@crvouga/personal 0.1.0 → 0.1.2

package/probe.mjs

@@ -1,3 +1,8 @@
+// packages/fleet/src/configure.ts
+import { join } from "node:path";
+import { mkdir, writeFile, rename } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+
 // packages/fleet/src/errors.ts
 class FleetUsageError extends Error {
 }
@@ -8,7 +13,11 @@ var CAPABILITIES = [
   "vault",
   "t3",
   "vscode",
-  "toolchain"
+  "toolchain",
+  "codex",
+  "claude",
+  "services",
+  "workstation"
 ];
 function record(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -75,14 +84,119 @@ function parseConfig(value) {
   return { version: 1, nodes };
 }
 
+// packages/fleet/src/configure.ts
+function validConfiguration(value) {
+  return record(value) && typeof value["revision"] === "string" && /^[a-f0-9]{40}$/.test(value["revision"]) && ["codex", "claude", "opencode", "gemini"].includes(String(value["tool"])) && ["direct", "proxy"].includes(String(value["profile"])) && typeof value["node"] === "string" && /^[a-z0-9][a-z0-9-]{0,62}$/.test(value["node"]);
+}
+async function configureWorkspace(root, request, run) {
+  if (!validConfiguration(request))
+    return failure("Invalid reviewed revision or configuration selection.");
+  const directory = join(root, "node_modules", ".fleet-revisions", request.revision);
+  const head = await run(["git", "rev-parse", "--verify", `${request.revision}^{commit}`], { cwd: root });
+  if (!head.ok || head.stdout.trim() !== request.revision)
+    return failure("Reviewed commit is unavailable locally. Fetch it explicitly and retry.");
+  const prepared = await prepareRevision(root, directory, request.revision, run);
+  if (prepared.length)
+    return prepared;
+  const setup = await run([
+    "mise",
+    "exec",
+    "--locked",
+    "bun",
+    "--",
+    "bun",
+    "scripts/dev/setup.ts",
+    "--non-interactive"
+  ], { cwd: directory, timeoutMs: 1200000 });
+  if (!setup.ok)
+    return failure("Existing setup owner failed. Partial tool/dependency installation is possible; no configuration receipt was advanced.");
+  const applied = await applyOwner(directory, request, run);
+  if (!applied.ok)
+    return failure("personal workstation configuration failed. Inspect preview on this node; no rollout receipt was advanced.");
+  const receipt = decodeReceipt(applied.stdout, request.revision);
+  if (!receipt)
+    return failure("personal workstation returned an invalid receipt; rollout remains unverified.");
+  await recordConfiguration(root, request, receipt);
+  return [
+    {
+      id: "configuration:apply",
+      status: "pass",
+      summary: `personal workstation applied revision ${request.revision}; configuration fingerprint ${receipt}. Authentication and T3 end-to-end remain separate gates.`
+    }
+  ];
+}
+function decodeReceipt(output, revision) {
+  try {
+    const data = JSON.parse(output);
+    return record(data) && data["ok"] === true && data["revision"] === revision && typeof data["fingerprint"] === "string" && /^[a-f0-9]{64}$/.test(data["fingerprint"]) ? data["fingerprint"] : null;
+  } catch {
+    return null;
+  }
+}
+function failure(summary) {
+  return [{ id: "configuration:apply", status: "fail", summary }];
+}
+async function prepareRevision(root, directory, revision, run) {
+  await mkdir(join(root, "node_modules", ".fleet-revisions"), {
+    recursive: true
+  });
+  let deployed = await run(["git", "rev-parse", "HEAD"], { cwd: directory });
+  if (!deployed.ok) {
+    const created = await run(["git", "worktree", "add", "--detach", directory, revision], { cwd: root, timeoutMs: 30000 });
+    if (!created.ok)
+      return failure("Cannot create pinned deployment worktree. Existing data was preserved.");
+    deployed = await run(["git", "rev-parse", "HEAD"], { cwd: directory });
+  }
+  const clean = await run(["git", "status", "--porcelain"], { cwd: directory });
+  if (!deployed.ok || deployed.stdout.trim() !== revision || !clean.ok || clean.stdout.trim())
+    return failure("Pinned deployment checkout differs or is dirty. Inspect it; fleet never resets it.");
