <= 3 && new Set(value).size === value.length && value.every((id) => AUTOMATED_REPAIRS.includes(id));
+}
+async function repairWorkspace(root, repairs, run, expected) {
+  if (!validRepairs(repairs))
+    throw new Error("Unsupported repairs");
+  const before = await fingerprint(root, run);
+  if (!before.head || !Object.values(before.files).every(Boolean))
+    return [
+      {
+        id: "repair:workspace",
+        status: "fail",
+        summary: "Repairs require a complete existing checkout. Register/bootstrap it first."
+      }
+    ];
+  if (expected && JSON.stringify(before) !== JSON.stringify(expected))
+    return [
+      {
+        id: "repair:inputs",
+        status: "fail",
+        summary: "Checkout inputs changed since diagnostics. Generate a fresh repair plan before applying."
+      }
+    ];
+  const checks = [];
+  for (const id of AUTOMATED_REPAIRS.filter((entry) => repairs.includes(entry))) {
+    const result = id === "workspace" ? await syncWorkspace(root, false, run) : await ownerCommand(root, id, run);
+    checks.push(...result);
+    if (result.some((check) => check.status !== "pass"))
+      break;
+  }
+  const after = await fingerprint(root, run);
+  if (JSON.stringify(before) !== JSON.stringify(after))
+    checks.push({
+      id: "repair:inputs",
+      status: "fail",
+      summary: "Checkout inputs changed during repair. Stop and review the checkout before retrying."
+    });
+  return checks;
+}
+async function ownerCommand(root, id, run) {
+  const result = await run(recipe(id).commands[0], {
+    cwd: root,
+    timeoutMs: 1200000
+  });
+  return [
+    {
+      id: `repair:${id}`,
+      status: result.ok ? "pass" : "fail",
+      summary: result.ok ? "The existing owner command completed. Fresh diagnostics determine whether configuration and authorization now pass." : `The owner command failed (${result.reason}); partial changes are possible. Raw output and credentials are withheld. Later repairs on this computer were stopped.`
+    }
+  ];
+}
+
+// packages/personal-cli/src/repair-apply.ts
+async function applyRepairs(targets, steps, options, services) {
+  let source;
+  return mapBounded(targets, async (target) => {
+    const actions = automaticRepairs(steps, target.name);
+    const checks = [];
+    for (const step of actions) {
+      try {
+        if (!target.fingerprint)
+          throw new Error("No verified checkout fingerprint");
+        const repairs = [step.id];
+        const result = target.node ? (await inspectRemote(target.node, {
+          action: "repair",
+          repairs,
+          expected: target.fingerprint,
+          source: await (source ??= Promise.resolve().then(services.source)),
+          timeoutMs: timeout(options)
+        }, services.run)).checks : await repairWorkspace(target.root, repairs, services.run, target.fingerprint);
+        checks.push(...result);
+        if (result.some((check) => check.status !== "pass"))
+          break;
+      } catch {
+        checks.push({
+          id: "repair:operation",
+          status: "fail",
+          summary: "Repair could not be prepared or completed. Later actions on this computer were stopped; inspect partial changes locally. Raw errors are withheld."
+        });
+        break;
+      }
+    }
+    return { node: target.name, checks };
+  }, 1);
+}
+
+// packages/personal-cli/src/repair-script.ts
+function targetCommand(target, commands) {
+  const command = `cd -- ${shellQuote(target.root)} && ${commands.map((args) => args.map(shellQuote).join(" ")).join(" && ")}`;
+  if (!target.node)
+    return command;
+  return [
+    ...sshArgs(target.node).map((arg) => arg === "-T" ? "-t" : arg).map(shellQuote),
+    shellQuote(command)
+  ].join(" ");
+}
+function repairScript(steps, targets) {
+  const lines = [
+    "#!/bin/sh",
+    "set -eu",
+    "# Generated repair plan. Review before running in your own terminal.",
+    "# Automated steps use existing owners. Native login commands below are commented and require operator approval.",
+    "# POSIX shell required; Windows operators can use the personal commands directly."
