@crvouga/personal 0.1.0 → 0.1.1

package/cli.mjs

@@ -72,15 +72,19 @@ function reproduction(session, args) {
 }
 function commandChoices(commands, term) {
   return searchCommands(commands, term).map((command) => ({
-    name: `[${clean(command.group)}] ${clean(command.title)}`,
+    name: `${clean(command.group)}: ${clean(command.title)}`,
     value: `command:${command.id}`,
     description: `${clean(command.description)}${command.mutation ? " · confirmation required" : ""}`
   }));
 }
 function reportChecks(data) {
-  if (!record2(data) || !Array.isArray(data["nodes"]))
+  if (!record2(data))
     return [];
-  return data["nodes"].flatMap(nodeChecks);
+  const nodes = Array.isArray(data["nodes"]) ? data["nodes"] : [];
+  return [
+    ...nodes.flatMap(nodeChecks),
+    ...nodeChecks({ node: "tailscale", checks: data["checks"] })
+  ];
 }
 function nodeChecks(value) {
   if (!record2(value) || !Array.isArray(value["checks"]))
@@ -117,6 +121,27 @@ var init_ui_data = __esm(() => {
   init_search();
 });
 
+// packages/personal-cli/src/ui-repairs.ts
+function showRepairs(session, data) {
+  const catalog = data["command"] === "repairs";
+  const entries = data[catalog ? "recipes" : "steps"];
+  if (!Array.isArray(entries))
+    return;
+  const steps = entries.filter(record2);
+  session.display.table(["Computer / owner", "Repair", "Execution"], steps.slice(0, 15).map((step) => [
+    text(step[catalog ? "owner" : "node"]),
+    text(step["title"]),
+    step["automatic"] === true && (catalog || step["eligible"] === true) ? "Owner command after explicit apply" : "Operator action; inspect instructions"
+  ]));
+  if (steps.length > 15)
+    session.display.write(`Showing 15 of ${steps.length} repair entries. Inspect structured details for the complete plan and native login commands.`);
+  if (!catalog)
+    session.display.write(data["applied"] === true ? `Owner commands completed: ${text(data["completed"])}. Fresh health verified: ${data["healthOk"] === true ? "yes" : "no; review remaining checks"}.` : "Preview only. Review the repair effects and native login instructions in structured details before applying.");
+}
+var init_ui_repairs = __esm(() => {
+  init_ui_data();
+});
+
 // packages/personal-cli/src/ui-execute.ts
 async function execute2(session, args, title) {
   session.display.write(`
@@ -138,11 +163,13 @@ function successful(outcome) {
 function showOutcome(session, outcome) {
   const checks = reportChecks(outcome.data);
   const incomplete = checks.filter((check) => ["warn", "skip"].includes(check.status)).length;
-  const state = successful(outcome) ? incomplete ? "WARNING" : "SUCCESS" : "FAILED";
+  const state = outcomeState(outcome, incomplete);
   const counts = ["pass", "warn", "fail", "skip"].map((status) => `${checks.filter((check) => check.status === status).length} ${status}`);
   session.display.panel(state, checks.length ? counts.join(" · ") : outcomeMessage(outcome));
+  showAttention(session, checks);
+  showData(session, outcome);
   if (!successful(outcome))
-    session.display.write("No automatic repair was attempted. Review the command, context and setup.");
+    session.display.write(record2(outcome.data) && outcome.data["applied"] === true ? "Actions were attempted. Review execution results, partial changes and fresh checks before retrying." : "No automatic repair was attempted. Review the command, context and setup.");
 }
 function outcomeMessage(outcome) {
   if (!successful(outcome))
@@ -155,6 +182,8 @@ function outcomeMessage(outcome) {
 function failureMessage(data) {
   if (!record2(data))
     return "Operation failed. Raw errors and subprocess output are intentionally hidden.";
+  if (data["code"] === "invalid_usage" && typeof data["error"] === "string")
+    return clean(data["error"]);
   const messages = {
     invalid_usage: "Configuration or arguments need attention. Use Fleet setup, validate, or session context.",
     config_missing: "No roster found. Add a node in Fleet setup, or run controller-only diagnostics.",
@@ -162,7 +191,58 @@ function failureMessage(data) {
   };
   return messages[String(data["code"])] ?? "Operation did not complete. Review setup and the noninteractive command.";
 }
+function showNodes(session, data) {
+  const nodes = Array.isArray(data["nodes"]) ? data["nodes"].filter(record2) : [];
+  if (!nodes.length) {
+    session.display.write("No computers registered yet. Choose Fleet: Register a developer computer to add one, or Fleet: Discover Tailscale computers.");
+    return;
+  }
+  session.display.table(["Computer", "SSH", "Workspace"], nodes.map((node) => [
+    text(node["id"]),
+    text(node["ssh"]),
+    text(node["workspace"])
+  ]));
+}
+function showComputers(session, data) {
+  const computers = Array.isArray(data["computers"]) ? data["computers"].filter(record2) : [];
+  session.display.table(["Computer", "OS", "Online"], computers.map((peer) => [
+    text(peer["dns"]),
+    text(peer["os"]),
+    peer["online"] === true ? "yes" : "no"
+  ]));
+  session.display.write("Visible Tailscale computers only; mobile devices excluded. Register each remote computer with its existing SSH alias and checkout path before full health checks.");
+}
+function showAttention(session, checks) {
+  const attention = checks.filter((check) => check.status !== "pass");
+  if (!attention.length)
+    return;
+  session.display.table(["Computer", "Check", "Status / next step"], attention.slice(0, 15).map((check) => [
+    check.node,
+    check.id,
+    `${check.status}: ${check.remedy ?? check.summary}`
+  ]));
+  if (attention.length > 15)
+    session.display.write(`Showing 15 of ${attention.length} checks needing attention. Explore checks and remedies for the complete report.`);
+}
+function showData(session, outcome) {
+  if (!record2(outcome.data))
+    return;
+  if (["repair", "repairs"].includes(String(outcome.data["command"])))
+    showRepairs(session, outcome.data);
+  if (successful(outcome) && outcome.data["command"] === "nodes")
+    showNodes(session, outcome.data);
+  if (outcome.data["command"] === "discover")
+    showComputers(session, outcome.data);
+}
+function outcomeState(outcome, incomplete) {
+  if (record2(outcome.data) && outcome.data["applied"] === false)
+    return "PREVIEW";
+  if (!successful(outcome))
+    return "FAILED";
+  return incomplete ? "WARNING" : "SUCCESS";
+}
 var init_ui_execute = __esm(() => {
+  init_ui_repairs();
   init_ui_data();
 });
 
@@ -343,9 +423,9 @@ async function chooseTargets(session, action) {
         description: "No roster or SSH required; uses this session workspace."
       },
       {
-        name: "All roster nodes",
+        name: allTargetsName(action),
         value: "all",
-        description: action === "doctor" ? "Controller + every configured node; read-only." : "Every configured remote checkout."
+        description: allTargetsDescription(action)
       }
     ],
     { name: "Select roster nodes…", value: "selected" },
@@ -355,6 +435,8 @@ async function chooseTargets(session, action) {
     return;
   if (selection === "local")
     return ["--local"];
+  if (selection === "all" && action === "repair")
+    return [];
   const nodes = await availableNodes(session);
   if (!nodes.length)
     return missingRoster2(session, action);
@@ -402,6 +484,14 @@ async function missingRoster2(session, action) {
   ]);
   return choice === "local" ? ["--local"] : undefined;
 }
+function allTargetsName(action) {
+  return action === "repair" ? "All visible Tailscale computers" : "All roster nodes";
+}
+function allTargetsDescription(action) {
+  if (action === "doctor")
+    return "Controller + every configured node; read-only.";
+  return action === "repair" ? "Inspect this controller and every visible computer; preview repairs before applying." : "Every configured remote checkout.";
+}
 var init_ui_targets = __esm(() => {
   init_ui_execute();
   init_ui_data();
@@ -413,7 +503,7 @@ async function runCommand2(session, command) {
   const args = await actionArgs(session, command);
   if (!args)
     return;
-  const preview = args[0] === "fleet" && ["sync", "init"].includes(args[1] ?? "");
+  const preview = args[0] === "fleet" && ["sync", "init", "repair"].includes(args[1] ?? "");
   if (args[1] === "init")
     session.display.write("EXAMPLE ONLY: init previews a starter roster, not a configured fleet. Saving requires --apply --yes.");
   const mutation = !preview && (command.mutation || args.includes("--apply"));
@@ -428,7 +518,7 @@ async function actionArgs(session, command) {
   if (args.includes("--local"))
     return args;
   const action = args[1] ?? "";
-  if (["sync", "init"].includes(action)) {
+  if (["sync", "init", "repair"].includes(action)) {
     const preview = args.filter((arg) => !["--apply", "--yes"].includes(arg));
     if (action === "init")
       return preview;
@@ -452,7 +542,7 @@ async function runWithResults(session, initialArgs, title, settings = {}) {
       return;
     await inspectSelection(session, outcome, selection);
     if (selection === "apply") {
-      const appliedArgs = [...args, "--apply", "--yes"];
+      const appliedArgs = applyArgs(args, outcome);
       if (!await confirmMutation(session, appliedArgs))
         continue;
       args = appliedArgs;
@@ -475,16 +565,16 @@ async function inspectSelection(session, outcome, selection) {
 }
 function resultChoices(outcome, preview) {
   return [
+    { name: "Back to commands", value: "back" },
     ...reportChecks(outcome.data).length ? [{ name: "Explore checks and remedies…", value: "checks" }] : [],
     { name: "Inspect structured details / plan…", value: "details" },
     ...preview && successful(outcome) ? [{ name: "Review and explicitly apply…", value: "apply" }] : [],
-    ...!successful(outcome) ? [{ name: "Retry command…", value: "retry" }] : [],
-    { name: "Back to palette", value: "back" }
+    ...!successful(outcome) ? [{ name: "Retry command…", value: "retry" }] : []
   ];
 }
 async function confirmMutation(session, args) {
   const action = args[1];
-  const warning = action === "sync" ? "Sync runs trusted checkout lifecycle scripts and installs tools/dependencies. Failure can leave partial changes; remote installers may continue after disconnect. Inspect the node before retrying. No automatic repairs or credentials." : "This writes the local roster only. No cloud resources, SSH configuration, credentials or host keys are changed.";
+  const warning = action === "repair" ? "Repair runs the eligible owner actions in the displayed plan, including trusted setup/install scripts. Workstation actions may read this machine’s Vault session and write managed 0600 provider configuration. No login session is transferred between computers. Failures can leave partial changes; fresh diagnostics follow." : action === "sync" ? "Sync runs trusted checkout lifecycle scripts and installs tools/dependencies. Failure can leave partial changes; remote installers may continue after disconnect. Inspect the node before retrying. No automatic repairs or credentials." : "This writes the local roster only. No cloud resources, SSH configuration, credentials or host keys are changed.";
   session.display.panel("Explicit approval required", [
     action === "init" ? "Create an EXAMPLE roster only. Replace sample aliases and paths before diagnostics." : warning,
     `Workspace: ${clean(session.workspace ?? session.options.workspace)}`,
@@ -494,6 +584,10 @@ async function confirmMutation(session, args) {
 `));
   return session.prompts.confirm("Apply this exact command? (default: no)");
 }
+function applyArgs(args, outcome) {
+  const guard = args[1] === "repair" && record2(outcome.data) && typeof outcome.data["planHash"] === "string" ? ["--plan-hash", outcome.data["planHash"]] : [];
+  return [...args, ...guard, "--apply", "--yes"];
+}
 var init_ui_actions = __esm(() => {
   init_ui_execute();
   init_ui_data();
@@ -604,64 +698,24 @@ function paletteChoices(session, term) {
   const commands = commandChoices(session.options.commands, term);
   const navigation = [
     {
-      name: "Fleet setup / add node…",
-      value: "setup",
-      description: "Register an existing node; preview + explicit approval before saving."
-    },
-    {
-      name: "Session workspace / config…",
+      name: "Session: Workspace / config…",
       value: "context",
       description: "Session-only overrides; no hidden configuration writes."
-    }
+    },
+    { name: "Exit", value: "exit", description: "Close the command palette." }
   ].filter((choice) => `${choice.name} ${choice.description}`.toLowerCase().includes(term.toLowerCase().trim()));
-  const groups = term.trim() ? [] : [
-    ...new Set(session.options.commands.map((command) => command.group))
-  ].map((group) => ({
-    name: `Browse ${clean(group)}…`,
-    value: `group:${group}`
-  }));
-  return [
-    ...groups,
-    ...navigation,
-    ...commands,
-    ...!commands.length && !navigation.length && term.trim() ? [
-      {
-        name: "No matching commands — change search or go back",
-        value: "none"
-      }
-    ] : [],
-    { name: "Exit", value: "exit" }
-  ];
+  const choices = [...navigation, ...commands].sort((a, b) => a.name.localeCompare(b.name, "en"));
+  return choices.length ? choices : [{ name: "No matching commands — change search", value: "none" }];
 }
 async function dispatch(session, choice) {
   if (choice === "exit")
     return false;
-  if (choice === "setup")
-    await addNode2(session);
   if (choice === "context")
     await changeContext(session);
-  if (choice.startsWith("group:"))
-    await browseGroup(session, choice.slice(6));
   if (choice.startsWith("command:"))
     await openCommand(session, choice.slice(8));
   return true;
 }
-async function browseGroup(session, group) {
-  const commands = session.options.commands.filter((command) => command.group === group);
-  while (true) {
-    const choice = await session.prompts.search(`${clean(group)} · searchable submenu`, (term) => {
-      const choices = commandChoices(commands, term);
-      return [
-        ...choices.length ? choices : [{ name: "No matches — try another keyword", value: "none" }],
-        { name: "Back to all commands", value: "back" }
-      ];
-    });
-    if (choice === "back")
-      return;
-    if (choice.startsWith("command:"))
-      await openCommand(session, choice.slice(8));
-  }
-}
 async function openCommand(session, id) {
   const command = session.options.commands.find((entry) => entry.id === id);
   if (!command)
@@ -796,9 +850,149 @@ var init_ui = __esm(() => {
   init_ui_terminal();
 });
 
