@hasna/machines 0.0.14 → 0.0.15

package/dist/cli/index.js

@@ -44,6 +44,7 @@ var __export = (target, all) => {
       set: __exportSetter.bind(all, name)
     });
 };
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
 // node_modules/commander/lib/error.js
@@ -2080,6 +2081,510 @@ var require_commander = __commonJS((exports) => {
   exports.InvalidOptionArgumentError = InvalidArgumentError;
 });
 
+// src/paths.ts
+import { existsSync as existsSync2, mkdirSync } from "fs";
+import { dirname as dirname2, join as join2, resolve } from "path";
+function homeDir() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || "~";
+}
+function getDataDir() {
+  return process.env["HASNA_MACHINES_DIR"] || join2(homeDir(), ".hasna", "machines");
+}
+function getDbPath() {
+  return process.env["HASNA_MACHINES_DB_PATH"] || join2(getDataDir(), "machines.db");
+}
+function getManifestPath() {
+  return process.env["HASNA_MACHINES_MANIFEST_PATH"] || join2(getDataDir(), "machines.json");
+}
+function getNotificationsPath() {
+  return process.env["HASNA_MACHINES_NOTIFICATIONS_PATH"] || join2(getDataDir(), "notifications.json");
+}
+function getClipboardKeyPath() {
+  return process.env["HASNA_MACHINES_CLIPBOARD_KEY_PATH"] || join2(getDataDir(), "clipboard.key");
+}
+function getClipboardHistoryPath() {
+  return process.env["HASNA_MACHINES_CLIPBOARD_HISTORY_PATH"] || join2(getDataDir(), "clipboard-history.json");
+}
+function ensureParentDir(filePath) {
+  if (filePath === ":memory:")
+    return;
+  const dir = dirname2(resolve(filePath));
+  if (!existsSync2(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+}
+var init_paths = () => {};
+
+// src/db.ts
+import { Database } from "bun:sqlite";
+import { hostname as hostname2 } from "os";
+
+class SqliteAdapter {
+  raw;
+  constructor(path) {
+    this.raw = new Database(path);
+  }
+  close() {
+    this.raw.close();
+  }
+}
+function createTables(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS agent_heartbeats (
+      machine_id TEXT NOT NULL,
+      pid INTEGER NOT NULL,
+      status TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      PRIMARY KEY (machine_id, pid)
+    )
+  `);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS setup_runs (
+      id TEXT PRIMARY KEY,
+      machine_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      details_json TEXT NOT NULL DEFAULT '[]',
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    )
+  `);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS sync_runs (
+      id TEXT PRIMARY KEY,
+      machine_id TEXT NOT NULL,
+      status TEXT NOT NULL,
+      actions_json TEXT NOT NULL DEFAULT '[]',
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    )
+  `);
+}
+function getAdapter(path = getDbPath()) {
+  if (path === ":memory:") {
+    const memoryAdapter = new SqliteAdapter(path);
+    createTables(memoryAdapter.raw);
+    return memoryAdapter;
+  }
+  if (adapter && adapter.raw.filename !== path) {
+    adapter.close();
+    adapter = null;
+  }
+  if (!adapter) {
+    ensureParentDir(path);
+    adapter = new SqliteAdapter(path);
+    adapter.raw.exec("PRAGMA journal_mode = WAL");
+    adapter.raw.exec("PRAGMA foreign_keys = ON");
+    createTables(adapter.raw);
+  }
+  return adapter;
+}
+function getDb(path = getDbPath()) {
+  return getAdapter(path).raw;
+}
+function getLocalMachineId() {
+  return process.env["HASNA_MACHINES_MACHINE_ID"] || hostname2();
+}
+function listHeartbeats(machineId) {
+  const db = getDb();
+  if (machineId) {
+    return db.query(`SELECT machine_id, pid, status, updated_at
+         FROM agent_heartbeats
+         WHERE machine_id = ?
+         ORDER BY updated_at DESC`).all(machineId);
+  }
+  return db.query(`SELECT machine_id, pid, status, updated_at
+       FROM agent_heartbeats
+       ORDER BY updated_at DESC`).all();
+}
+function countRuns(table) {
+  const db = getDb();
+  const row = db.query(`SELECT COUNT(*) as count FROM ${table}`).get();
+  return row.count;
+}
+function recordSetupRun(machineId, status, details) {
+  const db = getDb();
+  const now = new Date().toISOString();
+  db.query(`INSERT INTO setup_runs (id, machine_id, status, details_json, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?)`).run(crypto.randomUUID(), machineId, status, JSON.stringify(details), now, now);
+}
+function recordSyncRun(machineId, status, actions) {
+  const db = getDb();
+  const now = new Date().toISOString();
+  db.query(`INSERT INTO sync_runs (id, machine_id, status, actions_json, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?)`).run(crypto.randomUUID(), machineId, status, JSON.stringify(actions), now, now);
+}
+var adapter = null;
+var init_db = __esm(() => {
+  init_paths();
+});
+
+// src/pg-migrations.ts
+var PG_MIGRATIONS;
+var init_pg_migrations = __esm(() => {
+  PG_MIGRATIONS = [
+    `
+  CREATE TABLE IF NOT EXISTS agent_heartbeats (
+    machine_id TEXT NOT NULL,
+    pid INTEGER NOT NULL,
+    status TEXT NOT NULL,
+    updated_at TIMESTAMPTZ NOT NULL,
+    PRIMARY KEY (machine_id, pid)
+  );
+
+  CREATE TABLE IF NOT EXISTS setup_runs (
+    id TEXT PRIMARY KEY,
+    machine_id TEXT NOT NULL,
+    status TEXT NOT NULL,
+    details_json TEXT NOT NULL DEFAULT '[]',
+    created_at TIMESTAMPTZ NOT NULL,
+    updated_at TIMESTAMPTZ NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS sync_runs (
+    id TEXT PRIMARY KEY,
+    machine_id TEXT NOT NULL,
+    status TEXT NOT NULL,
+    actions_json TEXT NOT NULL DEFAULT '[]',
+    created_at TIMESTAMPTZ NOT NULL,
+    updated_at TIMESTAMPTZ NOT NULL
+  );
+  `
+  ];
+});
+
+// src/remote-storage.ts
+import pg from "pg";
+function translatePlaceholders(sql) {
+  let index = 0;
+  return sql.replace(/\?/g, () => `$${++index}`);
+}
+function normalizeParams(params) {
+  const flat = params.length === 1 && Array.isArray(params[0]) ? params[0] : params;
+  return flat.map((value) => value === undefined ? null : value);
+}
+function sslConfigFor(connectionString) {
+  return connectionString.includes("sslmode=require") || connectionString.includes("ssl=true") ? { rejectUnauthorized: false } : undefined;
+}
+
+class PgAdapterAsync {
+  pool;
+  constructor(connectionString) {
+    this.pool = new pg.Pool({ connectionString, ssl: sslConfigFor(connectionString) });
+  }
+  async run(sql, ...params) {
+    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
+    return { changes: result.rowCount ?? 0 };
+  }
+  async all(sql, ...params) {
+    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
+    return result.rows;
+  }
+  async close() {
+    await this.pool.end();
+  }
+}
+var init_remote_storage = () => {};
+
+// src/storage-sync.ts
+function readEnv(name) {
+  const value = process.env[name]?.trim();
+  return value || undefined;
+}
+function normalizeStorageMode(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (normalized === "local" || normalized === "hybrid" || normalized === "remote")
+    return normalized;
+  return;
+}
+function getStorageDatabaseEnvName() {
+  for (const name of STORAGE_DATABASE_ENV) {
+    if (readEnv(name))
+      return name;
+  }
+  return null;
+}
+function getStorageDatabaseEnv() {
+  const name = getStorageDatabaseEnvName();
+  return name ? { name } : null;
+}
+function getStorageDatabaseUrl() {
+  const env2 = getStorageDatabaseEnv();
+  return env2 ? readEnv(env2.name) ?? null : null;
+}
+function getStorageMode() {
+  const mode = normalizeStorageMode(readEnv(MACHINES_STORAGE_MODE_ENV)) ?? normalizeStorageMode(readEnv(MACHINES_STORAGE_MODE_FALLBACK_ENV));
+  if (mode)
+    return mode;
+  return getStorageDatabaseUrl() ? "hybrid" : "local";
+}
+async function getStoragePg() {
+  const url = getStorageDatabaseUrl();
+  if (!url) {
+    throw new Error("Missing HASNA_MACHINES_DATABASE_URL or MACHINES_DATABASE_URL");
+  }
+  return new PgAdapterAsync(url);
+}
+async function runStorageMigrations(remote) {
+  for (const sql of PG_MIGRATIONS)
+    await remote.run(sql);
+}
+async function storagePush(options) {
+  const remote = await getStoragePg();
+  const db = getDb();
+  try {
+    await runStorageMigrations(remote);
+    const results = [];
+    for (const table of resolveTables(options?.tables)) {
+      results.push(await pushTable(db, remote, table));
+    }
+    recordSyncMeta(db, "push", results);
+    return results;
+  } finally {
+    await remote.close();
+  }
+}
+async function storagePull(options) {
+  const remote = await getStoragePg();
+  const db = getDb();
+  try {
+    await runStorageMigrations(remote);
+    const results = [];
+    for (const table of resolveTables(options?.tables)) {
+      results.push(await pullTable(remote, db, table));
+    }
+    recordSyncMeta(db, "pull", results);
+    return results;
+  } finally {
+    await remote.close();
+  }
+}
+async function storageSync(options) {
+  const pull = await storagePull(options);
+  const push = await storagePush(options);
+  return { pull, push };
+}
+function getSyncMetaAll() {
+  const db = getDb();
+  ensureSyncMetaTable(db);
+  return db.query("SELECT table_name, last_synced_at, direction FROM _machines_sync_meta ORDER BY table_name, direction").all();
+}
+function getStorageStatus() {
+  const activeEnv = getStorageDatabaseEnv();
+  return {
+    configured: Boolean(activeEnv),
+    mode: getStorageMode(),
+    env: STORAGE_DATABASE_ENV,
+    activeEnv: activeEnv?.name ?? null,
+    service: "machines",
+    tables: STORAGE_TABLES,
+    sync: getSyncMetaAll()
+  };
+}
+function resolveTables(tables) {
+  if (!tables || tables.length === 0)
+    return [...STORAGE_TABLES];
