@crvouga/personal 0.0.0-stage → 0.1.1

package/probe.mjs

@@ -0,0 +1,1010 @@
+// packages/fleet/src/configure.ts
+import { join } from "node:path";
+import { mkdir, writeFile, rename } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+
+// packages/fleet/src/errors.ts
+class FleetUsageError extends Error {
+}
+
+// packages/fleet/src/config.ts
+var CAPABILITIES = [
+  "github",
+  "vault",
+  "t3",
+  "vscode",
+  "toolchain",
+  "codex",
+  "claude",
+  "services",
+  "workstation"
+];
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function fields(value, allowed) {
+  if (Object.keys(value).some((key) => !allowed.includes(key))) {
+    throw new FleetUsageError("Unknown configuration field. Run fleet schema.");
+  }
+}
+function absolutePath(value) {
+  return typeof value === "string" && value.startsWith("/") && value.length <= 4096 && !/[\x00-\x1f\x7f]/.test(value);
+}
+function parseNode(value) {
+  if (!record(value))
+    throw new FleetUsageError("Each node must be an object.");
+  fields(value, ["id", "ssh", "workspace", "runtime", "required"]);
+  const names = nodeNames(value);
+  if (!absolutePath(value["workspace"]))
+    throw new FleetUsageError("workspace must be an absolute POSIX path.");
+  if (value["runtime"] !== undefined && !absolutePath(value["runtime"])) {
+    throw new FleetUsageError("runtime must be an absolute POSIX path to Node or Bun.");
+  }
+  return {
+    ...names,
+    workspace: value["workspace"],
+    ...typeof value["runtime"] === "string" ? { runtime: value["runtime"] } : {},
+    required: requiredCapabilities(value["required"])
+  };
+}
+function nodeNames(value) {
+  if (typeof value["id"] !== "string" || !/^[a-z][a-z0-9-]{0,62}$/.test(value["id"])) {
+    throw new FleetUsageError("Node IDs must be lowercase names (1–63 characters).");
+  }
+  if (typeof value["ssh"] !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,252}$/.test(value["ssh"])) {
+    throw new FleetUsageError("ssh must be a plain SSH alias or hostname, not options or user@host.");
+  }
+  return { id: value["id"], ssh: value["ssh"] };
+}
+function requiredCapabilities(value) {
+  const required = value === undefined ? ["github", "vault", "t3", "toolchain"] : value;
+  if (!Array.isArray(required) || required.some((item) => !CAPABILITIES.includes(item))) {
+    throw new FleetUsageError("required must contain only capability names from fleet schema.");
+  }
+  if (new Set(required).size !== required.length)
+    throw new FleetUsageError("required capabilities must be unique.");
+  return required;
+}
+function parseConfig(value) {
+  if (!record(value))
+    throw new FleetUsageError("Fleet configuration must be an object.");
+  fields(value, ["$schema", "version", "nodes"]);
+  if (value["$schema"] !== undefined && typeof value["$schema"] !== "string")
+    throw new FleetUsageError("$schema must be a string.");
+  if (value["version"] !== 1 || !Array.isArray(value["nodes"])) {
+    throw new FleetUsageError("Expected version 1 and a nodes array.");
+  }
+  if (value["nodes"].length < 1 || value["nodes"].length > 64) {
+    throw new FleetUsageError("Configure between 1 and 64 developer nodes.");
+  }
+  const nodes = value["nodes"].map(parseNode);
+  if (new Set(nodes.map((node) => node.id)).size !== nodes.length) {
+    throw new FleetUsageError("Node IDs must be unique.");
+  }
+  return { version: 1, nodes };
+}
+
+// packages/fleet/src/configure.ts
+function validConfiguration(value) {
+  return record(value) && typeof value["revision"] === "string" && /^[a-f0-9]{40}$/.test(value["revision"]) && ["codex", "claude", "opencode", "gemini"].includes(String(value["tool"])) && ["direct", "proxy"].includes(String(value["profile"])) && typeof value["node"] === "string" && /^[a-z0-9][a-z0-9-]{0,62}$/.test(value["node"]);
+}
+async function configureWorkspace(root, request, run) {
+  if (!validConfiguration(request))
+    return failure("Invalid reviewed revision or configuration selection.");
+  const directory = join(root, "node_modules", ".fleet-revisions", request.revision);
+  const head = await run(["git", "rev-parse", "--verify", `${request.revision}^{commit}`], { cwd: root });
+  if (!head.ok || head.stdout.trim() !== request.revision)
+    return failure("Reviewed commit is unavailable locally. Fetch it explicitly and retry.");
+  const prepared = await prepareRevision(root, directory, request.revision, run);
+  if (prepared.length)
+    return prepared;
+  const setup = await run([
+    "mise",
+    "exec",
+    "--locked",
+    "bun",
+    "--",
+    "bun",
+    "scripts/dev/setup.ts",
+    "--non-interactive"
+  ], { cwd: directory, timeoutMs: 1200000 });
+  if (!setup.ok)
+    return failure("Existing setup owner failed. Partial tool/dependency installation is possible; no configuration receipt was advanced.");
+  const applied = await applyOwner(directory, request, run);
+  if (!applied.ok)
+    return failure("personal workstation configuration failed. Inspect preview on this node; no rollout receipt was advanced.");
+  const receipt = decodeReceipt(applied.stdout, request.revision);
+  if (!receipt)
+    return failure("personal workstation returned an invalid receipt; rollout remains unverified.");
+  await recordConfiguration(root, request, receipt);
+  return [
+    {
+      id: "configuration:apply",