+// packages/personal-cli/src/workstation.ts
+import { join } from "node:path";
+
+// packages/fleet/src/runner.ts
+import { spawn } from "node:child_process";
+var MAX_OUTPUT_BYTES = 1024 * 1024;
+function terminate(child) {
+  try {
+    if (process.platform !== "win32" && child.pid)
+      process.kill(-child.pid, "SIGKILL");
+    else
+      child.kill("SIGKILL");
+  } catch {}
+}
+function runCommand(command, options = {}) {
+  return new Promise((resolve) => {
+    const child = spawn(command[0], command.slice(1), {
+      cwd: options.cwd,
+      env: {
+        ...process.env,
+        ...options.env,
+        GIT_TERMINAL_PROMPT: "0",
+        CI: "1"
+      },
+      stdio: "pipe",
+      windowsHide: true,
+      detached: process.platform !== "win32"
+    });
+    let stdout = "";
+    let stderr = "";
+    let bytes = 0;
+    let finished = false;
+    let reason = "exit";
+    const finish = (ok) => {
+      if (finished)
+        return;
+      finished = true;
+      clearTimeout(timer);
+      child.stdin.destroy();
+      child.stdout.destroy();
+      child.stderr.destroy();
+      resolve({ ok, stdout, stderr, reason });
+    };
+    const abort = (cause) => {
+      reason = cause;
+      terminate(child);
+      finish(false);
+    };
+    const timer = setTimeout(() => {
+      abort("timeout");
+    }, options.timeoutMs ?? 15000);
+    const capture = (stream, chunk) => {
+      if (finished)
+        return;
+      bytes += Buffer.byteLength(chunk);
+      if (bytes > MAX_OUTPUT_BYTES) {
+        abort("overflow");
+        return;
+      }
+      if (stream === "stdout")
+        stdout += chunk;
+      else
+        stderr += chunk;
+    };
+    child.stdout.setEncoding("utf8").on("data", (chunk) => capture("stdout", chunk));
+    child.stderr.setEncoding("utf8").on("data", (chunk) => capture("stderr", chunk));
+    child.stdin.on("error", () => {
+      return;
+    });
+    child.on("error", () => {
+      abort("missing");
+    });
+    child.on("close", (code) => {
+      finish(code === 0 && reason === "exit");
+    });
+    child.stdin.end(options.input);
+  });
+}
+
+// packages/personal-cli/src/workstation.ts
+async function workstationCommand(args, settings) {
+  const help = args.length === 0 || args.includes("--help");
+  const result = await runCommand([
+    "bun",
+    join(settings.workspace, "packages/workstation/cli/internal.ts"),
+    ...help ? [...args, "--help"] : [...args, "--json", "--non-interactive"]
+  ], { cwd: settings.workspace, timeoutMs: 1200000 });
+  if (help && result.ok)
+    return {
+      exitCode: 0,
+      data: { version: 1, help: result.stdout },
+      text: result.stdout
+    };
+  if (result.ok) {
+    try {
+      return { exitCode: 0, data: JSON.parse(result.stdout) };
+    } catch {}
+  }
+  return {
+    exitCode: 1,
+    data: {
+      version: 1,
+      ok: false,
+      error: "Workstation operation failed. Check the personal checkout, Bun, conflicts and per-machine authentication."
+    }
+  };
+}
+async function forwardWorkstation(args, settings) {
+  const { spawn } = await import("node:child_process");
+  const childArgs = [];
+  let commandSeen = false;
+  for (let index = 0;index < args.length; index++) {
+    if (["--workspace", "--config"].includes(args[index])) {
+      index++;
+      continue;
+    }
+    if (args[index] === "workstation" && !commandSeen) {
+      commandSeen = true;
+      continue;
+    }
+    childArgs.push(args[index]);
+  }
+  return new Promise((resolve) => {
+    const child = spawn("bun", [
+      join(settings.workspace, "packages/workstation/cli/internal.ts"),
+      ...childArgs.length ? childArgs : ["--help"]
+    ], {
+      cwd: settings.workspace,
+      stdio: "inherit",
+      env: process.env
+    });
+    child.on("error", () => {
+      process.stderr.write(`Workstation requires the personal checkout and shared Bun toolchain.
+`);
+      resolve(1);
+    });
+    child.on("exit", (code) => resolve(code ?? 1));
+  });
+}
+
 // packages/personal-cli/src/settings.ts
 import { access } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
+import { dirname, join as join2, resolve } from "node:path";
 import { homedir } from "node:os";
 async function exists(path) {
   try {
@@ -811,8 +1005,8 @@ async function exists(path) {
 async function findUp(start, name) {
   let current = resolve(start);
   while (true) {
-    if (await exists(join(current, name)))
-      return join(current, name);
+    if (await exists(join2(current, name)))
+      return join2(current, name);
     const parent = dirname(current);
     if (parent === current)
       return null;
@@ -820,11 +1014,378 @@ async function findUp(start, name) {
   }
 }
 async function resolveSettings(overrides = {}, cwd = process.cwd(), env = process.env) {
-  const workspace = resolve(overrides.workspace ?? env["PERSONAL_WORKSPACE"] ?? dirname(await findUp(cwd, "mise.toml") ?? join(cwd, "mise.toml")));
-  const config = resolve(overrides.config ?? env["PERSONAL_FLEET_CONFIG"] ?? await findUp(cwd, ".fleet.local.json") ?? join(homedir(), ".config/personal/fleet.json"));
+  const workspace = resolve(overrides.workspace ?? env["PERSONAL_WORKSPACE"] ?? dirname(await findUp(cwd, "mise.toml") ?? join2(cwd, "mise.toml")));
+  const config = resolve(overrides.config ?? env["PERSONAL_FLEET_CONFIG"] ?? await findUp(cwd, ".fleet.local.json") ?? join2(homedir(), ".config/personal/fleet.json"));
   return { workspace, config };
 }
 
+// packages/personal-cli/src/node-deployment.ts
+import { join as join3 } from "node:path";
+
+// packages/personal-cli/src/t3/files.ts
+import {
+  lstat,
+  mkdir,
+  readFile,
+  rename,
+  rm,
+  writeFile
+} from "node:fs/promises";
+import { dirname as dirname2, parse } from "node:path";
+import { randomUUID, createHash } from "node:crypto";
+
+// packages/fleet/src/errors.ts
+class FleetUsageError extends Error {
+}
+
+// packages/personal-cli/src/t3/files.ts
+var hash = (value) => createHash("sha256").update(value).digest("hex");
+async function safePath(path) {
+  for (let current = path;current !== parse(current).root; current = dirname2(current)) {
+    try {
+      if ((await lstat(current)).isSymbolicLink())
+        throw new FleetUsageError("Managed T3 paths cannot be symlinks.");
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+  }
+}
+async function read(path) {
+  await safePath(path);
+  try {
+    const info = await lstat(path);
+    if (!info.isFile() || info.size > 4 * 1024 * 1024)
+      throw new FleetUsageError("T3 configuration must be a regular file smaller than 4 MiB.");
+    return await readFile(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw error;
+  }
+}
+async function write(path, contents) {
+  await safePath(path);
+  await mkdir(dirname2(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, contents, { mode: 384, flag: "wx" });
+    await rename(temporary, path);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+function object(raw) {
+  if (raw === null)
+    return {};
+  try {
+    const value = JSON.parse(raw);
+    if (value && typeof value === "object" && !Array.isArray(value))
+      return value;
+  } catch {}
+  throw new FleetUsageError("Invalid T3 JSON object. Repair the file before reconciliation.");
+}
+function canonical(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+
+// packages/personal-cli/src/node-deployment.ts
+async function deployment(root) {
+  const raw = await read(join3(root, "node_modules/.personal-node.json"));
+  if (raw === null)
+    return null;
+  const data = object(raw);
+  if (data["version"] !== 1 || typeof data["revision"] !== "string" || !/^[a-f0-9]{40}$/.test(data["revision"]) || typeof data["node"] !== "string" || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(data["node"]))
+    throw new FleetUsageError("Invalid local node receipt. Restore it before reconciling.");
+  return {
+    workspace: join3(root, "node_modules/.fleet-revisions", data["revision"]),
+    node: data["node"],
+    revision: data["revision"]
+  };
+}
+async function recordDeployment(root, node, revision) {
+  const path = join3(root, "node_modules/.personal-node.json");
+  const content = JSON.stringify({ version: 1, node, revision }) + `
+`;
+  if (await read(path) !== content)
+    await write(path, content);
+}
+
+// packages/personal-cli/src/t3/desired.ts
+import { join as join4, resolve as resolve2 } from "node:path";
+import { homedir as homedir2, hostname } from "node:os";
+function nodeId(value) {
+  const id = value ?? hostname().toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 63);
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(id))
+    throw new FleetUsageError("Invalid node ID. Use --id NAME.");
+  return id;
+}
+function paths(options, workspace) {
+  const base = resolve2(options.t3Home ?? process.env["T3CODE_HOME"] ?? join4(homedir2(), ".t3"));
+  return {
+    settings: join4(base, "userdata/settings.json"),
+    state: join4(base, "userdata/personal-managed.json"),
+    definition: resolve2(options.definition ?? join4(workspace, "packages/workstation/agents/t3.json"))
+  };
+}
+async function desired(path, workspace, id) {
+  const raw = await read(path);
+  if (raw === null)
+    throw new FleetUsageError("T3 definition is missing in this checkout.");
+  const doc = object(raw);
+  if (doc["version"] !== 1 || Object.keys(doc).some((key) => !["version", "instances"].includes(key)))
+    throw new FleetUsageError("Unsupported T3 definition. Expected version 1 and instances.");
+  const instances = object(JSON.stringify(doc["instances"] ?? null));
+  for (const [key, value] of Object.entries(instances))
+    validateInstance(key, value);
+  const agents = process.platform === "win32" ? join4(homedir2(), "AppData/Local/personal/agents") : join4(homedir2(), ".config/personal/agents");
+  const variables = {
+    workspace: resolve2(workspace),
+    agents,
+    node: id
+  };
+  return expand(instances, variables);
+}
+function expand(value, variables) {
+  if (typeof value === "string")
+    return value.replace(/\$\{([^}]+)\}/g, (_, key) => {
+      if (!(key in variables))
+        throw new FleetUsageError("Unknown variable in T3 definition.");
+      return variables[key];
+    });
+  if (Array.isArray(value))
+    return value.map((item) => expand(item, variables));
+  if (value && typeof value === "object")
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, expand(item, variables)]));
+  return value;
+}
+function validateInstance(id, value) {
+  const instance = object(JSON.stringify(value));
+  const config = object(JSON.stringify(instance["config"]));
+  const env = instance["environment"];
+  if (!/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/.test(id) || instance["driver"] !== "codex" || typeof instance["displayName"] !== "string" || typeof instance["enabled"] !== "boolean" || Object.keys(instance).some((key) => !["driver", "displayName", "enabled", "config", "environment"].includes(key)) || !validConfig(config) || !validEnvironment(env))
+    throw new FleetUsageError("Invalid T3 instance definition; only the supported Codex adapter fields are accepted.");
+}
+function validConfig(config) {
+  return Object.keys(config).every((key) => ["binaryPath", "homePath"].includes(key)) && typeof config["binaryPath"] === "string" && typeof config["homePath"] === "string";
+}
+function validEnvironment(env) {
+  if (!Array.isArray(env) || env.length !== 1)
+    return false;
+  const variable = object(JSON.stringify(env[0]));
+  return variable["name"] === "WS_AGENT_NODE" && variable["value"] === "${node}" && variable["sensitive"] === false && Object.keys(variable).length === 3;
+}
+
+// packages/personal-cli/src/t3/reconcile.ts
+import { mkdir as mkdir2, rm as rm2 } from "node:fs/promises";
+import { dirname as dirname3 } from "node:path";
+
+// packages/personal-cli/src/t3/plan.ts
+async function planT3(paths, desired) {
+  const raw = await read(paths.settings);
+  const stateRaw = await read(paths.state);
+  const settings = object(raw);
+  const current = object(JSON.stringify(settings["providerInstances"] ?? {}));
+  const owned = readOwnership(stateRaw, paths.settings);
+  const next = { ...current };
+  const changes = [];
+  for (const [id, instance] of Object.entries(desired)) {
+    const exists = Object.hasOwn(current, id);
+    const action = actionFor(exists, owned.includes(id), current[id], instance);
+    changes.push({ id, action });
+    if (action !== "conflict")
+      next[id] = instance;
+  }
+  for (const id of owned.filter((id) => !Object.hasOwn(desired, id))) {
+    changes.push({
+      id,
+      action: Object.hasOwn(current, id) ? "delete" : "unchanged"
+    });
+    delete next[id];
+  }
+  const settingsChanged = canonical(next) !== canonical(current);
+  const state = ownership(paths.settings, Object.keys(desired));
+  return {
+    raw,
+    stateRaw,
+    settings: settingsChanged ? { ...settings, providerInstances: next } : settings,
+    state,
+    settingsChanged,
+    stateChanged: canonical(object(stateRaw)) !== canonical(state),
+    changes,
+    planHash: hash(canonical({ target: paths.settings, raw, stateRaw, desired }))
+  };
+}
+function ownership(target, ids) {
+  return { version: 1, target, instances: [...ids].sort() };
+}
+function readOwnership(raw, target) {
+  if (raw === null)
+    return [];
+  const state = object(raw);
+  const ids = state["instances"];
+  if (state["version"] !== 1 || state["target"] !== target || !Array.isArray(ids) || ids.some((id) => typeof id !== "string" || !/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/.test(id)) || new Set(ids).size !== ids.length)
+    throw new FleetUsageError("Invalid T3 ownership state; restore its backup before reconciliation.");
+  return ids;
+}
+function actionFor(exists, owned, current, desired) {
+  if (exists && !owned)
+    return "conflict";
+  if (!exists)
+    return "create";
+  return canonical(current) === canonical(desired) ? "unchanged" : "update";
+}
+
+// packages/personal-cli/src/t3/reconcile.ts
+async function reconcileT3(paths, desired, options) {
+  if (!options.apply)
+    return report(await planT3(paths, desired), false);
+  return locked(paths, async () => {
+    const plan = await planT3(paths, desired);
+    if (options.planHash && options.planHash !== plan.planHash)
+      throw new FleetUsageError("T3 plan is stale. Run personal t3-plan again.");
+    if (plan.changes.some((change) => change.action === "conflict"))
+      throw new FleetUsageError("T3 instance already exists without ownership. Review it and use personal t3-import --instance ID.");
+    if (!plan.settingsChanged && !plan.stateChanged)
+      return report(plan, true);
+    await persist(paths, desired, plan);
+    const verified = await planT3(paths, desired);
+    if (verified.settingsChanged || verified.stateChanged)
+      throw new FleetUsageError("T3 changed after apply; reconciliation is incomplete. Replan and retry.");
+    return report(plan, true);
+  });
+}
+async function importT3(paths, id) {
+  return locked(paths, async () => {
+    const raw = await read(paths.settings);
+    const instances = object(JSON.stringify(object(raw)["providerInstances"] ?? {}));
+    if (!Object.hasOwn(instances, id))
+      throw new FleetUsageError("T3 import requires an existing instance ID.");
+    const state = await read(paths.state);
+    const owned = readOwnership(state, paths.settings);
+    if (!owned.includes(id)) {
+      if (state !== null)
+        await write(`${paths.state}.backup`, state);
+      if (await read(paths.settings) !== raw)
+        throw new FleetUsageError("T3 changed during import; retry.");
+      await write(paths.state, canonical(ownership(paths.settings, [...owned, id])) + `
+`);
+    }
+    return { version: 1, ok: true, imported: id, changed: !owned.includes(id) };
+  });
+}
+async function locked(paths, action) {
+  await safePath(paths.state);
+  await mkdir2(dirname3(paths.state), { recursive: true, mode: 448 });
+  const lock = `${paths.state}.lock`;
+  try {
+    await mkdir2(lock, { mode: 448 });
+  } catch {
+    throw new FleetUsageError("Another personal T3 operation holds the lock. Inspect interrupted operations before removing a stale lock.");
+  }
+  try {
+    return await action();
+  } finally {
+    await rm2(lock, { recursive: true });
+  }
+}
+function report(plan, applied) {
+  return {
+    version: 1,
+    ok: !plan.changes.some((change) => change.action === "conflict"),
+    applied,
+    changed: plan.settingsChanged || plan.stateChanged,
+    planHash: plan.planHash,
+    changes: plan.changes,
+    runtime: "T3 watches settings.json; new sessions use the reconciled instances. Active sessions are not restarted."
+  };
+}
+async function persist(paths, desired, plan) {
+  if (plan.raw !== null && plan.settingsChanged)
+    await write(`${paths.state}.settings-backup`, plan.raw);
+  if (plan.stateRaw !== null)
+    await write(`${paths.state}.backup`, plan.stateRaw);
+  if (await read(paths.settings) !== plan.raw || await read(paths.state) !== plan.stateRaw)
+    throw new FleetUsageError("T3 configuration changed during apply. Replan and retry.");
+  const previous = readOwnership(plan.stateRaw, paths.settings);
+  await write(paths.state, canonical(ownership(paths.settings, [
+    ...new Set([...previous, ...Object.keys(desired)])
+  ])) + `
+`);
+  if (plan.settingsChanged) {
+    if (await read(paths.settings) !== plan.raw)
+      throw new FleetUsageError("T3 changed during apply. Ownership intent was saved; replan and retry.");
+    await write(paths.settings, JSON.stringify(plan.settings, null, 2) + `
+`);
+  }
+  await write(paths.state, canonical(plan.state) + `
+`);
+}
+
+// packages/personal-cli/src/t3/command.ts
+async function t3Command(command, options, settings) {
+  const deployed = options.definition ? null : await deployment(settings.workspace);
+  const workspace = deployed?.workspace ?? settings.workspace;
+  const target = paths(options, workspace);
+  if (command === "t3-import")
+    return importCommand(target, options);
+  const instances = command === "t3-cleanup" ? {} : await desired(target.definition, workspace, nodeId(options.id ?? deployed?.node));
+  const apply = shouldApply(command, options);
+  if (apply)
+    requireSupportedPlatform(instances);
+  const data = await reconcileT3(target, instances, {
+    apply,
+    ...options.planHash ? { planHash: options.planHash } : {}
+  });
+  return {
+    exitCode: outcomeCode(command, data),
+    data: { command, ...data }
+  };
+}
+async function importCommand(target, options) {
+  if (options.dryRun)
+    throw new FleetUsageError("t3-import is an explicit ownership operation; inspect t3-plan first.");
+  if (!options.instance || !/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/.test(options.instance))
+    throw new FleetUsageError("t3-import requires --instance ID. Import authorizes management of that entire provider instance.");
+  return { exitCode: 0, data: await importT3(target, options.instance) };
+}
+function shouldApply(command, options) {
+  return ["t3-apply", "t3-cleanup"].includes(command) && !options.dryRun;
+}
+function outcomeCode(command, data) {
+  return !data.ok || command === "t3-status" && data.changed ? 1 : 0;
+}
+function requireSupportedPlatform(instances) {
+  if (process.platform === "win32" && Object.keys(instances).length)
+    throw new FleetUsageError("Managed Codex proxy execution requires macOS/Linux/WSL; native Windows settings were preserved.");
+}
+
+// packages/personal-cli/src/t3/register.ts
+var T3_COMMANDS = [
+  ["t3-plan", "Preview creates, updates and owned removals"],
+  ["t3-apply", "Reconcile declared T3 provider instances"],
+  ["t3-status", "Check managed T3 configuration for drift"],
+  [
+    "t3-cleanup",
+    "Remove only provider instances recorded in personal ownership state"
+  ],
+  ["t3-import", "Adopt an existing provider instance into personal ownership"]
+];
+function registerT3(program, defaults, complete) {
+  for (const [name, description] of T3_COMMANDS) {
+    program.command(name).description(description).option("--id <name>", "Node ID; defaults to hostname").option("--t3-home <path>", "T3 base directory; defaults to T3CODE_HOME or ~/.t3").option("--definition <path>", "Version 1 declarative T3 provider definition").option("--plan-hash <sha256>", "Reject any changes since the reviewed plan").option("--dry-run", "Preview without writing configuration or state").option("--instance <id>", "Existing instance to adopt with t3-import").action(async (_options, command) => {
+      const options = command.optsWithGlobals();
+      const settings = await resolveSettings({ ...defaults, ...options });
+      complete(await t3Command(name, options, settings));
+    });
+  }
+}
+
 // packages/personal-cli/src/registry.ts
 init_search();
 function fleet(command, title, description, keywords) {
@@ -836,10 +1397,79 @@ function fleet(command, title, description, keywords) {
     keywords,
     args: ["fleet", command],
     examples: [`personal fleet ${command} --json`],
-    mutation: ["add", "sync", "init"].includes(command)
+    mutation: ["add", "sync", "init", "repair"].includes(command)
   };
 }
 var COMMANDS = [
+  ...T3_COMMANDS.map(([id, description]) => ({
+    id,
+    title: description,
+    description,
+    group: "T3",
+    keywords: ["t3", "configuration", "terraform", "drift"],
+    args: [id],
+    examples: [`personal ${id} --json`],
+    mutation: ["t3-apply", "t3-cleanup", "t3-import"].includes(id)
+  })),
+  {
+    id: "workstation",
+    title: "Workstation configuration",
+    description: "Tools, editor configuration, agent profiles, notifications and launcher lifecycle.",
+    group: "Workstation",
+    keywords: ["tools", "agents", "opencode", "install"],
+    args: ["workstation"],
+    examples: ["personal workstation --help"],
+    mutation: false
+  },
+  ...[
+    [
+      "fleet-node-sync",
+      "Sync this node",
+      "Upsert and reconcile locked tools and the Codex proxy profile on this machine. Applies by default; --dry-run previews."
+    ],
+    [
+      "fleet-status",
+      "Fleet status",
+      "Check this machine and all registered computers without changing them."
+    ],
+    [
+      "fleet-discover",
+      "Discover computers",
+      "List computers visible through Tailscale."
+    ]
+  ].map(([id, title, description]) => ({
+    id,
+    title,
+    description,
+    group: "Fleet",
+    keywords: ["node", "sync", "proxy", "status"],
+    args: [id],
+    examples: [`personal ${id} --json`],
+    mutation: id === "fleet-node-sync"
+  })),
+  fleet("repairs", "Explore repairs and login commands", "List existing tool owners, automated repairs, native per-machine login commands and shared Vault access guidance. No roster or credentials required.", ["fix", "repair", "login", "credentials", "sharing", "vault", "resources"]),
+  fleet("repair", "Repair tools and configuration", "Inspect visible Tailscale computers and preview owner-managed repairs. --apply --yes executes eligible tools/config repairs and reruns diagnostics. Logins and host trust remain explicit operator steps.", [
+    "fix",
+    "repair",
+    "sync",
+    "setup",
+    "versions",
+    "config",
+    "login",
+    "credentials"
+  ]),
+  fleet("health", "Check all Tailscale computers", "Discover every visible non-mobile Tailscale computer, test reachability, pinned tools, configuration and service logins. Offline, unregistered and unverified computers fail coverage.", [
+    "tailscale",
+    "tailnet",
+    "all",
+    "health",
+    "versions",
+    "codex",
+    "claude",
+    "login",
+    "auth"
+  ]),
+  fleet("discover", "Discover Tailscale computers", "List all computers visible to this Tailscale account, including offline devices. Excludes iOS, Android and tvOS; never writes a roster.", ["tailscale", "tailnet", "computers", "discover", "machines"]),
   fleet("doctor", "Diagnose the entire fleet", "Read-only SSH, authentication, T3, VS Code and dependency checks for this controller and every roster node.", [
     "health",
     "ssh",
@@ -891,54 +1521,9 @@ function commandCatalog(search = "", group) {
 // packages/personal-cli/src/program.ts
 import { Command, CommanderError } from "commander";
 