+  const allowed = new Set(STORAGE_TABLES);
+  const requested = tables.map((table) => table.trim()).filter(Boolean);
+  const invalid = requested.filter((table) => !allowed.has(table));
+  if (invalid.length > 0)
+    throw new Error(`Unknown machines storage table(s): ${invalid.join(", ")}`);
+  return requested;
+}
+function parseStorageTables(value) {
+  if (!value)
+    return;
+  return resolveTables(Array.isArray(value) ? value : value.split(","));
+}
+async function pushTable(db, remote, table) {
+  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
+  try {
+    if (!tableExists(db, table))
+      return result;
+    const rows = db.query(`SELECT * FROM ${quoteIdent(table)}`).all();
+    result.rowsRead = rows.length;
+    if (rows.length === 0)
+      return result;
+    const remoteColumns = await getRemoteColumns(remote, table);
+    const columns = filterRemoteColumns(remoteColumns, Object.keys(rows[0]));
+    result.rowsWritten = await upsertPg(remote, table, columns, rows);
+  } catch (error) {
+    result.errors.push(error instanceof Error ? error.message : String(error));
+  }
+  return result;
+}
+async function pullTable(remote, db, table) {
+  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
+  try {
+    if (!tableExists(db, table))
+      return result;
+    const rows = await remote.all(`SELECT * FROM ${quoteIdent(table)}`);
+    result.rowsRead = rows.length;
+    if (rows.length === 0)
+      return result;
+    const columns = filterLocalColumns(db, table, Object.keys(rows[0]));
+    result.rowsWritten = upsertSqlite(db, table, columns, rows);
+  } catch (error) {
+    result.errors.push(error instanceof Error ? error.message : String(error));
+  }
+  return result;
+}
+async function getRemoteColumns(remote, table) {
+  const rows = await remote.all("SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = ?", table);
+  return new Set(rows.map((row) => row.column_name));
+}
+function filterRemoteColumns(remoteColumns, columns) {
+  if (remoteColumns.size === 0)
+    return columns;
+  return columns.filter((column) => remoteColumns.has(column));
+}
+function filterLocalColumns(db, table, columns) {
+  const rows = db.query(`PRAGMA table_info(${quoteIdent(table)})`).all();
+  const allowed = new Set(rows.map((row) => row.name));
+  return columns.filter((column) => allowed.has(column));
+}
+async function upsertPg(remote, table, columns, rows) {
+  if (columns.length === 0)
+    return 0;
+  const primaryKeys = PRIMARY_KEYS[table];
+  const columnList = columns.map(quoteIdent).join(", ");
+  const placeholders = columns.map(() => "?").join(", ");
+  const keyList = primaryKeys.map(quoteIdent).join(", ");
+  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
+  const fallbackKey = primaryKeys[0];
+  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = EXCLUDED.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = EXCLUDED.${quoteIdent(fallbackKey)}`;
+  for (const row of rows) {
+    await remote.run(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders})
+       ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`, ...columns.map((column) => coerceForPg(row[column])));
+  }
+  return rows.length;
+}
+function upsertSqlite(db, table, columns, rows) {
+  if (columns.length === 0)
+    return 0;
+  const primaryKeys = PRIMARY_KEYS[table];
+  const columnList = columns.map(quoteIdent).join(", ");
+  const placeholders = columns.map(() => "?").join(", ");
+  const keyList = primaryKeys.map(quoteIdent).join(", ");
+  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
+  const fallbackKey = primaryKeys[0];
+  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = excluded.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = excluded.${quoteIdent(fallbackKey)}`;
+  const statement = db.query(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders})
+     ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`);
+  const insert = db.transaction((batch) => {
+    for (const row of batch)
+      statement.run(...columns.map((column) => coerceForSqlite(row[column])));
+  });
+  insert(rows);
+  return rows.length;
+}
+function recordSyncMeta(db, direction, results) {
+  ensureSyncMetaTable(db);
+  const now = new Date().toISOString();
+  const statement = db.query(`
+    INSERT INTO _machines_sync_meta (table_name, last_synced_at, direction)
+    VALUES (?, ?, ?)
+    ON CONFLICT(table_name, direction) DO UPDATE SET last_synced_at = excluded.last_synced_at
+  `);
+  for (const result of results) {
+    if (result.errors.length > 0)
+      continue;
+    statement.run(result.table, now, direction);
+  }
+}
+function ensureSyncMetaTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS _machines_sync_meta (
+      table_name TEXT NOT NULL,
+      last_synced_at TEXT,
+      direction TEXT NOT NULL CHECK(direction IN ('push', 'pull')),
+      PRIMARY KEY (table_name, direction)
+    )
+  `);
+}
+function tableExists(db, table) {
+  const row = db.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(table);
+  return Boolean(row);
+}
+function quoteIdent(identifier) {
+  return `"${identifier.replace(/"/g, '""')}"`;
+}
+function coerceForPg(value) {
+  if (value === undefined || value === null)
+    return null;
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array)
+    return value;
+  if (typeof value === "object")
+    return JSON.stringify(value);
+  return value;
+}
+function coerceForSqlite(value) {
+  if (value === undefined || value === null)
+    return null;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean")
+    return value;
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array)
+    return value;
+  if (typeof value === "object")
+    return JSON.stringify(value);
+  return String(value);
+}
+var STORAGE_TABLES, MACHINES_STORAGE_TABLES, MACHINES_STORAGE_ENV = "HASNA_MACHINES_DATABASE_URL", MACHINES_STORAGE_FALLBACK_ENV = "MACHINES_DATABASE_URL", MACHINES_STORAGE_MODE_ENV = "HASNA_MACHINES_STORAGE_MODE", MACHINES_STORAGE_MODE_FALLBACK_ENV = "MACHINES_STORAGE_MODE", STORAGE_DATABASE_ENV, STORAGE_MODE_ENV, PRIMARY_KEYS;
+var init_storage_sync = __esm(() => {
+  init_db();
+  init_pg_migrations();
+  init_remote_storage();
+  STORAGE_TABLES = [
+    "agent_heartbeats",
+    "setup_runs",
+    "sync_runs"
+  ];
+  MACHINES_STORAGE_TABLES = STORAGE_TABLES;
+  STORAGE_DATABASE_ENV = [MACHINES_STORAGE_ENV, MACHINES_STORAGE_FALLBACK_ENV];
+  STORAGE_MODE_ENV = [MACHINES_STORAGE_MODE_ENV, MACHINES_STORAGE_MODE_FALLBACK_ENV];
+  PRIMARY_KEYS = {
+    agent_heartbeats: ["machine_id", "pid"],
+    setup_runs: ["id"],
+    sync_runs: ["id"]
+  };
+});
+
+// src/storage.ts
+var exports_storage = {};
+__export(exports_storage, {
+  storageSync: () => storageSync,
+  storagePush: () => storagePush,
+  storagePull: () => storagePull,
+  runStorageMigrations: () => runStorageMigrations,
+  resolveTables: () => resolveTables,
+  parseStorageTables: () => parseStorageTables,
+  getSyncMetaAll: () => getSyncMetaAll,
+  getStorageStatus: () => getStorageStatus,
+  getStoragePg: () => getStoragePg,
+  getStorageMode: () => getStorageMode,
+  getStorageDatabaseUrl: () => getStorageDatabaseUrl,
+  getStorageDatabaseEnvName: () => getStorageDatabaseEnvName,
+  getStorageDatabaseEnv: () => getStorageDatabaseEnv,
+  STORAGE_TABLES: () => STORAGE_TABLES,
+  STORAGE_MODE_ENV: () => STORAGE_MODE_ENV,
+  STORAGE_DATABASE_ENV: () => STORAGE_DATABASE_ENV,
+  PgAdapterAsync: () => PgAdapterAsync,
+  PG_MIGRATIONS: () => PG_MIGRATIONS,
+  MACHINES_STORAGE_TABLES: () => MACHINES_STORAGE_TABLES,
+  MACHINES_STORAGE_MODE_FALLBACK_ENV: () => MACHINES_STORAGE_MODE_FALLBACK_ENV,
+  MACHINES_STORAGE_MODE_ENV: () => MACHINES_STORAGE_MODE_ENV,
+  MACHINES_STORAGE_FALLBACK_ENV: () => MACHINES_STORAGE_FALLBACK_ENV,
+  MACHINES_STORAGE_ENV: () => MACHINES_STORAGE_ENV
+});
+var init_storage = __esm(() => {
+  init_storage_sync();
+  init_pg_migrations();
+  init_remote_storage();
+});
+
 // node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
@@ -6581,40 +7086,8 @@ var coerce = {
   date: (arg) => ZodDate.create({ ...arg, coerce: true })
 };
 var NEVER = INVALID;
-// src/paths.ts
-import { existsSync as existsSync2, mkdirSync } from "fs";
-import { dirname as dirname2, join as join2, resolve } from "path";
-function homeDir() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || "~";
-}
-function getDataDir() {
-  return process.env["HASNA_MACHINES_DIR"] || join2(homeDir(), ".hasna", "machines");
-}
-function getDbPath() {
-  return process.env["HASNA_MACHINES_DB_PATH"] || join2(getDataDir(), "machines.db");
-}
-function getManifestPath() {
-  return process.env["HASNA_MACHINES_MANIFEST_PATH"] || join2(getDataDir(), "machines.json");
-}
-function getNotificationsPath() {
-  return process.env["HASNA_MACHINES_NOTIFICATIONS_PATH"] || join2(getDataDir(), "notifications.json");
-}
-function getClipboardKeyPath() {
-  return process.env["HASNA_MACHINES_CLIPBOARD_KEY_PATH"] || join2(getDataDir(), "clipboard.key");
-}
-function getClipboardHistoryPath() {
-  return process.env["HASNA_MACHINES_CLIPBOARD_HISTORY_PATH"] || join2(getDataDir(), "clipboard-history.json");
-}
-function ensureParentDir(filePath) {
-  if (filePath === ":memory:")
-    return;
-  const dir = dirname2(resolve(filePath));
-  if (!existsSync2(dir)) {
-    mkdirSync(dir, { recursive: true });
-  }
-}
-
 // src/manifests.ts
+init_paths();
 var packageSchema = exports_external.object({
   name: exports_external.string(),
   manager: exports_external.enum(["bun", "brew", "apt", "custom"]).optional(),
@@ -6718,6 +7191,7 @@ function detectCurrentMachineManifest() {
 }
 