+  ];
+  for (const target of targets) {
+    const actions = automaticRepairs(steps, target.name);
+    if (!actions.length)
+      continue;
+    const commands = actions.flatMap((step) => step.id === "workspace" ? [
+      [
+        "bun",
+        "packages/fleet/src/cli.ts",
+        "sync",
+        "--local",
+        "--apply",
+        "--yes",
+        "--json"
+      ]
+    ] : recipe(step.id).commands);
+    lines.push("", targetCommand(target, commands));
+  }
+  for (const step of steps.filter((entry) => !entry.automatic || !entry.eligible)) {
+    lines.push("", `# ${comment(step.node)} / ${comment(step.title)}`, `# ${comment(step.action)}`);
+    const target = targets.find((entry) => entry.name === step.node);
+    if (target && step.eligible && step.commands.length)
+      lines.push(`# ${targetCommand(target, step.commands)}`);
+    else
+      for (const next of step.next)
+        lines.push(`# ${comment(next)}`);
+  }
+  lines.push("", "# Re-run personal fleet health --json for fresh whole-tailnet coverage.");
+  return `${lines.join(`
+`)}
+`;
+}
+function comment(value) {
+  return value.replace(/[\r\n\x00-\x1f\x7f]/g, " ");
+}
+
+// packages/personal-cli/src/repair-guard.ts
+import { createHash as createHash3 } from "node:crypto";
+function repairPlanHash(steps, targets) {
+  return createHash3("sha256").update(JSON.stringify({ steps, targets })).digest("hex");
+}
+
+// packages/personal-cli/src/repair.ts
+function requestedRepairs(value) {
+  if (value === undefined)
+    return;
+  const ids = value.split(",");
+  if (!ids.length || ids.some((id) => !AUTOMATED_REPAIRS.includes(id)))
+    throw new FleetUsageError("--repair expects workspace,workstation,providers. Native logins require operator approval; inspect fleet repairs.");
+  return [...new Set(ids)];
+}
+function repairCatalog() {
+  return {
+    exitCode: 0,
+    data: {
+      version: 1,
+      command: "repairs",
+      ok: true,
+      recipes: REPAIR_RECIPES,
+      credentials: [
+        "Use the existing password-manager / Bitwarden owner for human passwords and shared login items. Run bun run password-manager doctor and actions list on each machine; never synchronize its private state.",
+        "Authenticate each computer independently with the intended identity. Never clone OAuth caches, browser cookies, keychains, SSH private keys or Vault sessions.",
+        "Access shared permitted API keys through this machine’s existing Vault/secret-store session. Prefer vault run --config dev -- COMMAND for process-scoped injection.",
+        "The workstation owner can render its supported provider configuration from Vault with 0600 permissions. Missing provider keys and live provider access still require checks.",
+        "Service roles, shared resources, Vault policies and infrastructure remain OpenTofu-owned. A login does not grant every account/team/resource permission."
+      ]
+    }
+  };
+}
+async function executeRepairCommand(command, options, settings, services) {
+  return command === "repairs" ? repairCatalog() : executeRepair(options, settings, services);
+}
+async function executeRepair(options, settings, services) {
+  const selected = requestedRepairs(options.repair);
+  const before = await inspectRepair(options, settings, services);
+  const steps = selectRepairs(repairPlan(before.reports, before.targets), before, selected);
+  const planHash = repairPlanHash(steps, before.targets);
+  if (options.planHash && options.planHash !== planHash)
+    throw new FleetUsageError("Repair plan changed since review. Generate and review a fresh preview; nothing was applied.");
+  const initial = makeReport("repair", before.reports);
+  const healthOk = reportExitCode(initial, true) === 0;
+  const script = options.script ? repairScript(steps, before.targets) : undefined;
+  if (!options.apply)
+    return {
+      exitCode: 0,
+      data: {
+        ...initial,
+        ok: true,
+        applied: false,
+        planHash,
+        healthOk,
+        coverage: before.coverage,
+        steps,
+        ...script ? { script } : {},
+        authorize: "Preview only. Review effects, then repeat with --apply --yes. Only eligible automatic steps execute. Native logins and manual steps remain operator work."
+      },
+      text: script ?? renderSteps(steps)
+    };
+  return appliedOutcome(steps, before, { options, settings, services });
+}
+async function appliedOutcome(steps, before, context) {
+  const { options, settings, services } = context;
+  const executions = await applyRepairs(before.targets, steps, options, services);
+  const after = await recheckRepair(before, options, settings, services);
+  const checked = makeReport("repair", after.reports);
+  const executionOk = executions.every((node) => node.checks.every((check) => check.status === "pass"));
+  const verified = reportExitCode(checked, true) === 0;
+  const ok = executionOk && verified;
+  return {
+    exitCode: ok ? 0 : 1,
+    data: {
+      ...checked,
+      ok,
+      applied: true,
+      executionOk,
+      healthOk: verified,
+      coverage: after.coverage,
+      steps,
+      executions,
+      remaining: repairPlan(after.reports, after.targets),
+      completed: executions.flatMap((node) => node.checks).filter((check) => check.status === "pass").length
+    },
+    text: `Repair commands ${executionOk ? "completed" : "need attention"}; fresh health ${verified ? "verified" : "still has failing or unverified checks"}.
+${renderSteps(repairPlan(after.reports, after.targets))}`
+  };
+}
+function selectRepairs(steps, inspection, selected) {
+  if (!selected)
+    return steps;
+  const filtered = steps.filter((step) => !step.automatic || selected.includes(step.id));
+  for (const target of inspection.targets) {
+    const report = inspection.reports.find((entry) => entry.node === target.name);
+    if (!report?.snapshot)
+      continue;
+    for (const id of selected)
+      if (!filtered.some((step) => step.node === target.name && step.id === id))
+        filtered.push({
+          ...recipe(id),
+          node: target.name,
+          eligible: true,
+          checks: ["explicit:request"],
+          next: [
+            "Explicitly requested owner action; fresh diagnostics still follow."