-// packages/fleet/src/errors.ts
-class FleetUsageError extends Error {
-}
-
-// packages/personal-cli/src/agent-guide.ts
-var AGENT_GUIDE = {
-  version: 1,
-  name: "@crvouga/personal",
-  invocation: "npx --yes @crvouga/personal@<exact-version> <command> --json --non-interactive",
-  discovery: "personal commands --json",
-  configuration: {
-    workspace: "--workspace PATH, PERSONAL_WORKSPACE, closest ancestor mise.toml, then current directory",
-    roster: "--config PATH, PERSONAL_FLEET_CONFIG, closest ancestor .fleet.local.json, then ~/.config/personal/fleet.json"
-  },
-  output: {
-    stdout: "One versioned JSON document with --json. Prompts and progress never contaminate stdout.",
-    exitCodes: {
-      "0": "Success or preview",
-      "1": "Failed check or operation; strict also rejects warnings/skips",
-      "2": "Invalid usage or configuration",
-      "130": "Cancelled"
-    },
-    errors: "{version:1,ok:false,code,error}; raw subprocess output and exception details are withheld",
-    reports: "{version:1,command,ok,generatedAt,nodes:[{node,checks:[{id,status,summary,remedy?}]}],summary,coverage}",
-    statuses: ["pass", "warn", "fail", "skip"],
-    coverage: "Default doctor tests the controller and all configured nodes. --local tests only this controller. A missing roster fails explicitly; configured nodes are not every computer that exists. T3/VS Code end-to-end checks remain manual."
-  },
-  safety: [
-    "No arguments opens a menu only on an interactive terminal. --json and --non-interactive never prompt.",
-    "Diagnostics, onboarding instructions, schema, catalog and sync previews are read-only.",
-    "Roster writes and sync require both --apply and --yes. npx --yes only approves downloading the CLI.",
-    "Do not copy credentials, forward SSH agents, bypass host keys, provision infrastructure or execute unreviewed remedies.",
-    "A healthy controller does not prove another machine can connect to it. Run doctor from each intended controller.",
-    "Use exact npm versions for automation. The application never self-updates."
-  ],
-  examples: [
-    "personal fleet doctor --local --workspace /path/to/personal --json",
-    "personal fleet doctor --all --json --strict --timeout 120000",
-    "personal fleet add --id dev-linux --ssh dev-linux --path /home/dev/workspace --require github,t3,toolchain --json",
-    "personal fleet add --id dev-linux --ssh dev-linux --path /home/dev/workspace --apply --yes --json",
-    "personal fleet doctor --node dev-linux --json",
-    "personal fleet sync --node dev-linux --json"
-  ]
-};
-
 // packages/personal-cli/src/fleet.ts
-import { writeFile as writeFile2, mkdir as mkdir3 } from "node:fs/promises";
-import { dirname as dirname3 } from "node:path";
+import { writeFile as writeFile3, mkdir as mkdir5 } from "node:fs/promises";
+import { dirname as dirname5 } from "node:path";
 
 // packages/fleet/src/config.ts
 var CAPABILITIES = [
@@ -946,7 +1531,11 @@ var CAPABILITIES = [
   "vault",
   "t3",
   "vscode",
-  "toolchain"
+  "toolchain",
+  "codex",
+  "claude",
+  "services",
+  "workstation"
 ];
 function record(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -1020,13 +1609,13 @@ function selectNodes(config, ids) {
 }
 
 // packages/fleet/src/fingerprint.ts
-import { readFile as readFile2, mkdir, writeFile } from "node:fs/promises";
-import { join as join3 } from "node:path";
+import { readFile as readFile3, mkdir as mkdir3, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join6 } from "node:path";
 
 // packages/fleet/src/input-hashes.ts
-import { createHash } from "node:crypto";
-import { readFile, readdir } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { createHash as createHash2 } from "node:crypto";
+import { readFile as readFile2, readdir } from "node:fs/promises";
+import { join as join5 } from "node:path";
 var INPUT_FILES = [
   "package.json",
   "bun.lock",
@@ -1040,19 +1629,19 @@ var FINGERPRINT_FILES = [
 ];
 async function fileHash(path) {
   try {
-    return digest(await readFile(path));
+    return digest(await readFile2(path));
   } catch {
     return null;
   }
 }
 async function manifestHash(root) {
   try {
-    const entries = await readdir(join2(root, "packages"), {
+    const entries = await readdir(join5(root, "packages"), {
       withFileTypes: true
     });
     const hashes = [];
     for (const entry of entries.filter((item) => item.isDirectory()).sort((left, right) => left.name.localeCompare(right.name, "en"))) {
-      hashes.push(`${entry.name}:${await fileHash(join2(root, "packages", entry.name, "package.json"))}`);
+      hashes.push(`${entry.name}:${await fileHash(join5(root, "packages", entry.name, "package.json"))}`);
     }
     return digest(hashes.join(`
 `));
@@ -1062,19 +1651,19 @@ async function manifestHash(root) {
 }
 async function sidecarHash(root) {
   try {
-    const files = await readdir(join2(root, ".mise/locks"), {
+    const files = await readdir(join5(root, ".mise/locks"), {
       recursive: true,
       withFileTypes: true
     });
     if (files.length > 4096 || files.some((entry) => entry.isSymbolicLink()))
       return null;
     const hashes = [];
-    const paths = files.filter((entry) => entry.isFile()).map((entry) => join2(entry.parentPath, entry.name)).sort();
+    const paths = files.filter((entry) => entry.isFile()).map((entry) => join5(entry.parentPath, entry.name)).sort();
     for (const path of paths) {
       const hash = await fileHash(path);
       if (hash === null)
         return null;
-      const relative = path.slice(join2(root, ".mise/locks").length).replaceAll("\\", "/");
+      const relative = path.slice(join5(root, ".mise/locks").length).replaceAll("\\", "/");
       hashes.push(`${relative}:${hash}`);
     }
     return digest(hashes.join(`
@@ -1084,7 +1673,7 @@ async function sidecarHash(root) {
   }
 }
 function digest(value) {
-  return createHash("sha256").update(value).digest("hex");
+  return createHash2("sha256").update(value).digest("hex");
 }
 
 // packages/fleet/src/fingerprint.ts
@@ -1092,7 +1681,7 @@ var RECEIPT = "node_modules/.fleet-sync.json";
 async function fingerprint(root, run) {
   const files = {};
   for (const name of INPUT_FILES)
-    files[name] = await fileHash(join3(root, name));
+    files[name] = await fileHash(join6(root, name));
   files["workspace-manifests"] = await manifestHash(root);
   files["mise-sidecars"] = await sidecarHash(root);
   const head = await run(["git", "rev-parse", "HEAD"], { cwd: root });
@@ -1106,7 +1695,7 @@ async function dependencyCheck(root, current) {
     action: "Review fleet sync, then explicitly apply a frozen toolchain/dependency sync."
   };
   try {
-    const receipt = JSON.parse(await readFile2(join3(root, RECEIPT), "utf8"));
+    const receipt = JSON.parse(await readFile3(join6(root, RECEIPT), "utf8"));
     const matches = record(receipt) && receipt["version"] === 1 && JSON.stringify(receipt["files"]) === JSON.stringify(current.files);
     return {
       id: "dependencies",
@@ -1124,8 +1713,8 @@ async function dependencyCheck(root, current) {
   }
 }
 async function writeReceipt(root, current) {
-  await mkdir(join3(root, "node_modules"), { recursive: true });
-  await writeFile(join3(root, RECEIPT), JSON.stringify({ version: 1, files: current.files }), { mode: 384 });
+  await mkdir3(join6(root, "node_modules"), { recursive: true });
+  await writeFile2(join6(root, RECEIPT), JSON.stringify({ version: 1, files: current.files }), { mode: 384 });
 }
 function compareFingerprints(expected, actual) {
   return [
@@ -1148,11 +1737,200 @@ function compare(id, expected, actual) {
   };
 }
 
