@hasna/machines 0.0.14 → 0.0.15

package/dist/mcp/index.js

@@ -16,11 +16,30 @@ var __export = (target, all) => {
 };
 
 // src/mcp/index.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { dirname as dirname4, join as join6 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
+// src/version.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+function getPackageVersion() {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const candidates = [join(here, "..", "package.json"), join(here, "..", "..", "package.json")];
+    const pkgPath = candidates.find((candidate) => existsSync(candidate));
+    if (!pkgPath) {
+      return "0.0.0";
+    }
+    return JSON.parse(readFileSync(pkgPath, "utf8")).version || "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+
+// src/mcp/http.ts
+import { createServer } from "http";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
@@ -3999,20 +4018,20 @@ var coerce = {
 var NEVER = INVALID;
 // src/commands/backup.ts
 import { homedir } from "os";
-import { join } from "path";
+import { join as join2 } from "path";
 function quote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function defaultBackupSources() {
   const home = homedir();
   return [
-    join(home, ".hasna"),
-    join(home, ".ssh"),
-    join(home, ".secrets")
+    join2(home, ".hasna"),
+    join2(home, ".ssh"),
+    join2(home, ".secrets")
   ];
 }
 function buildBackupPlan(bucket, prefix = "machines") {
-  const archivePath = join(homedir(), ".hasna", "machines", "backup.tgz");
+  const archivePath = join2(homedir(), ".hasna", "machines", "backup.tgz");
   const sources = defaultBackupSources();
   const steps = [
     {
@@ -4063,33 +4082,33 @@ function runBackup(bucket, prefix = "machines", options = {}) {
 }
 
 // src/manifests.ts
-import { existsSync as existsSync2, readFileSync, writeFileSync } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync } from "fs";
 import { arch, homedir as homedir2, hostname, platform, userInfo } from "os";
-import { dirname as dirname2 } from "path";
+import { dirname as dirname3 } from "path";
 
 // src/paths.ts
-import { existsSync, mkdirSync } from "fs";
-import { dirname, join as join2, resolve } from "path";
+import { existsSync as existsSync2, mkdirSync } from "fs";
+import { dirname as dirname2, join as join3, resolve } from "path";
 function homeDir() {
   return process.env["HOME"] || process.env["USERPROFILE"] || "~";
 }
 function getDataDir() {
-  return process.env["HASNA_MACHINES_DIR"] || join2(homeDir(), ".hasna", "machines");
+  return process.env["HASNA_MACHINES_DIR"] || join3(homeDir(), ".hasna", "machines");
 }
 function getDbPath() {
-  return process.env["HASNA_MACHINES_DB_PATH"] || join2(getDataDir(), "machines.db");
+  return process.env["HASNA_MACHINES_DB_PATH"] || join3(getDataDir(), "machines.db");
 }
 function getManifestPath() {
-  return process.env["HASNA_MACHINES_MANIFEST_PATH"] || join2(getDataDir(), "machines.json");
+  return process.env["HASNA_MACHINES_MANIFEST_PATH"] || join3(getDataDir(), "machines.json");
 }
 function getNotificationsPath() {
-  return process.env["HASNA_MACHINES_NOTIFICATIONS_PATH"] || join2(getDataDir(), "notifications.json");
+  return process.env["HASNA_MACHINES_NOTIFICATIONS_PATH"] || join3(getDataDir(), "notifications.json");
 }
 function ensureParentDir(filePath) {
   if (filePath === ":memory:")
     return;
-  const dir = dirname(resolve(filePath));
-  if (!existsSync(dir)) {
+  const dir = dirname2(resolve(filePath));
+  if (!existsSync2(dir)) {
     mkdirSync(dir, { recursive: true });
   }
 }
@@ -4154,10 +4173,10 @@ function getDefaultManifest() {
   };
 }
 function readManifest(path = getManifestPath()) {
-  if (!existsSync2(path)) {
+  if (!existsSync3(path)) {
     return getDefaultManifest();
   }
-  const raw = JSON.parse(readFileSync(path, "utf8"));
+  const raw = JSON.parse(readFileSync2(path, "utf8"));
   return fleetSchema.parse(raw);
 }
 function validateManifest(path = getManifestPath()) {
@@ -4181,7 +4200,7 @@ function getManifestMachine(machineId, path = getManifestPath()) {
 function detectCurrentMachineManifest() {
   const machineId = process.env["HASNA_MACHINES_MACHINE_ID"] || hostname();
   const user = userInfo().username;
-  const bunDir = dirname2(process.execPath);
+  const bunDir = dirname3(process.execPath);
   return {
     id: machineId,
     hostname: hostname(),
@@ -4348,7 +4367,7 @@ function runMachineCommand(machineId, command) {
   const isLocal = machineId === localMachineId;
   const route = isLocal ? "local" : resolveSshTarget(machineId).route;
   const shellCommand = isLocal ? command : buildSshCommand(machineId, command);
-  const result = spawnSync2("bash", ["-lc", shellCommand], {
+  const result = spawnSync2("bash", ["-c", shellCommand], {
     encoding: "utf8",
     env: process.env
   });
@@ -4501,20 +4520,20 @@ function runAppsInstall(machineId, options = {}) {
 