+      status: "pass",
+      summary: `personal workstation applied revision ${request.revision}; configuration fingerprint ${receipt}. Authentication and T3 end-to-end remain separate gates.`
+    }
+  ];
+}
+function decodeReceipt(output, revision) {
+  try {
+    const data = JSON.parse(output);
+    return record(data) && data["ok"] === true && data["revision"] === revision && typeof data["fingerprint"] === "string" && /^[a-f0-9]{64}$/.test(data["fingerprint"]) ? data["fingerprint"] : null;
+  } catch {
+    return null;
+  }
+}
+function failure(summary) {
+  return [{ id: "configuration:apply", status: "fail", summary }];
+}
+async function prepareRevision(root, directory, revision, run) {
+  await mkdir(join(root, "node_modules", ".fleet-revisions"), {
+    recursive: true
+  });
+  let deployed = await run(["git", "rev-parse", "HEAD"], { cwd: directory });
+  if (!deployed.ok) {
+    const created = await run(["git", "worktree", "add", "--detach", directory, revision], { cwd: root, timeoutMs: 30000 });
+    if (!created.ok)
+      return failure("Cannot create pinned deployment worktree. Existing data was preserved.");
+    deployed = await run(["git", "rev-parse", "HEAD"], { cwd: directory });
+  }
+  const clean = await run(["git", "status", "--porcelain"], { cwd: directory });
+  if (!deployed.ok || deployed.stdout.trim() !== revision || !clean.ok || clean.stdout.trim())
+    return failure("Pinned deployment checkout differs or is dirty. Inspect it; fleet never resets it.");
+  const top = await run(["git", "rev-parse", "--show-toplevel"], {
+    cwd: directory
+  });
+  if (!top.ok || top.stdout.trim() !== directory)
+    return failure("Deployment path is not its own Git worktree.");
+  return [];
+}
+async function recordConfiguration(root, request, receipt) {
+  const receipts = join(root, "node_modules", ".fleet-configuration");
+  await mkdir(receipts, { recursive: true, mode: 448 });
+  const path = join(receipts, `${request.node}-${request.tool}-${request.profile}.json`);
+  const temp = `${path}.${randomUUID()}.tmp`;
+  await writeFile(temp, JSON.stringify({ version: 1, ...request, fingerprint: receipt }) + `
+`, { flag: "wx", mode: 384 });
+  await rename(temp, path);
+}
+async function applyOwner(directory, request, run) {
+  return run([
+    "mise",
+    "exec",
+    "--locked",
+    "bun",
+    "--",
+    "bun",
+    "packages/workstation/cli/internal.ts",
+    "--json",
+    "--yes",
+    "--non-interactive",
+    "agents",
+    "apply",
+    "--node",
+    request.node,
+    "--tool",
+    request.tool,
+    "--profile",
+    request.profile
+  ], { cwd: directory, timeoutMs: 120000 });
+}
+
+// packages/fleet/src/fingerprint.ts
+import { readFile as readFile2, mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+
+// packages/fleet/src/input-hashes.ts
+import { createHash } from "node:crypto";
+import { readFile, readdir } from "node:fs/promises";
+import { join as join2 } from "node:path";
+var INPUT_FILES = [
+  "package.json",
+  "bun.lock",
+  "mise.toml",
+  "mise.lock"
+];
+var FINGERPRINT_FILES = [
+  ...INPUT_FILES,
+  "workspace-manifests",
+  "mise-sidecars"
+];
+async function fileHash(path) {
+  try {
+    return digest(await readFile(path));
+  } catch {
+    return null;
+  }
+}
+async function manifestHash(root) {
+  try {
+    const entries = await readdir(join2(root, "packages"), {
+      withFileTypes: true
+    });
+    const hashes = [];
+    for (const entry of entries.filter((item) => item.isDirectory()).sort((left, right) => left.name.localeCompare(right.name, "en"))) {
+      hashes.push(`${entry.name}:${await fileHash(join2(root, "packages", entry.name, "package.json"))}`);
+    }
+    return digest(hashes.join(`
+`));
+  } catch {
+    return null;
+  }
+}
+async function sidecarHash(root) {
+  try {
+    const files = await readdir(join2(root, ".mise/locks"), {
+      recursive: true,
+      withFileTypes: true
+    });
+    if (files.length > 4096 || files.some((entry) => entry.isSymbolicLink()))
+      return null;
+    const hashes = [];
+    const paths = files.filter((entry) => entry.isFile()).map((entry) => join2(entry.parentPath, entry.name)).sort();
+    for (const path of paths) {
+      const hash = await fileHash(path);
+      if (hash === null)
+        return null;
+      const relative = path.slice(join2(root, ".mise/locks").length).replaceAll("\\", "/");
+      hashes.push(`${relative}:${hash}`);
+    }
+    return digest(hashes.join(`
+`));
+  } catch {
+    return null;
+  }
+}
+function digest(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+// packages/fleet/src/fingerprint.ts
+var RECEIPT = "node_modules/.fleet-sync.json";
+async function fingerprint(root, run) {
+  const files = {};
+  for (const name of INPUT_FILES)
+    files[name] = await fileHash(join3(root, name));
+  files["workspace-manifests"] = await manifestHash(root);
+  files["mise-sidecars"] = await sidecarHash(root);
+  const head = await run(["git", "rev-parse", "HEAD"], { cwd: root });
+  return {
+    head: head.ok && /^[a-f0-9]{40,64}\s*$/.test(head.stdout) ? head.stdout.trim() : null,
+    files
+  };
+}
+async function dependencyCheck(root, current) {
+  const remedy = {
+    action: "Review fleet sync, then explicitly apply a frozen toolchain/dependency sync."