+          ]
+        });
+  }
+  return filtered;
+}
+function renderSteps(steps) {
+  return steps.map((step) => `${step.node} / ${step.id}: ${step.automatic && step.eligible ? "automatic after --apply --yes" : "operator action"}
+  ${step.action}`).join(`
+`);
+}
+async function recheckRepair(before, options, settings, services) {
+  try {
+    return await inspectRepair(options, settings, services);
+  } catch {
+    return {
+      reports: before.reports.map((report) => ({
+        node: report.node,
+        checks: [
+          {
+            id: "repair:recheck",
+            status: "fail",
+            summary: "Fresh diagnostics could not complete after repair. Earlier diagnostics are not being treated as fresh; inspect this computer and rerun health."
+          }
+        ]
+      })),
+      targets: [],
+      coverage: {
+        ...before.coverage,
+        limitation: "Post-repair diagnostics failed. Execution results are retained; machine health remains unverified."
+      }
+    };
+  }
+}
+
+// packages/personal-cli/src/fleet.ts
+var SERVICES = { run: runCommand, source: probeSource };
+async function executeFleet(command, options, settings, services = SERVICES) {
+  validateOptions(command, options);
+  if (["repair", "repairs"].includes(command))
+    return executeRepairCommand(command, options, settings, services);
+  if (["discover", "health"].includes(command))
+    return executeTailnet(command, options, settings, services);
+  if (command === "schema")
+    return result(schema_default);
+  if (command === "init")
+    return initialize(settings, options);
+  if (command === "add")
+    return register(settings, options);
+  const roster = options.local ? null : await readRoster(settings.config);
+  const nodes = resolveNodes(command, options, roster);
+  if (["nodes", "validate", "onboard"].includes(command))
+    return rosterResult(command, nodes, roster !== null);
+  if (command === "sync")
+    return synchronize(nodes, options, settings, services);
+  return diagnose(nodes, options, { ...settings, missingRoster: !roster }, services);
+}
+function rosterResult(command, nodes, configured) {
+  return result({
+    version: 1,
+    command,
+    ok: true,
+    ...command === "nodes" ? { configured } : {},
+    nodes: command === "onboard" ? nodes.map((node) => onboarding(node, "personal fleet")) : nodes
+  });
+}
+function resolveNodes(command, options, roster) {
+  if (!roster && !options.local && !["doctor", "nodes"].includes(command))
+    throw new FleetUsageError("No fleet roster. Use fleet add or the interactive Register action; use fleet doctor --local for this machine.");
+  if (options.node?.length && !roster)
+    throw new FleetUsageError("Cannot select nodes without a roster. Use fleet add first.");
+  return roster ? selectNodes(roster, options.node ?? []) : [];
+}
+function result(data, text) {
+  return { exitCode: 0, data, ...text ? { text } : {} };
+}
+async function register(settings, options) {
+  const node = nodeFromOptions(options);
+  const config = await addNode(settings.config, node, options.apply === true);
+  return result({
+    version: 1,
+    command: "add",
+    ok: true,
+    applied: options.apply === true,
+    path: settings.config,
+    node,
+    nodes: config.nodes,
+    next: options.apply ? "Run fleet onboard, then fleet doctor --all --json." : "Review this preview, then repeat with --apply --yes."
+  });
+}
+async function initialize(settings, options) {
+  const config = {
+    ...fleet_example_default,
+    $schema: new URL("./schema.json", import.meta.url).href
+  };
+  if (options.apply) {
+    await mkdir5(dirname5(settings.config), { recursive: true, mode: 448 });
+    try {
+      await writeFile3(settings.config, `${JSON.stringify(config, null, 2)}
+`, {
+        flag: "wx",
+        mode: 384
+      });
+    } catch {
+      throw new FleetUsageError("Cannot create roster. Existing files are never overwritten; use --config PATH.");
+    }
+  }
+  return result({
+    version: 1,
+    command: "init",
+    ok: true,
+    applied: options.apply === true,
+    path: settings.config,
+    config,
+    next: "This is example data, not discovered machines. Edit placeholders before doctor, or use fleet add to register real nodes."
+  });
+}
+async function diagnose(nodes, options, settings, services) {
+  const source = nodes.length ? await services.source() : undefined;
+  const reports = await doctor(nodes, {
+    root: settings.workspace,
+    local: options.local === true,
+    required: capabilities(options.require),
+    timeoutMs: timeout(options),
+    ...source ? { source } : {}
+  }, services.run);
+  if (!options.local && settings.missingRoster)
+    reports.push(missingRoster());
+  const report = {
+    ...makeReport("doctor", reports),
+    coverage: {
+      scope: options.local ? "local" : options.node?.length ? "selected" : "all-configured",
+      controller: true,
+      configuredNodesTested: nodes.map((node) => node.id),
+      rosterAvailable: !settings.missingRoster,
+      note: "Directed SSH checks from this controller only. T3 relay/peer and VS Code forwarding require operator tests."