 // src/commands/cert.ts
 import { homedir as homedir3, platform as platform2 } from "os";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function quote2(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function certDir() {
-  return join3(homedir3(), ".hasna", "machines", "certs");
+  return join4(homedir3(), ".hasna", "machines", "certs");
 }
 function buildCertPlan(domains) {
   if (domains.length === 0) {
     throw new Error("At least one domain is required.");
   }
   const primary = domains[0];
-  const certPath = join3(certDir(), `${primary}.pem`);
-  const keyPath = join3(certDir(), `${primary}-key.pem`);
+  const certPath = join4(certDir(), `${primary}.pem`);
+  const keyPath = join4(certDir(), `${primary}-key.pem`);
   const steps = [];
   if (platform2() === "darwin") {
     steps.push({
@@ -4578,16 +4597,16 @@ function runCertPlan(domains, options = {}) {
 }
 
 // src/commands/dns.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { join as join5 } from "path";
 function getDnsPath() {
-  return join4(getDataDir(), "dns.json");
+  return join5(getDataDir(), "dns.json");
 }
 function readMappings() {
   const path = getDnsPath();
-  if (!existsSync3(path))
+  if (!existsSync4(path))
     return [];
-  return JSON.parse(readFileSync2(path, "utf8"));
+  return JSON.parse(readFileSync3(path, "utf8"));
 }
 function writeMappings(mappings) {
   const path = getDnsPath();
@@ -4614,10 +4633,10 @@ function renderDomainMapping(domain) {
     hostsEntry: `${entry.targetHost} ${entry.domain}`,
     caddySnippet: `${entry.domain} {
   reverse_proxy 127.0.0.1:${entry.port}
-  tls ${join4(getDataDir(), "certs", `${entry.domain}.pem`)} ${join4(getDataDir(), "certs", `${entry.domain}-key.pem`)}
+  tls ${join5(getDataDir(), "certs", `${entry.domain}.pem`)} ${join5(getDataDir(), "certs", `${entry.domain}-key.pem`)}
 }`,
-    certPath: join4(getDataDir(), "certs", `${entry.domain}.pem`),
-    keyPath: join4(getDataDir(), "certs", `${entry.domain}-key.pem`)
+    certPath: join5(getDataDir(), "certs", `${entry.domain}.pem`),
+    keyPath: join5(getDataDir(), "certs", `${entry.domain}-key.pem`)
   };
 }
 
@@ -4889,7 +4908,7 @@ function runTailscaleInstall(machineId, options = {}) {
 }
 
 // src/commands/notifications.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 var notificationChannelSchema = exports_external.object({
   id: exports_external.string(),
   type: exports_external.enum(["email", "webhook", "command"]),
@@ -5045,10 +5064,10 @@ function getDefaultNotificationConfig() {
   };
 }
 function readNotificationConfig(path = getNotificationsPath()) {
-  if (!existsSync4(path)) {
+  if (!existsSync5(path)) {
     return getDefaultNotificationConfig();
   }
-  return notificationConfigSchema.parse(JSON.parse(readFileSync3(path, "utf8")));
+  return notificationConfigSchema.parse(JSON.parse(readFileSync4(path, "utf8")));
 }
 function writeNotificationConfig(config, path = getNotificationsPath()) {
   ensureParentDir(path);
@@ -5220,24 +5239,6 @@ function manifestValidate() {
   return validateManifest(getManifestPath());
 }
 