+  };
+  try {
+    const receipt = JSON.parse(await readFile2(join3(root, RECEIPT), "utf8"));
+    const matches = record(receipt) && receipt["version"] === 1 && JSON.stringify(receipt["files"]) === JSON.stringify(current.files);
+    return {
+      id: "dependencies",
+      status: matches ? "pass" : "fail",
+      summary: matches ? "Last successful frozen sync matches input hashes; not a full integrity audit." : "Dependency sync receipt is stale or invalid.",
+      ...matches ? {} : { remedy }
+    };
+  } catch {
+    return {
+      id: "dependencies",
+      status: "warn",
+      summary: "No frozen-sync receipt; installed dependencies are unverified.",
+      remedy
+    };
+  }
+}
+async function writeReceipt(root, current) {
+  await mkdir2(join3(root, "node_modules"), { recursive: true });
+  await writeFile2(join3(root, RECEIPT), JSON.stringify({ version: 1, files: current.files }), { mode: 384 });
+}
+
+// packages/fleet/src/service-auth.ts
+function json(result) {
+  try {
+    const data = JSON.parse(result.stdout);
+    return record(data) ? data : null;
+  } catch {
+    return null;
+  }
+}
+async function codingAuth(id, run) {
+  return [
+    await serviceCheck(id === "codex" ? {
+      id,
+      command: ["codex", "login", "status"],
+      action: "Run codex login on this computer as its operator.",
+      valid: (result) => /^Logged in using (ChatGPT|an API key|API key)\b/im.test(`${result.stdout}
+${result.stderr}`)
+    } : {
+      id,
+      command: ["claude", "auth", "status", "--json"],
+      action: "Run claude auth login on this computer as its operator.",
+      valid: (result) => json(result)?.["loggedIn"] === true
+    }, run)
+  ];
+}
+async function serviceAuth(run) {
+  const services = [
+    {
+      id: "railway",
+      command: ["railway", "whoami", "--json"],
+      action: "Run railway login on this computer.",
+      valid: (result) => typeof json(result)?.["id"] === "string"
+    },
+    {
+      id: "vercel",
+      command: ["vercel", "whoami"],
+      action: "Run vercel login on this computer.",
+      valid: (result) => /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,100}$/.test(result.stdout.trim())
+    },
+    {
+      id: "cloudflare",
+      command: ["wrangler", "whoami", "--json"],
+      action: "Run wrangler login on this computer.",
+      valid: (result) => json(result)?.["loggedIn"] === true
+    },
+    {
+      id: "aws",
+      command: [
+        "aws",
+        "sts",
+        "get-caller-identity",
+        "--output",
+        "json",
+        "--no-cli-pager"
+      ],
+      action: "Select and authenticate the intended AWS profile on this computer.",
+      valid: (result) => typeof json(result)?.["Account"] === "string" && typeof json(result)?.["Arn"] === "string"
+    },
+    {
+      id: "npm",
+      command: ["npm", "whoami", "--registry=https://registry.npmjs.org/"],
+      action: "Run npm login only if this computer should publish packages.",
+      valid: (result) => /^[a-z0-9][a-z0-9._-]{0,213}$/.test(result.stdout.trim())
+    }
+  ];
+  const checks = [];
+  for (const service of services)
+    checks.push(await serviceCheck(service, run));
+  for (const id of ["gemini", "copilot", "opencode"])
+    checks.push({
+      id: `auth:${id}`,
+      status: "skip",
+      summary: `${id} provider authorization has no verified noninteractive status adapter in this CLI. Installed binaries or saved keys are not proof of access.`,
+      remedy: {
+        action: `Verify ${id} provider access locally using its supported account diagnostics. No prompt or billable request was made.`
+      }
+    });
+  return checks;
+}
+async function serviceCheck(service, run) {
+  const result = await run(service.command, { timeoutMs: 15000 });
+  const ok = result.ok && service.valid(result);
+  return {
+    id: `auth:${service.id}`,
+    status: ok ? "pass" : "fail",
+    summary: ok ? `${service.id} reports an authenticated session in this process context; no credential or account output retained.` : `${service.id} login is missing or could not be verified (${result.reason}); no credential output retained.`,
+    ...!ok ? { remedy: { action: service.action } } : {}
+  };
+}
+
+// packages/fleet/src/workstation-checks.ts
+async function workstationChecks(root, run) {
+  const result = await run(["personal", "workstation", "doctor", "--json", "--non-interactive"], {
+    cwd: root,
+    timeoutMs: 20000
+  });
+  const fallback = {
+    id: "workstation:configuration",
+    status: "fail",
+    summary: "Managed workstation configuration could not be verified.",
+    remedy: {
+      action: "Run personal workstation doctor --json on this computer. Review managed links, PATH, coding-tool/provider configuration and notification settings; apply personal workstation sync only explicitly."