+    }
+  };
+  return {
+    exitCode: reportExitCode(report, options.strict === true),
+    data: report,
+    text: renderReport(report)
+  };
+}
+function missingRoster() {
+  return {
+    node: "fleet",
+    checks: [
+      {
+        id: "fleet:roster",
+        status: "fail",
+        summary: "No developer fleet roster is configured. Only this controller could be checked; fleet-wide health is unknown.",
+        remedy: {
+          action: "Open personal and choose Register a developer computer, or run personal fleet add --help. Then run fleet doctor --all."
+        }
+      }
+    ]
+  };
+}
+async function synchronize(nodes, options, settings, services) {
+  if (!options.apply)
+    return result({
+      version: 1,
+      command: "sync",
+      ok: true,
+      applied: false,
+      targets: options.local ? ["local"] : nodes.map((node) => node.id),
+      steps: syncPlan(options.pull === true),
+      authorize: "Review the plan; repeat with --apply --yes to authorize changes."
+    });
+  const reports = options.local ? [
+    {
+      node: "local",
+      checks: await syncWorkspace(settings.workspace, options.pull === true, services.run)
+    }
+  ] : await syncRemotes(nodes, options, services);
+  const report = makeReport("sync", reports);
+  return {
+    exitCode: reportExitCode(report, options.strict === true),
+    data: report,
+    text: renderReport(report)
+  };
+}
+async function syncRemotes(nodes, options, services) {
+  const source = await services.source();
+  return mapBounded(nodes, (node) => inspectRemote(node, {
+    source,
+    action: "sync",
+    timeoutMs: timeout(options),
+    pull: options.pull === true
+  }, services.run), 1);
+}
+
+// packages/personal-cli/src/node-sync.ts
+import { join as join10 } from "node:path";
+
+// packages/fleet/src/configure.ts
+import { join as join9 } from "node:path";
+import { mkdir as mkdir6, writeFile as writeFile4, rename as rename3 } from "node:fs/promises";
+import { randomUUID as randomUUID3 } from "node:crypto";
+function validConfiguration(value) {
+  return record(value) && typeof value["revision"] === "string" && /^[a-f0-9]{40}$/.test(value["revision"]) && ["codex", "claude", "opencode", "gemini"].includes(String(value["tool"])) && ["direct", "proxy"].includes(String(value["profile"])) && typeof value["node"] === "string" && /^[a-z0-9][a-z0-9-]{0,62}$/.test(value["node"]);
+}
+async function configureWorkspace(root, request, run) {
+  if (!validConfiguration(request))
+    return failure("Invalid reviewed revision or configuration selection.");
+  const directory = join9(root, "node_modules", ".fleet-revisions", request.revision);
+  const head = await run(["git", "rev-parse", "--verify", `${request.revision}^{commit}`], { cwd: root });
+  if (!head.ok || head.stdout.trim() !== request.revision)
+    return failure("Reviewed commit is unavailable locally. Fetch it explicitly and retry.");
+  const prepared = await prepareRevision(root, directory, request.revision, run);
+  if (prepared.length)
+    return prepared;
+  const setup = await run([
+    "mise",
+    "exec",
+    "--locked",
+    "bun",
+    "--",
+    "bun",
+    "scripts/dev/setup.ts",
+    "--non-interactive"
+  ], { cwd: directory, timeoutMs: 1200000 });
+  if (!setup.ok)
+    return failure("Existing setup owner failed. Partial tool/dependency installation is possible; no configuration receipt was advanced.");
+  const applied = await applyOwner(directory, request, run);
+  if (!applied.ok)
+    return failure("personal workstation configuration failed. Inspect preview on this node; no rollout receipt was advanced.");
+  const receipt = decodeReceipt(applied.stdout, request.revision);
+  if (!receipt)
+    return failure("personal workstation returned an invalid receipt; rollout remains unverified.");
+  await recordConfiguration(root, request, receipt);
+  return [
+    {
+      id: "configuration:apply",
+      status: "pass",
+      summary: `personal workstation applied revision ${request.revision}; configuration fingerprint ${receipt}. Authentication and T3 end-to-end remain separate gates.`
+    }
+  ];
+}
+function decodeReceipt(output, revision) {
+  try {
+    const data = JSON.parse(output);
+    return record(data) && data["ok"] === true && data["revision"] === revision && typeof data["fingerprint"] === "string" && /^[a-f0-9]{64}$/.test(data["fingerprint"]) ? data["fingerprint"] : null;
+  } catch {
+    return null;
+  }
+}
+function failure(summary) {
+  return [{ id: "configuration:apply", status: "fail", summary }];
+}
+async function prepareRevision(root, directory, revision, run) {
+  await mkdir6(join9(root, "node_modules", ".fleet-revisions"), {
+    recursive: true