+// packages/fleet/src/service-auth.ts
+function json(result) {
+  try {
+    const data = JSON.parse(result.stdout);
+    return record(data) ? data : null;
+  } catch {
+    return null;
+  }
+}
+async function codingAuth(id, run) {
+  return [
+    await serviceCheck(id === "codex" ? {
+      id,
+      command: ["codex", "login", "status"],
+      action: "Run codex login on this computer as its operator.",
+      valid: (result) => /^Logged in using (ChatGPT|an API key|API key)\b/im.test(`${result.stdout}
+${result.stderr}`)
+    } : {
+      id,
+      command: ["claude", "auth", "status", "--json"],
+      action: "Run claude auth login on this computer as its operator.",
+      valid: (result) => json(result)?.["loggedIn"] === true
+    }, run)
+  ];
+}
+async function serviceAuth(run) {
+  const services = [
+    {
+      id: "railway",
+      command: ["railway", "whoami", "--json"],
+      action: "Run railway login on this computer.",
+      valid: (result) => typeof json(result)?.["id"] === "string"
+    },
+    {
+      id: "vercel",
+      command: ["vercel", "whoami"],
+      action: "Run vercel login on this computer.",
+      valid: (result) => /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,100}$/.test(result.stdout.trim())
+    },
+    {
+      id: "cloudflare",
+      command: ["wrangler", "whoami", "--json"],
+      action: "Run wrangler login on this computer.",
+      valid: (result) => json(result)?.["loggedIn"] === true
+    },
+    {
+      id: "aws",
+      command: [
+        "aws",
+        "sts",
+        "get-caller-identity",
+        "--output",
+        "json",
+        "--no-cli-pager"
+      ],
+      action: "Select and authenticate the intended AWS profile on this computer.",
+      valid: (result) => typeof json(result)?.["Account"] === "string" && typeof json(result)?.["Arn"] === "string"
+    },
+    {
+      id: "npm",
+      command: ["npm", "whoami", "--registry=https://registry.npmjs.org/"],
+      action: "Run npm login only if this computer should publish packages.",
+      valid: (result) => /^[a-z0-9][a-z0-9._-]{0,213}$/.test(result.stdout.trim())
+    }
+  ];
+  const checks = [];
+  for (const service of services)
+    checks.push(await serviceCheck(service, run));
+  for (const id of ["gemini", "copilot", "opencode"])
+    checks.push({
+      id: `auth:${id}`,
+      status: "skip",
+      summary: `${id} provider authorization has no verified noninteractive status adapter in this CLI. Installed binaries or saved keys are not proof of access.`,
+      remedy: {
+        action: `Verify ${id} provider access locally using its supported account diagnostics. No prompt or billable request was made.`
+      }
+    });
+  return checks;
+}
+async function serviceCheck(service, run) {
+  const result = await run(service.command, { timeoutMs: 15000 });
+  const ok = result.ok && service.valid(result);
+  return {
+    id: `auth:${service.id}`,
+    status: ok ? "pass" : "fail",
+    summary: ok ? `${service.id} reports an authenticated session in this process context; no credential or account output retained.` : `${service.id} login is missing or could not be verified (${result.reason}); no credential output retained.`,
+    ...!ok ? { remedy: { action: service.action } } : {}
+  };
+}
+
+// packages/fleet/src/workstation-checks.ts
+async function workstationChecks(root, run) {
+  const result = await run(["personal", "workstation", "doctor", "--json", "--non-interactive"], {
+    cwd: root,
+    timeoutMs: 20000
+  });
+  const fallback = {
+    id: "workstation:configuration",
+    status: "fail",
+    summary: "Managed workstation configuration could not be verified.",
+    remedy: {
+      action: "Run personal workstation doctor --json on this computer. Review managed links, PATH, coding-tool/provider configuration and notification settings; apply personal workstation sync only explicitly."
+    }
+  };
+  try {
+    const data = JSON.parse(result.stdout);
+    if (!record(data) || !Array.isArray(data["checks"]) || !data["checks"].length || data["checks"].length > 100)
+      return [fallback];
+    const checks = data["checks"].map(configurationCheck);
+    if (checks.some((check) => check === null))
+      return [fallback];
+    return [
+      ...!result.ok || data["ok"] !== true ? [fallback] : [],
+      ...checks
+    ];
+  } catch {
+    return [fallback];
+  }
+}
+function configurationCheck(value) {
+  if (!record(value) || typeof value["id"] !== "string" || !/^[a-zA-Z0-9:._-]{1,75}$/.test(value["id"]) || !["pass", "warn", "fail"].includes(String(value["severity"])))
+    return null;
+  const ok = value["severity"] === "pass";
+  return {
+    id: `workstation:${value["id"].toLowerCase()}`,
+    status: value["severity"],
+    summary: ok ? "Managed configuration check succeeded (configuration presence; provider authorization is checked separately)." : "Managed configuration is missing, conflicting or unverified.",
+    ...!ok ? {
+      remedy: {
+        action: "Inspect personal workstation doctor --json on this computer. Use explicit personal workstation sync only after reviewing the configuration changes."
+      }
+    } : {}
+  };
+}
+
+// packages/fleet/src/toolchain-checks.ts
+import { join as join7 } from "node:path";
+async function toolchainChecks(root, run) {
+  const result = await run(["bun", join7(root, "scripts/dev/doctor.ts"), "--json", "--docker"], { cwd: root, timeoutMs: 90000 });
+  const fallback = {
+    id: "auth:toolchain",
+    status: "fail",
+    summary: "Pinned tool/dependency and Docker checks could not be verified.",
+    remedy: {
+      action: "Run the checkout scripts/dev/doctor.ts --json --docker on this computer. Reconcile versions only through the shared mise setup."
+    }
+  };
+  try {
+    const data = JSON.parse(result.stdout);
+    if (!record(data) || typeof data["ok"] !== "boolean" || !Array.isArray(data["checks"]) || !data["checks"].length || data["checks"].length > 150)
+      return [fallback];
+    const checks = data["checks"].map(toolCheck);
+    if (checks.some((check) => check === null))
+      return [fallback];
+    return [
+      ...!result.ok || !data["ok"] ? [fallback] : [],
+      ...checks
+    ];
+  } catch {
+    return [fallback];
+  }
+}
+function toolCheck(value) {
+  if (!record(value) || typeof value["id"] !== "string" || !/^[a-zA-Z0-9@:/._-]{1,75}$/.test(value["id"]) || !["pass", "fail", "warn", "skip"].includes(String(value["status"])))
+    return null;
+  const ok = value["status"] === "pass";
+  const version = typeof value["detail"] === "string" && /^v?\d{1,6}(?:\.\d{1,6}){1,3}$/.test(value["detail"]) ? ` ${value["detail"]}` : "";
+  return {
+    id: `tool:${value["id"].toLowerCase().replace(/[^a-z0-9:._-]/g, "_")}`,
+    status: value["status"],
+    summary: ok ? `Expected tool version or runtime check succeeded${version}.` : "Expected tool version, runtime or authentication check did not pass.",
+    ...!ok ? {
+      remedy: {
+        action: "Review scripts/dev/doctor.ts --json --docker locally. Use shared mise/workstation setup to reconcile this computer."
+      }
+    } : {}
+  };
+}
+
 // packages/fleet/src/auth-checks.ts
-import { join as join4 } from "node:path";
 async function authCheck(capability, run, root) {
   if (capability === "t3")
     return t3Checks(run);
+  if (capability === "codex" || capability === "claude")
+    return codingAuth(capability, run);
+  if (capability === "services")
+    return serviceAuth(run);
+  if (capability === "workstation")
+    return workstationChecks(root, run);
+  if (capability === "toolchain")
+    return toolchainChecks(root, run);
+  return basicAuth(capability, run, root);
+}
+async function basicAuth(capability, run, root) {
   const spec = {
     github: {
       command: ["gh", "auth", "status", "--active"],
@@ -1165,15 +1943,11 @@ async function authCheck(capability, run, root) {
     vscode: {
       command: ["code", "--list-extensions"],
       action: "Install the VS Code CLI on PATH and ms-vscode-remote.remote-ssh in the local editor profile."
-    },
-    toolchain: {
-      command: ["bun", join4(root, "scripts/dev/doctor.ts"), "--json"],
-      action: "Run ws tools check --json; use the shared mise setup to reconcile tools."
     }
   }[capability];
   const result = await run(spec.command, {
     cwd: root,
-    timeoutMs: capability === "toolchain" ? 90000 : 15000
+    timeoutMs: 15000
   });
   const extensions = result.stdout.toLowerCase().split(/\s+/);
   const ok = result.ok && (capability !== "vscode" || extensions.includes("ms-vscode-remote.remote-ssh"));
@@ -1252,13 +2026,7 @@ async function probe(root, required, run) {
     summary: dirty.ok && !dirty.stdout.trim() ? "Working tree is clean." : "Working tree is dirty or unreadable; sync --pull will refuse."
   });
   checks.push(await dependencyCheck(root, current));
-  for (const capability of [
-    "github",
-    "vault",
-    "t3",
-    "vscode",
-    "toolchain"
-  ]) {
+  for (const capability of CAPABILITIES) {
     if (required.includes(capability))
       checks.push(...await authCheck(capability, run, root));
     else
@@ -1506,8 +2274,11 @@ async function bundleProbe() {
 async function inspectRemote(node, options, run) {
   const command = remoteCommand(node, {
     action: options.action,
+    configuration: options.configuration,
     node,
-    apply: options.action === "sync",
+    apply: options.action !== "probe",
+    repairs: options.repairs,
+    expected: options.expected,
     pull: options.pull === true
   });
   const result = await run(command, {
@@ -1516,7 +2287,7 @@ async function inspectRemote(node, options, run) {
   });
   if (!result.ok)
     return { node: node.id, checks: [sshFailure(result)] };
-  if (options.action === "sync")
+  if (options.action !== "probe")
     return decodeSync(node.id, result.stdout);
   const snapshot = decodeSnapshot(result.stdout);
   if (!snapshot)
@@ -1542,7 +2313,7 @@ async function inspectRemote(node, options, run) {
 function decodeSync(node, output) {
   try {
     const data = JSON.parse(output);
-    if (record(data) && data["version"] === 1 && Array.isArray(data["checks"]) && data["checks"].length <= 200 && data["checks"].every(validCheck)) {
+    if (record(data) && data["version"] === 1 && Array.isArray(data["checks"]) && data["checks"].length > 0 && data["checks"].length <= 200 && data["checks"].every(validCheck)) {
       return { node, checks: data["checks"].map(cleanCheck) };
     }
   } catch {
@@ -1604,7 +2375,7 @@ async function doctor(nodes, options, run) {
 
 // packages/fleet/src/sync.ts
 import { unlink } from "node:fs/promises";
-import { join as join5 } from "node:path";
+import { join as join8 } from "node:path";
 function syncPlan(pull) {
   return [
     "Validate the checkout and shared input files; invalidate any prior sync receipt.",
@@ -1629,7 +2400,7 @@ async function syncWorkspace(root, pull, run) {
     if (!dirty.ok || dirty.stdout.trim() || !branch.ok)
       return failed("Refusing pull: dirty, detached, or unreadable checkout. Reconcile manually.");
   }
-  await unlink(join5(root, "node_modules/.fleet-sync.json")).catch(() => {
+  await unlink(join8(root, "node_modules/.fleet-sync.json")).catch(() => {
     return;
   });
   if (pull) {
@@ -1719,82 +2490,6 @@ function onboarding(node, launcher = "bun run fleet") {
     }
   };
 }
-
-// packages/fleet/src/runner.ts
-import { spawn } from "node:child_process";
-var MAX_OUTPUT_BYTES = 1024 * 1024;
-function terminate(child) {
-  try {
-    if (process.platform !== "win32" && child.pid)
-      process.kill(-child.pid, "SIGKILL");
-    else
-      child.kill("SIGKILL");
-  } catch {}
-}
-function runCommand(command, options = {}) {
-  return new Promise((resolve) => {
-    const child = spawn(command[0], command.slice(1), {
-      cwd: options.cwd,
-      env: {
-        ...process.env,
-        ...options.env,
-        GIT_TERMINAL_PROMPT: "0",
-        CI: "1"
-      },
-      stdio: "pipe",
-      windowsHide: true,
-      detached: process.platform !== "win32"
-    });
-    let stdout = "";
-    let stderr = "";
-    let bytes = 0;
-    let finished = false;
-    let reason = "exit";
-    const finish = (ok) => {
-      if (finished)
-        return;
-      finished = true;
-      clearTimeout(timer);
-      child.stdin.destroy();
-      child.stdout.destroy();
-      child.stderr.destroy();
-      resolve({ ok, stdout, stderr, reason });
-    };
-    const abort = (cause) => {
-      reason = cause;
-      terminate(child);
-      finish(false);
-    };
-    const timer = setTimeout(() => {
-      abort("timeout");
-    }, options.timeoutMs ?? 15000);
-    const capture = (stream, chunk) => {
-      if (finished)
-        return;
-      bytes += Buffer.byteLength(chunk);
-      if (bytes > MAX_OUTPUT_BYTES) {
-        abort("overflow");
-        return;
-      }
-      if (stream === "stdout")
-        stdout += chunk;
-      else
-        stderr += chunk;
-    };
-    child.stdout.setEncoding("utf8").on("data", (chunk) => capture("stdout", chunk));
-    child.stderr.setEncoding("utf8").on("data", (chunk) => capture("stderr", chunk));
-    child.stdin.on("error", () => {
-      return;
-    });
-    child.on("error", () => {
-      abort("missing");
-    });
-    child.on("close", (code) => {
-      finish(code === 0 && reason === "exit");
-    });
-    child.stdin.end(options.input);
-  });
-}
 // packages/fleet/schema.json
 var schema_default = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
@@ -1834,7 +2529,17 @@ var schema_default = {
             uniqueItems: true,
             default: ["github", "vault", "t3", "toolchain"],
             items: {
-              enum: ["github", "vault", "t3", "vscode", "toolchain"]
+              enum: [
+                "github",
+                "vault",
+                "t3",
+                "vscode",
+                "toolchain",
+                "codex",
+                "claude",
+                "services",
+                "workstation"
+              ]
             }
           }
         }
@@ -1861,7 +2566,7 @@ var fleet_example_default = {
 function capabilities(value) {
   const values = value === "none" ? [] : value?.split(",") ?? CAPABILITIES;
   if (values.some((entry) => !CAPABILITIES.includes(entry)))
-    throw new FleetUsageError("--require expects github,vault,t3,vscode,toolchain or none.");
+    throw new FleetUsageError(`--require expects ${CAPABILITIES.join(",")} or none.`);
   return [...new Set(values)];
 }
 function timeout(options) {
@@ -1872,24 +2577,29 @@ function timeout(options) {
 }
 function validateOptions(command, options) {
   validateMutation(command, options);
+  validateRepair(command, options);
   validateScope(command, options);
+  if (["discover", "health", "repair"].includes(command) && options.require !== undefined)
+    throw new FleetUsageError("Tailscale health always checks the complete capability set; --require is not supported.");
   if (options.timeout !== undefined)
     timeout(options);
 }
 function validateMutation(command, options) {
-  if (options.apply && !["add", "init", "sync"].includes(command))
-    throw new FleetUsageError("--apply is only valid for fleet add, init or sync.");
+  if (options.apply && !["add", "init", "sync", "repair"].includes(command))
+    throw new FleetUsageError("--apply is only valid for fleet add, init, sync or repair.");
   if (options.apply && !options.yes)
     throw new FleetUsageError("Mutation requires both --apply and --yes.");
   if (options.pull && command !== "sync")
     throw new FleetUsageError("--pull is only valid for fleet sync.");
 }
 function validateScope(command, options) {
-  if (options.local && !["doctor", "sync"].includes(command))
-    throw new FleetUsageError("--local is only valid for fleet doctor or sync.");
+  if (["discover", "health"].includes(command) && (options.local || options.all || options.node?.length))
+    throw new FleetUsageError("Tailscale discovery and health always cover all visible computers; scope filters are not supported.");
+  if (options.local && !["doctor", "sync", "repair"].includes(command))
+    throw new FleetUsageError("--local is only valid for fleet doctor, sync or repair.");
   validateExclusive(options);
-  if (options.all && command !== "doctor")
-    throw new FleetUsageError("--all is only valid for fleet doctor; sync already targets all configured nodes by default.");
+  if (options.all && !["doctor", "repair"].includes(command))
+    throw new FleetUsageError("--all is only valid for fleet doctor or repair; sync already targets all configured nodes by default.");
 }
 function validateExclusive(options) {
   const selected = [
@@ -1900,17 +2610,30 @@ function validateExclusive(options) {
   if (selected.length > 1)
     throw new FleetUsageError("Choose --local, --all, or --node, not a combination.");
 }
+function validateRepair(command, options) {
+  if (options.planHash !== undefined && !/^[a-f0-9]{64}$/.test(options.planHash))
+    throw new FleetUsageError("--plan-hash expects the SHA-256 value from a repair preview.");
+  if ((options.repair !== undefined || options.script || options.planHash !== undefined) && command !== "repair")
+    throw new FleetUsageError("--repair and --script are only valid for fleet repair.");
+  if (options.script && options.apply)
+    throw new FleetUsageError("--script only generates a preview; run a reviewed repair separately with --apply --yes.");
+  validateCatalogScope(command, options);
+}
+function validateCatalogScope(command, options) {
+  if (command === "repairs" && (options.local || options.node?.length || options.all || options.require !== undefined))
+    throw new FleetUsageError("fleet repairs is a static catalog and does not accept target or capability filters.");
+}
 