+    }
+  };
+  try {
+    const data = JSON.parse(result.stdout);
+    if (!record(data) || !Array.isArray(data["checks"]) || !data["checks"].length || data["checks"].length > 100)
+      return [fallback];
+    const checks = data["checks"].map(configurationCheck);
+    if (checks.some((check) => check === null))
+      return [fallback];
+    return [
+      ...!result.ok || data["ok"] !== true ? [fallback] : [],
+      ...checks
+    ];
+  } catch {
+    return [fallback];
+  }
+}
+function configurationCheck(value) {
+  if (!record(value) || typeof value["id"] !== "string" || !/^[a-zA-Z0-9:._-]{1,75}$/.test(value["id"]) || !["pass", "warn", "fail"].includes(String(value["severity"])))
+    return null;
+  const ok = value["severity"] === "pass";
+  return {
+    id: `workstation:${value["id"].toLowerCase()}`,
+    status: value["severity"],
+    summary: ok ? "Managed configuration check succeeded (configuration presence; provider authorization is checked separately)." : "Managed configuration is missing, conflicting or unverified.",
+    ...!ok ? {
+      remedy: {
+        action: "Inspect personal workstation doctor --json on this computer. Use explicit personal workstation sync only after reviewing the configuration changes."
+      }
+    } : {}
+  };
+}
+
+// packages/fleet/src/toolchain-checks.ts
+import { join as join4 } from "node:path";
+async function toolchainChecks(root, run) {
+  const result = await run(["bun", join4(root, "scripts/dev/doctor.ts"), "--json", "--docker"], { cwd: root, timeoutMs: 90000 });
+  const fallback = {
+    id: "auth:toolchain",
+    status: "fail",
+    summary: "Pinned tool/dependency and Docker checks could not be verified.",
+    remedy: {
+      action: "Run the checkout scripts/dev/doctor.ts --json --docker on this computer. Reconcile versions only through the shared mise setup."
+    }
+  };
+  try {
+    const data = JSON.parse(result.stdout);
+    if (!record(data) || typeof data["ok"] !== "boolean" || !Array.isArray(data["checks"]) || !data["checks"].length || data["checks"].length > 150)
+      return [fallback];
+    const checks = data["checks"].map(toolCheck);
+    if (checks.some((check) => check === null))
+      return [fallback];
+    return [
+      ...!result.ok || !data["ok"] ? [fallback] : [],
+      ...checks
+    ];
+  } catch {
+    return [fallback];
+  }
+}
+function toolCheck(value) {
+  if (!record(value) || typeof value["id"] !== "string" || !/^[a-zA-Z0-9@:/._-]{1,75}$/.test(value["id"]) || !["pass", "fail", "warn", "skip"].includes(String(value["status"])))
+    return null;
+  const ok = value["status"] === "pass";
+  const version = typeof value["detail"] === "string" && /^v?\d{1,6}(?:\.\d{1,6}){1,3}$/.test(value["detail"]) ? ` ${value["detail"]}` : "";
+  return {
+    id: `tool:${value["id"].toLowerCase().replace(/[^a-z0-9:._-]/g, "_")}`,
+    status: value["status"],
+    summary: ok ? `Expected tool version or runtime check succeeded${version}.` : "Expected tool version, runtime or authentication check did not pass.",
+    ...!ok ? {
+      remedy: {
+        action: "Review scripts/dev/doctor.ts --json --docker locally. Use shared mise/workstation setup to reconcile this computer."
+      }
+    } : {}
+  };
+}
+
+// packages/fleet/src/auth-checks.ts
+async function authCheck(capability, run, root) {
+  if (capability === "t3")
+    return t3Checks(run);
+  if (capability === "codex" || capability === "claude")
+    return codingAuth(capability, run);
+  if (capability === "services")
+    return serviceAuth(run);
+  if (capability === "workstation")
+    return workstationChecks(root, run);
+  if (capability === "toolchain")
+    return toolchainChecks(root, run);
+  return basicAuth(capability, run, root);
+}
+async function basicAuth(capability, run, root) {
+  const spec = {
+    github: {
+      command: ["gh", "auth", "status", "--active"],
+      action: "Authenticate on this node with gh auth login, then gh auth setup-git."
+    },
+    vault: {
+      command: ["vault", "token", "lookup", "-format=json"],
+      action: "Authenticate to the configured Vault on this node. Do not copy a token from another computer."
+    },
+    vscode: {
+      command: ["code", "--list-extensions"],
+      action: "Install the VS Code CLI on PATH and ms-vscode-remote.remote-ssh in the local editor profile."