+  });
+  let deployed = await run(["git", "rev-parse", "HEAD"], { cwd: directory });
+  if (!deployed.ok) {
+    const created = await run(["git", "worktree", "add", "--detach", directory, revision], { cwd: root, timeoutMs: 30000 });
+    if (!created.ok)
+      return failure("Cannot create pinned deployment worktree. Existing data was preserved.");
+    deployed = await run(["git", "rev-parse", "HEAD"], { cwd: directory });
+  }
+  const clean = await run(["git", "status", "--porcelain"], { cwd: directory });
+  if (!deployed.ok || deployed.stdout.trim() !== revision || !clean.ok || clean.stdout.trim())
+    return failure("Pinned deployment checkout differs or is dirty. Inspect it; fleet never resets it.");
+  const top = await run(["git", "rev-parse", "--show-toplevel"], {
+    cwd: directory
+  });
+  if (!top.ok || top.stdout.trim() !== directory)
+    return failure("Deployment path is not its own Git worktree.");
+  return [];
+}
+async function recordConfiguration(root, request, receipt) {
+  const receipts = join9(root, "node_modules", ".fleet-configuration");
+  await mkdir6(receipts, { recursive: true, mode: 448 });
+  const path = join9(receipts, `${request.node}-${request.tool}-${request.profile}.json`);
+  const temp = `${path}.${randomUUID3()}.tmp`;
+  await writeFile4(temp, JSON.stringify({ version: 1, ...request, fingerprint: receipt }) + `
+`, { flag: "wx", mode: 384 });
+  await rename3(temp, path);
+}
+async function applyOwner(directory, request, run) {
+  return run([
+    "mise",
+    "exec",
+    "--locked",
+    "bun",
+    "--",
+    "bun",
+    "packages/workstation/cli/internal.ts",
+    "--json",
+    "--yes",
+    "--non-interactive",
+    "agents",
+    "apply",
+    "--node",
+    request.node,
+    "--tool",
+    request.tool,
+    "--profile",
+    request.profile
+  ], { cwd: directory, timeoutMs: 120000 });
+}
+
+// packages/personal-cli/src/node-t3.ts
+async function syncT3(options, settings) {
+  try {
+    return await t3Command("t3-apply", options, settings);
+  } catch (error) {
+    return {
+      exitCode: 1,
+      data: {
+        version: 1,
+        command: "fleet-node-sync",
+        ok: false,
+        applied: true,
+        stage: "t3",
+        error: error instanceof FleetUsageError ? error.message : "T3 reconciliation failed; inspect local configuration and ownership state.",
+        progress: "Tools, launcher and profile steps completed. Node receipt was not advanced. Fix the T3 conflict and repeat fleet-node-sync."
+      }
+    };
+  }
+}
+
+// packages/personal-cli/src/node-sync.ts
+async function syncNode(options, settings, run = runCommand) {
+  if (process.platform === "win32" && !options.dryRun)
+    throw new FleetUsageError("Codex proxy node sync requires macOS/Linux/WSL. Use personal workstation commands for native Windows configuration.");
+  const node = nodeId(options.id);
+  const head = await run(["git", "rev-parse", "--verify", "HEAD"], {
+    cwd: settings.workspace
+  });
+  const revision = options.revision ?? head.stdout.trim();
+  if (!head.ok || !/^[a-f0-9]{40}$/.test(revision))
+    throw new FleetUsageError("An existing personal checkout is required; set --workspace PATH.");
+  const request = { node, revision, tool: "codex", profile: "proxy" };
+  if (options.dryRun)
+    return {
+      exitCode: 0,
+      data: {
+        version: 1,
+        command: "fleet-node-sync",
+        ok: true,
+        applied: false,
+        ...request,
+        steps: [
+          "Reconcile locked tools",
+          "Install personal and retire owned ws launcher",
+          "Upsert Codex proxy profile",
+          "Reconcile declared T3 instances and remove stale owned entries"
+        ]
+      }
+    };
+  const checks = await configureWorkspace(settings.workspace, request, run);
+  if (checks.some((check) => check.status !== "pass"))
+    return {
+      exitCode: 1,
+      data: { version: 1, command: "fleet-node-sync", ok: false, checks }
+    };
+  return finishSync(options, settings, { request, checks }, run);
+}
+async function finishSync(options, settings, input, run) {
+  const { request, checks } = input;
+  const { node, revision } = request;
+  const workspace = join10(settings.workspace, "node_modules/.fleet-revisions", revision);
+  const installed = await run([
+    "bun",
+    "packages/workstation/cli/internal.ts",
+    "--json",
+    "--yes",
+    "--non-interactive",
+    "install"
+  ], { cwd: workspace, timeoutMs: 1200000 });
+  if (!installed.ok)
+    return {
+      exitCode: 1,
+      data: {
+        version: 1,
+        ok: false,
+        checks,
+        error: "Launcher/workstation convergence failed; profile changes may already have applied."