 // src/commands/manifest.ts
+init_paths();
 function manifestInit() {
   return writeManifest(getDefaultManifest(), getManifestPath());
 }
@@ -6751,108 +7225,10 @@ function manifestValidate() {
   return validateManifest(getManifestPath());
 }
 
-// src/db.ts
-import { Database } from "bun:sqlite";
-import { hostname as hostname2 } from "os";
-class SqliteAdapter {
-  raw;
-  constructor(path) {
-    this.raw = new Database(path);
-  }
-  close() {
-    this.raw.close();
-  }
-}
-var adapter = null;
-function createTables(db) {
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS agent_heartbeats (
-      machine_id TEXT NOT NULL,
-      pid INTEGER NOT NULL,
-      status TEXT NOT NULL,
-      updated_at TEXT NOT NULL,
-      PRIMARY KEY (machine_id, pid)
-    )
-  `);
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS setup_runs (
-      id TEXT PRIMARY KEY,
-      machine_id TEXT NOT NULL,
-      status TEXT NOT NULL,
-      details_json TEXT NOT NULL DEFAULT '[]',
-      created_at TEXT NOT NULL,
-      updated_at TEXT NOT NULL
-    )
-  `);
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS sync_runs (
-      id TEXT PRIMARY KEY,
-      machine_id TEXT NOT NULL,
-      status TEXT NOT NULL,
-      actions_json TEXT NOT NULL DEFAULT '[]',
-      created_at TEXT NOT NULL,
-      updated_at TEXT NOT NULL
-    )
-  `);
-}
-function getAdapter(path = getDbPath()) {
-  if (path === ":memory:") {
-    const memoryAdapter = new SqliteAdapter(path);
-    createTables(memoryAdapter.raw);
-    return memoryAdapter;
-  }
-  if (adapter && adapter.raw.filename !== path) {
-    adapter.close();
-    adapter = null;
-  }
-  if (!adapter) {
-    ensureParentDir(path);
-    adapter = new SqliteAdapter(path);
-    adapter.raw.exec("PRAGMA journal_mode = WAL");
-    adapter.raw.exec("PRAGMA foreign_keys = ON");
-    createTables(adapter.raw);
-  }
-  return adapter;
-}
-function getDb(path = getDbPath()) {
-  return getAdapter(path).raw;
-}
-function getLocalMachineId() {
-  return process.env["HASNA_MACHINES_MACHINE_ID"] || hostname2();
-}
-function listHeartbeats(machineId) {
-  const db = getDb();
-  if (machineId) {
-    return db.query(`SELECT machine_id, pid, status, updated_at
-         FROM agent_heartbeats
-         WHERE machine_id = ?
-         ORDER BY updated_at DESC`).all(machineId);
-  }
-  return db.query(`SELECT machine_id, pid, status, updated_at
-       FROM agent_heartbeats
-       ORDER BY updated_at DESC`).all();
-}
-function countRuns(table) {
-  const db = getDb();
-  const row = db.query(`SELECT COUNT(*) as count FROM ${table}`).get();
-  return row.count;
-}
-function recordSetupRun(machineId, status, details) {
-  const db = getDb();
-  const now = new Date().toISOString();
-  db.query(`INSERT INTO setup_runs (id, machine_id, status, details_json, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?)`).run(crypto.randomUUID(), machineId, status, JSON.stringify(details), now, now);
-}
-function recordSyncRun(machineId, status, actions) {
-  const db = getDb();
-  const now = new Date().toISOString();
-  db.query(`INSERT INTO sync_runs (id, machine_id, status, actions_json, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?)`).run(crypto.randomUUID(), machineId, status, JSON.stringify(actions), now, now);
-}
-
-// src/commands/setup.ts
-function quote(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
+// src/commands/setup.ts
+init_db();
+function quote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function buildBaseSteps(machine) {
   const steps = [
@@ -7109,6 +7485,7 @@ function runCertPlan(domains, options = {}) {
 }
 
 // src/commands/dns.ts
+init_paths();
 import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { join as join5 } from "path";
 function getDnsPath() {
@@ -7194,6 +7571,7 @@ function diffMachines(leftMachineId, rightMachineId) {
 }
 
 // src/remote.ts
+init_db();
 import { spawnSync as spawnSync2 } from "child_process";
 
 // src/commands/ssh.ts
@@ -7245,7 +7623,7 @@ function runMachineCommand(machineId, command) {
   const isLocal = machineId === localMachineId;
   const route = isLocal ? "local" : resolveSshTarget(machineId).route;
   const shellCommand = isLocal ? command : buildSshCommand(machineId, command);
-  const result = spawnSync2("bash", ["-lc", shellCommand], {
+  const result = spawnSync2("bash", ["-c", shellCommand], {
     encoding: "utf8",
     env: process.env
   });
@@ -7571,6 +7949,7 @@ function runTailscaleInstall(machineId, options = {}) {
 
 // src/commands/notifications.ts
 import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+init_paths();
 var notificationChannelSchema = exports_external.object({
   id: exports_external.string(),
   type: exports_external.enum(["email", "webhook", "command"]),
@@ -7817,6 +8196,7 @@ async function testNotificationChannel(channelId, event = "manual.test", message
 }
 
 // src/commands/ports.ts
+init_db();
 import { spawnSync as spawnSync3 } from "child_process";
 function parseSsOutput(output) {
   return output.trim().split(`
@@ -7872,6 +8252,8 @@ function listPorts(machineId) {
 
 // src/commands/sync.ts
 import { existsSync as existsSync6, lstatSync, readFileSync as readFileSync5, symlinkSync, copyFileSync } from "fs";
+init_paths();
+init_db();
 function quote4(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -8023,6 +8405,8 @@ function runSync(machineId, options = {}) {
 }
 
 // src/commands/status.ts
+init_db();
+init_paths();
 function getStatus() {
   const manifest = readManifest();
   const heartbeats = listHeartbeats();
@@ -8054,8 +8438,424 @@ function getStatus() {
   };
 }
 