 // packages/personal-cli/src/roster.ts
-import { lstat, mkdir as mkdir2, open, readFile as readFile3, rename, unlink as unlink2 } from "node:fs/promises";
-import { dirname as dirname2 } from "node:path";
-import { randomUUID } from "node:crypto";
+import { lstat as lstat2, mkdir as mkdir4, open, readFile as readFile4, rename as rename2, unlink as unlink2 } from "node:fs/promises";
+import { dirname as dirname4 } from "node:path";
+import { randomUUID as randomUUID2 } from "node:crypto";
 async function readRoster(path) {
   try {
-    const info = await lstat(path);
+    const info = await lstat2(path);
     if (!info.isFile() || info.size > 1024 * 1024)
       throw new FleetUsageError("Roster must be a regular file smaller than 1 MiB; symlinks are not supported.");
-    return parseConfig(JSON.parse(await readFile3(path, "utf8")));
+    return parseConfig(JSON.parse(await readFile4(path, "utf8")));
   } catch (error) {
     if (record(error) && error["code"] === "ENOENT")
       return null;
@@ -1937,7 +2660,7 @@ function appendNode(existing, node) {
 async function addNode(path, node, apply) {
   if (!apply)
     return appendNode(await readRoster(path), node);
-  await mkdir2(dirname2(path), { recursive: true, mode: 448 });
+  await mkdir4(dirname4(path), { recursive: true, mode: 448 });
   const lock = await acquireLock(path);
   try {
     const roster = appendNode(await readRoster(path), node);
@@ -1956,14 +2679,14 @@ async function acquireLock(path) {
   }
 }
 async function atomicWrite(path, roster) {
-  const temporary = `${path}.${randomUUID()}.tmp`;
+  const temporary = `${path}.${randomUUID2()}.tmp`;
   const handle = await open(temporary, "wx", 384);
   try {
     await handle.writeFile(`${JSON.stringify(roster, null, 2)}
 `);
     await handle.sync();
     await handle.close();
-    await rename(temporary, path);
+    await rename2(temporary, path);
   } finally {
     await handle.close();
     await unlink2(temporary).catch(() => {
@@ -1972,60 +2695,903 @@ async function atomicWrite(path, roster) {
   }
 }
 