+      }
+    };
+  const t3 = await syncT3({ ...options, id: node }, { ...settings, workspace });
+  if (t3.exitCode !== 0)
+    return t3;
+  await recordDeployment(settings.workspace, node, revision);
+  return {
+    exitCode: 0,
+    data: {
+      version: 1,
+      command: "fleet-node-sync",
+      ok: true,
+      applied: true,
+      ...request,
+      checks,
+      t3: t3.data,
+      readiness: {
+        authentication: "unverified",
+        inference: "unverified",
+        pairing: "unverified"
+      },
+      next: "Use personal t3-status for configuration drift and personal fleet-status for machine health."
+    }
+  };
+}
+
+// packages/personal-cli/src/flat-commands.ts
+function registerFlatCommands(program, defaults, complete) {
+  program.command("fleet-node-sync").description("Reconcile this node’s locked tools and Codex proxy profile; applies by default").option("--id <name>", "Stable node name; defaults to this machine hostname").option("--revision <sha>", "Reviewed commit; defaults to checkout HEAD").option("--dry-run", "Preview without changing this node").option("--t3-home <path>", "T3 base directory").action(async (_options, command) => {
+    const options = command.optsWithGlobals();
+    const settings = await resolveSettings({ ...defaults, ...options });
+    complete(await syncNode(options, settings));
+  });
+  for (const [name, target, description] of [
+    [
+      "fleet-status",
+      "doctor",
+      "Check this computer and all registered fleet nodes"
+    ],
+    ["fleet-discover", "discover", "Find computers visible through Tailscale"]
+  ]) {
+    program.command(name).description(description).action(async (_options, command) => {
+      const options = command.optsWithGlobals();
+      const settings = await resolveSettings({ ...defaults, ...options });
+      complete(await executeFleet(target, {}, settings));
+    });
+  }
+}
+
+// packages/personal-cli/src/agent-guide.ts
+var AGENT_GUIDE = {
+  version: 1,
+  name: "@crvouga/personal",
+  invocation: "personal <command> --json --non-interactive",
+  discovery: "personal commands --json",
+  configuration: {
+    workspace: "--workspace PATH, PERSONAL_WORKSPACE, closest ancestor mise.toml, then current directory",
+    roster: "--config PATH, PERSONAL_FLEET_CONFIG, closest ancestor .fleet.local.json, then ~/.config/personal/fleet.json"
+  },
+  output: {
+    stdout: "One versioned JSON document with --json. Prompts and progress never contaminate stdout.",
+    exitCodes: {
+      "0": "Success or preview",
+      "1": "Failed check or operation; strict also rejects warnings/skips",
+      "2": "Invalid usage or configuration",
+      "130": "Cancelled"
+    },
+    errors: "{version:1,ok:false,code,error}; raw subprocess output and exception details are withheld",
+    reports: "{version:1,command,ok,generatedAt,nodes:[{node,checks:[{id,status,summary,remedy?}]}],summary,coverage}",
+    statuses: ["pass", "warn", "fail", "skip"],
+    coverage: "Default doctor tests the controller and all configured nodes. --local tests only this controller. A missing roster fails explicitly; configured nodes are not every computer that exists. T3/VS Code end-to-end checks remain manual."
+  },
+  safety: [
+    "No arguments opens a menu only on an interactive terminal. --json and --non-interactive never prompt.",
+    "Diagnostics, onboarding instructions, schema, catalogs, scripts and sync/repair previews are read-only.",
+    "fleet-node-sync authorizes local reconciliation by invocation; --dry-run previews. Legacy roster writes, sync and repair require --apply --yes.",
+    "Do not copy credentials, forward SSH agents, bypass host keys, provision infrastructure or execute unreviewed remedies.",
+    "A healthy controller does not prove another machine can connect to it. Run doctor from each intended controller.",
+    "Repair executes only allowlisted owner actions, then reruns diagnostics. Native logins, host trust and resource permissions remain explicit operator steps. Pass the reviewed planHash as --plan-hash to reject a changed plan.",
+    "Shared provider keys are fetched through each machine’s existing Vault authorization by workstation tooling. Never copy machine-local login caches.",
+    "Use exact npm versions for automation. The application never self-updates."
+  ],
+  reconciliation: {
+    plan: "personal t3-plan --json",
+    apply: "personal t3-apply --plan-hash HASH",
+    cleanup: "personal t3-cleanup --dry-run",
+    import: "personal t3-import --instance ID",
+    ownership: "Only declared or explicitly imported T3 instances. Pairing, credentials, threads and unrelated settings are preserved.",
+    concurrency: "Exclusive personal lock with optimistic external T3 file updates; avoid concurrent Settings edits."