+// src/topology.ts
+init_db();
+import { existsSync as existsSync7 } from "fs";
+import { arch as arch2, hostname as hostname3, platform as platform3, userInfo as userInfo2 } from "os";
+import { spawnSync as spawnSync4 } from "child_process";
+init_paths();
+function normalizePlatform2(value = platform3()) {
+  const normalized = value.toLowerCase();
+  if (normalized === "darwin" || normalized === "macos")
+    return "macos";
+  if (normalized === "win32" || normalized === "windows")
+    return "windows";
+  if (normalized === "linux")
+    return "linux";
+  return value;
+}
+function defaultRunner(command) {
+  const result = spawnSync4("bash", ["-c", command], {
+    encoding: "utf8",
+    env: process.env
+  });
+  return {
+    stdout: result.stdout || "",
+    stderr: result.stderr || "",
+    exitCode: result.status ?? 1
+  };
+}
+function hasCommand2(command, runner) {
+  return runner(`command -v ${command} >/dev/null 2>&1`).exitCode === 0;
+}
+function parseTailscaleStatus(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object")
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function loadTailscalePeers(runner, warnings) {
+  const peers = new Map;
+  if (!hasCommand2("tailscale", runner)) {
+    warnings.push("tailscale_not_available");
+    return peers;
+  }
+  const result = runner("tailscale status --json");
+  if (result.exitCode !== 0) {
+    warnings.push(`tailscale_status_failed:${result.stderr.trim() || result.exitCode}`);
+    return peers;
+  }
+  const status = parseTailscaleStatus(result.stdout);
+  if (!status) {
+    warnings.push("tailscale_status_invalid_json");
+    return peers;
+  }
+  const addPeer = (peer) => {
+    if (!peer)
+      return;
+    const id = peer.HostName || peer.DNSName?.split(".")[0];
+    if (id)
+      peers.set(id, peer);
+  };
+  addPeer(status.Self);
+  for (const peer of Object.values(status.Peer ?? {}))
+    addPeer(peer);
+  return peers;
+}
+function machineKeys(machine) {
+  return [
+    machine.id,
+    machine.hostname,
+    machine.tailscaleName?.split(".")[0],
+    machine.tailscaleName,
+    machine.sshAddress?.split("@").pop()
+  ].filter((value) => Boolean(value));
+}
+function findTailscalePeer(machine, machineId, peers) {
+  if (machine) {
+    for (const key of machineKeys(machine)) {
+      const peer = peers.get(key) ?? peers.get(key.replace(/\.$/, ""));
+      if (peer)
+        return peer;
+    }
+  }
+  return peers.get(machineId) ?? null;
+}
+function routeHints(input) {
+  const hints = [];
+  if (input.machineId === input.localMachineId) {
+    hints.push({ kind: "local", target: "localhost", reachable: true });
+  }
+  if (input.manifest?.sshAddress) {
+    hints.push({ kind: "ssh", target: input.manifest.sshAddress, reachable: null });
+  }
+  if (input.manifest?.hostname) {
+    hints.push({ kind: "lan", target: input.manifest.hostname, reachable: null });
+  }
+  const tailscaleTarget = input.manifest?.tailscaleName ?? input.peer?.DNSName ?? input.peer?.TailscaleIPs?.[0];
+  if (tailscaleTarget) {
+    hints.push({ kind: "tailscale", target: tailscaleTarget.replace(/\.$/, ""), reachable: input.peer?.Online ?? null });
+  }
+  return hints;
+}
+function buildEntry(input) {
+  const manifest = input.manifest;
+  const peer = input.peer;
+  const hints = routeHints({
+    machineId: input.machineId,
+    localMachineId: input.localMachineId,
+    manifest,
+    peer
+  });
+  const selectedRoute = hints.find((hint) => hint.kind === "local") ?? hints.find((hint) => hint.kind === "ssh") ?? hints.find((hint) => hint.kind === "lan") ?? hints.find((hint) => hint.kind === "tailscale");
+  const route = selectedRoute?.kind === "ssh" ? "lan" : selectedRoute?.kind ?? "unknown";
+  return {
+    machine_id: input.machineId,
+    hostname: manifest?.hostname ?? peer?.HostName ?? null,
+    platform: manifest?.platform ?? (peer?.OS ? normalizePlatform2(peer.OS) : null),
+    os: peer?.OS ?? null,
+    user: typeof manifest?.metadata?.user === "string" ? manifest.metadata.user : null,
+    workspace_path: manifest?.workspacePath ?? null,
+    manifest_declared: Boolean(manifest),
+    heartbeat_status: input.heartbeat?.status ?? "unknown",
+    last_heartbeat_at: input.heartbeat?.updated_at ?? null,
+    tailscale: {
+      dns_name: manifest?.tailscaleName ?? peer?.DNSName?.replace(/\.$/, "") ?? null,
+      ips: peer?.TailscaleIPs ?? [],
+      online: peer?.Online ?? null,
+      active: peer?.Active ?? null,
+      last_seen: peer?.LastSeen ?? null
+    },
+    ssh: {
+      address: manifest?.sshAddress ?? null,
+      route,
+      command_target: selectedRoute?.target ?? null
+    },
+    route_hints: hints,
+    tags: manifest?.tags ?? [],
+    metadata: manifest?.metadata ?? {}
+  };
+}
+function discoverMachineTopology(options = {}) {
+  const now = options.now ?? new Date;
+  const runner = options.runner ?? defaultRunner;
+  const warnings = [];
+  const manifest = readManifest();
+  const heartbeats = listHeartbeats();
+  const heartbeatByMachine = new Map(heartbeats.map((heartbeat) => [heartbeat.machine_id, heartbeat]));
+  const localMachineId = getLocalMachineId();
+  const peers = options.includeTailscale === false ? new Map : loadTailscalePeers(runner, warnings);
+  const machineIds = new Set([
+    localMachineId,
+    ...manifest.machines.map((machine) => machine.id),
+    ...heartbeats.map((heartbeat) => heartbeat.machine_id),
+    ...peers.keys()
+  ]);
+  const manifestById = new Map(manifest.machines.map((machine) => [machine.id, machine]));
+  const machines = [...machineIds].sort().map((machineId) => {
+    const manifestMachine = manifestById.get(machineId);
+    return buildEntry({
+      machineId,
+      localMachineId,
+      manifest: manifestMachine,
+      peer: findTailscalePeer(manifestMachine ?? null, machineId, peers),
+      heartbeat: heartbeatByMachine.get(machineId)
+    });
+  });
+  return {
+    generated_at: now.toISOString(),
+    local_machine_id: localMachineId,
+    local_hostname: hostname3(),
+    current_platform: normalizePlatform2(),
+    manifest_path_known: existsSync7(getManifestPath()),
+    machines,
+    warnings
+  };
+}
+
+// src/compatibility.ts
+init_db();
+var DEFAULT_COMMANDS = [
+  { command: "bun", required: true },
+  { command: "machines", required: true }
+];
+function defaultPackages() {
+  return [{ name: "@hasna/machines", command: "machines", expectedVersion: getPackageVersion(), required: true }];
+}
+function shellQuote3(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function commandId(value) {
+  return value.replace(/[^a-zA-Z0-9_.@/-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function packageCommand(name) {
+  if (name === "@hasna/knowledge")
+    return "knowledge";
+  if (name === "@hasna/machines")
+    return "machines";
+  return name.split("/").pop() ?? name;
+}
+function firstLine(value) {
+  return value.trim().split(/\r?\n/).find(Boolean) ?? "";
+}
+function extractVersion(value) {
+  const match = value.match(/\b\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?\b/);
+  return match?.[0] ?? null;
+}
+function statusFor(required, ok) {
+  if (ok)
+    return "ok";
+  return required === false ? "warn" : "fail";
+}
+function makeCheck(input) {
+  return {
+    id: input.id,
+    kind: input.kind,
+    status: input.status,
+    target: input.target,
+    expected: input.expected ?? null,
+    actual: input.actual ?? null,
+    detail: input.detail,
+    source: input.source
+  };
+}
+function parseKeyValue(stdout) {
+  const result = {};
+  for (const line of stdout.split(/\r?\n/)) {
+    const idx = line.indexOf("=");
+    if (idx <= 0)
+      continue;
+    result[line.slice(0, idx)] = line.slice(idx + 1);
+  }
+  return result;
+}
+function defaultRunner2(machineId, command) {
+  return runMachineCommand(machineId, command);
+}
+function inspectCommand(machineId, spec, runner) {
+  const command = shellQuote3(spec.command);
+  const versionArgs = spec.versionArgs ?? "--version";
+  const script = [
+    `cmd=${command}`,
+    'path="$(command -v "$cmd" 2>/dev/null || true)"',
+    'printf "path=%s\\n" "$path"',
+    'if [ -n "$path" ]; then version="$("$cmd" ' + versionArgs + ' 2>/dev/null || true)"; printf "version=%s\\n" "$version"; fi'
+  ].join("; ");
+  const result = runner(machineId, script);
+  const parsed = parseKeyValue(result.stdout);
+  return {
+    path: parsed.path || null,
+    version: parsed.version ? firstLine(parsed.version) : null,
+    exitCode: result.exitCode,
+    source: result.source,
+    stderr: result.stderr
+  };
+}
+function fieldCommand(field) {
+  const regex = field === "name" ? String.raw`s/.*"name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p` : String.raw`s/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p`;
+  return [
+    `if command -v bun >/dev/null 2>&1; then bun -e "const p=JSON.parse(await Bun.file(process.argv[1]).text()); console.log(p.${field} ?? '')" "$pkg" 2>/dev/null`,
+    `elif command -v node >/dev/null 2>&1; then node -e "const fs=require('fs'); const p=JSON.parse(fs.readFileSync(process.argv[1], 'utf8')); console.log(p.${field} || '')" "$pkg" 2>/dev/null`,
+    `else sed -n '${regex}' "$pkg" | head -n 1`,
+    "fi"
+  ].join("; ");
+}
+function inspectWorkspace(machineId, spec, runner) {
+  const script = [
+    `path=${shellQuote3(spec.path)}`,
+    'printf "exists=%s\\n" "$(test -d "$path" && printf yes || printf no)"',
+    'pkg="$path/package.json"',
+    'printf "package_json=%s\\n" "$(test -f "$pkg" && printf yes || printf no)"',
+    `if [ -f "$pkg" ]; then printf "package_name=%s\\n" "$(${fieldCommand("name")})"; printf "version=%s\\n" "$(${fieldCommand("version")})"; fi`