-// src/version.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname3, join as join5 } from "path";
-import { fileURLToPath } from "url";
-function getPackageVersion() {
-  try {
-    const here = dirname3(fileURLToPath(import.meta.url));
-    const candidates = [join5(here, "..", "package.json"), join5(here, "..", "..", "package.json")];
-    const pkgPath = candidates.find((candidate) => existsSync5(candidate));
-    if (!pkgPath) {
-      return "0.0.0";
-    }
-    return JSON.parse(readFileSync4(pkgPath, "utf8")).version || "0.0.0";
-  } catch {
-    return "0.0.0";
-  }
-}
-
 // src/commands/status.ts
 function getStatus() {
   const manifest = readManifest();
@@ -5756,7 +5757,742 @@ function getAgentStatus(machineId = getLocalMachineId()) {
   }));
 }
 
+// src/topology.ts
+import { existsSync as existsSync7 } from "fs";
+import { arch as arch2, hostname as hostname3, platform as platform3, userInfo as userInfo2 } from "os";
+import { spawnSync as spawnSync4 } from "child_process";
+function normalizePlatform2(value = platform3()) {
+  const normalized = value.toLowerCase();
+  if (normalized === "darwin" || normalized === "macos")
+    return "macos";
+  if (normalized === "win32" || normalized === "windows")
+    return "windows";
+  if (normalized === "linux")
+    return "linux";
+  return value;
+}
+function defaultRunner(command) {
+  const result = spawnSync4("bash", ["-c", command], {
+    encoding: "utf8",
+    env: process.env
+  });
+  return {
+    stdout: result.stdout || "",
+    stderr: result.stderr || "",
+    exitCode: result.status ?? 1
+  };
+}
+function hasCommand2(command, runner) {
+  return runner(`command -v ${command} >/dev/null 2>&1`).exitCode === 0;
+}
+function parseTailscaleStatus(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object")
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function loadTailscalePeers(runner, warnings) {
+  const peers = new Map;
+  if (!hasCommand2("tailscale", runner)) {
+    warnings.push("tailscale_not_available");
+    return peers;
+  }
+  const result = runner("tailscale status --json");
+  if (result.exitCode !== 0) {
+    warnings.push(`tailscale_status_failed:${result.stderr.trim() || result.exitCode}`);
+    return peers;
+  }
+  const status = parseTailscaleStatus(result.stdout);
+  if (!status) {
+    warnings.push("tailscale_status_invalid_json");
+    return peers;
+  }
+  const addPeer = (peer) => {
+    if (!peer)
+      return;
+    const id = peer.HostName || peer.DNSName?.split(".")[0];
+    if (id)
+      peers.set(id, peer);
+  };
+  addPeer(status.Self);
+  for (const peer of Object.values(status.Peer ?? {}))
+    addPeer(peer);
+  return peers;
+}
+function machineKeys(machine) {
+  return [
+    machine.id,
+    machine.hostname,
+    machine.tailscaleName?.split(".")[0],
+    machine.tailscaleName,
+    machine.sshAddress?.split("@").pop()
+  ].filter((value) => Boolean(value));
+}
+function findTailscalePeer(machine, machineId, peers) {
+  if (machine) {
+    for (const key of machineKeys(machine)) {
+      const peer = peers.get(key) ?? peers.get(key.replace(/\.$/, ""));
+      if (peer)
+        return peer;
+    }
+  }
+  return peers.get(machineId) ?? null;
+}
+function routeHints(input) {
+  const hints = [];
+  if (input.machineId === input.localMachineId) {
+    hints.push({ kind: "local", target: "localhost", reachable: true });
+  }
+  if (input.manifest?.sshAddress) {
+    hints.push({ kind: "ssh", target: input.manifest.sshAddress, reachable: null });
+  }
+  if (input.manifest?.hostname) {
+    hints.push({ kind: "lan", target: input.manifest.hostname, reachable: null });
+  }
+  const tailscaleTarget = input.manifest?.tailscaleName ?? input.peer?.DNSName ?? input.peer?.TailscaleIPs?.[0];
+  if (tailscaleTarget) {
+    hints.push({ kind: "tailscale", target: tailscaleTarget.replace(/\.$/, ""), reachable: input.peer?.Online ?? null });
+  }
+  return hints;
+}
+function buildEntry(input) {
+  const manifest = input.manifest;
+  const peer = input.peer;
+  const hints = routeHints({
+    machineId: input.machineId,