+  },
+  examples: [
+    "personal fleet-node-sync",
+    "personal fleet-status",
+    "personal t3-status",
+    "personal fleet doctor --local --workspace /path/to/personal --json",
+    "personal fleet doctor --all --json --strict --timeout 120000",
+    "personal fleet add --id dev-linux --ssh dev-linux --path /home/dev/workspace --require github,t3,toolchain --json",
+    "personal fleet add --id dev-linux --ssh dev-linux --path /home/dev/workspace --apply --yes --json",
+    "personal fleet doctor --node dev-linux --json",
+    "personal fleet sync --node dev-linux --json",
+    "personal fleet repairs --json",
+    "personal fleet repair --json",
+    "personal fleet repair --local --repair workspace --json",
+    "personal fleet repair --local --repair workspace --plan-hash <reviewed-sha256> --apply --yes --json"
+  ]
+};
+
+// packages/personal-cli/src/program.ts
+var GLOBAL_OPTIONS = [
+  {
+    flag: "--json",
+    description: "One versioned JSON document on stdout; never prompt"
+  },
+  { flag: "--non-interactive", description: "Never open interactive prompts" },
+  {
+    flag: "--workspace <path>",
+    description: "Existing controller checkout; does not clone or change it"
+  },
+  { flag: "--config <path>", description: "Local, secret-free fleet roster" }
+];
+function common(command) {
+  return command.option("--node <id>", "Select an existing node; repeat for multiple nodes", collect, []).option("--local", "Controller only; no roster or SSH required").option("--all", "All targets: doctor uses the roster; repair uses the visible tailnet").option("--require <capabilities>", "Controller capabilities, comma separated, or none").option("--timeout <ms>", "Per-node deadline, 1000–1800000 milliseconds").option("--strict", "Warnings and skipped checks also produce exit 1").option("--repair <ids>", "Repair only: workspace,workstation,providers; comma separated").option("--plan-hash <sha256>", "Repair only: require the reviewed plan to match current diagnostics").option("--script", "Repair only: generate a reviewable POSIX script without executing it").option("--pull", "Sync only: explicitly request a clean, fast-forward pull").option("--apply", "Authorize the displayed roster/sync/repair mutation; requires --yes").option("--yes", "Confirm an explicitly requested --apply operation");
+}
+function collect(value, previous) {
+  return [...previous, value];
+}
+function createProgram(version, output) {
+  const program = new Command().name("personal").description("Developer command center · interactive for people, structured for agents").version(version).exitOverride().configureOutput({ writeOut: output, writeErr: () => {
+    return;
+  } }).showSuggestionAfterError(false).option("--interactive", "Open the interactive terminal application (TTY required)");
+  for (const option of GLOBAL_OPTIONS)
+    program.option(option.flag, option.description);
+  return program;
+}
+function fleetCommands(program) {
+  const fleet = program.command("fleet").description("Diagnose, explore and onboard developer computers");
+  const definitions = commandCatalog().filter((entry) => entry.group === "Fleet" && entry.args[0] === "fleet" && entry.id !== "fleet doctor local");
+  return definitions.map((entry) => {
+    const command = common(fleet.command(entry.args[1]).description(entry.description));
+    if (entry.args[1] === "add")
+      command.requiredOption("--id <name>", "Unique lowercase node ID").requiredOption("--ssh <alias>", "Existing OpenSSH alias; never writes SSH configuration").requiredOption("--path <path>", "Absolute POSIX checkout path on the node").option("--runtime <path>", "Optional absolute Node/Bun runtime; defaults to node on SSH PATH");
+    command.addHelpText("after", `
+Example: ${entry.examples[0]}
+Writes require both --apply and --yes. Diagnostics never log in or repair automatically.`);
+    return command;
+  });
+}
+function catalog(options, version) {
+  const commands = commandCatalog(options.search, options.group);
+  return {
+    exitCode: 0,
+    data: {
+      version: 1,
+      cliVersion: version,
+      command: "commands",
+      ok: true,
+      commands,
+      globalOptions: GLOBAL_OPTIONS,
+      agentGuide: "personal agent --json",
+      schema: "personal fleet schema --json"
+    },
+    text: [
+      "Personal command catalog",
+      ...commands.map((entry) => `
+  ${entry.id}
+    ${entry.description}`),
+      `
+Run personal for the interactive application; add --json for agents.`
+    ].join(`
+`)
+  };
+}
+async function execute(args, defaults, version) {
+  let outcome;
+  let output = "";
+  const program = createProgram(version, (text) => {
+    output += text;
+  });
+  registerT3(program, defaults, (result) => {
+    outcome = result;
+  });
+  registerFlatCommands(program, defaults, (result) => {
+    outcome = result;
+  });
+  program.command("workstation [args...]").description("Local configuration, tools, agent profiles and launcher lifecycle").allowUnknownOption().action(async (args, command) => {
+    const options = command.optsWithGlobals();
+    const settings = await resolveSettings({