-// packages/personal-cli/src/probe-source.ts
-import { readFile as readFile4 } from "node:fs/promises";
-async function probeSource() {
-  if (typeof Bun !== "undefined")
-    return bundleProbe();
-  return readFile4(new URL("./probe.mjs", import.meta.url), "utf8");
+// packages/fleet/src/tailscale.ts
+import { isIP } from "node:net";
+async function discoverTailnet(run) {
+  const result = await run(["tailscale", "status", "--json"], {
+    timeoutMs: 15000
+  });
+  if (!result.ok)
+    return unavailable("Tailscale status is unavailable; check the CLI, daemon and account login.");
+  try {
+    return parseTailnet(JSON.parse(result.stdout));
+  } catch {
+    return unavailable("Tailscale returned an unsupported status document. Update the CLI and check its daemon.");
+  }
 }
-
-// packages/personal-cli/src/fleet.ts
-var SERVICES = { run: runCommand, source: probeSource };
-async function executeFleet(command, options, settings, services = SERVICES) {
-  validateOptions(command, options);
-  if (command === "schema")
-    return result(schema_default);
-  if (command === "init")
-    return initialize(settings, options);
-  if (command === "add")
-    return register(settings, options);
-  const roster = options.local ? null : await readRoster(settings.config);
-  const nodes = resolveNodes(command, options, roster);
-  if (["nodes", "validate", "onboard"].includes(command))
-    return result({
-      version: 1,
-      command,
-      ok: true,
-      nodes: command === "onboard" ? nodes.map((node) => onboarding(node, "personal fleet")) : nodes
-    });
-  if (command === "sync")
-    return synchronize(nodes, options, settings, services);
-  return diagnose(nodes, options, { ...settings, missingRoster: !roster }, services);
+function parseTailnet(data) {
+  if (!record(data) || data["BackendState"] !== "Running")
+    return unavailable("Tailscale is not running and signed in. Review tailscale status locally.");
+  validateStatusFields(data);
+  const peers = Object.values(data["Peer"] ?? {});
+  if (peers.length > 1024)
+    throw new Error("Too many peers");
+  const all = [
+    parseComputer(data["Self"], true),
+    ...peers.map((peer) => parseComputer(peer, false))
+  ];
+  if (new Set(all.map((peer) => peer.id)).size !== all.length)
+    throw new Error("Duplicate peer");
+  const mobile = (peer) => ["ios", "android", "tvos"].includes(peer.os.toLowerCase());
+  const computers = all.filter((peer) => !mobile(peer)).sort((a, b) => a.name.localeCompare(b.name, "en"));
+  const healthy = healthyDiscovery(data, computers.length);
+  return {
+    computers,
+    excludedMobile: all.filter(mobile).length,
+    checks: [
+      {
+        id: "tailscale:discovery",
+        status: healthy ? "pass" : "fail",
+        summary: healthy ? "Signed-in Tailscale daemon returned its visible computer inventory." : "Tailscale reports a daemon/coordination health problem or no computers; discovery may be incomplete.",
+        ...!healthy ? {
+          remedy: {
+            action: "Review tailscale status and network connectivity. Resolve coordination/daemon health before claiming complete coverage."
+          }
+        } : {}
+      }
+    ]
+  };
 }
-function resolveNodes(command, options, roster) {
-  if (!roster && !options.local && command !== "doctor")
-    throw new FleetUsageError("No fleet roster. Use fleet add or the interactive Register action; use fleet doctor --local for this machine.");
-  if (options.node?.length && !roster)
-    throw new FleetUsageError("Cannot select nodes without a roster. Use fleet add first.");
-  return roster ? selectNodes(roster, options.node ?? []) : [];
+function healthyDiscovery(data, count) {
+  const health = data["Health"] ?? [];
+  return health.length === 0 && count > 0;
 }
-function result(data, text) {
-  return { exitCode: 0, data, ...text ? { text } : {} };
+function validateStatusFields(data) {
+  const health = data["Health"] ?? [];
+  const peers = data["Peer"] ?? {};
+  if (!record(data["Self"]) || !record(peers) || !Array.isArray(health))
+    throw new Error("Unsupported Tailscale status");
 }
-async function register(settings, options) {
-  const node = nodeFromOptions(options);
-  const config = await addNode(settings.config, node, options.apply === true);
-  return result({
-    version: 1,
-    command: "add",
-    ok: true,
-    applied: options.apply === true,
-    path: settings.config,
-    node,
-    nodes: config.nodes,
-    next: options.apply ? "Run fleet onboard, then fleet doctor --all --json." : "Review this preview, then repeat with --apply --yes."
-  });
+function parseComputer(value, self) {
+  if (!record(value))
+    throw new Error("Invalid peer");
+  const {
+    ID: id,
+    HostName: name,
+    DNSName: dns,
+    OS: os,
+    TailscaleIPs: ips,
+    Online: online
+  } = value;
+  if (![id, name, os].every((field) => typeof field === "string" && field.length > 0 && field.length <= 256 && !/[\x00-\x1f\x7f]/.test(field)) || typeof dns !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9.-]{0,252}\.?$/.test(dns) || !Array.isArray(ips) || ips.length < 1 || ips.length > 16 || !ips.every((ip) => typeof ip === "string" && isIP(ip) !== 0) || typeof online !== "boolean")
+    throw new Error("Invalid peer fields");
+  return {
+    id,
+    name,
+    dns: dns.replace(/\.$/, "").toLowerCase(),
+    os,
+    ips,
+    online,
+    self
+  };
+}
+function unavailable(summary) {
+  return {
+    computers: [],
+    excludedMobile: 0,
+    checks: [{ id: "tailscale:discovery", status: "fail", summary }]
+  };
+}
+
+// packages/fleet/src/tailnet-matching.ts
+function matchesComputer(host, peer) {
+  const name = host.toLowerCase().replace(/\.$/, "");
+  return [peer.dns, peer.dns.split(".")[0], ...peer.ips].includes(name);
+}
+async function matchComputers(nodes, peers, run) {
+  const matches = new Map(peers.map((peer) => [peer.id, []]));
+  for (const node of nodes) {
+    const resolved = await run([
+      "ssh",
+      "-G",
+      "-o",
+      "CanonicalizeHostname=no",
+      "-o",
+      "PermitLocalCommand=no",
+      node.ssh
+    ], { timeoutMs: 5000 });
+    const hostname = resolved.ok ? /^hostname ([^\r\n]+)$/im.exec(resolved.stdout)?.[1]?.trim() : undefined;
+    const targets = peers.filter((peer) => matchesComputer(hostname ?? node.ssh, peer));
+    for (const peer of targets)
+      matches.get(peer.id).push(node);
+  }
+  return matches;
+}
+
+// packages/fleet/src/tailnet-health.ts
+var HEALTH_CAPABILITIES = [
+  "github",
+  "vault",
+  "t3",
+  "toolchain",
+  "codex",
+  "claude",
+  "services",
+  "workstation"
+];
+async function tailnetHealth(tailnet, nodes, options, run) {
+  const controller = await probe(options.root, HEALTH_CAPABILITIES, run);
+  const matches = await matchComputers(nodes, tailnet.computers, run);
+  let source;
+  const reports = await mapBounded(tailnet.computers, async (peer) => {
+    const checks = await connectivity(peer, run);
+    if (peer.self)
+      return {
+        node: peer.dns,
+        snapshot: controller,
+        checks: [...checks, ...controller.checks]
+      };
+    const candidates = matches.get(peer.id);
+    if (!uniqueMapping(candidates, matches))
+      return missingMapping(peer, checks, candidates.length);
+    if (!peer.online)
+      return { node: peer.dns, checks };
+    const node = candidates[0];
+    const report = await inspectComputer({
+      ...node,
+      required: [...new Set([...node.required, ...HEALTH_CAPABILITIES])]
+    }, {
+      action: "probe",
+      source: source ??= Promise.resolve().then(options.source),
+      timeoutMs: options.timeoutMs
+    }, run);
+    return combine(peer, checks, report, controller);
+  });
+  const absent = nodes.filter((node) => ![...matches.values()].some((matched) => matched.includes(node)));
+  return [
+    { node: "tailscale", checks: tailnet.checks },
+    ...!tailnet.computers.some((peer) => peer.self) ? [
+      {
+        node: "controller",
+        snapshot: controller,
+        checks: controller.checks
+      }
+    ] : [],
+    ...reports,
+    ...absent.map((node) => ({
+      node: node.id,
+      checks: [
+        {
+          id: "tailscale:membership",
+          status: "fail",
+          summary: "Registered node is absent from visible Tailscale inventory. It was not silently omitted.",
+          remedy: {
+            action: "Check the node account, tailnet visibility, and the registered SSH alias."
+          }
+        }
+      ]
+    }))
+  ];
+}
+function uniqueMapping(candidates, matches) {
+  return candidates.length === 1 && [...matches.values()].filter((nodes) => nodes.includes(candidates[0])).length === 1;
+}
+async function inspectComputer(node, options, run) {
+  try {
+    return await inspectRemote(node, { ...options, source: await options.source }, run);
+  } catch {
+    return {
+      node: node.id,
+      checks: [
+        {
+          id: "fleet:probe",
+          status: "fail",
+          summary: "The current remote probe could not be prepared or completed; this computer remains unverified.",
+          remedy: {
+            action: "Reinstall the validated Personal CLI package and retry. No raw exception or remote output is retained."
+          }
+        }
+      ]
+    };
+  }
+}
+async function connectivity(peer, run) {
+  const online = {
+    id: "tailscale:online",
+    status: peer.online ? "pass" : "fail",
+    summary: peer.online ? "Computer is online in Tailscale status." : "Computer is offline or Tailscale cannot confirm its online state."
+  };
+  if (peer.self || !peer.online)
+    return [online];
+  const ping = await run(["tailscale", "ping", "--c=1", "--timeout=5s", peer.ips[0]], { timeoutMs: 8000 });
+  return [
+    online,
+    {
+      id: "tailscale:reachability",
+      status: ping.ok ? "pass" : "fail",
+      summary: ping.ok ? "Tailscale peer answered a bounded reachability probe." : "Tailscale peer did not answer; online inventory is not proof of connectivity."
+    }
+  ];
+}
+function missingMapping(peer, checks, count) {
+  return {
+    node: peer.dns,
+    checks: [
+      ...checks,
+      {
+        id: "fleet:registration",
+        status: "fail",
+        summary: count ? "Roster mapping is ambiguous between entries or computers; no SSH probe was run." : "Computer is not registered with a verified SSH alias and checkout path; dependencies and authentication are unverified.",
+        remedy: {
+          action: "Use Fleet: Register a developer computer with its existing SSH alias and actual checkout path, then rerun Fleet: Check all Tailscale computers."
+        }
+      }
+    ]
+  };
+}
+function combine(peer, checks, report, reference) {
+  return {
+    ...report,
+    node: peer.dns,
+    checks: [
+      ...checks,
+      ...report.checks,
+      ...report.snapshot ? compareFingerprints(reference.fingerprint, report.snapshot.fingerprint) : []
+    ]
+  };
+}
+
+// packages/personal-cli/src/tailnet.ts
+async function executeTailnet(command, options, settings, services) {
+  const tailnet = await discoverTailnet(services.run);
+  const coverage = {
+    scope: "tailscale-visible-computers",
+    computers: tailnet.computers.length,
+    excludedMobile: tailnet.excludedMobile,
+    limitation: "This controller can inspect only devices visible to its Tailscale account/ACLs. Other tailnets, hidden devices and all-pairs connectivity are not verified."
+  };
+  if (command === "discover") {
+    const ok = tailnet.checks.every((check) => check.status === "pass");
+    return {
+      exitCode: ok ? 0 : 1,
+      data: {
+        version: 1,
+        command,
+        ok,
+        coverage,
+        computers: tailnet.computers,
+        checks: tailnet.checks
+      }
+    };
+  }
+  const roster = await readRoster(settings.config);
+  const nodes = await tailnetHealth(tailnet, roster?.nodes ?? [], {
+    root: settings.workspace,
+    timeoutMs: timeout({ ...options, timeout: options.timeout ?? "300000" }),
+    source: services.source
+  }, services.run);
+  const report = makeReport("health", nodes);
+  const exitCode = reportExitCode(report, true);
+  const verified = exitCode === 0;
+  return {
+    exitCode,
+    data: {
+      ...report,
+      ok: verified,
+      coverage: {
+        ...coverage,
+        verified,
+        inspected: nodes.filter((node) => node.snapshot).length
+      }
+    },
+    text: `${renderReport({ ...report, ok: verified })}
+Coverage: ${coverage.computers} visible computers; ${coverage.excludedMobile} mobile devices excluded.
+${coverage.limitation}`
+  };
+}
+
+// packages/personal-cli/src/probe-source.ts
+import { readFile as readFile5 } from "node:fs/promises";
+async function probeSource() {
+  if (typeof Bun !== "undefined")
+    return bundleProbe();
+  return readFile5(new URL("./probe.mjs", import.meta.url), "utf8");
+}
+
+// packages/fleet/src/repair-catalog.ts
+var login = (id, title, commands, action) => ({
+  id: `login:${id}`,
+  title,
+  owner: `${id} native CLI`,
+  automatic: false,
+  action,
+  commands
+});
+var REPAIR_RECIPES = [
+  {
+    id: "workspace",
+    title: "Install locked tools and frozen dependencies",
+    owner: "mise / scripts/dev/setup.ts",
+    automatic: true,
+    action: "Runs the existing shared setup and trusted checkout lifecycle scripts. Updates user mise/PATH configuration and writes a sync receipt. Does not pull or reset Git.",
+    commands: [
+      [
+        "mise",
+        "exec",
+        "--locked",
+        "bun",
+        "--",
+        "bun",
+        "scripts/dev/setup.ts",
+        "--non-interactive"
+      ]
+    ]
+  },
+  {
+    id: "workstation",
+    title: "Install launcher and converge managed workstation configuration",
+    owner: "workstation",
+    automatic: true,
+    action: "Runs personal:install --yes: frozen install, launcher/PATH, managed links, notifications and provider configuration. Reads available provider keys from this machine’s Vault session and writes owner-managed 0600 configuration. Conflicting unmanaged files fail.",
+    commands: [["bun", "run", "personal:install", "--yes"]]
+  },
+  {
+    id: "providers",
+    title: "Refresh shared provider configuration from Vault",
+    owner: "workstation / secret-store",
+    automatic: true,
+    action: "Uses this machine’s own Vault authorization to fetch the existing permitted provider keys. The workstation owner writes its 0600 tool configuration; no credentials are copied from another computer. Missing provider keys may remain skipped.",
+    commands: [
+      [
+        "bun",
+        "packages/workstation/cli/internal.ts",
+        "opencode",
+        "sync",
+        "--strict",
+        "--json",
+        "--non-interactive",
+        "--yes"
+      ]
+    ]
+  },
+  login("codex", "Sign in to Codex on this machine", [["codex", "login", "--device-auth"]], "Approve the device flow in your browser. Run codex login status afterward; retain this machine’s own credential store."),
+  login("claude", "Sign in to Claude Code on this machine", [["claude", "auth", "login"]], "Complete the native browser login, then run claude auth status --json. API-key and subscription contexts can differ."),
+  login("github", "Sign in to GitHub and configure Git", [
+    [
+      "gh",
+      "auth",
+      "login",
+      "--hostname",
+      "github.com",
+      "--web",
+      "--git-protocol",
+      "https"
+    ],
+    ["gh", "auth", "setup-git"]
+  ], "Approve GitHub in the browser on the intended account, then run gh auth status --active. Environment tokens can override stored login; inspect their source locally."),
+  login("vault", "Authorize this machine for the shared Vault", [], "Run vault login -method=userpass username=YOUR_USERNAME in your own terminal. The native CLI prompts privately for the password. Use the existing permitted project/config; never copy VAULT_TOKEN between computers."),
+  login("railway", "Sign in to Railway", [["railway", "login", "--browserless"]], "Complete the browserless native flow, then run railway whoami --json."),
+  login("vercel", "Sign in to Vercel", [["vercel", "login"]], "Complete native login, then run vercel whoami. Select the intended team/project separately; do not create resources as a login repair."),
+  login("cloudflare", "Sign in to Cloudflare", [["wrangler", "login", "--browser=false"]], "Complete native OAuth login, then run wrangler whoami --json. For headless SSH, prefer an existing scoped API token injected by the approved Vault config. --browser=false suppresses browser launch; it does not make a remote loopback callback reachable. Any OAuth callback tunnel needs explicit operator setup. Resource access still depends on account permissions."),
+  login("aws", "Refresh the selected AWS SSO session", [["aws", "sso", "login"]], "Configure the intended profile with aws configure sso first if needed. Login and the health check use this shell’s current profile; no access keys are cloned."),
+  login("npm", "Sign in to npm on this machine", [
+    [
+      "npm",
+      "login",
+      "--auth-type=web",
+      "--registry=https://registry.npmjs.org/"
+    ]
+  ], "Complete the specific CLI approval and run npm whoami. Prefer the existing trusted-publisher CI workflow for releases."),
+  login("opencode", "Authorize an OpenCode provider", [["opencode", "auth", "login"]], "Prefer the existing Vault-backed providers repair for managed API keys. Native auth login handles an operator-owned OAuth provider. Credential listing alone does not prove live provider access."),
+  login("copilot", "Sign in to Copilot", [["copilot", "login"]], "Complete native login; provider authorization still needs supported operator diagnostics. No model prompt is used for health checking."),
+  login("gemini", "Sign in to Gemini", [], "Open Gemini interactively and choose its supported sign-in flow. Provider authorization remains unverified without a supported read-only status adapter."),
+  {
+    id: "t3",
+    title: "Enable and authorize T3 Connect",
+    owner: "T3",
+    automatic: false,
+    action: "Run t3 up --connect in this machine’s terminal and approve the intended connection. Treat pairing material as private. Then check t3 status --json and perform an operator peer test.",
+    commands: [["t3", "up", "--connect"]]
+  },
+  {
+    id: "docker",
+    title: "Start the intended Docker runtime",
+    owner: "OS / Docker",
+    automatic: false,
+    action: "Start Docker Desktop on desktop systems, or the already-installed Docker service using the OS service manager on Linux. Confirm the intended context with docker context ls. This repair never installs a daemon, invokes sudo, changes contexts or exposes a TCP socket.",
+    commands: [
+      ["docker", "context", "ls"],
+      ["docker", "info"]
+    ]
+  },
+  {
+    id: "password-manager",
+    title: "Review shared human login onboarding",
+    owner: "password-manager / Bitwarden",
+    automatic: false,
+    action: "Use the existing password-manager doctor and actions list on this computer. Its setup guides native consent and Bitwarden enrollment. Keep its private state and OS credential store local. Password vault access does not authorize native CLI OAuth sessions; imports and rotations remain separate reviewed workflows.",
+    commands: [
+      ["bun", "run", "password-manager", "doctor"],
+      ["bun", "run", "password-manager", "actions", "list"]
+    ]
+  },
+  {
+    id: "operator",
+    title: "Resolve the check with its owning tool",
+    owner: "operator / existing owner",
+    automatic: false,
+    action: "Follow the check’s remedy on the affected machine. Verify host fingerprints, register real SSH aliases/checkouts, reconcile Git changes, or perform the named end-to-end test. Infrastructure changes remain OpenTofu-owned.",
+    commands: []
+  }
+];
+var AUTOMATED_REPAIRS = [
+  "workspace",
+  "workstation",
+  "providers"
+];
+function recipe(id) {
+  return REPAIR_RECIPES.find((entry) => entry.id === id) ?? REPAIR_RECIPES.find((entry) => entry.id === "operator");
+}
+
+// packages/fleet/src/repair-plan.ts
+function repairId(check) {
+  if (check.id.startsWith("tool:docker-"))
+    return "docker";
+  if (check.id.startsWith("tool:github-auth"))
+    return "login:github";
+  if (["dependencies", "auth:toolchain"].includes(check.id))
+    return "workspace";
+  if (check.id.startsWith("tool:"))
+    return "workspace";
+  if (check.id.startsWith("workstation:"))
+    return "workstation";
+  if (check.id.startsWith("auth:") && !["auth:vscode", "auth:workstation"].includes(check.id))
+    return `login:${check.id.slice(5)}`;
+  if (check.id === "t3:settings" || check.id === "t3:api")
+    return "t3";
+  return "operator";
+}
+function repairPlan(reports, targets) {
+  const steps = [];
+  for (const report of reports) {
+    const groups = new Map;
+    for (const check of report.checks.filter((entry) => entry.status !== "pass")) {
+      const repair = recipe(repairId(check)).id;
+      groups.set(repair, [...groups.get(repair) ?? [], check]);
+    }
+    for (const [id, checks] of groups)
+      steps.push({
+        ...recipe(id),
+        node: report.node,
+        eligible: targets.some((target) => target.name === report.node) && report.snapshot !== undefined,
+        checks: checks.map((check) => check.id),
+        next: [
+          ...new Set(checks.flatMap((check) => check.remedy ? [check.remedy.action] : [check.summary]))
+        ]
+      });
+  }
+  return steps;
+}
+function automaticRepairs(steps, node) {
+  return AUTOMATED_REPAIRS.flatMap((id) => steps.filter((step) => step.node === node && step.id === id && step.automatic && step.eligible));
+}
+
+// packages/personal-cli/src/repair-inspect.ts
+async function inspectRepair(options, settings, services) {
+  if (options.local)
+    return inspectLocal(settings, services);
+  const roster = await readRoster(settings.config);
+  if (options.node?.length)
+    return inspectSelected(options, roster, services);
+  return inspectTailnet(options, settings, roster, services);
+}
+async function inspectLocal(settings, services) {
+  const snapshot = await probe(settings.workspace, HEALTH_CAPABILITIES, services.run);
+  return {
+    reports: [{ node: "local", snapshot, checks: snapshot.checks }],
+    targets: [
+      {
+        name: "local",
+        root: settings.workspace,
+        fingerprint: snapshot.fingerprint
+      }
+    ],
+    coverage: {
+      scope: "local",
+      limitation: "Only this process context was tested."
+    }
+  };
+}
+async function inspectSelected(options, roster, services) {
+  if (!roster)
+    throw new FleetUsageError("Register real SSH aliases and checkout paths before selecting remote repairs.");
+  const nodes = selectNodes(roster, options.node ?? []);
+  const source = await services.source();
+  const reports = await mapBounded(nodes, (node) => inspectRemote({
+    ...node,
+    required: [...new Set([...node.required, ...HEALTH_CAPABILITIES])]
+  }, { action: "probe", source, timeoutMs: timeout(options) }, services.run));
+  return {
+    reports,
+    targets: nodes.map((node) => attachFingerprint({ name: node.id, root: node.workspace, node }, reports)),
+    coverage: {
+      scope: "selected",
+      limitation: "Only selected roster computers were tested; other devices are unverified."
+    }
+  };
+}
+async function inspectTailnet(options, settings, roster, services) {
+  const tailnet = await discoverTailnet(services.run);
+  const reports = await tailnetHealth(tailnet, roster?.nodes ?? [], {
+    root: settings.workspace,
+    timeoutMs: timeout(options),
+    source: services.source
+  }, services.run);
+  const matches = await matchComputers(roster?.nodes ?? [], tailnet.computers, services.run);
+  const targets = [];
+  for (const peer of tailnet.computers) {
+    if (peer.self)
+      targets.push({ name: peer.dns, root: settings.workspace });
+    else if (peer.online && uniqueMapping(matches.get(peer.id), matches)) {
+      const node = matches.get(peer.id)[0];
+      targets.push({ name: peer.dns, root: node.workspace, node });
+    }
+  }
+  if (!tailnet.computers.some((peer) => peer.self))
+    targets.push({ name: "controller", root: settings.workspace });
+  return {
+    reports,
+    targets: targets.map((target) => attachFingerprint(target, reports)),
+    coverage: {
+      scope: "tailscale-visible-computers",
+      limitation: "Only devices visible to this Tailscale account/ACLs. Offline, unregistered or ambiguous computers cannot be repaired. No credentials, host keys or resources are cloned."
+    }
+  };
+}
+function attachFingerprint(target, reports) {
+  const snapshot = reports.find((report) => report.node === target.name)?.snapshot;
+  return {
+    ...target,
+    ...snapshot ? { fingerprint: snapshot.fingerprint } : {}
+  };
+}
+
+// packages/fleet/src/repair-runner.ts
+function validRepairs(value) {
+  return Array.isArray(value) && value.length > 0 && value.length <= 3 && new Set(value).size === value.length && value.every((id) => AUTOMATED_REPAIRS.includes(id));
+}
+async function repairWorkspace(root, repairs, run, expected) {
+  if (!validRepairs(repairs))
+    throw new Error("Unsupported repairs");
+  const before = await fingerprint(root, run);
+  if (!before.head || !Object.values(before.files).every(Boolean))
+    return [
+      {
+        id: "repair:workspace",
+        status: "fail",
+        summary: "Repairs require a complete existing checkout. Register/bootstrap it first."
+      }
+    ];
+  if (expected && JSON.stringify(before) !== JSON.stringify(expected))
+    return [
+      {
+        id: "repair:inputs",
+        status: "fail",
+        summary: "Checkout inputs changed since diagnostics. Generate a fresh repair plan before applying."
+      }
+    ];
+  const checks = [];
+  for (const id of AUTOMATED_REPAIRS.filter((entry) => repairs.includes(entry))) {
+    const result = id === "workspace" ? await syncWorkspace(root, false, run) : await ownerCommand(root, id, run);
+    checks.push(...result);
+    if (result.some((check) => check.status !== "pass"))
+      break;
+  }
+  const after = await fingerprint(root, run);
+  if (JSON.stringify(before) !== JSON.stringify(after))
+    checks.push({
+      id: "repair:inputs",
+      status: "fail",
+      summary: "Checkout inputs changed during repair. Stop and review the checkout before retrying."
+    });
+  return checks;
+}
+async function ownerCommand(root, id, run) {
+  const result = await run(recipe(id).commands[0], {
+    cwd: root,
+    timeoutMs: 1200000
+  });
+  return [
+    {
+      id: `repair:${id}`,
+      status: result.ok ? "pass" : "fail",
+      summary: result.ok ? "The existing owner command completed. Fresh diagnostics determine whether configuration and authorization now pass." : `The owner command failed (${result.reason}); partial changes are possible. Raw output and credentials are withheld. Later repairs on this computer were stopped.`
+    }
+  ];
+}
+
+// packages/personal-cli/src/repair-apply.ts
+async function applyRepairs(targets, steps, options, services) {
+  let source;
+  return mapBounded(targets, async (target) => {
+    const actions = automaticRepairs(steps, target.name);
+    const checks = [];
+    for (const step of actions) {
+      try {
+        if (!target.fingerprint)
+          throw new Error("No verified checkout fingerprint");
+        const repairs = [step.id];
+        const result = target.node ? (await inspectRemote(target.node, {
+          action: "repair",
+          repairs,
+          expected: target.fingerprint,
+          source: await (source ??= Promise.resolve().then(services.source)),
+          timeoutMs: timeout(options)
+        }, services.run)).checks : await repairWorkspace(target.root, repairs, services.run, target.fingerprint);
+        checks.push(...result);
+        if (result.some((check) => check.status !== "pass"))
+          break;
+      } catch {
+        checks.push({
+          id: "repair:operation",
+          status: "fail",
+          summary: "Repair could not be prepared or completed. Later actions on this computer were stopped; inspect partial changes locally. Raw errors are withheld."
+        });
+        break;
+      }
+    }
+    return { node: target.name, checks };
+  }, 1);
+}
+
+// packages/personal-cli/src/repair-script.ts
+function targetCommand(target, commands) {
+  const command = `cd -- ${shellQuote(target.root)} && ${commands.map((args) => args.map(shellQuote).join(" ")).join(" && ")}`;
+  if (!target.node)
+    return command;
+  return [
+    ...sshArgs(target.node).map((arg) => arg === "-T" ? "-t" : arg).map(shellQuote),
+    shellQuote(command)
+  ].join(" ");
+}
+function repairScript(steps, targets) {
+  const lines = [
+    "#!/bin/sh",
+    "set -eu",
+    "# Generated repair plan. Review before running in your own terminal.",
+    "# Automated steps use existing owners. Native login commands below are commented and require operator approval.",
+    "# POSIX shell required; Windows operators can use the personal commands directly."
+  ];
+  for (const target of targets) {
+    const actions = automaticRepairs(steps, target.name);
+    if (!actions.length)
+      continue;
+    const commands = actions.flatMap((step) => step.id === "workspace" ? [
+      [
+        "bun",
+        "packages/fleet/src/cli.ts",
+        "sync",
+        "--local",
+        "--apply",
+        "--yes",
+        "--json"
+      ]
+    ] : recipe(step.id).commands);
+    lines.push("", targetCommand(target, commands));
+  }
+  for (const step of steps.filter((entry) => !entry.automatic || !entry.eligible)) {
+    lines.push("", `# ${comment(step.node)} / ${comment(step.title)}`, `# ${comment(step.action)}`);
+    const target = targets.find((entry) => entry.name === step.node);
+    if (target && step.eligible && step.commands.length)
+      lines.push(`# ${targetCommand(target, step.commands)}`);
+    else
+      for (const next of step.next)
+        lines.push(`# ${comment(next)}`);
+  }
+  lines.push("", "# Re-run personal fleet health --json for fresh whole-tailnet coverage.");
+  return `${lines.join(`
+`)}
+`;
+}
+function comment(value) {
+  return value.replace(/[\r\n\x00-\x1f\x7f]/g, " ");
+}
+
+// packages/personal-cli/src/repair-guard.ts
+import { createHash as createHash3 } from "node:crypto";
+function repairPlanHash(steps, targets) {
+  return createHash3("sha256").update(JSON.stringify({ steps, targets })).digest("hex");
+}
+
+// packages/personal-cli/src/repair.ts
+function requestedRepairs(value) {
+  if (value === undefined)
+    return;
+  const ids = value.split(",");
+  if (!ids.length || ids.some((id) => !AUTOMATED_REPAIRS.includes(id)))
+    throw new FleetUsageError("--repair expects workspace,workstation,providers. Native logins require operator approval; inspect fleet repairs.");
+  return [...new Set(ids)];
+}
+function repairCatalog() {
+  return {
+    exitCode: 0,
+    data: {
+      version: 1,
+      command: "repairs",
+      ok: true,
+      recipes: REPAIR_RECIPES,
+      credentials: [
+        "Use the existing password-manager / Bitwarden owner for human passwords and shared login items. Run bun run password-manager doctor and actions list on each machine; never synchronize its private state.",
+        "Authenticate each computer independently with the intended identity. Never clone OAuth caches, browser cookies, keychains, SSH private keys or Vault sessions.",
+        "Access shared permitted API keys through this machine’s existing Vault/secret-store session. Prefer vault run --config dev -- COMMAND for process-scoped injection.",
+        "The workstation owner can render its supported provider configuration from Vault with 0600 permissions. Missing provider keys and live provider access still require checks.",
+        "Service roles, shared resources, Vault policies and infrastructure remain OpenTofu-owned. A login does not grant every account/team/resource permission."
+      ]
+    }
+  };
+}
+async function executeRepairCommand(command, options, settings, services) {
+  return command === "repairs" ? repairCatalog() : executeRepair(options, settings, services);
+}
+async function executeRepair(options, settings, services) {
+  const selected = requestedRepairs(options.repair);
+  const before = await inspectRepair(options, settings, services);
+  const steps = selectRepairs(repairPlan(before.reports, before.targets), before, selected);
+  const planHash = repairPlanHash(steps, before.targets);
+  if (options.planHash && options.planHash !== planHash)
+    throw new FleetUsageError("Repair plan changed since review. Generate and review a fresh preview; nothing was applied.");
+  const initial = makeReport("repair", before.reports);
+  const healthOk = reportExitCode(initial, true) === 0;
+  const script = options.script ? repairScript(steps, before.targets) : undefined;
+  if (!options.apply)
+    return {
+      exitCode: 0,
+      data: {
+        ...initial,
+        ok: true,
+        applied: false,
+        planHash,
+        healthOk,
+        coverage: before.coverage,
+        steps,
+        ...script ? { script } : {},
+        authorize: "Preview only. Review effects, then repeat with --apply --yes. Only eligible automatic steps execute. Native logins and manual steps remain operator work."
+      },
+      text: script ?? renderSteps(steps)
+    };
+  return appliedOutcome(steps, before, { options, settings, services });
+}
+async function appliedOutcome(steps, before, context) {
+  const { options, settings, services } = context;
+  const executions = await applyRepairs(before.targets, steps, options, services);
+  const after = await recheckRepair(before, options, settings, services);
+  const checked = makeReport("repair", after.reports);
+  const executionOk = executions.every((node) => node.checks.every((check) => check.status === "pass"));
+  const verified = reportExitCode(checked, true) === 0;
+  const ok = executionOk && verified;
+  return {
+    exitCode: ok ? 0 : 1,
+    data: {
+      ...checked,
+      ok,
+      applied: true,
+      executionOk,
+      healthOk: verified,
+      coverage: after.coverage,
+      steps,
+      executions,
+      remaining: repairPlan(after.reports, after.targets),
+      completed: executions.flatMap((node) => node.checks).filter((check) => check.status === "pass").length
+    },
+    text: `Repair commands ${executionOk ? "completed" : "need attention"}; fresh health ${verified ? "verified" : "still has failing or unverified checks"}.
+${renderSteps(repairPlan(after.reports, after.targets))}`
+  };
+}
+function selectRepairs(steps, inspection, selected) {
+  if (!selected)
+    return steps;
+  const filtered = steps.filter((step) => !step.automatic || selected.includes(step.id));
+  for (const target of inspection.targets) {
+    const report = inspection.reports.find((entry) => entry.node === target.name);
+    if (!report?.snapshot)
+      continue;
+    for (const id of selected)
+      if (!filtered.some((step) => step.node === target.name && step.id === id))
+        filtered.push({
+          ...recipe(id),
+          node: target.name,
+          eligible: true,
+          checks: ["explicit:request"],
+          next: [
+            "Explicitly requested owner action; fresh diagnostics still follow."
+          ]
+        });
+  }
+  return filtered;
+}
+function renderSteps(steps) {
+  return steps.map((step) => `${step.node} / ${step.id}: ${step.automatic && step.eligible ? "automatic after --apply --yes" : "operator action"}
+  ${step.action}`).join(`
+`);
+}
+async function recheckRepair(before, options, settings, services) {
+  try {
+    return await inspectRepair(options, settings, services);
+  } catch {
+    return {
+      reports: before.reports.map((report) => ({
+        node: report.node,
+        checks: [
+          {
+            id: "repair:recheck",
+            status: "fail",
+            summary: "Fresh diagnostics could not complete after repair. Earlier diagnostics are not being treated as fresh; inspect this computer and rerun health."
+          }
+        ]
+      })),
+      targets: [],
+      coverage: {
+        ...before.coverage,
+        limitation: "Post-repair diagnostics failed. Execution results are retained; machine health remains unverified."
+      }
+    };
+  }
+}
+
+// packages/personal-cli/src/fleet.ts
+var SERVICES = { run: runCommand, source: probeSource };
+async function executeFleet(command, options, settings, services = SERVICES) {
+  validateOptions(command, options);
+  if (["repair", "repairs"].includes(command))
+    return executeRepairCommand(command, options, settings, services);
+  if (["discover", "health"].includes(command))
+    return executeTailnet(command, options, settings, services);
+  if (command === "schema")
+    return result(schema_default);
+  if (command === "init")
+    return initialize(settings, options);
+  if (command === "add")
+    return register(settings, options);
+  const roster = options.local ? null : await readRoster(settings.config);
+  const nodes = resolveNodes(command, options, roster);
+  if (["nodes", "validate", "onboard"].includes(command))
+    return rosterResult(command, nodes, roster !== null);
+  if (command === "sync")
+    return synchronize(nodes, options, settings, services);
+  return diagnose(nodes, options, { ...settings, missingRoster: !roster }, services);
+}
+function rosterResult(command, nodes, configured) {
+  return result({
+    version: 1,
+    command,
+    ok: true,
+    ...command === "nodes" ? { configured } : {},
+    nodes: command === "onboard" ? nodes.map((node) => onboarding(node, "personal fleet")) : nodes
+  });
+}
+function resolveNodes(command, options, roster) {
+  if (!roster && !options.local && !["doctor", "nodes"].includes(command))
+    throw new FleetUsageError("No fleet roster. Use fleet add or the interactive Register action; use fleet doctor --local for this machine.");
+  if (options.node?.length && !roster)
+    throw new FleetUsageError("Cannot select nodes without a roster. Use fleet add first.");
+  return roster ? selectNodes(roster, options.node ?? []) : [];
+}
+function result(data, text) {
+  return { exitCode: 0, data, ...text ? { text } : {} };
+}
+async function register(settings, options) {
+  const node = nodeFromOptions(options);
+  const config = await addNode(settings.config, node, options.apply === true);
+  return result({
+    version: 1,
+    command: "add",
+    ok: true,
+    applied: options.apply === true,
+    path: settings.config,
+    node,
+    nodes: config.nodes,
+    next: options.apply ? "Run fleet onboard, then fleet doctor --all --json." : "Review this preview, then repeat with --apply --yes."
+  });
 }
 async function initialize(settings, options) {
   const config = {
@@ -2033,9 +3599,9 @@ async function initialize(settings, options) {
     $schema: new URL("./schema.json", import.meta.url).href
   };
   if (options.apply) {
-    await mkdir3(dirname3(settings.config), { recursive: true, mode: 448 });
+    await mkdir5(dirname5(settings.config), { recursive: true, mode: 448 });
     try {
-      await writeFile2(settings.config, `${JSON.stringify(config, null, 2)}
+      await writeFile3(settings.config, `${JSON.stringify(config, null, 2)}
 `, {
         flag: "wx",
         mode: 384
@@ -2130,6 +3696,301 @@ async function syncRemotes(nodes, options, services) {
   }, services.run), 1);
 }
 