+    localMachineId: input.localMachineId,
+    manifest,
+    peer
+  });
+  const selectedRoute = hints.find((hint) => hint.kind === "local") ?? hints.find((hint) => hint.kind === "ssh") ?? hints.find((hint) => hint.kind === "lan") ?? hints.find((hint) => hint.kind === "tailscale");
+  const route = selectedRoute?.kind === "ssh" ? "lan" : selectedRoute?.kind ?? "unknown";
+  return {
+    machine_id: input.machineId,
+    hostname: manifest?.hostname ?? peer?.HostName ?? null,
+    platform: manifest?.platform ?? (peer?.OS ? normalizePlatform2(peer.OS) : null),
+    os: peer?.OS ?? null,
+    user: typeof manifest?.metadata?.user === "string" ? manifest.metadata.user : null,
+    workspace_path: manifest?.workspacePath ?? null,
+    manifest_declared: Boolean(manifest),
+    heartbeat_status: input.heartbeat?.status ?? "unknown",
+    last_heartbeat_at: input.heartbeat?.updated_at ?? null,
+    tailscale: {
+      dns_name: manifest?.tailscaleName ?? peer?.DNSName?.replace(/\.$/, "") ?? null,
+      ips: peer?.TailscaleIPs ?? [],
+      online: peer?.Online ?? null,
+      active: peer?.Active ?? null,
+      last_seen: peer?.LastSeen ?? null
+    },
+    ssh: {
+      address: manifest?.sshAddress ?? null,
+      route,
+      command_target: selectedRoute?.target ?? null
+    },
+    route_hints: hints,
+    tags: manifest?.tags ?? [],
+    metadata: manifest?.metadata ?? {}
+  };
+}
+function discoverMachineTopology(options = {}) {
+  const now = options.now ?? new Date;
+  const runner = options.runner ?? defaultRunner;
+  const warnings = [];
+  const manifest = readManifest();
+  const heartbeats = listHeartbeats();
+  const heartbeatByMachine = new Map(heartbeats.map((heartbeat) => [heartbeat.machine_id, heartbeat]));
+  const localMachineId = getLocalMachineId();
+  const peers = options.includeTailscale === false ? new Map : loadTailscalePeers(runner, warnings);
+  const machineIds = new Set([
+    localMachineId,
+    ...manifest.machines.map((machine) => machine.id),
+    ...heartbeats.map((heartbeat) => heartbeat.machine_id),
+    ...peers.keys()
+  ]);
+  const manifestById = new Map(manifest.machines.map((machine) => [machine.id, machine]));
+  const machines = [...machineIds].sort().map((machineId) => {
+    const manifestMachine = manifestById.get(machineId);
+    return buildEntry({
+      machineId,
+      localMachineId,
+      manifest: manifestMachine,
+      peer: findTailscalePeer(manifestMachine ?? null, machineId, peers),
+      heartbeat: heartbeatByMachine.get(machineId)
+    });
+  });
+  return {
+    generated_at: now.toISOString(),
+    local_machine_id: localMachineId,
+    local_hostname: hostname3(),
+    current_platform: normalizePlatform2(),
+    manifest_path_known: existsSync7(getManifestPath()),
+    machines,
+    warnings
+  };
+}
+
+// src/compatibility.ts
+var DEFAULT_COMMANDS = [
+  { command: "bun", required: true },
+  { command: "machines", required: true }
+];
+function defaultPackages() {
+  return [{ name: "@hasna/machines", command: "machines", expectedVersion: getPackageVersion(), required: true }];
+}
+function shellQuote3(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function commandId(value) {
+  return value.replace(/[^a-zA-Z0-9_.@/-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function packageCommand(name) {
+  if (name === "@hasna/knowledge")
+    return "knowledge";
+  if (name === "@hasna/machines")
+    return "machines";
+  return name.split("/").pop() ?? name;
+}
+function firstLine(value) {
+  return value.trim().split(/\r?\n/).find(Boolean) ?? "";
+}
+function extractVersion(value) {
+  const match = value.match(/\b\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?\b/);
+  return match?.[0] ?? null;
+}
+function statusFor(required, ok) {
+  if (ok)
+    return "ok";
+  return required === false ? "warn" : "fail";
+}
+function makeCheck2(input) {
+  return {
+    id: input.id,
+    kind: input.kind,
+    status: input.status,
+    target: input.target,
+    expected: input.expected ?? null,
+    actual: input.actual ?? null,