+    }
+  }[capability];
+  const result = await run(spec.command, {
+    cwd: root,
+    timeoutMs: 15000
+  });
+  const extensions = result.stdout.toLowerCase().split(/\s+/);
+  const ok = result.ok && (capability !== "vscode" || extensions.includes("ms-vscode-remote.remote-ssh"));
+  return [
+    {
+      id: `auth:${capability}`,
+      status: ok ? "pass" : "fail",
+      summary: ok ? `${capability} check succeeded in this process context.` : `${capability} check failed (${result.reason}); no credential output retained.`,
+      ...ok ? {} : { remedy: { action: spec.action } }
+    }
+  ];
+}
+async function t3Checks(run) {
+  const config = await run(["t3", "status", "--json"]);
+  const checks = [t3Settings(config)];
+  const live = await run(["t3", "environment", "list", "--json"]);
+  checks.push({
+    id: "t3:api",
+    status: live.ok ? "pass" : "fail",
+    summary: live.ok ? "Local T3 API answered a read-only environment listing; peer connectivity is not inferred." : "Local T3 API did not answer the environment listing.",
+    ...!live.ok ? {
+      remedy: {
+        action: "Check t3 service status and t3 status. Inspect linked peers in T3 Settings → Connections; relink only with operator approval."
+      }
+    } : {}
+  });
+  checks.push({
+    id: "t3:end-to-end",
+    status: "skip",
+    summary: "Relay traversal and remote peer authorization require an operator connection test; local settings are not proof."
+  });
+  return checks;
+}
+function t3Settings(config) {
+  const fallback = {
+    id: "t3:settings",
+    status: "fail",
+    summary: "T3 settings unavailable or unsupported CLI response.",
+    remedy: {
+      action: "Run t3 status --json on this node. Complete t3 up --connect as its operator if needed."
+    }
+  };
+  try {
+    const data = JSON.parse(config.stdout);
+    if (config.ok && record(data) && record(data["connect"])) {
+      const enabled = data["connect"]["enabled"] === true && data["connect"]["revoked"] === false;
+      return {
+        id: "t3:settings",
+        status: enabled ? "pass" : "fail",
+        summary: enabled ? "T3 Connect enabled and not marked revoked (settings only)." : "T3 Connect disabled, revoked, or unknown.",
+        ...!enabled ? {
+          remedy: {
+            action: "Review t3 status, then complete t3 up --connect as the operator. Never share pairing tokens."
+          }
+        } : {}
+      };
+    }
+  } catch {}
+  return fallback;
+}
+
+// packages/fleet/src/probe.ts
+async function probe(root, required, run) {
+  const current = await fingerprint(root, run);
+  const checks = [
+    {
+      id: "workspace",
+      status: Object.values(current.files).every(Boolean) && current.head ? "pass" : "fail",
+      summary: "Checkout revision and shared dependency/toolchain input availability."
+    }
+  ];
+  const dirty = await run(["git", "status", "--porcelain"], { cwd: root });
+  checks.push({
+    id: "git:clean",
+    status: dirty.ok ? dirty.stdout.trim() ? "warn" : "pass" : "fail",
+    summary: dirty.ok && !dirty.stdout.trim() ? "Working tree is clean." : "Working tree is dirty or unreadable; sync --pull will refuse."
+  });
+  checks.push(await dependencyCheck(root, current));
+  for (const capability of CAPABILITIES) {
+    if (required.includes(capability))
+      checks.push(...await authCheck(capability, run, root));
+    else
+      checks.push({
+        id: `auth:${capability}`,
+        status: "skip",
+        summary: "Not required by this node configuration."
+      });
+  }
+  return {
+    version: 1,
+    platform: process.platform,
+    fingerprint: current,
+    checks
+  };
+}
+
+// packages/fleet/src/runner.ts
+import { spawn } from "node:child_process";
+var MAX_OUTPUT_BYTES = 1024 * 1024;
+function terminate(child) {
+  try {
+    if (process.platform !== "win32" && child.pid)
+      process.kill(-child.pid, "SIGKILL");
+    else
+      child.kill("SIGKILL");
+  } catch {}
+}
+function runCommand(command, options = {}) {
+  return new Promise((resolve) => {
+    const child = spawn(command[0], command.slice(1), {
+      cwd: options.cwd,
+      env: {
+        ...process.env,
+        ...options.env,
+        GIT_TERMINAL_PROMPT: "0",
+        CI: "1"
+      },
+      stdio: "pipe",
+      windowsHide: true,
+      detached: process.platform !== "win32"
+    });
+    let stdout = "";
+    let stderr = "";
+    let bytes = 0;
+    let finished = false;
+    let reason = "exit";
+    const finish = (ok) => {
+      if (finished)
+        return;
+      finished = true;
+      clearTimeout(timer);
+      child.stdin.destroy();
+      child.stdout.destroy();
+      child.stderr.destroy();
+      resolve({ ok, stdout, stderr, reason });
+    };
+    const abort = (cause) => {
+      reason = cause;
+      terminate(child);
+      finish(false);
+    };
+    const timer = setTimeout(() => {
+      abort("timeout");
+    }, options.timeoutMs ?? 15000);
+    const capture = (stream, chunk) => {
+      if (finished)
+        return;
+      bytes += Buffer.byteLength(chunk);
+      if (bytes > MAX_OUTPUT_BYTES) {
+        abort("overflow");
+        return;
+      }
+      if (stream === "stdout")
+        stdout += chunk;
+      else
+        stderr += chunk;
+    };