+// packages/personal-cli/src/node-sync.ts
+import { join as join10 } from "node:path";
+
+// packages/fleet/src/configure.ts
+import { join as join9 } from "node:path";
+import { mkdir as mkdir6, writeFile as writeFile4, rename as rename3 } from "node:fs/promises";
+import { randomUUID as randomUUID3 } from "node:crypto";
+function validConfiguration(value) {
+  return record(value) && typeof value["revision"] === "string" && /^[a-f0-9]{40}$/.test(value["revision"]) && ["codex", "claude", "opencode", "gemini"].includes(String(value["tool"])) && ["direct", "proxy"].includes(String(value["profile"])) && typeof value["node"] === "string" && /^[a-z0-9][a-z0-9-]{0,62}$/.test(value["node"]);
+}
+async function configureWorkspace(root, request, run) {
+  if (!validConfiguration(request))
+    return failure("Invalid reviewed revision or configuration selection.");
+  const directory = join9(root, "node_modules", ".fleet-revisions", request.revision);
+  const head = await run(["git", "rev-parse", "--verify", `${request.revision}^{commit}`], { cwd: root });
+  if (!head.ok || head.stdout.trim() !== request.revision)
+    return failure("Reviewed commit is unavailable locally. Fetch it explicitly and retry.");
+  const prepared = await prepareRevision(root, directory, request.revision, run);
+  if (prepared.length)
+    return prepared;
+  const setup = await run([
+    "mise",
+    "exec",
+    "--locked",
+    "bun",
+    "--",
+    "bun",
+    "scripts/dev/setup.ts",
+    "--non-interactive"
+  ], { cwd: directory, timeoutMs: 1200000 });
+  if (!setup.ok)
+    return failure("Existing setup owner failed. Partial tool/dependency installation is possible; no configuration receipt was advanced.");
+  const applied = await applyOwner(directory, request, run);
+  if (!applied.ok)
+    return failure("personal workstation configuration failed. Inspect preview on this node; no rollout receipt was advanced.");
+  const receipt = decodeReceipt(applied.stdout, request.revision);
+  if (!receipt)
+    return failure("personal workstation returned an invalid receipt; rollout remains unverified.");
+  await recordConfiguration(root, request, receipt);
+  return [
+    {
+      id: "configuration:apply",
+      status: "pass",
+      summary: `personal workstation applied revision ${request.revision}; configuration fingerprint ${receipt}. Authentication and T3 end-to-end remain separate gates.`
+    }
+  ];
+}
+function decodeReceipt(output, revision) {
+  try {
+    const data = JSON.parse(output);
+    return record(data) && data["ok"] === true && data["revision"] === revision && typeof data["fingerprint"] === "string" && /^[a-f0-9]{64}$/.test(data["fingerprint"]) ? data["fingerprint"] : null;
+  } catch {
+    return null;
+  }
+}
+function failure(summary) {
+  return [{ id: "configuration:apply", status: "fail", summary }];
+}
+async function prepareRevision(root, directory, revision, run) {
+  await mkdir6(join9(root, "node_modules", ".fleet-revisions"), {
+    recursive: true
+  });
+  let deployed = await run(["git", "rev-parse", "HEAD"], { cwd: directory });
+  if (!deployed.ok) {
+    const created = await run(["git", "worktree", "add", "--detach", directory, revision], { cwd: root, timeoutMs: 30000 });
+    if (!created.ok)
+      return failure("Cannot create pinned deployment worktree. Existing data was preserved.");
+    deployed = await run(["git", "rev-parse", "HEAD"], { cwd: directory });
+  }
+  const clean = await run(["git", "status", "--porcelain"], { cwd: directory });
+  if (!deployed.ok || deployed.stdout.trim() !== revision || !clean.ok || clean.stdout.trim())
+    return failure("Pinned deployment checkout differs or is dirty. Inspect it; fleet never resets it.");
+  const top = await run(["git", "rev-parse", "--show-toplevel"], {
+    cwd: directory
+  });
+  if (!top.ok || top.stdout.trim() !== directory)
+    return failure("Deployment path is not its own Git worktree.");
+  return [];
+}
+async function recordConfiguration(root, request, receipt) {
+  const receipts = join9(root, "node_modules", ".fleet-configuration");
+  await mkdir6(receipts, { recursive: true, mode: 448 });
+  const path = join9(receipts, `${request.node}-${request.tool}-${request.profile}.json`);
+  const temp = `${path}.${randomUUID3()}.tmp`;
+  await writeFile4(temp, JSON.stringify({ version: 1, ...request, fingerprint: receipt }) + `
+`, { flag: "wx", mode: 384 });
+  await rename3(temp, path);
+}
+async function applyOwner(directory, request, run) {
+  return run([
+    "mise",
+    "exec",
+    "--locked",
+    "bun",
+    "--",
+    "bun",
+    "packages/workstation/cli/internal.ts",
+    "--json",
+    "--yes",
+    "--non-interactive",
+    "agents",
+    "apply",
+    "--node",
+    request.node,
+    "--tool",
+    request.tool,
+    "--profile",
+    request.profile
+  ], { cwd: directory, timeoutMs: 120000 });
+}
+
+// packages/personal-cli/src/node-t3.ts
+async function syncT3(options, settings) {
+  try {
+    return await t3Command("t3-apply", options, settings);
+  } catch (error) {
+    return {
+      exitCode: 1,
+      data: {
+        version: 1,
+        command: "fleet-node-sync",
+        ok: false,
+        applied: true,
+        stage: "t3",
+        error: error instanceof FleetUsageError ? error.message : "T3 reconciliation failed; inspect local configuration and ownership state.",
+        progress: "Tools, launcher and profile steps completed. Node receipt was not advanced. Fix the T3 conflict and repeat fleet-node-sync."
+      }
+    };
+  }
+}
+
+// packages/personal-cli/src/node-sync.ts
+async function syncNode(options, settings, run = runCommand) {
+  if (process.platform === "win32" && !options.dryRun)
+    throw new FleetUsageError("Codex proxy node sync requires macOS/Linux/WSL. Use personal workstation commands for native Windows configuration.");
+  const node = nodeId(options.id);
+  const head = await run(["git", "rev-parse", "--verify", "HEAD"], {
+    cwd: settings.workspace
+  });
+  const revision = options.revision ?? head.stdout.trim();
+  if (!head.ok || !/^[a-f0-9]{40}$/.test(revision))
+    throw new FleetUsageError("An existing personal checkout is required; set --workspace PATH.");
+  const request = { node, revision, tool: "codex", profile: "proxy" };
+  if (options.dryRun)
+    return {
+      exitCode: 0,
+      data: {
+        version: 1,
+        command: "fleet-node-sync",
+        ok: true,
+        applied: false,
+        ...request,
+        steps: [
+          "Reconcile locked tools",
+          "Install personal and retire owned ws launcher",
+          "Upsert Codex proxy profile",
+          "Reconcile declared T3 instances and remove stale owned entries"
+        ]
+      }
+    };
+  const checks = await configureWorkspace(settings.workspace, request, run);
+  if (checks.some((check) => check.status !== "pass"))
+    return {
+      exitCode: 1,
+      data: { version: 1, command: "fleet-node-sync", ok: false, checks }
+    };
+  return finishSync(options, settings, { request, checks }, run);
+}
+async function finishSync(options, settings, input, run) {
+  const { request, checks } = input;
+  const { node, revision } = request;
+  const workspace = join10(settings.workspace, "node_modules/.fleet-revisions", revision);
+  const installed = await run([
+    "bun",
+    "packages/workstation/cli/internal.ts",
+    "--json",
+    "--yes",
+    "--non-interactive",
+    "install"
+  ], { cwd: workspace, timeoutMs: 1200000 });
+  if (!installed.ok)
+    return {
+      exitCode: 1,
+      data: {
+        version: 1,
+        ok: false,
+        checks,
+        error: "Launcher/workstation convergence failed; profile changes may already have applied."
+      }
+    };
+  const t3 = await syncT3({ ...options, id: node }, { ...settings, workspace });
+  if (t3.exitCode !== 0)
+    return t3;
+  await recordDeployment(settings.workspace, node, revision);
+  return {
+    exitCode: 0,
+    data: {
+      version: 1,
+      command: "fleet-node-sync",
+      ok: true,
+      applied: true,
+      ...request,
+      checks,
+      t3: t3.data,
+      readiness: {
+        authentication: "unverified",
+        inference: "unverified",
+        pairing: "unverified"
+      },
+      next: "Use personal t3-status for configuration drift and personal fleet-status for machine health."
+    }
+  };
+}
+
+// packages/personal-cli/src/flat-commands.ts
+function registerFlatCommands(program, defaults, complete) {
+  program.command("fleet-node-sync").description("Reconcile this node’s locked tools and Codex proxy profile; applies by default").option("--id <name>", "Stable node name; defaults to this machine hostname").option("--revision <sha>", "Reviewed commit; defaults to checkout HEAD").option("--dry-run", "Preview without changing this node").option("--t3-home <path>", "T3 base directory").action(async (_options, command) => {
+    const options = command.optsWithGlobals();
+    const settings = await resolveSettings({ ...defaults, ...options });
+    complete(await syncNode(options, settings));
+  });
+  for (const [name, target, description] of [
+    [
+      "fleet-status",
+      "doctor",
+      "Check this computer and all registered fleet nodes"
+    ],
+    ["fleet-discover", "discover", "Find computers visible through Tailscale"]
+  ]) {
+    program.command(name).description(description).action(async (_options, command) => {
+      const options = command.optsWithGlobals();
+      const settings = await resolveSettings({ ...defaults, ...options });
+      complete(await executeFleet(target, {}, settings));
+    });
+  }
+}
+
+// packages/personal-cli/src/agent-guide.ts
+var AGENT_GUIDE = {
+  version: 1,
+  name: "@crvouga/personal",
+  invocation: "personal <command> --json --non-interactive",
+  discovery: "personal commands --json",
+  configuration: {
+    workspace: "--workspace PATH, PERSONAL_WORKSPACE, closest ancestor mise.toml, then current directory",
+    roster: "--config PATH, PERSONAL_FLEET_CONFIG, closest ancestor .fleet.local.json, then ~/.config/personal/fleet.json"
+  },
+  output: {
+    stdout: "One versioned JSON document with --json. Prompts and progress never contaminate stdout.",
+    exitCodes: {
+      "0": "Success or preview",
+      "1": "Failed check or operation; strict also rejects warnings/skips",
+      "2": "Invalid usage or configuration",
+      "130": "Cancelled"
+    },
+    errors: "{version:1,ok:false,code,error}; raw subprocess output and exception details are withheld",
+    reports: "{version:1,command,ok,generatedAt,nodes:[{node,checks:[{id,status,summary,remedy?}]}],summary,coverage}",
+    statuses: ["pass", "warn", "fail", "skip"],
+    coverage: "Default doctor tests the controller and all configured nodes. --local tests only this controller. A missing roster fails explicitly; configured nodes are not every computer that exists. T3/VS Code end-to-end checks remain manual."
+  },
+  safety: [
+    "No arguments opens a menu only on an interactive terminal. --json and --non-interactive never prompt.",
+    "Diagnostics, onboarding instructions, schema, catalogs, scripts and sync/repair previews are read-only.",
+    "fleet-node-sync authorizes local reconciliation by invocation; --dry-run previews. Legacy roster writes, sync and repair require --apply --yes.",
+    "Do not copy credentials, forward SSH agents, bypass host keys, provision infrastructure or execute unreviewed remedies.",
+    "A healthy controller does not prove another machine can connect to it. Run doctor from each intended controller.",
+    "Repair executes only allowlisted owner actions, then reruns diagnostics. Native logins, host trust and resource permissions remain explicit operator steps. Pass the reviewed planHash as --plan-hash to reject a changed plan.",
+    "Shared provider keys are fetched through each machine’s existing Vault authorization by workstation tooling. Never copy machine-local login caches.",
+    "Use exact npm versions for automation. The application never self-updates."
+  ],
+  reconciliation: {
+    plan: "personal t3-plan --json",
+    apply: "personal t3-apply --plan-hash HASH",
+    cleanup: "personal t3-cleanup --dry-run",
+    import: "personal t3-import --instance ID",
+    ownership: "Only declared or explicitly imported T3 instances. Pairing, credentials, threads and unrelated settings are preserved.",
+    concurrency: "Exclusive personal lock with optimistic external T3 file updates; avoid concurrent Settings edits."
+  },
+  examples: [
+    "personal fleet-node-sync",
+    "personal fleet-status",
+    "personal t3-status",
+    "personal fleet doctor --local --workspace /path/to/personal --json",
+    "personal fleet doctor --all --json --strict --timeout 120000",
+    "personal fleet add --id dev-linux --ssh dev-linux --path /home/dev/workspace --require github,t3,toolchain --json",
+    "personal fleet add --id dev-linux --ssh dev-linux --path /home/dev/workspace --apply --yes --json",
+    "personal fleet doctor --node dev-linux --json",
+    "personal fleet sync --node dev-linux --json",
+    "personal fleet repairs --json",
+    "personal fleet repair --json",
+    "personal fleet repair --local --repair workspace --json",
+    "personal fleet repair --local --repair workspace --plan-hash <reviewed-sha256> --apply --yes --json"
+  ]
+};
+
 // packages/personal-cli/src/program.ts
 var GLOBAL_OPTIONS = [
   {
@@ -2144,7 +4005,7 @@ var GLOBAL_OPTIONS = [
   { flag: "--config <path>", description: "Local, secret-free fleet roster" }
 ];
 function common(command) {
-  return command.option("--node <id>", "Select an existing node; repeat for multiple nodes", collect, []).option("--local", "Controller only; no roster or SSH required").option("--all", "All configured nodes and the controller (doctor default)").option("--require <capabilities>", "Controller capabilities, comma separated, or none").option("--timeout <ms>", "Per-node deadline, 1000–1800000 milliseconds").option("--strict", "Warnings and skipped checks also produce exit 1").option("--pull", "Sync only: explicitly request a clean, fast-forward pull").option("--apply", "Authorize the displayed roster/sync mutation; requires --yes").option("--yes", "Confirm an explicitly requested --apply operation");
+  return command.option("--node <id>", "Select an existing node; repeat for multiple nodes", collect, []).option("--local", "Controller only; no roster or SSH required").option("--all", "All targets: doctor uses the roster; repair uses the visible tailnet").option("--require <capabilities>", "Controller capabilities, comma separated, or none").option("--timeout <ms>", "Per-node deadline, 1000–1800000 milliseconds").option("--strict", "Warnings and skipped checks also produce exit 1").option("--repair <ids>", "Repair only: workspace,workstation,providers; comma separated").option("--plan-hash <sha256>", "Repair only: require the reviewed plan to match current diagnostics").option("--script", "Repair only: generate a reviewable POSIX script without executing it").option("--pull", "Sync only: explicitly request a clean, fast-forward pull").option("--apply", "Authorize the displayed roster/sync/repair mutation; requires --yes").option("--yes", "Confirm an explicitly requested --apply operation");
 }
 function collect(value, previous) {
   return [...previous, value];
@@ -2159,7 +4020,7 @@ function createProgram(version, output) {
 }
 function fleetCommands(program) {
   const fleet = program.command("fleet").description("Diagnose, explore and onboard developer computers");
-  const definitions = commandCatalog().filter((entry) => entry.group === "Fleet" && entry.id !== "fleet doctor local");
+  const definitions = commandCatalog().filter((entry) => entry.group === "Fleet" && entry.args[0] === "fleet" && entry.id !== "fleet doctor local");
   return definitions.map((entry) => {
     const command = common(fleet.command(entry.args[1]).description(entry.description));
     if (entry.args[1] === "add")
@@ -2201,6 +4062,20 @@ async function execute(args, defaults, version) {
   const program = createProgram(version, (text) => {
     output += text;
   });
+  registerT3(program, defaults, (result) => {
+    outcome = result;
+  });
+  registerFlatCommands(program, defaults, (result) => {
+    outcome = result;
+  });
+  program.command("workstation [args...]").description("Local configuration, tools, agent profiles and launcher lifecycle").allowUnknownOption().action(async (args, command) => {
+    const options = command.optsWithGlobals();
+    const settings = await resolveSettings({
+      ...defaults,
+      ...settingsOverrides(options)
+    });
+    outcome = await workstationCommand(args, settings);
+  });
   const commands = fleetCommands(program);
   for (const command of commands)
     command.action(async () => {
@@ -2258,7 +4133,7 @@ function commandError(error, output) {
 