+  const top = await run(["git", "rev-parse", "--show-toplevel"], {
+    cwd: directory
+  });
+  if (!top.ok || top.stdout.trim() !== directory)
+    return failure("Deployment path is not its own Git worktree.");
+  return [];
+}
+async function recordConfiguration(root, request, receipt) {
+  const receipts = join(root, "node_modules", ".fleet-configuration");
+  await mkdir(receipts, { recursive: true, mode: 448 });
+  const path = join(receipts, `${request.node}-${request.tool}-${request.profile}.json`);
+  const temp = `${path}.${randomUUID()}.tmp`;
+  await writeFile(temp, JSON.stringify({ version: 1, ...request, fingerprint: receipt }) + `
+`, { flag: "wx", mode: 384 });
+  await rename(temp, path);
+}
+async function applyOwner(directory, request, run) {
+  return run([
+    "mise",
+    "exec",
+    "--locked",
+    "bun",
+    "--",
+    "bun",
+    "packages/workstation/cli/internal.ts",
+    "--json",
+    "--yes",
+    "--non-interactive",
+    "agents",
+    "apply",
+    "--node",
+    request.node,
+    "--tool",
+    request.tool,
+    "--profile",
+    request.profile
+  ], { cwd: directory, timeoutMs: 120000 });
+}
+
 // packages/fleet/src/fingerprint.ts
-import { readFile as readFile2, mkdir, writeFile } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { readFile as readFile2, mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join3 } from "node:path";
 
 // packages/fleet/src/input-hashes.ts
 import { createHash } from "node:crypto";
 import { readFile, readdir } from "node:fs/promises";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 var INPUT_FILES = [
   "package.json",
   "bun.lock",
@@ -103,12 +217,12 @@ async function fileHash(path) {
 }
 async function manifestHash(root) {
   try {
-    const entries = await readdir(join(root, "packages"), {
+    const entries = await readdir(join2(root, "packages"), {
       withFileTypes: true
     });
     const hashes = [];
     for (const entry of entries.filter((item) => item.isDirectory()).sort((left, right) => left.name.localeCompare(right.name, "en"))) {
-      hashes.push(`${entry.name}:${await fileHash(join(root, "packages", entry.name, "package.json"))}`);
+      hashes.push(`${entry.name}:${await fileHash(join2(root, "packages", entry.name, "package.json"))}`);
     }
     return digest(hashes.join(`
 `));
@@ -118,19 +232,19 @@ async function manifestHash(root) {
 }
 async function sidecarHash(root) {
   try {
-    const files = await readdir(join(root, ".mise/locks"), {
+    const files = await readdir(join2(root, ".mise/locks"), {
       recursive: true,
       withFileTypes: true
     });
     if (files.length > 4096 || files.some((entry) => entry.isSymbolicLink()))
       return null;
     const hashes = [];
-    const paths = files.filter((entry) => entry.isFile()).map((entry) => join(entry.parentPath, entry.name)).sort();
+    const paths = files.filter((entry) => entry.isFile()).map((entry) => join2(entry.parentPath, entry.name)).sort();
     for (const path of paths) {
       const hash = await fileHash(path);
       if (hash === null)
         return null;
-      const relative = path.slice(join(root, ".mise/locks").length).replaceAll("\\", "/");
+      const relative = path.slice(join2(root, ".mise/locks").length).replaceAll("\\", "/");
       hashes.push(`${relative}:${hash}`);
     }
     return digest(hashes.join(`
@@ -148,7 +262,7 @@ var RECEIPT = "node_modules/.fleet-sync.json";
 async function fingerprint(root, run) {
   const files = {};
   for (const name of INPUT_FILES)
-    files[name] = await fileHash(join2(root, name));
+    files[name] = await fileHash(join3(root, name));
   files["workspace-manifests"] = await manifestHash(root);
   files["mise-sidecars"] = await sidecarHash(root);
   const head = await run(["git", "rev-parse", "HEAD"], { cwd: root });
@@ -162,7 +276,7 @@ async function dependencyCheck(root, current) {
     action: "Review fleet sync, then explicitly apply a frozen toolchain/dependency sync."