+  ].join("; ");
+  const result = runner(machineId, script);
+  const parsed = parseKeyValue(result.stdout);
+  return {
+    exists: parsed.exists === "yes",
+    packageJson: parsed.package_json === "yes",
+    packageName: parsed.package_name || null,
+    version: parsed.version || null,
+    source: result.source,
+    stderr: result.stderr
+  };
+}
+function commandCheck(machineId, spec, runner) {
+  const inspection = inspectCommand(machineId, spec, runner);
+  const found = Boolean(inspection.path);
+  const checks = [
+    makeCheck({
+      id: `command:${commandId(spec.command)}:path`,
+      kind: "command",
+      status: statusFor(spec.required, found),
+      target: spec.command,
+      expected: "available",
+      actual: inspection.path ?? "missing",
+      detail: found ? `found at ${inspection.path}` : inspection.stderr || "command missing",
+      source: inspection.source
+    })
+  ];
+  if (spec.expectedVersion) {
+    const actualVersion = extractVersion(inspection.version ?? "");
+    checks.push(makeCheck({
+      id: `command:${commandId(spec.command)}:version`,
+      kind: "command",
+      status: actualVersion === spec.expectedVersion ? "ok" : statusFor(spec.required, false),
+      target: spec.command,
+      expected: spec.expectedVersion,
+      actual: actualVersion ?? inspection.version ?? "missing",
+      detail: actualVersion ? `version output: ${inspection.version}` : "version unavailable",
+      source: inspection.source
+    }));
+  }
+  return checks;
+}
+function packageCheck(machineId, spec, runner) {
+  const command = spec.command ?? packageCommand(spec.name);
+  const inspection = inspectCommand(machineId, { command, expectedVersion: spec.expectedVersion, required: spec.required }, runner);
+  const found = Boolean(inspection.path);
+  const checks = [
+    makeCheck({
+      id: `package:${commandId(spec.name)}:command`,
+      kind: "package",
+      status: statusFor(spec.required, found),
+      target: spec.name,
+      expected: command,
+      actual: inspection.path ?? "missing",
+      detail: found ? `${command} found at ${inspection.path}` : `${command} command missing`,
+      source: inspection.source
+    })
+  ];
+  if (spec.expectedVersion) {
+    const actualVersion = extractVersion(inspection.version ?? "");
+    checks.push(makeCheck({
+      id: `package:${commandId(spec.name)}:version`,
+      kind: "package",
+      status: actualVersion === spec.expectedVersion ? "ok" : statusFor(spec.required, false),
+      target: spec.name,
+      expected: spec.expectedVersion,
+      actual: actualVersion ?? inspection.version ?? "missing",
+      detail: actualVersion ? `version output: ${inspection.version}` : "version unavailable",
+      source: inspection.source
+    }));
+  }
+  return checks;
+}
+function workspaceCheck(machineId, spec, runner) {
+  const inspection = inspectWorkspace(machineId, spec, runner);
+  const target = spec.label ?? spec.path;
+  const checks = [
+    makeCheck({
+      id: `workspace:${commandId(target)}:path`,
+      kind: "workspace",
+      status: statusFor(spec.required, inspection.exists),
+      target,
+      expected: spec.path,
+      actual: inspection.exists ? "exists" : "missing",
+      detail: inspection.exists ? `workspace exists at ${spec.path}` : inspection.stderr || `workspace missing at ${spec.path}`,
+      source: inspection.source
+    })
+  ];
+  if (spec.expectedPackageName) {
+    checks.push(makeCheck({
+      id: `workspace:${commandId(target)}:package-name`,
+      kind: "workspace",
+      status: inspection.packageName === spec.expectedPackageName ? "ok" : statusFor(spec.required, false),
+      target,
+      expected: spec.expectedPackageName,
+      actual: inspection.packageName ?? (inspection.packageJson ? "missing-name" : "missing-package-json"),
+      detail: inspection.packageJson ? "package.json inspected" : "package.json missing",
+      source: inspection.source
+    }));
+  }
+  if (spec.expectedVersion) {
+    checks.push(makeCheck({
+      id: `workspace:${commandId(target)}:version`,
+      kind: "workspace",
+      status: inspection.version === spec.expectedVersion ? "ok" : statusFor(spec.required, false),
+      target,
+      expected: spec.expectedVersion,
+      actual: inspection.version ?? (inspection.packageJson ? "missing-version" : "missing-package-json"),
+      detail: inspection.packageJson ? "package.json inspected" : "package.json missing",
+      source: inspection.source
+    }));
+  }
+  return checks;
+}
+function checkMachineCompatibility(options = {}) {
+  const machineId = options.machineId ?? getLocalMachineId();
+  const runner = options.runner ?? defaultRunner2;
+  const commands = options.commands ?? DEFAULT_COMMANDS;
+  const packages = options.packages ?? defaultPackages();
+  const workspaces = options.workspaces ?? [];
+  const checks = [];
+  for (const spec of commands)
+    checks.push(...commandCheck(machineId, spec, runner));
+  for (const spec of packages)
+    checks.push(...packageCheck(machineId, spec, runner));
+  for (const spec of workspaces)
+    checks.push(...workspaceCheck(machineId, spec, runner));
+  const summary = {
+    ok: checks.filter((check) => check.status === "ok").length,
+    warn: checks.filter((check) => check.status === "warn").length,
+    fail: checks.filter((check) => check.status === "fail").length
+  };
+  return {
+    ok: summary.fail === 0,
+    machine_id: machineId,
+    source: checks[0]?.source ?? "local",
+    generated_at: (options.now ?? new Date).toISOString(),
+    checks,
+    summary
+  };
+}
+
 // src/commands/doctor.ts
-function makeCheck(id, status, summary, detail) {
+init_db();
+function makeCheck2(id, status, summary, detail) {
   return { id, status, summary, detail };
 }
 function parseKeyValueOutput(stdout) {
@@ -8087,15 +8887,15 @@ function runDoctor(machineId = getLocalMachineId()) {
   const details = parseKeyValueOutput(commandChecks.stdout);
   const machineInManifest = manifest.machines.find((machine) => machine.id === machineId);
   const checks = [
-    makeCheck("manifest-entry", machineInManifest ? "ok" : "warn", machineInManifest ? "Machine exists in manifest" : "Machine missing from manifest", machineInManifest ? JSON.stringify(machineInManifest) : `No manifest entry for ${machineId}`),
-    makeCheck("manifest-path", details["manifest_exists"] === "yes" ? "ok" : "warn", "Manifest path check", `${details["manifest_path"] || "unknown"} ${details["manifest_exists"] === "yes" ? "exists" : "missing"}`),
-    makeCheck("db-path", details["db_exists"] === "yes" ? "ok" : "warn", "DB path check", `${details["db_path"] || "unknown"} ${details["db_exists"] === "yes" ? "exists" : "missing"}`),
-    makeCheck("notifications-path", details["notifications_exists"] === "yes" ? "ok" : "warn", "Notifications path check", `${details["notifications_path"] || "unknown"} ${details["notifications_exists"] === "yes" ? "exists" : "missing"}`),
-    makeCheck("bun", details["bun"] && details["bun"] !== "missing" ? "ok" : "fail", "Bun availability", details["bun"] || "missing"),
-    makeCheck("machines-cli", details["machines"] && details["machines"] !== "missing" ? "ok" : "warn", "machines CLI availability", details["machines"] || "missing"),
-    makeCheck("machines-agent-cli", details["machines_agent"] && details["machines_agent"] !== "missing" ? "ok" : "warn", "machines-agent availability", details["machines_agent"] || "missing"),
-    makeCheck("machines-mcp-cli", details["machines_mcp"] && details["machines_mcp"] !== "missing" ? "ok" : "warn", "machines-mcp availability", details["machines_mcp"] || "missing"),
-    makeCheck("ssh", details["ssh"] === "ok" ? "ok" : "warn", "SSH availability", details["ssh"] || "missing")
+    makeCheck2("manifest-entry", machineInManifest ? "ok" : "warn", machineInManifest ? "Machine exists in manifest" : "Machine missing from manifest", machineInManifest ? JSON.stringify(machineInManifest) : `No manifest entry for ${machineId}`),
+    makeCheck2("manifest-path", details["manifest_exists"] === "yes" ? "ok" : "warn", "Manifest path check", `${details["manifest_path"] || "unknown"} ${details["manifest_exists"] === "yes" ? "exists" : "missing"}`),
+    makeCheck2("db-path", details["db_exists"] === "yes" ? "ok" : "warn", "DB path check", `${details["db_path"] || "unknown"} ${details["db_exists"] === "yes" ? "exists" : "missing"}`),
+    makeCheck2("notifications-path", details["notifications_exists"] === "yes" ? "ok" : "warn", "Notifications path check", `${details["notifications_path"] || "unknown"} ${details["notifications_exists"] === "yes" ? "exists" : "missing"}`),
+    makeCheck2("bun", details["bun"] && details["bun"] !== "missing" ? "ok" : "fail", "Bun availability", details["bun"] || "missing"),
+    makeCheck2("machines-cli", details["machines"] && details["machines"] !== "missing" ? "ok" : "warn", "machines CLI availability", details["machines"] || "missing"),
+    makeCheck2("machines-agent-cli", details["machines_agent"] && details["machines_agent"] !== "missing" ? "ok" : "warn", "machines-agent availability", details["machines_agent"] || "missing"),
+    makeCheck2("machines-mcp-cli", details["machines_mcp"] && details["machines_mcp"] !== "missing" ? "ok" : "warn", "machines-mcp availability", details["machines_mcp"] || "missing"),
+    makeCheck2("ssh", details["ssh"] === "ok" ? "ok" : "warn", "SSH availability", details["ssh"] || "missing")
   ];
   return {
     machineId,
@@ -8107,6 +8907,9 @@ function runDoctor(machineId = getLocalMachineId()) {
   };
 }
 