+    child.stdout.setEncoding("utf8").on("data", (chunk) => capture("stdout", chunk));
+    child.stderr.setEncoding("utf8").on("data", (chunk) => capture("stderr", chunk));
+    child.stdin.on("error", () => {
+      return;
+    });
+    child.on("error", () => {
+      abort("missing");
+    });
+    child.on("close", (code) => {
+      finish(code === 0 && reason === "exit");
+    });
+    child.stdin.end(options.input);
+  });
+}
+
+// packages/fleet/src/sync.ts
+import { unlink } from "node:fs/promises";
+import { join as join5 } from "node:path";
+async function syncWorkspace(root, pull, run) {
+  const before = await fingerprint(root, run);
+  if (!completeFingerprint(before)) {
+    return failed("Not a complete workspace checkout. Follow fleet onboard first.");
+  }
+  if (pull) {
+    const dirty = await run(["git", "status", "--porcelain"], { cwd: root });
+    const branch = await run(["git", "symbolic-ref", "--quiet", "HEAD"], {
+      cwd: root
+    });
+    if (!dirty.ok || dirty.stdout.trim() || !branch.ok)
+      return failed("Refusing pull: dirty, detached, or unreadable checkout. Reconcile manually.");
+  }
+  await unlink(join5(root, "node_modules/.fleet-sync.json")).catch(() => {
+    return;
+  });
+  if (pull) {
+    const result = await run(["git", "pull", "--ff-only"], {
+      cwd: root,
+      timeoutMs: 120000
+    });
+    if (!result.ok)
+      return failed("Fast-forward pull failed. Inspect upstream/network/auth manually; nothing was reset.");
+  }
+  const expected = await fingerprint(root, run);
+  const result = await run([
+    "mise",
+    "exec",
+    "--locked",
+    "bun",
+    "--",
+    "bun",
+    "scripts/dev/setup.ts",
+    "--non-interactive"
+  ], { cwd: root, timeoutMs: 1200000 });
+  if (!result.ok)
+    return failed(`Shared toolchain/dependency sync failed (${result.reason}). Inspect setup locally; partial installs are possible.`);
+  const after = await fingerprint(root, run);
+  if (JSON.stringify(expected) !== JSON.stringify(after))
+    return failed("Checkout inputs changed during sync. Retry from a stable checkout.");
+  await writeReceipt(root, after);
+  return [
+    {
+      id: "sync",
+      status: "pass",
+      summary: "Shared setup succeeded; frozen-sync receipt recorded. Auth and live connectivity still need doctor checks."
+    }
+  ];
+}
+function failed(summary) {
+  return [
+    {
+      id: "sync",
+      status: "fail",
+      summary,
+      remedy: {
+        action: "Resolve locally using scripts/dev/README.md, then review and retry fleet sync."
+      }
+    }
+  ];
+}
+function completeFingerprint(value) {
+  return value.head !== null && Object.values(value.files).every(Boolean);
+}
+
+// packages/fleet/src/repair-catalog.ts
+var login = (id, title, commands, action) => ({
+  id: `login:${id}`,
+  title,
+  owner: `${id} native CLI`,
+  automatic: false,
+  action,
+  commands
+});
+var REPAIR_RECIPES = [
+  {
+    id: "workspace",
+    title: "Install locked tools and frozen dependencies",
+    owner: "mise / scripts/dev/setup.ts",
+    automatic: true,
+    action: "Runs the existing shared setup and trusted checkout lifecycle scripts. Updates user mise/PATH configuration and writes a sync receipt. Does not pull or reset Git.",
+    commands: [
+      [
+        "mise",
+        "exec",
+        "--locked",
+        "bun",
+        "--",
+        "bun",
+        "scripts/dev/setup.ts",
+        "--non-interactive"
+      ]
+    ]
+  },
+  {
+    id: "workstation",
+    title: "Install launcher and converge managed workstation configuration",
+    owner: "workstation",
+    automatic: true,
+    action: "Runs personal:install --yes: frozen install, launcher/PATH, managed links, notifications and provider configuration. Reads available provider keys from this machine’s Vault session and writes owner-managed 0600 configuration. Conflicting unmanaged files fail.",
+    commands: [["bun", "run", "personal:install", "--yes"]]
+  },
+  {
+    id: "providers",
+    title: "Refresh shared provider configuration from Vault",
+    owner: "workstation / secret-store",
+    automatic: true,
+    action: "Uses this machine’s own Vault authorization to fetch the existing permitted provider keys. The workstation owner writes its 0600 tool configuration; no credentials are copied from another computer. Missing provider keys may remain skipped.",
+    commands: [
+      [
+        "bun",
+        "packages/workstation/cli/internal.ts",
+        "opencode",
+        "sync",
+        "--strict",
+        "--json",
+        "--non-interactive",
+        "--yes"
+      ]
+    ]
+  },
+  login("codex", "Sign in to Codex on this machine", [["codex", "login", "--device-auth"]], "Approve the device flow in your browser. Run codex login status afterward; retain this machine’s own credential store."),
+  login("claude", "Sign in to Claude Code on this machine", [["claude", "auth", "login"]], "Complete the native browser login, then run claude auth status --json. API-key and subscription contexts can differ."),
+  login("github", "Sign in to GitHub and configure Git", [
+    [
+      "gh",
+      "auth",
+      "login",
+      "--hostname",
+      "github.com",
+      "--web",
+      "--git-protocol",
+      "https"
+    ],
+    ["gh", "auth", "setup-git"]