   };
   try {
-    const receipt = JSON.parse(await readFile2(join2(root, RECEIPT), "utf8"));
+    const receipt = JSON.parse(await readFile2(join3(root, RECEIPT), "utf8"));
     const matches = record(receipt) && receipt["version"] === 1 && JSON.stringify(receipt["files"]) === JSON.stringify(current.files);
     return {
       id: "dependencies",
@@ -180,15 +294,204 @@ async function dependencyCheck(root, current) {
   }
 }
 async function writeReceipt(root, current) {
-  await mkdir(join2(root, "node_modules"), { recursive: true });
-  await writeFile(join2(root, RECEIPT), JSON.stringify({ version: 1, files: current.files }), { mode: 384 });
+  await mkdir2(join3(root, "node_modules"), { recursive: true });
+  await writeFile2(join3(root, RECEIPT), JSON.stringify({ version: 1, files: current.files }), { mode: 384 });
+}
+
+// packages/fleet/src/service-auth.ts
+function json(result) {
+  try {
+    const data = JSON.parse(result.stdout);
+    return record(data) ? data : null;
+  } catch {
+    return null;
+  }
+}
+async function codingAuth(id, run) {
+  return [
+    await serviceCheck(id === "codex" ? {
+      id,
+      command: ["codex", "login", "status"],
+      action: "Run codex login on this computer as its operator.",
+      valid: (result) => /^Logged in using (ChatGPT|an API key|API key)\b/im.test(`${result.stdout}
+${result.stderr}`)
+    } : {
+      id,
+      command: ["claude", "auth", "status", "--json"],
+      action: "Run claude auth login on this computer as its operator.",
+      valid: (result) => json(result)?.["loggedIn"] === true
+    }, run)
+  ];
+}
+async function serviceAuth(run) {
+  const services = [
+    {
+      id: "railway",
+      command: ["railway", "whoami", "--json"],
+      action: "Run railway login on this computer.",
+      valid: (result) => typeof json(result)?.["id"] === "string"
+    },
+    {
+      id: "vercel",
+      command: ["vercel", "whoami"],
+      action: "Run vercel login on this computer.",
+      valid: (result) => /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,100}$/.test(result.stdout.trim())
+    },
+    {
+      id: "cloudflare",
+      command: ["wrangler", "whoami", "--json"],
+      action: "Run wrangler login on this computer.",
+      valid: (result) => json(result)?.["loggedIn"] === true
+    },
+    {
+      id: "aws",
+      command: [
+        "aws",
+        "sts",
+        "get-caller-identity",
+        "--output",
+        "json",
+        "--no-cli-pager"
+      ],
+      action: "Select and authenticate the intended AWS profile on this computer.",
+      valid: (result) => typeof json(result)?.["Account"] === "string" && typeof json(result)?.["Arn"] === "string"
+    },
+    {
+      id: "npm",
+      command: ["npm", "whoami", "--registry=https://registry.npmjs.org/"],
+      action: "Run npm login only if this computer should publish packages.",
+      valid: (result) => /^[a-z0-9][a-z0-9._-]{0,213}$/.test(result.stdout.trim())
+    }
+  ];
+  const checks = [];
+  for (const service of services)
+    checks.push(await serviceCheck(service, run));
+  for (const id of ["gemini", "copilot", "opencode"])
+    checks.push({
+      id: `auth:${id}`,
+      status: "skip",
+      summary: `${id} provider authorization has no verified noninteractive status adapter in this CLI. Installed binaries or saved keys are not proof of access.`,
+      remedy: {
+        action: `Verify ${id} provider access locally using its supported account diagnostics. No prompt or billable request was made.`
+      }
+    });
+  return checks;
+}
+async function serviceCheck(service, run) {
+  const result = await run(service.command, { timeoutMs: 15000 });
+  const ok = result.ok && service.valid(result);
+  return {
+    id: `auth:${service.id}`,
+    status: ok ? "pass" : "fail",
+    summary: ok ? `${service.id} reports an authenticated session in this process context; no credential or account output retained.` : `${service.id} login is missing or could not be verified (${result.reason}); no credential output retained.`,
+    ...!ok ? { remedy: { action: service.action } } : {}
+  };
+}
+
+// packages/fleet/src/workstation-checks.ts
+async function workstationChecks(root, run) {
+  const result = await run(["personal", "workstation", "doctor", "--json", "--non-interactive"], {
+    cwd: root,
+    timeoutMs: 20000
+  });
+  const fallback = {
+    id: "workstation:configuration",
+    status: "fail",
+    summary: "Managed workstation configuration could not be verified.",
+    remedy: {
+      action: "Run personal workstation doctor --json on this computer. Review managed links, PATH, coding-tool/provider configuration and notification settings; apply personal workstation sync only explicitly."