+// src/commands/self-test.ts
+init_db();
+
 // src/commands/serve.ts
 function escapeHtml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
@@ -8393,8 +9196,9 @@ function runSelfTest() {
 }
 
 // src/commands/clipboard.ts
+init_paths();
 import { createHash } from "crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync4 } from "fs";
 import { join as join6 } from "path";
 var DEFAULT_CONFIG = {
   version: 1,
@@ -8425,7 +9229,7 @@ function getDefaultConfig() {
 }
 function readConfig(configPath) {
   const path = resolveConfigPath(configPath);
-  if (!existsSync7(path)) {
+  if (!existsSync8(path)) {
     return getDefaultConfig();
   }
   const parsed = JSON.parse(readFileSync6(path, "utf8"));
@@ -8439,7 +9243,7 @@ function writeConfig(config, configPath) {
 }
 function readHistory(historyPath) {
   const path = resolveHistoryPath(historyPath);
-  if (!existsSync7(path)) {
+  if (!existsSync8(path)) {
     return [];
   }
   try {
@@ -8472,7 +9276,7 @@ function sanitizeClipboardForRead(content, maxSizeBytes, skipPatterns) {
 }
 function getOrCreateClipboardKey() {
   const keyPath = getClipboardKeyPath();
-  if (existsSync7(keyPath)) {
+  if (existsSync8(keyPath)) {
     return readFileSync6(keyPath, "utf8").trim();
   }
   const key = createHash("sha256").update(crypto.randomUUID()).digest("hex").slice(0, 32);
@@ -8512,7 +9316,7 @@ function addClipboardEntry(entry, historyPath) {
 }
 function clearClipboardHistory(historyPath) {
   const path = resolveHistoryPath(historyPath);
-  if (existsSync7(path)) {
+  if (existsSync8(path)) {
     rmSync(path);
   }
 }
@@ -8527,26 +9331,28 @@ function getClipboardStatus(historyPath) {
 }
 
 // src/commands/clipboard-daemon.ts
+init_paths();
 import { readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
 import { join as join7 } from "path";
 import { createHash as createHash3 } from "crypto";
 
 // src/commands/clipboard-server.ts
+init_paths();
 import { createServer } from "http";
 import { createHash as createHash2 } from "crypto";
 import { readFileSync as readFileSync7 } from "fs";
 function readLocalClipboardSync() {
-  const platform3 = process.platform;
-  if (platform3 === "darwin") {
+  const platform4 = process.platform;
+  if (platform4 === "darwin") {
     const result = Bun.spawnSync(["pbpaste"], { stdout: "pipe", stderr: "pipe" });
     return result.exitCode === 0 ? result.stdout.toString("utf8").trim() : "";
   }
-  if (platform3 === "linux") {
-    if (hasCommand2("wl-paste")) {
+  if (platform4 === "linux") {
+    if (hasCommand3("wl-paste")) {
       const result = Bun.spawnSync(["wl-paste"], { stdout: "pipe", stderr: "pipe" });
       return result.exitCode === 0 ? result.stdout.toString("utf8").trim() : "";
     }
-    if (hasCommand2("xclip")) {
+    if (hasCommand3("xclip")) {
       const result = Bun.spawnSync(["xclip", "-selection", "clipboard", "-o"], { stdout: "pipe", stderr: "pipe" });
       return result.exitCode === 0 ? result.stdout.toString("utf8").trim() : "";
     }
@@ -8555,17 +9361,17 @@ function readLocalClipboardSync() {
   return "";
 }
 function writeLocalClipboardSync(content) {
-  const platform3 = process.platform;
-  if (platform3 === "darwin") {
+  const platform4 = process.platform;
+  if (platform4 === "darwin") {
     const result = Bun.spawnSync(["pbcopy"], { stdin: new TextEncoder().encode(content), stdout: "ignore", stderr: "ignore" });
     return result.exitCode === 0;
   }
-  if (platform3 === "linux") {
-    if (hasCommand2("wl-copy")) {
+  if (platform4 === "linux") {
+    if (hasCommand3("wl-copy")) {
       const result = Bun.spawnSync(["wl-copy"], { stdin: new TextEncoder().encode(content), stdout: "ignore", stderr: "ignore" });
       return result.exitCode === 0;
     }
-    if (hasCommand2("xclip")) {
+    if (hasCommand3("xclip")) {
       const result = Bun.spawnSync(["xclip", "-selection", "clipboard"], { stdin: new TextEncoder().encode(content), stdout: "ignore", stderr: "ignore" });
       return result.exitCode === 0;
     }
@@ -8573,7 +9379,7 @@ function writeLocalClipboardSync(content) {
   }
   return false;
 }
-function hasCommand2(binary) {
+function hasCommand3(binary) {
   const result = Bun.spawnSync(["bash", "-lc", `command -v ${binary} >/dev/null 2>&1`], { stdout: "ignore", stderr: "ignore", env: process.env });
   return result.exitCode === 0;
 }
@@ -8687,17 +9493,17 @@ function handleGetClipboard(response, config) {
 // src/commands/clipboard-daemon.ts
 var DAEMON_PID_PATH = join7(getDataDir(), "clipboard-daemon.pid");
 function readLocalClipboardSync2() {
-  const platform3 = process.platform;
-  if (platform3 === "darwin") {
+  const platform4 = process.platform;
+  if (platform4 === "darwin") {
     const result = Bun.spawnSync(["pbpaste"], { stdout: "pipe", stderr: "pipe" });
     return result.exitCode === 0 ? result.stdout.toString("utf8").trim() : "";
   }
-  if (platform3 === "linux") {
-    if (hasCommand3("wl-paste")) {
+  if (platform4 === "linux") {
+    if (hasCommand4("wl-paste")) {
       const result = Bun.spawnSync(["wl-paste"], { stdout: "pipe", stderr: "pipe" });
       return result.exitCode === 0 ? result.stdout.toString("utf8").trim() : "";
     }
-    if (hasCommand3("xclip")) {
+    if (hasCommand4("xclip")) {
       const result = Bun.spawnSync(["xclip", "-selection", "clipboard", "-o"], { stdout: "pipe", stderr: "pipe" });
       return result.exitCode === 0 ? result.stdout.toString("utf8").trim() : "";
     }
@@ -8705,7 +9511,7 @@ function readLocalClipboardSync2() {
   }
   return "";
 }
-function hasCommand3(binary) {
+function hasCommand4(binary) {
   const result = Bun.spawnSync(["bash", "-lc", `command -v ${binary} >/dev/null 2>&1`], { stdout: "ignore", stderr: "ignore", env: process.env });
   return result.exitCode === 0;
 }
@@ -8857,6 +9663,500 @@ async function discoverPeers() {
   return peers;
 }
 