+      ...defaults,
+      ...settingsOverrides(options)
+    });
+    outcome = await workstationCommand(args, settings);
+  });
+  const commands = fleetCommands(program);
+  for (const command of commands)
+    command.action(async () => {
+      const options = command.optsWithGlobals();
+      const settings = await resolveSettings({
+        ...defaults,
+        ...settingsOverrides(options)
+      });
+      outcome = await executeFleet(command.name(), options, settings);
+    });
+  program.command("commands").description("Search the complete command catalog").option("--search <text>", "Filter names, descriptions and keywords").option("--group <name>", "Filter category, for example Fleet or Reference").action((_options, command) => {
+    outcome = catalog(command.optsWithGlobals(), version);
+  });
+  program.command("agent").description("Machine-readable usage and safety contract").action(() => {
+    outcome = { exitCode: 0, data: AGENT_GUIDE };
+  });
+  program.action(() => {
+    outcome = catalog(program.opts(), version);
+  });
+  try {
+    await program.parseAsync(args, { from: "user" });
+    return outcome ?? {
+      exitCode: 0,
+      data: { version: 1, help: output.trim() },
+      text: output.trim()
+    };
+  } catch (error) {
+    return commandError(error, output);
+  }
+}
+function settingsOverrides(options) {
+  return {
+    ...options.workspace ? { workspace: options.workspace } : {},
+    ...options.config ? { config: options.config } : {}
+  };
+}
+function commandError(error, output) {
+  if (error instanceof CommanderError && error.exitCode === 0)
+    return {
+      exitCode: 0,
+      data: { version: 1, help: output.trim() },
+      text: output.trim()
+    };
+  const usage = error instanceof CommanderError || error instanceof FleetUsageError;
+  return {
+    exitCode: usage ? 2 : 1,
+    data: {
+      version: 1,
+      ok: false,
+      code: usage ? "invalid_usage" : "operation_failed",
+      error: error instanceof FleetUsageError ? error.message : usage ? "Invalid command or option. Run personal --help or personal commands --json." : "Operation failed. Inspect configuration and permissions locally; raw errors are withheld to protect credentials."
+    }
+  };
+}
+
+// packages/personal-cli/src/app.ts
+import { parseArgs } from "node:util";
+var VERSION = "0.1.1";
+function wantsInteractive(args, terminal, ci) {
+  if (args.includes("--json") || args.includes("--non-interactive"))
+    return false;
+  return terminal && (args.includes("--interactive") || contextOnly(args) && !ci);
+}
+function startup(args) {
+  return parseArgs({
+    args,
+    allowPositionals: true,
+    strict: false,
+    options: {
+      workspace: { type: "string" },
+      config: { type: "string" },
+      interactive: { type: "boolean" },
+      json: { type: "boolean" },
+      "non-interactive": { type: "boolean" }
+    }
+  });
+}
+function contextOnly(args) {
+  const parsed = startup(args);
+  return parsed.positionals.length === 0 && Object.keys(parsed.values).every((key) => ["workspace", "config", "interactive"].includes(key));
+}
+async function main(args = process.argv.slice(2)) {
+  const { values } = startup(args);
+  const settings = await resolveSettings({
+    ...typeof values.workspace === "string" ? { workspace: values.workspace } : {},
+    ...typeof values.config === "string" ? { config: values.config } : {}
+  });
+  if (startup(args).positionals[0] === "workstation")
+    return forwardWorkstation(args, settings);
+  const terminal = interactiveTerminal();
+  if (args.includes("--interactive") && !terminal) {
+    process.stdout.write(`${JSON.stringify({ version: 1, ok: false, code: "tty_required", error: "Interactive mode needs a terminal. Use personal commands --json or fleet doctor --local --json." })}
+`);
+    return 2;
+  }
+  if (wantsInteractive(args, terminal, Boolean(process.env["CI"]))) {
+    await Promise.resolve().then(() => init_ui());
+    await startInteractive({
+      ...settings,
+      version: VERSION,
+      commands: COMMANDS,
+      execute: (command) => execute(command, settings, VERSION)
+    });
+    return 0;
+  }
+  const outcome = await execute(args.filter((arg) => arg !== "--interactive"), settings, VERSION);
+  const text = args.includes("--json") ? JSON.stringify(outcome.data, null, 2) : outcome.text ?? JSON.stringify(outcome.data, null, 2);
+  process.stdout.write(`${text}
+`);
+  return outcome.exitCode;
+}
+function interactiveTerminal() {
+  return process.stdin.isTTY === true && process.stderr.isTTY === true;
+}
+
+// packages/personal-cli/src/cli.ts
+try {
+  process.exitCode = await main();
+} catch (error) {
+  const cancelled = error instanceof Error && ["ExitPromptError", "AbortPromptError"].includes(error.name);
+  process.stdout.write(`${JSON.stringify({
+    version: 1,
+    ok: false,
+    code: cancelled ? "cancelled" : "operation_failed",
+    error: cancelled ? "Cancelled; no further actions will run." : "Command failed. Inspect the local setup; raw errors are withheld to protect credentials."
+  })}
+`);
+  process.exitCode = cancelled ? 130 : 1;
+}