+    }
+  };
+  try {
+    const data = JSON.parse(result.stdout);
+    if (!record(data) || !Array.isArray(data["checks"]) || !data["checks"].length || data["checks"].length > 100)
+      return [fallback];
+    const checks = data["checks"].map(configurationCheck);
+    if (checks.some((check) => check === null))
+      return [fallback];
+    return [
+      ...!result.ok || data["ok"] !== true ? [fallback] : [],
+      ...checks
+    ];
+  } catch {
+    return [fallback];
+  }
+}
+function configurationCheck(value) {
+  if (!record(value) || typeof value["id"] !== "string" || !/^[a-zA-Z0-9:._-]{1,75}$/.test(value["id"]) || !["pass", "warn", "fail"].includes(String(value["severity"])))
+    return null;
+  const ok = value["severity"] === "pass";
+  return {
+    id: `workstation:${value["id"].toLowerCase()}`,
+    status: value["severity"],
+    summary: ok ? "Managed configuration check succeeded (configuration presence; provider authorization is checked separately)." : "Managed configuration is missing, conflicting or unverified.",
+    ...!ok ? {
+      remedy: {
+        action: "Inspect personal workstation doctor --json on this computer. Use explicit personal workstation sync only after reviewing the configuration changes."
+      }
+    } : {}
+  };
+}
+
+// packages/fleet/src/toolchain-checks.ts
+import { join as join4 } from "node:path";
+async function toolchainChecks(root, run) {
+  const result = await run(["bun", join4(root, "scripts/dev/doctor.ts"), "--json", "--docker"], { cwd: root, timeoutMs: 90000 });
+  const fallback = {
+    id: "auth:toolchain",
+    status: "fail",
+    summary: "Pinned tool/dependency and Docker checks could not be verified.",
+    remedy: {
+      action: "Run the checkout scripts/dev/doctor.ts --json --docker on this computer. Reconcile versions only through the shared mise setup."
+    }
+  };
+  try {
+    const data = JSON.parse(result.stdout);
+    if (!record(data) || typeof data["ok"] !== "boolean" || !Array.isArray(data["checks"]) || !data["checks"].length || data["checks"].length > 150)
+      return [fallback];
+    const checks = data["checks"].map(toolCheck);
+    if (checks.some((check) => check === null))
+      return [fallback];
+    return [
+      ...!result.ok || !data["ok"] ? [fallback] : [],
+      ...checks
+    ];
+  } catch {
+    return [fallback];
+  }
+}
+function toolCheck(value) {
+  if (!record(value) || typeof value["id"] !== "string" || !/^[a-zA-Z0-9@:/._-]{1,75}$/.test(value["id"]) || !["pass", "fail", "warn", "skip"].includes(String(value["status"])))
+    return null;
+  const ok = value["status"] === "pass";
+  const version = typeof value["detail"] === "string" && /^v?\d{1,6}(?:\.\d{1,6}){1,3}$/.test(value["detail"]) ? ` ${value["detail"]}` : "";
+  return {
+    id: `tool:${value["id"].toLowerCase().replace(/[^a-z0-9:._-]/g, "_")}`,
+    status: value["status"],
+    summary: ok ? `Expected tool version or runtime check succeeded${version}.` : "Expected tool version, runtime or authentication check did not pass.",
+    ...!ok ? {
+      remedy: {
+        action: "Review scripts/dev/doctor.ts --json --docker locally. Use shared mise/workstation setup to reconcile this computer."