+  ], "Approve GitHub in the browser on the intended account, then run gh auth status --active. Environment tokens can override stored login; inspect their source locally."),
+  login("vault", "Authorize this machine for the shared Vault", [], "Run vault login -method=userpass username=YOUR_USERNAME in your own terminal. The native CLI prompts privately for the password. Use the existing permitted project/config; never copy VAULT_TOKEN between computers."),
+  login("railway", "Sign in to Railway", [["railway", "login", "--browserless"]], "Complete the browserless native flow, then run railway whoami --json."),
+  login("vercel", "Sign in to Vercel", [["vercel", "login"]], "Complete native login, then run vercel whoami. Select the intended team/project separately; do not create resources as a login repair."),
+  login("cloudflare", "Sign in to Cloudflare", [["wrangler", "login", "--browser=false"]], "Complete native OAuth login, then run wrangler whoami --json. For headless SSH, prefer an existing scoped API token injected by the approved Vault config. --browser=false suppresses browser launch; it does not make a remote loopback callback reachable. Any OAuth callback tunnel needs explicit operator setup. Resource access still depends on account permissions."),
+  login("aws", "Refresh the selected AWS SSO session", [["aws", "sso", "login"]], "Configure the intended profile with aws configure sso first if needed. Login and the health check use this shell’s current profile; no access keys are cloned."),
+  login("npm", "Sign in to npm on this machine", [
+    [
+      "npm",
+      "login",
+      "--auth-type=web",
+      "--registry=https://registry.npmjs.org/"
+    ]
+  ], "Complete the specific CLI approval and run npm whoami. Prefer the existing trusted-publisher CI workflow for releases."),
+  login("opencode", "Authorize an OpenCode provider", [["opencode", "auth", "login"]], "Prefer the existing Vault-backed providers repair for managed API keys. Native auth login handles an operator-owned OAuth provider. Credential listing alone does not prove live provider access."),
+  login("copilot", "Sign in to Copilot", [["copilot", "login"]], "Complete native login; provider authorization still needs supported operator diagnostics. No model prompt is used for health checking."),
+  login("gemini", "Sign in to Gemini", [], "Open Gemini interactively and choose its supported sign-in flow. Provider authorization remains unverified without a supported read-only status adapter."),
+  {
+    id: "t3",
+    title: "Enable and authorize T3 Connect",
+    owner: "T3",
+    automatic: false,
+    action: "Run t3 up --connect in this machine’s terminal and approve the intended connection. Treat pairing material as private. Then check t3 status --json and perform an operator peer test.",
+    commands: [["t3", "up", "--connect"]]
+  },
+  {
+    id: "docker",
+    title: "Start the intended Docker runtime",
+    owner: "OS / Docker",
+    automatic: false,
+    action: "Start Docker Desktop on desktop systems, or the already-installed Docker service using the OS service manager on Linux. Confirm the intended context with docker context ls. This repair never installs a daemon, invokes sudo, changes contexts or exposes a TCP socket.",
+    commands: [
+      ["docker", "context", "ls"],
+      ["docker", "info"]
+    ]
+  },
+  {
+    id: "password-manager",
+    title: "Review shared human login onboarding",
+    owner: "password-manager / Bitwarden",
+    automatic: false,
+    action: "Use the existing password-manager doctor and actions list on this computer. Its setup guides native consent and Bitwarden enrollment. Keep its private state and OS credential store local. Password vault access does not authorize native CLI OAuth sessions; imports and rotations remain separate reviewed workflows.",
+    commands: [
+      ["bun", "run", "password-manager", "doctor"],
+      ["bun", "run", "password-manager", "actions", "list"]
+    ]
+  },
+  {
+    id: "operator",
+    title: "Resolve the check with its owning tool",
+    owner: "operator / existing owner",
+    automatic: false,
+    action: "Follow the check’s remedy on the affected machine. Verify host fingerprints, register real SSH aliases/checkouts, reconcile Git changes, or perform the named end-to-end test. Infrastructure changes remain OpenTofu-owned.",
+    commands: []
+  }
+];
+var AUTOMATED_REPAIRS = [
+  "workspace",
+  "workstation",
+  "providers"
+];
+function recipe(id) {
+  return REPAIR_RECIPES.find((entry) => entry.id === id) ?? REPAIR_RECIPES.find((entry) => entry.id === "operator");
+}
+
+// packages/fleet/src/repair-runner.ts
+function validRepairs(value) {
+  return Array.isArray(value) && value.length > 0 && value.length <= 3 && new Set(value).size === value.length && value.every((id) => AUTOMATED_REPAIRS.includes(id));
+}
+async function repairWorkspace(root, repairs, run, expected) {
+  if (!validRepairs(repairs))
+    throw new Error("Unsupported repairs");
+  const before = await fingerprint(root, run);
+  if (!before.head || !Object.values(before.files).every(Boolean))
+    return [
+      {
+        id: "repair:workspace",
+        status: "fail",
+        summary: "Repairs require a complete existing checkout. Register/bootstrap it first."