+// src/commands/heal.ts
+init_paths();
+import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "fs";
+import { join as join8 } from "path";
+var DEFAULT_THRESHOLDS = {
+  reconnect: 3,
+  nmRestart: 7,
+  fallback: 12,
+  reboot: 15
+};
+var DEFAULT_HEAL_CONFIG = {
+  version: 1,
+  enabled: true,
+  wifiInterface: "",
+  preferredSsid: "",
+  fallbackSsid: "",
+  internetUrl: "https://1.1.1.1",
+  tailscaleAnchors: [],
+  quorumRequired: 2,
+  intervalSec: 60,
+  thresholds: { ...DEFAULT_THRESHOLDS },
+  rebootMinIntervalSec: 1800,
+  nmRestartMinIntervalSec: 1800,
+  reconnectMinIntervalSec: 120,
+  healthyWindowSec: 300,
+  maxFailedBootRecoveries: 2,
+  bootBackoffSec: 21600,
+  fallbackWindowSec: 600,
+  gpuJobGuard: true,
+  allowReboot: true
+};
+function defaultHealState() {
+  return {
+    failCount: 0,
+    bootId: "",
+    bootHealthySince: null,
+    lastRebootAttempt: 0,
+    lastNmRestart: 0,
+    lastReconnect: 0,
+    lastFallback: 0,
+    degradedUntil: 0,
+    pendingRebootRecovery: false,
+    failedBootRecoveries: 0,
+    rebootSuppressUntil: 0
+  };
+}
+function getHealConfigPath() {
+  return process.env["HASNA_MACHINES_HEAL_CONFIG_PATH"] || join8(getDataDir(), "heal-config.json");
+}
+function getHealStatePath() {
+  return process.env["HASNA_MACHINES_HEAL_STATE_PATH"] || join8(getDataDir(), "heal-state.json");
+}
+function readHealConfig(path) {
+  const p = path || getHealConfigPath();
+  if (!existsSync9(p))
+    return { ...DEFAULT_HEAL_CONFIG, thresholds: { ...DEFAULT_THRESHOLDS } };
+  const parsed = JSON.parse(readFileSync9(p, "utf8"));
+  return {
+    ...DEFAULT_HEAL_CONFIG,
+    ...parsed,
+    thresholds: { ...DEFAULT_THRESHOLDS, ...parsed.thresholds || {} },
+    tailscaleAnchors: parsed.tailscaleAnchors ?? []
+  };
+}
+function writeHealConfig(config, path) {
+  const p = path || getHealConfigPath();
+  ensureParentDir(p);
+  writeFileSync6(p, `${JSON.stringify(config, null, 2)}
+`, "utf8");
+}
+function readHealState(path) {
+  const p = path || getHealStatePath();
+  if (!existsSync9(p))
+    return defaultHealState();
+  try {
+    return { ...defaultHealState(), ...JSON.parse(readFileSync9(p, "utf8")) };
+  } catch {
+    return defaultHealState();
+  }
+}
+function writeHealState(state, path) {
+  const p = path || getHealStatePath();
+  ensureParentDir(p);
+  writeFileSync6(p, `${JSON.stringify(state, null, 2)}
+`, "utf8");
+}
+function evaluateHealth(probe, config, state) {
+  const reasons = [];
+  const inDegraded = state.degradedUntil > 0;
+  const acceptableSsid = probe.associatedSsid === config.preferredSsid || config.fallbackSsid !== "" && inDegraded && probe.associatedSsid === config.fallbackSsid;
+  if (!acceptableSsid)
+    reasons.push(`wrong-ssid:${probe.associatedSsid ?? "none"}`);
+  if (!probe.gatewayReachable)
+    reasons.push("gateway-unreachable");
+  let remoteScore = 0;
+  for (const [anchor, ok] of Object.entries(probe.anchorsReachable)) {
+    if (ok)
+      remoteScore += 1;
+    else
+      reasons.push(`anchor-down:${anchor}`);
+  }
+  if (probe.internetReachable)
+    remoteScore += 1;
+  else
+    reasons.push("internet-down");
+  const localOk = acceptableSsid && probe.gatewayReachable;
+  const quorumOk = remoteScore >= config.quorumRequired;
+  if (!quorumOk)
+    reasons.push(`quorum:${remoteScore}/${config.quorumRequired}`);
+  return { healthy: localOk && quorumOk, remoteScore, reasons };
+}
+function decideAction(input) {
+  const { healthy, now, gpuBusy, config, currentBootId } = input;
+  const s = { ...input.state };
+  const t = config.thresholds;
+  if (s.bootId !== currentBootId) {
+    s.bootId = currentBootId;
+    s.bootHealthySince = null;
+    s.failCount = 0;
+  }
+  if (healthy) {
+    s.failCount = 0;
+    if (s.bootHealthySince === null)
+      s.bootHealthySince = now;
+    if (now - s.bootHealthySince >= config.healthyWindowSec) {
+      s.failedBootRecoveries = 0;
+      s.rebootSuppressUntil = 0;
+      s.pendingRebootRecovery = false;
+    }
+    if (s.degradedUntil > 0 && now >= s.degradedUntil) {
+      s.degradedUntil = 0;
+      return { action: "restore_preferred", state: s };
+    }
+    return { action: "none", state: s };
+  }
+  s.failCount += 1;
+  s.bootHealthySince = null;
+  let tier = "none";
+  if (s.failCount >= t.reboot)
+    tier = "reboot";
+  else if (s.failCount >= t.fallback && config.fallbackSsid !== "")
+    tier = "fallback";
+  else if (s.failCount >= t.nmRestart)
+    tier = "nmRestart";
+  else if (s.failCount >= t.reconnect)
+    tier = "reconnect";
+  const tryReconnect = (reason) => {
+    if (now - s.lastReconnect >= config.reconnectMinIntervalSec) {
+      s.lastReconnect = now;
+      return { action: "reconnect_wifi", suppressedReason: reason, state: s };
+    }
+    return { action: "none", suppressedReason: reason, state: s };
+  };
+  switch (tier) {
+    case "reconnect":
+      return tryReconnect();
+    case "nmRestart":
+      if (now - s.lastNmRestart >= config.nmRestartMinIntervalSec) {
+        s.lastNmRestart = now;
+        return { action: "restart_nm", state: s };
+      }
+      return tryReconnect();
+    case "fallback":
+      if (now - s.lastFallback >= config.fallbackWindowSec) {
+        s.lastFallback = now;
+        s.degradedUntil = now + config.fallbackWindowSec;
+        return { action: "fallback_ssid", state: s };
+      }
+      return tryReconnect();
+    case "reboot": {
+      let reason = null;
+      if (!config.allowReboot)
+        reason = "disabled";
+      else if (now < s.rebootSuppressUntil)
+        reason = "loop";
+      else if (config.gpuJobGuard && gpuBusy)
+        reason = "gpu";
+      else if (now - s.lastRebootAttempt < config.rebootMinIntervalSec)
+        reason = "rate";
+      if (reason)
+        return tryReconnect(reason);
+      if (s.pendingRebootRecovery) {
+        s.failedBootRecoveries += 1;
+        if (s.failedBootRecoveries >= config.maxFailedBootRecoveries) {
+          s.rebootSuppressUntil = now + config.bootBackoffSec;
+          return tryReconnect("loop");
+        }
+      }
+      s.lastRebootAttempt = now;
+      s.pendingRebootRecovery = true;
+      return { action: "reboot", state: s };
+    }
+    default:
+      return { action: "none", state: s };
+  }
+}
+function sh(cmd, timeoutMs = 8000) {
+  const r = Bun.spawnSync(["bash", "-c", cmd], { stdout: "pipe", stderr: "pipe", env: process.env, timeout: timeoutMs });
+  return { ok: r.exitCode === 0, out: r.stdout.toString("utf8").trim() };
+}
+function getCurrentBootId() {
+  try {
+    return readFileSync9("/proc/sys/kernel/random/boot_id", "utf8").trim();
+  } catch {
+    return "";
+  }
+}
+function detectWifiInterface() {
+  const r = sh(`nmcli -t -f DEVICE,TYPE device status 2>/dev/null | awk -F: '$2=="wifi"{print $1; exit}'`);
+  return r.ok ? r.out : "";
+}
+function detectGateway() {
+  const r = sh(`ip route 2>/dev/null | awk '/^default/{print $3; exit}'`);
+  return r.ok ? r.out : "";
+}
+function getAssociatedSsid() {
+  const r = sh(`iwgetid -r 2>/dev/null || nmcli -t -f active,ssid dev wifi 2>/dev/null | awk -F: '/^yes/{print $2; exit}'`);
+  return r.ok && r.out ? r.out : null;
+}
+function pingHost(host) {
+  if (!host)
+    return false;
+  return sh(`ping -c1 -W2 ${host} >/dev/null 2>&1`, 5000).ok;
+}
+function internetReachable(url) {
+  return sh(`curl -sf -m5 -o /dev/null ${url}`, 8000).ok;
+}
+function tailscalePing(host) {
+  return sh(`timeout 8 tailscale ping --until-direct=false ${host} 2>/dev/null | grep -q pong`, 1e4).ok;
+}
+function gpuBusy() {
+  return sh(`command -v nvidia-smi >/dev/null 2>&1 && nvidia-smi --query-compute-apps=pid --format=csv,noheader 2>/dev/null | grep -q .`, 6000).ok;
+}
+function discoverAnchors() {
+  const r = sh(`tailscale status --json 2>/dev/null`);
+  if (!r.ok)
+    return [];
+  try {
+    const status = JSON.parse(r.out);
+    const anchors = [];
+    for (const peer of Object.values(status.Peer || {})) {
+      const name = peer.HostName || (peer.DNSName || "").split(".")[0];
+      if (name)
+        anchors.push(name);
+    }
+    return anchors;
+  } catch {
+    return [];
+  }
+}
+function probeHealth(config) {
+  const gw = config.wifiInterface ? detectGateway() : detectGateway();
+  const anchors = config.tailscaleAnchors.length > 0 ? config.tailscaleAnchors : discoverAnchors().slice(0, 3);
+  const anchorsReachable = {};
+  for (const a of anchors)
+    anchorsReachable[a] = tailscalePing(a);
+  return {
+    associatedSsid: getAssociatedSsid(),
+    gatewayReachable: pingHost(gw),
+    anchorsReachable,
+    internetReachable: internetReachable(config.internetUrl)
+  };
+}
+function executeAction(action, config) {
+  const iface = config.wifiInterface || detectWifiInterface();
+  switch (action) {
+    case "reconnect_wifi":
+      sh(`nmcli connection up "${config.preferredSsid}" 2>&1; tailscale up 2>&1 || true`, 30000);
+      return `reconnected wifi to ${config.preferredSsid}`;
+    case "restart_nm":
+      sh(`systemctl restart NetworkManager 2>&1; sleep 5; nmcli connection up "${config.preferredSsid}" 2>&1; tailscale up 2>&1 || true`, 40000);
+      return "restarted NetworkManager";
+    case "fallback_ssid":
+      sh(`nmcli connection modify "${config.fallbackSsid}" connection.autoconnect yes 2>&1; nmcli connection up "${config.fallbackSsid}" 2>&1; tailscale up 2>&1 || true`, 30000);
+      return `switched to degraded fallback ${config.fallbackSsid}`;
+    case "restore_preferred":
+      sh(`nmcli connection modify "${config.fallbackSsid}" connection.autoconnect no 2>&1; nmcli connection up "${config.preferredSsid}" 2>&1; tailscale up 2>&1 || true`, 30000);
+      return `restored preferred ${config.preferredSsid}`;
+    case "reboot":
+      sh(`systemctl reboot 2>&1 || reboot 2>&1`, 1e4);
+      return "reboot issued";
+    default:
+      return "no action";
+  }
+}
+
+// src/commands/heal-daemon.ts
+init_paths();
+import { existsSync as existsSync10, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "fs";
+import { join as join9 } from "path";
+var DAEMON_PID_PATH2 = join9(getDataDir(), "heal-daemon.pid");
+var SERVICE_PATH = "/etc/systemd/system/machines-heal.service";
+var SYSTEM_CONF = "/etc/systemd/system.conf";
+function log(msg) {
+  console.log(`${new Date().toISOString()} [machines-heal] ${msg}`);
+}
+function runHealOnce(config, opts = {}) {
+  const state = readHealState();
+  const probe = probeHealth(config);
+  const health = evaluateHealth(probe, config, state);
+  const busy = config.gpuJobGuard ? gpuBusy() : false;
+  const decision = decideAction({
+    state,
+    healthy: health.healthy,
+    now: Math.floor(Date.now() / 1000),
+    gpuBusy: busy,
+    config,
+    currentBootId: getCurrentBootId()
+  });
+  let executed = "skipped (dry-run)";
+  if (!opts.dryRun) {
+    writeHealState(decision.state);
+    if (decision.action !== "none")
+      executed = executeAction(decision.action, config);
+    else
+      executed = "no action";
+  }
+  const result = {
+    healthy: health.healthy,
+    action: decision.action,
+    suppressedReason: decision.suppressedReason,
+    reasons: health.reasons,
+    remoteScore: health.remoteScore,
+    failCount: decision.state.failCount,
+    executed
+  };
+  const sup = decision.suppressedReason ? ` suppressed=${decision.suppressedReason}` : "";
+  log(health.healthy ? `healthy (quorum ${health.remoteScore}) action=${decision.action} ${executed}` : `UNHEALTHY [${health.reasons.join(",")}] fails=${decision.state.failCount} action=${decision.action}${sup} -> ${executed}`);
+  return result;
+}
+function writePid2(pid) {
+  writeFileSync7(DAEMON_PID_PATH2, `${pid}
+`);
+}
+function readPid2() {
+  try {
+    const pid = Number.parseInt(readFileSync10(DAEMON_PID_PATH2, "utf8").trim());
+    return Number.isFinite(pid) ? pid : null;
+  } catch {
+    return null;
+  }
+}
+function isProcessRunning2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function stopHealDaemon() {
+  const pid = readPid2();
+  if (pid && isProcessRunning2(pid)) {
+    process.kill(pid, "SIGTERM");
+    return { stopped: true, pid };
+  }
+  return { stopped: false, pid };
+}
+function startHealDaemon() {
+  const config = readHealConfig();
+  if (!config.preferredSsid) {
+    log("refusing to start: preferredSsid is not configured (run `machines heal config --set ...`)");
+    process.exit(1);
+  }
+  writePid2(process.pid);
+  log(`daemon started (pid ${process.pid}) interval=${config.intervalSec}s preferred=${config.preferredSsid}`);
+  const tick = () => {
+    try {
+      runHealOnce(config);
+    } catch (err) {
+      log(`tick error: ${err.message}`);
+    }
+  };
+  tick();
+  setInterval(tick, Math.max(10, config.intervalSec) * 1000);
+}
+function sh2(cmd, timeoutMs = 15000) {
+  const r = Bun.spawnSync(["bash", "-c", cmd], { stdout: "pipe", stderr: "pipe", env: process.env, timeout: timeoutMs });
+  return { ok: r.exitCode === 0, out: `${r.stdout.toString("utf8")}${r.stderr.toString("utf8")}`.trim() };
+}
+function applyDeterminism(config) {
+  const iface = config.wifiInterface || detectWifiInterface();
+  const log2 = [];
+  if (!config.preferredSsid)
+    return ["no preferredSsid configured; skipping determinism"];
+  sh2(`nmcli connection modify "${config.preferredSsid}" connection.autoconnect yes connection.autoconnect-priority 10 802-11-wireless.powersave 2`);
+  log2.push(`pinned ${config.preferredSsid} (autoconnect, priority 10, powersave off)`);
+  const profiles = sh2(`nmcli -t -f NAME,TYPE connection show 2>/dev/null | awk -F: '$2 ~ /wireless/{print $1}'`).out.split(`
+`).filter(Boolean);
+  for (const p of profiles) {
+    if (p === config.preferredSsid)
+      continue;
+    if (p === config.fallbackSsid) {
+      sh2(`nmcli connection modify "${p}" connection.autoconnect no`);
+      log2.push(`disabled autoconnect on fallback ${p}`);
+      continue;
+    }
+    sh2(`nmcli connection modify "${p}" connection.autoconnect no`);
+    log2.push(`disabled autoconnect on ${p}`);
+  }
+  if (iface) {
+    sh2(`iw dev ${iface} set power_save off 2>/dev/null || true`);
+    log2.push(`power_save off on ${iface}`);
+  }
+  return log2;
+}
+function enableHardwareWatchdog() {
+  const log2 = [];
+  if (!existsSync10(SYSTEM_CONF))
+    return ["/etc/systemd/system.conf not found; skipping hardware watchdog"];
+  let conf = readFileSync10(SYSTEM_CONF, "utf8");
+  const set = (key, value) => {
+    const re = new RegExp(`^#?\\s*${key}=.*$`, "m");
+    if (re.test(conf))
+      conf = conf.replace(re, `${key}=${value}`);
+    else
+      conf += `
+${key}=${value}
+`;
+  };
+  set("RuntimeWatchdogSec", "20s");
+  set("RebootWatchdogSec", "2min");
+  writeFileSync7(SYSTEM_CONF, conf);
+  sh2("systemctl daemon-reexec");
+  log2.push("hardware watchdog: RuntimeWatchdogSec=20s RebootWatchdogSec=2min");
+  return log2;
+}
+function binPath() {
+  const candidates = [];
+  const which = sh2("command -v machines").out.split(`
+`)[0]?.trim();
+  if (which)
+    candidates.push(which);
+  if (process.argv[1])
+    candidates.push(process.argv[1]);
+  const home = process.env["HOME"] || "/home/hasna";
+  candidates.push(`${home}/.bun/bin/machines`, "/home/hasna/.bun/bin/machines", "/root/.bun/bin/machines", "/usr/local/bin/machines");
+  for (const c of candidates) {
+    if (c && existsSync10(c))
+      return c;
+  }
+  return "machines";
+}
+var ROOT_DATA_DIR = "/etc/machines-heal";
+function installHealService() {
+  const log2 = [];
+  const exec = binPath();
+  const binDir = exec.includes("/") ? exec.slice(0, exec.lastIndexOf("/")) : "/usr/local/bin";
+  const unit = `[Unit]
+Description=Hasna machines self-healing network watchdog
+After=network.target NetworkManager.service tailscaled.service
+Wants=network.target
+
+[Service]
+Type=simple
+ExecStart=${exec} heal daemon
+Restart=always
+RestartSec=10
+Environment=HOME=/root
+Environment=HASNA_MACHINES_DIR=${ROOT_DATA_DIR}
+Environment=PATH=${binDir}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+[Install]
+WantedBy=multi-user.target
+`;
+  writeFileSync7(SERVICE_PATH, unit);
+  sh2("systemctl daemon-reload");
+  sh2("systemctl enable --now machines-heal.service");
+  log2.push(`installed + enabled ${SERVICE_PATH} (ExecStart=${exec} heal daemon)`);
+  return log2;
+}
+function uninstallHealService() {
+  const log2 = [];
+  sh2("systemctl disable --now machines-heal.service 2>/dev/null || true");
+  if (existsSync10(SERVICE_PATH)) {
+    sh2(`rm -f ${SERVICE_PATH}`);
+    sh2("systemctl daemon-reload");
+    log2.push(`removed ${SERVICE_PATH}`);
+  } else {
+    log2.push("service not installed");
+  }
+  return log2;
+}
+function healServiceStatus() {
+  return {
+    installed: existsSync10(SERVICE_PATH),
+    active: sh2("systemctl is-active machines-heal.service").out === "active",
+    enabled: sh2("systemctl is-enabled machines-heal.service 2>/dev/null").out === "enabled"
+  };
+}
+
+// src/cli/index.ts
+init_paths();
+
 // src/cli-utils.ts
 function parseIntegerOption(value, label, constraints = {}) {
   const parsed = Number.parseInt(value, 10);
@@ -8888,7 +10188,7 @@ ${items.map((item) => `- ${item}`).join(`
 