+      }
+    } : {}
+  };
 }
 
 // packages/fleet/src/auth-checks.ts
-import { join as join3 } from "node:path";
 async function authCheck(capability, run, root) {
   if (capability === "t3")
     return t3Checks(run);
+  if (capability === "codex" || capability === "claude")
+    return codingAuth(capability, run);
+  if (capability === "services")
+    return serviceAuth(run);
+  if (capability === "workstation")
+    return workstationChecks(root, run);
+  if (capability === "toolchain")
+    return toolchainChecks(root, run);
+  return basicAuth(capability, run, root);
+}
+async function basicAuth(capability, run, root) {
   const spec = {
     github: {
       command: ["gh", "auth", "status", "--active"],
@@ -201,15 +504,11 @@ async function authCheck(capability, run, root) {
     vscode: {
       command: ["code", "--list-extensions"],
       action: "Install the VS Code CLI on PATH and ms-vscode-remote.remote-ssh in the local editor profile."
-    },
-    toolchain: {
-      command: ["bun", join3(root, "scripts/dev/doctor.ts"), "--json"],
-      action: "Run ws tools check --json; use the shared mise setup to reconcile tools."
     }
   }[capability];
   const result = await run(spec.command, {
     cwd: root,
-    timeoutMs: capability === "toolchain" ? 90000 : 15000
+    timeoutMs: 15000
   });
   const extensions = result.stdout.toLowerCase().split(/\s+/);
   const ok = result.ok && (capability !== "vscode" || extensions.includes("ms-vscode-remote.remote-ssh"));
@@ -288,13 +587,7 @@ async function probe(root, required, run) {
     summary: dirty.ok && !dirty.stdout.trim() ? "Working tree is clean." : "Working tree is dirty or unreadable; sync --pull will refuse."
   });
   checks.push(await dependencyCheck(root, current));
-  for (const capability of [
-    "github",
-    "vault",
-    "t3",
-    "vscode",
-    "toolchain"
-  ]) {
+  for (const capability of CAPABILITIES) {
     if (required.includes(capability))
       checks.push(...await authCheck(capability, run, root));
     else
@@ -390,7 +683,7 @@ function runCommand(command, options = {}) {
 
 // packages/fleet/src/sync.ts
 import { unlink } from "node:fs/promises";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 async function syncWorkspace(root, pull, run) {
   const before = await fingerprint(root, run);
   if (!completeFingerprint(before)) {
@@ -404,7 +697,7 @@ async function syncWorkspace(root, pull, run) {
     if (!dirty.ok || dirty.stdout.trim() || !branch.ok)
       return failed("Refusing pull: dirty, detached, or unreadable checkout. Reconcile manually.");
   }
-  await unlink(join4(root, "node_modules/.fleet-sync.json")).catch(() => {
+  await unlink(join5(root, "node_modules/.fleet-sync.json")).catch(() => {
     return;
   });
   if (pull) {
@@ -456,13 +749,242 @@ function completeFingerprint(value) {
   return value.head !== null && Object.values(value.files).every(Boolean);
 }
 
+// packages/fleet/src/repair-catalog.ts
+var login = (id, title, commands, action) => ({
+  id: `login:${id}`,
+  title,
+  owner: `${id} native CLI`,
+  automatic: false,
+  action,
+  commands
+});
+var REPAIR_RECIPES = [
+  {
+    id: "workspace",
+    title: "Install locked tools and frozen dependencies",
+    owner: "mise / scripts/dev/setup.ts",
+    automatic: true,
+    action: "Runs the existing shared setup and trusted checkout lifecycle scripts. Updates user mise/PATH configuration and writes a sync receipt. Does not pull or reset Git.",
+    commands: [
+      [
+        "mise",
+        "exec",
+        "--locked",
+        "bun",
+        "--",
+        "bun",
+        "scripts/dev/setup.ts",
+        "--non-interactive"
+      ]
+    ]
+  },
+  {
+    id: "workstation",
+    title: "Install launcher and converge managed workstation configuration",
+    owner: "workstation",
+    automatic: true,