 // packages/personal-cli/src/app.ts
 import { parseArgs } from "node:util";
-var VERSION = "0.1.0";
+var VERSION = "0.1.1";
 function wantsInteractive(args, terminal, ci) {
   if (args.includes("--json") || args.includes("--non-interactive"))
     return false;
@@ -2288,7 +4163,9 @@ async function main(args = process.argv.slice(2)) {
     ...typeof values.workspace === "string" ? { workspace: values.workspace } : {},
     ...typeof values.config === "string" ? { config: values.config } : {}
   });
-  const terminal = process.stdin.isTTY === true && process.stderr.isTTY === true;
+  if (startup(args).positionals[0] === "workstation")
+    return forwardWorkstation(args, settings);
+  const terminal = interactiveTerminal();
   if (args.includes("--interactive") && !terminal) {
     process.stdout.write(`${JSON.stringify({ version: 1, ok: false, code: "tty_required", error: "Interactive mode needs a terminal. Use personal commands --json or fleet doctor --local --json." })}
 `);
@@ -2310,6 +4187,9 @@ async function main(args = process.argv.slice(2)) {
 `);
   return outcome.exitCode;
 }
+function interactiveTerminal() {
+  return process.stdin.isTTY === true && process.stderr.isTTY === true;
+}
 
 // packages/personal-cli/src/cli.ts
 try {