 // src/cli/index.ts
 import { rmSync as rmSync2 } from "fs";
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 var program2 = new Command;
 function printJsonOrText(data, text, json = false) {
   if (json || program2.opts().quiet) {
@@ -8897,6 +10197,22 @@ function printJsonOrText(data, text, json = false) {
   }
   console.log(text);
 }
+function printStorageResults(results, json) {
+  if (json) {
+    console.log(JSON.stringify(results, null, 2));
+    return;
+  }
+  for (const result of results) {
+    const marker = result.errors.length > 0 ? source_default.red("!") : source_default.green("\u2713");
+    const suffix = result.errors.length > 0 ? `  ${source_default.red(result.errors.join("; "))}` : "";
+    console.log(`${marker} ${result.table}: read ${result.rowsRead}, wrote ${result.rowsWritten}${suffix}`);
+  }
+}
+function printStorageError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  console.error(source_default.red(message));
+  process.exit(1);
+}
 function renderAppsListResult(result) {
   return [
     `machine: ${result.machineId}`,
@@ -8979,6 +10295,49 @@ function renderSelfTestResult(result) {
   ].join(`
 `);
 }
+function parseCommandSpec(value) {
+  const [command, expectedVersion] = value.split(":");
+  return {
+    command,
+    expectedVersion: expectedVersion || undefined,
+    required: true
+  };
+}
+function parsePackageSpec(value) {
+  const [name, command, expectedVersion] = value.split(":");
+  return {
+    name,
+    command: command || undefined,
+    expectedVersion: expectedVersion || undefined,
+    required: true
+  };
+}
+function parseWorkspaceSpec(value) {
+  const [label, path] = value.includes("=") ? value.split(/=(.*)/s).filter(Boolean) : ["workspace", value];
+  return {
+    label,
+    path,
+    required: true
+  };
+}
+function renderCompatibilityCheck(check2) {
+  const marker = check2.status === "ok" ? source_default.green("\u2713") : check2.status === "warn" ? source_default.yellow("!") : source_default.red("\u2717");
+  const expected = check2.expected ? ` expected=${check2.expected}` : "";
+  return `${marker} ${check2.id} ${check2.actual ?? "unknown"}${expected}`;
+}
+function renderCompatibilityResult(result) {
+  return [
+    renderKeyValueTable([
+      ["machine", result.machine_id],
+      ["source", result.source],
+      ["ok", String(result.ok)],
+      ["checks", `${result.summary.ok} ok, ${result.summary.warn} warn, ${result.summary.fail} fail`]
+    ]),
+    "",
+    ...result.checks.map(renderCompatibilityCheck)
+  ].join(`
+`);
+}
 function renderFleetStatus(status) {
   return [
     renderKeyValueTable([
@@ -9035,7 +10394,7 @@ manifestCommand.command("add").description("Add or replace a machine in the flee
       console.error("error: --from-stdin requires piped input");
       process.exit(1);
     }
-    const input = readFileSync9(0, "utf8");
+    const input = readFileSync11(0, "utf8");
     const machine2 = JSON.parse(input);
     console.log(JSON.stringify(manifestAdd(machine2), null, 2));
     return;
@@ -9100,6 +10459,35 @@ program2.command("sync").description("Reconcile a machine against the fleet mani
   const result = options.apply ? runSync(options.machine, { apply: true, yes: options.yes }) : buildSyncPlan(options.machine);
   console.log(JSON.stringify(result, null, 2));
 });
+program2.command("topology").description("Discover local, manifest, heartbeat, SSH, and Tailscale machine topology").option("--no-tailscale", "Skip tailscale status probing").option("-j, --json", "Print JSON output", false).action((options) => {
+  const topology = discoverMachineTopology({ includeTailscale: options.tailscale !== false });
+  if (options.json) {
+    console.log(JSON.stringify(topology, null, 2));
+    return;
+  }
+  console.log(renderKeyValueTable([
+    ["local machine", topology.local_machine_id],
+    ["hostname", topology.local_hostname],
+    ["platform", String(topology.current_platform)],
+    ["machines", String(topology.machines.length)],
+    ["warnings", topology.warnings.join(", ") || "none"]
+  ]));
+  for (const machine of topology.machines) {
+    const route = machine.ssh.command_target ? `${machine.ssh.route}:${machine.ssh.command_target}` : machine.ssh.route;
+    console.log(`${machine.machine_id.padEnd(18)} ${String(machine.platform || "unknown").padEnd(8)} ${machine.heartbeat_status.padEnd(8)} ${route}`);
+  }
+});
+program2.command("compatibility").description("Check remote package, command, and workspace compatibility for open-* consumers").option("--machine <id>", "Machine identifier").option("--command <command...>", "Required command or command:expectedVersion").option("--package <spec...>", "Required package as name[:command[:expectedVersion]]").option("--workspace <spec...>", "Required workspace as label=/path or /path").option("-j, --json", "Print JSON output", false).action((options) => {
+  const result = checkMachineCompatibility({
+    machineId: options.machine,
+    commands: options.command?.map(parseCommandSpec),
+    packages: options.package?.map(parsePackageSpec),
+    workspaces: options.workspace?.map(parseWorkspaceSpec)
+  });
+  printJsonOrText(result, renderCompatibilityResult(result), options.json);
+  if (!result.ok && !options.json)
+    process.exitCode = 1;
+});
 program2.command("diff").description("Show manifest differences between two machines").requiredOption("--left <id>", "Left machine identifier").option("--right <id>", "Right machine identifier (defaults to current machine)").option("-j, --json", "Print JSON output", false).action((options) => {
   const result = diffMachines(options.left, options.right);
   console.log(JSON.stringify(result, null, 2));
@@ -9253,6 +10641,51 @@ program2.command("ports").description("List listening ports on a machine").optio
   const result = listPorts(options.machine);
   console.log(JSON.stringify(result, null, 2));
 });
+var storageCommand = program2.command("storage").description("Sync local machine runtime data with storage PostgreSQL");
+storageCommand.command("status").description("Show storage sync status").option("-j, --json", "Print JSON output", false).action(async (options) => {
+  const { getStorageStatus: getStorageStatus2 } = await Promise.resolve().then(() => (init_storage(), exports_storage));
+  const status = getStorageStatus2();
+  printJsonOrText(status, renderKeyValueTable([
+    ["mode", status.mode],
+    ["configured", status.configured ? "yes" : "no"],
+    ["active env", status.activeEnv || "none"],
+    ["tables", status.tables.join(", ")]
+  ]), options.json);
+});
+storageCommand.command("push").description("Push local machine runtime data to storage PostgreSQL").option("--tables <tables>", "Comma-separated table names").option("-j, --json", "Print JSON output", false).action(async (options) => {
+  try {
+    const { parseStorageTables: parseStorageTables2, storagePush: storagePush2 } = await Promise.resolve().then(() => (init_storage(), exports_storage));
+    const results = await storagePush2({ tables: parseStorageTables2(options.tables) });
+    printStorageResults(results, options.json);
+  } catch (error) {
+    printStorageError(error);
+  }
+});
+storageCommand.command("pull").description("Pull machine runtime data from storage PostgreSQL to local SQLite").option("--tables <tables>", "Comma-separated table names").option("-j, --json", "Print JSON output", false).action(async (options) => {
+  try {
+    const { parseStorageTables: parseStorageTables2, storagePull: storagePull2 } = await Promise.resolve().then(() => (init_storage(), exports_storage));
+    const results = await storagePull2({ tables: parseStorageTables2(options.tables) });
+    printStorageResults(results, options.json);
+  } catch (error) {
+    printStorageError(error);
+  }
+});
+storageCommand.command("sync").description("Bidirectional storage sync: pull then push").option("--tables <tables>", "Comma-separated table names").option("-j, --json", "Print JSON output", false).action(async (options) => {
+  try {
+    const { parseStorageTables: parseStorageTables2, storageSync: storageSync2 } = await Promise.resolve().then(() => (init_storage(), exports_storage));
+    const result = await storageSync2({ tables: parseStorageTables2(options.tables) });
+    if (options.json) {
+      console.log(JSON.stringify(result, null, 2));
+      return;
+    }
+    console.log(source_default.bold("Pull"));
+    printStorageResults(result.pull);
+    console.log(source_default.bold("Push"));
+    printStorageResults(result.push);
+  } catch (error) {
+    printStorageError(error);
+  }
+});
 program2.command("status").description("Print local machine and storage status").option("-j, --json", "Print JSON output", false).action((options) => {
   const status = getStatus();
   printJsonOrText(status, renderFleetStatus(status), options.json);
@@ -9274,4 +10707,98 @@ program2.command("serve").description("Serve a local fleet dashboard and JSON AP
   const server = startDashboardServer({ host: info.host, port: info.port });
   console.log(source_default.green(`machines dashboard listening on http://${server.hostname}:${server.port}`));
 });
+var healCommand = program2.command("heal").description("Self-healing network watchdog: keeps a Wi-Fi node reachable (SSID pinning + peer-reachability + gated reboot)");
+function requireRoot() {
+  const uid = process.getuid ? process.getuid() : 1;
+  if (uid !== 0) {
+    console.error(source_default.red("error: this command must run as root (try: sudo machines heal install)"));
+    return false;
+  }
+  return true;
+}
+healCommand.command("config").description(`View or update self-healing config (e.g. --set '{"preferredSsid":"X81ND","fallbackSsid":"DIGI-s2N5"}')`).option("--set <json>", "Merge a JSON object into the config").option("-j, --json", "Print JSON output", false).action((options) => {
+  if (options.set) {
+    const current = readHealConfig();
+    const partial = JSON.parse(options.set);
+    writeHealConfig({
+      ...current,
+      ...partial,
+      thresholds: { ...current.thresholds, ...partial.thresholds || {} }
+    });
+  }
+  const config = readHealConfig();
+  printJsonOrText(config, renderKeyValueTable([
+    ["enabled", String(config.enabled)],
+    ["preferredSsid", config.preferredSsid || source_default.yellow("(unset)")],
+    ["fallbackSsid", config.fallbackSsid || "(none)"],
+    ["anchors", config.tailscaleAnchors.length ? config.tailscaleAnchors.join(", ") : "(auto-discover)"],
+    ["quorumRequired", String(config.quorumRequired)],
+    ["intervalSec", String(config.intervalSec)],
+    ["thresholds", `reconnect=${config.thresholds.reconnect} nm=${config.thresholds.nmRestart} fallback=${config.thresholds.fallback} reboot=${config.thresholds.reboot}`],
+    ["allowReboot", String(config.allowReboot)],
+    ["gpuJobGuard", String(config.gpuJobGuard)]
+  ]), options.json);
+});
+healCommand.command("check").description("Run one health + decision tick read-only (no side effects)").option("-j, --json", "Print JSON output", false).action((options) => {
+  const result = runHealOnce(readHealConfig(), { dryRun: true });
+  printJsonOrText(result, renderList("heal check", [
+    `health: ${result.healthy ? source_default.green("HEALTHY") : source_default.red("UNHEALTHY")} (remote quorum ${result.remoteScore})`,
+    `reasons: ${result.reasons.length ? result.reasons.join(", ") : "none"}`,
+    `would do: ${result.action}${result.suppressedReason ? ` (reboot suppressed: ${result.suppressedReason})` : ""}`,
+    `consecutive fails: ${result.failCount}`
+  ]), options.json);
+});
+healCommand.command("status").description("Show watchdog service status and last persisted state").option("-j, --json", "Print JSON output", false).action((options) => {
+  const svc = healServiceStatus();
+  const state = readHealState();
+  const config = readHealConfig();
+  printJsonOrText({ service: svc, state, config }, renderKeyValueTable([
+    ["service installed", svc.installed ? source_default.green("yes") : "no"],
+    ["service active", svc.active ? source_default.green("yes") : source_default.yellow("no")],
+    ["service enabled", svc.enabled ? "yes" : "no"],
+    ["preferredSsid", config.preferredSsid || source_default.yellow("(unset)")],
+    ["consecutive fails", String(state.failCount)],
+    ["pending reboot recovery", String(state.pendingRebootRecovery)],
+    ["failed boot recoveries", String(state.failedBootRecoveries)]
+  ]), options.json);
+});
+healCommand.command("daemon").description("Run the watchdog loop in the foreground (used by systemd)").action(() => {
+  startHealDaemon();
+});
+healCommand.command("stop").description("Stop a foreground daemon started via `heal daemon`").action(() => {
+  const r = stopHealDaemon();
+  console.log(r.stopped ? `stopped heal daemon (pid ${r.pid})` : "heal daemon not running");
+});
+healCommand.command("determinism").description("Pin the preferred SSID, disable other autoconnects, turn off Wi-Fi power save").action(() => {
+  const log2 = applyDeterminism(readHealConfig());
+  console.log(renderList("determinism", log2));
+});
+healCommand.command("install").description("Install the watchdog: determinism + hardware watchdog + systemd service (requires root)").option("--no-determinism", "Skip SSID pinning / power-save changes").option("--no-watchdog", "Skip enabling the systemd hardware watchdog").option("--no-service", "Skip installing the systemd service").action((options) => {
+  if (!requireRoot()) {
+    process.exitCode = 1;
+    return;
+  }
+  const config = readHealConfig();
+  if (!config.preferredSsid) {
+    console.error(source_default.red(`error: set preferredSsid first: machines heal config --set '{"preferredSsid":"X81ND"}'`));
+    process.exitCode = 1;
+    return;
+  }
+  const out = [];
+  if (options.determinism !== false)
+    out.push(...applyDeterminism(config));
+  if (options.watchdog !== false)
+    out.push(...enableHardwareWatchdog());
+  if (options.service !== false)
+    out.push(...installHealService());
+  console.log(renderList("install", out));
+  console.log(source_default.green("self-healing watchdog installed"));
+});
+healCommand.command("uninstall").description("Remove the systemd watchdog service (requires root)").action(() => {
+  if (!requireRoot()) {
+    process.exitCode = 1;
+    return;
+  }
+  console.log(renderList("uninstall", uninstallHealService()));
+});
 await program2.parseAsync(process.argv);