+    action: "Runs personal:install --yes: frozen install, launcher/PATH, managed links, notifications and provider configuration. Reads available provider keys from this machine’s Vault session and writes owner-managed 0600 configuration. Conflicting unmanaged files fail.",
+    commands: [["bun", "run", "personal:install", "--yes"]]
+  },
+  {
+    id: "providers",
+    title: "Refresh shared provider configuration from Vault",
+    owner: "workstation / secret-store",
+    automatic: true,
+    action: "Uses this machine’s own Vault authorization to fetch the existing permitted provider keys. The workstation owner writes its 0600 tool configuration; no credentials are copied from another computer. Missing provider keys may remain skipped.",
+    commands: [
+      [
+        "bun",
+        "packages/workstation/cli/internal.ts",
+        "opencode",
+        "sync",
+        "--strict",
+        "--json",
+        "--non-interactive",
+        "--yes"
+      ]
+    ]
+  },
+  login("codex", "Sign in to Codex on this machine", [["codex", "login", "--device-auth"]], "Approve the device flow in your browser. Run codex login status afterward; retain this machine’s own credential store."),
+  login("claude", "Sign in to Claude Code on this machine", [["claude", "auth", "login"]], "Complete the native browser login, then run claude auth status --json. API-key and subscription contexts can differ."),
+  login("github", "Sign in to GitHub and configure Git", [
+    [
+      "gh",
+      "auth",
+      "login",
+      "--hostname",
+      "github.com",
+      "--web",
+      "--git-protocol",
+      "https"
+    ],
+    ["gh", "auth", "setup-git"]
+  ], "Approve GitHub in the browser on the intended account, then run gh auth status --active. Environment tokens can override stored login; inspect their source locally."),
+  login("vault", "Authorize this machine for the shared Vault", [], "Run vault login -method=userpass username=YOUR_USERNAME in your own terminal. The native CLI prompts privately for the password. Use the existing permitted project/config; never copy VAULT_TOKEN between computers."),
+  login("railway", "Sign in to Railway", [["railway", "login", "--browserless"]], "Complete the browserless native flow, then run railway whoami --json."),
+  login("vercel", "Sign in to Vercel", [["vercel", "login"]], "Complete native login, then run vercel whoami. Select the intended team/project separately; do not create resources as a login repair."),
+  login("cloudflare", "Sign in to Cloudflare", [["wrangler", "login", "--browser=false"]], "Complete native OAuth login, then run wrangler whoami --json. For headless SSH, prefer an existing scoped API token injected by the approved Vault config. --browser=false suppresses browser launch; it does not make a remote loopback callback reachable. Any OAuth callback tunnel needs explicit operator setup. Resource access still depends on account permissions."),
+  login("aws", "Refresh the selected AWS SSO session", [["aws", "sso", "login"]], "Configure the intended profile with aws configure sso first if needed. Login and the health check use this shell’s current profile; no access keys are cloned."),
+  login("npm", "Sign in to npm on this machine", [
+    [
+      "npm",
+      "login",
+      "--auth-type=web",
+      "--registry=https://registry.npmjs.org/"
+    ]
+  ], "Complete the specific CLI approval and run npm whoami. Prefer the existing trusted-publisher CI workflow for releases."),
+  login("opencode", "Authorize an OpenCode provider", [["opencode", "auth", "login"]], "Prefer the existing Vault-backed providers repair for managed API keys. Native auth login handles an operator-owned OAuth provider. Credential listing alone does not prove live provider access."),
+  login("copilot", "Sign in to Copilot", [["copilot", "login"]], "Complete native login; provider authorization still needs supported operator diagnostics. No model prompt is used for health checking."),