+      }
+    ];
+  if (expected && JSON.stringify(before) !== JSON.stringify(expected))
+    return [
+      {
+        id: "repair:inputs",
+        status: "fail",
+        summary: "Checkout inputs changed since diagnostics. Generate a fresh repair plan before applying."
+      }
+    ];
+  const checks = [];
+  for (const id of AUTOMATED_REPAIRS.filter((entry) => repairs.includes(entry))) {
+    const result = id === "workspace" ? await syncWorkspace(root, false, run) : await ownerCommand(root, id, run);
+    checks.push(...result);
+    if (result.some((check) => check.status !== "pass"))
+      break;
+  }
+  const after = await fingerprint(root, run);
+  if (JSON.stringify(before) !== JSON.stringify(after))
+    checks.push({
+      id: "repair:inputs",
+      status: "fail",
+      summary: "Checkout inputs changed during repair. Stop and review the checkout before retrying."
+    });
+  return checks;
+}
+async function ownerCommand(root, id, run) {
+  const result = await run(recipe(id).commands[0], {
+    cwd: root,
+    timeoutMs: 1200000
+  });
+  return [
+    {
+      id: `repair:${id}`,
+      status: result.ok ? "pass" : "fail",
+      summary: result.ok ? "The existing owner command completed. Fresh diagnostics determine whether configuration and authorization now pass." : `The owner command failed (${result.reason}); partial changes are possible. Raw output and credentials are withheld. Later repairs on this computer were stopped.`
+    }
+  ];
+}
+
+// packages/fleet/src/protocol.ts
+var STATUSES = ["pass", "warn", "fail", "skip"];
+function validCheck(value) {
+  if (!record(value) || typeof value["id"] !== "string" || !/^[a-z0-9:._-]{1,100}$/.test(value["id"]) || !STATUSES.includes(String(value["status"])) || typeof value["summary"] !== "string" || value["summary"].length > 2000)
+    return false;
+  const remedy = value["remedy"];
+  return remedy === undefined || validRemedy(remedy);
+}
+function validRemedy(value) {
+  return record(value) && typeof value["action"] === "string" && value["action"].length < 2000 && (value["command"] === undefined || typeof value["command"] === "string");
+}
+function validSnapshot(value) {
+  if (!record(value) || value["version"] !== 1 || typeof value["platform"] !== "string" || !Array.isArray(value["checks"]) || value["checks"].length > 200 || !value["checks"].every(validCheck))
+    return false;
+  return validFingerprint(value["fingerprint"]);
+}
+function validFingerprint(value) {
+  if (!record(value) || !record(value["files"]))
+    return false;
+  if (!Object.keys(value["files"]).every((key) => FINGERPRINT_FILES.includes(key)))
+    return false;
+  const head = value["head"];
+  return (head === null || typeof head === "string" && /^[a-f0-9]{40,64}$/.test(head)) && Object.values(value["files"]).every(validHash);
+}
+function validHash(value) {
+  return value === null || typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+}
+
+// packages/fleet/src/remote-entry.ts
+async function main() {
+  const raw = JSON.parse(Buffer.from(process.argv.at(-1) ?? "", "base64").toString());
+  if (!validRequest(raw))
+    throw new Error("Invalid request.");
+  const node = parseConfig({ version: 1, nodes: [raw["node"]] }).nodes[0];
+  if (raw["action"] === "configure") {
+    await configureRequest(raw, node);
+  } else if (raw["action"] === "repair") {
+    if (raw["apply"] !== true || !validRepairs(raw["repairs"]) || !validSnapshot({
+      version: 1,
+      platform: "request",
+      checks: [],
+      fingerprint: raw["expected"]
+    }))
+      throw new Error("Repair requires explicit authorization and supported actions.");
+    const checks = await repairWorkspace(node.workspace, raw["repairs"], runCommand, raw["expected"]);
+    process.stdout.write(JSON.stringify({ version: 1, checks }));
+  } else if (raw["action"] === "sync") {
+    if (raw["apply"] !== true)
+      throw new Error("Sync requires explicit authorization.");
+    const checks = await syncWorkspace(node.workspace, raw["pull"] === true, runCommand);
+    process.stdout.write(JSON.stringify({ version: 1, checks }));
+  } else
+    process.stdout.write(JSON.stringify(await probe(node.workspace, node.required, runCommand)));
+}
+await main().catch(() => {
+  process.stdout.write(JSON.stringify({
+    version: 1,
+    error: "Remote operation failed; inspect node locally."
+  }));
+  process.exitCode = 1;
+});
+async function configureRequest(raw, node) {
+  if (raw["apply"] !== true || !validConfiguration(raw["configuration"]) || raw["configuration"].node !== node.id)
+    throw new Error("Invalid configuration request.");
+  const checks = await configureWorkspace(node.workspace, raw["configuration"], runCommand);
+  process.stdout.write(JSON.stringify({ version: 1, checks }));
+}
+function validRequest(raw) {
+  return record(raw) && ["probe", "sync", "repair", "configure"].includes(String(raw["action"]));
+}