+  login("gemini", "Sign in to Gemini", [], "Open Gemini interactively and choose its supported sign-in flow. Provider authorization remains unverified without a supported read-only status adapter."),
+  {
+    id: "t3",
+    title: "Enable and authorize T3 Connect",
+    owner: "T3",
+    automatic: false,
+    action: "Run t3 up --connect in this machine’s terminal and approve the intended connection. Treat pairing material as private. Then check t3 status --json and perform an operator peer test.",
+    commands: [["t3", "up", "--connect"]]
+  },
+  {
+    id: "docker",
+    title: "Start the intended Docker runtime",
+    owner: "OS / Docker",
+    automatic: false,
+    action: "Start Docker Desktop on desktop systems, or the already-installed Docker service using the OS service manager on Linux. Confirm the intended context with docker context ls. This repair never installs a daemon, invokes sudo, changes contexts or exposes a TCP socket.",
+    commands: [
+      ["docker", "context", "ls"],
+      ["docker", "info"]
+    ]
+  },
+  {
+    id: "password-manager",
+    title: "Review shared human login onboarding",
+    owner: "password-manager / Bitwarden",
+    automatic: false,
+    action: "Use the existing password-manager doctor and actions list on this computer. Its setup guides native consent and Bitwarden enrollment. Keep its private state and OS credential store local. Password vault access does not authorize native CLI OAuth sessions; imports and rotations remain separate reviewed workflows.",
+    commands: [
+      ["bun", "run", "password-manager", "doctor"],
+      ["bun", "run", "password-manager", "actions", "list"]
+    ]
+  },
+  {
+    id: "operator",
+    title: "Resolve the check with its owning tool",
+    owner: "operator / existing owner",
+    automatic: false,
+    action: "Follow the check’s remedy on the affected machine. Verify host fingerprints, register real SSH aliases/checkouts, reconcile Git changes, or perform the named end-to-end test. Infrastructure changes remain OpenTofu-owned.",
+    commands: []
+  }
+];
+var AUTOMATED_REPAIRS = [
+  "workspace",
+  "workstation",
+  "providers"
+];
+function recipe(id) {
+  return REPAIR_RECIPES.find((entry) => entry.id === id) ?? REPAIR_RECIPES.find((entry) => entry.id === "operator");
+}
+
+// packages/fleet/src/repair-runner.ts
+function validRepairs(value) {
+  return Array.isArray(value) && value.length > 0 && value.length <= 3 && new Set(value).size === value.length && value.every((id) => AUTOMATED_REPAIRS.includes(id));
+}
+async function repairWorkspace(root, repairs, run, expected) {
+  if (!validRepairs(repairs))
+    throw new Error("Unsupported repairs");
+  const before = await fingerprint(root, run);
+  if (!before.head || !Object.values(before.files).every(Boolean))
+    return [
+      {
+        id: "repair:workspace",
+        status: "fail",
+        summary: "Repairs require a complete existing checkout. Register/bootstrap it first."
+      }
+    ];
+  if (expected && JSON.stringify(before) !== JSON.stringify(expected))
+    return [
+      {
+        id: "repair:inputs",
+        status: "fail",
+        summary: "Checkout inputs changed since diagnostics. Generate a fresh repair plan before applying."
+      }
+    ];
+  const checks = [];
+  for (const id of AUTOMATED_REPAIRS.filter((entry) => repairs.includes(entry))) {
+    const result = id === "workspace" ? await syncWorkspace(root, false, run) : await ownerCommand(root, id, run);
+    checks.push(...result);
+    if (result.some((check) => check.status !== "pass"))
+      break;
+  }
+  const after = await fingerprint(root, run);
+  if (JSON.stringify(before) !== JSON.stringify(after))
+    checks.push({
+      id: "repair:inputs",
+      status: "fail",
+      summary: "Checkout inputs changed during repair. Stop and review the checkout before retrying."
+    });
+  return checks;
+}
+async function ownerCommand(root, id, run) {
+  const result = await run(recipe(id).commands[0], {
+    cwd: root,
+    timeoutMs: 1200000
+  });
+  return [
+    {
+      id: `repair:${id}`,
+      status: result.ok ? "pass" : "fail",
+      summary: result.ok ? "The existing owner command completed. Fresh diagnostics determine whether configuration and authorization now pass." : `The owner command failed (${result.reason}); partial changes are possible. Raw output and credentials are withheld. Later repairs on this computer were stopped.`
+    }
+  ];
+}
+
+// packages/fleet/src/protocol.ts
+var STATUSES = ["pass", "warn", "fail", "skip"];
+function validCheck(value) {
+  if (!record(value) || typeof value["id"] !== "string" || !/^[a-z0-9:._-]{1,100}$/.test(value["id"]) || !STATUSES.includes(String(value["status"])) || typeof value["summary"] !== "string" || value["summary"].length > 2000)
+    return false;
+  const remedy = value["remedy"];
+  return remedy === undefined || validRemedy(remedy);
+}
+function validRemedy(value) {
+  return record(value) && typeof value["action"] === "string" && value["action"].length < 2000 && (value["command"] === undefined || typeof value["command"] === "string");
+}
+function validSnapshot(value) {
+  if (!record(value) || value["version"] !== 1 || typeof value["platform"] !== "string" || !Array.isArray(value["checks"]) || value["checks"].length > 200 || !value["checks"].every(validCheck))
+    return false;
+  return validFingerprint(value["fingerprint"]);
+}
+function validFingerprint(value) {
+  if (!record(value) || !record(value["files"]))
+    return false;
+  if (!Object.keys(value["files"]).every((key) => FINGERPRINT_FILES.includes(key)))
+    return false;
+  const head = value["head"];
+  return (head === null || typeof head === "string" && /^[a-f0-9]{40,64}$/.test(head)) && Object.values(value["files"]).every(validHash);
+}
+function validHash(value) {
+  return value === null || typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+}
+
 // packages/fleet/src/remote-entry.ts
 async function main() {
   const raw = JSON.parse(Buffer.from(process.argv.at(-1) ?? "", "base64").toString());
-  if (!record(raw) || raw["action"] !== "probe" && raw["action"] !== "sync")
+  if (!validRequest(raw))
     throw new Error("Invalid request.");
   const node = parseConfig({ version: 1, nodes: [raw["node"]] }).nodes[0];
-  if (raw["action"] === "sync") {
+  if (raw["action"] === "configure") {
+    await configureRequest(raw, node);
+  } else if (raw["action"] === "repair") {
+    if (raw["apply"] !== true || !validRepairs(raw["repairs"]) || !validSnapshot({
+      version: 1,
+      platform: "request",
+      checks: [],
+      fingerprint: raw["expected"]
+    }))
+      throw new Error("Repair requires explicit authorization and supported actions.");
+    const checks = await repairWorkspace(node.workspace, raw["repairs"], runCommand, raw["expected"]);
+    process.stdout.write(JSON.stringify({ version: 1, checks }));
+  } else if (raw["action"] === "sync") {
     if (raw["apply"] !== true)
       throw new Error("Sync requires explicit authorization.");
     const checks = await syncWorkspace(node.workspace, raw["pull"] === true, runCommand);
@@ -477,3 +999,12 @@ await main().catch(() => {
   }));
   process.exitCode = 1;
 });
+async function configureRequest(raw, node) {
+  if (raw["apply"] !== true || !validConfiguration(raw["configuration"]) || raw["configuration"].node !== node.id)
+    throw new Error("Invalid configuration request.");
+  const checks = await configureWorkspace(node.workspace, raw["configuration"], runCommand);
+  process.stdout.write(JSON.stringify({ version: 1, checks }));
+}
+function validRequest(raw) {
+  return record(raw) && ["probe", "sync", "repair", "configure"].includes(String(raw["action"]));
+}