+    detail: input.detail,
+    source: input.source
+  };
+}
+function parseKeyValue(stdout) {
+  const result = {};
+  for (const line of stdout.split(/\r?\n/)) {
+    const idx = line.indexOf("=");
+    if (idx <= 0)
+      continue;
+    result[line.slice(0, idx)] = line.slice(idx + 1);
+  }
+  return result;
+}
+function defaultRunner2(machineId, command) {
+  return runMachineCommand(machineId, command);
+}
+function inspectCommand(machineId, spec, runner) {
+  const command = shellQuote3(spec.command);
+  const versionArgs = spec.versionArgs ?? "--version";
+  const script = [
+    `cmd=${command}`,
+    'path="$(command -v "$cmd" 2>/dev/null || true)"',
+    'printf "path=%s\\n" "$path"',
+    'if [ -n "$path" ]; then version="$("$cmd" ' + versionArgs + ' 2>/dev/null || true)"; printf "version=%s\\n" "$version"; fi'
+  ].join("; ");
+  const result = runner(machineId, script);
+  const parsed = parseKeyValue(result.stdout);
+  return {
+    path: parsed.path || null,
+    version: parsed.version ? firstLine(parsed.version) : null,
+    exitCode: result.exitCode,
+    source: result.source,
+    stderr: result.stderr
+  };
+}
+function fieldCommand(field) {
+  const regex = field === "name" ? String.raw`s/.*"name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p` : String.raw`s/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p`;
+  return [
+    `if command -v bun >/dev/null 2>&1; then bun -e "const p=JSON.parse(await Bun.file(process.argv[1]).text()); console.log(p.${field} ?? '')" "$pkg" 2>/dev/null`,
+    `elif command -v node >/dev/null 2>&1; then node -e "const fs=require('fs'); const p=JSON.parse(fs.readFileSync(process.argv[1], 'utf8')); console.log(p.${field} || '')" "$pkg" 2>/dev/null`,
+    `else sed -n '${regex}' "$pkg" | head -n 1`,
+    "fi"
+  ].join("; ");
+}
+function inspectWorkspace(machineId, spec, runner) {
+  const script = [
+    `path=${shellQuote3(spec.path)}`,
+    'printf "exists=%s\\n" "$(test -d "$path" && printf yes || printf no)"',
+    'pkg="$path/package.json"',
+    'printf "package_json=%s\\n" "$(test -f "$pkg" && printf yes || printf no)"',
+    `if [ -f "$pkg" ]; then printf "package_name=%s\\n" "$(${fieldCommand("name")})"; printf "version=%s\\n" "$(${fieldCommand("version")})"; fi`
+  ].join("; ");
+  const result = runner(machineId, script);
+  const parsed = parseKeyValue(result.stdout);
+  return {
+    exists: parsed.exists === "yes",
+    packageJson: parsed.package_json === "yes",
+    packageName: parsed.package_name || null,
+    version: parsed.version || null,
+    source: result.source,
+    stderr: result.stderr
+  };
+}
+function commandCheck(machineId, spec, runner) {
+  const inspection = inspectCommand(machineId, spec, runner);
+  const found = Boolean(inspection.path);
+  const checks = [
+    makeCheck2({
+      id: `command:${commandId(spec.command)}:path`,
+      kind: "command",
+      status: statusFor(spec.required, found),
+      target: spec.command,
+      expected: "available",
+      actual: inspection.path ?? "missing",
+      detail: found ? `found at ${inspection.path}` : inspection.stderr || "command missing",
+      source: inspection.source
+    })
+  ];
+  if (spec.expectedVersion) {
+    const actualVersion = extractVersion(inspection.version ?? "");
+    checks.push(makeCheck2({
+      id: `command:${commandId(spec.command)}:version`,
+      kind: "command",
+      status: actualVersion === spec.expectedVersion ? "ok" : statusFor(spec.required, false),
+      target: spec.command,
+      expected: spec.expectedVersion,
+      actual: actualVersion ?? inspection.version ?? "missing",
+      detail: actualVersion ? `version output: ${inspection.version}` : "version unavailable",
+      source: inspection.source
+    }));
+  }
+  return checks;
+}
+function packageCheck(machineId, spec, runner) {
+  const command = spec.command ?? packageCommand(spec.name);
+  const inspection = inspectCommand(machineId, { command, expectedVersion: spec.expectedVersion, required: spec.required }, runner);
+  const found = Boolean(inspection.path);
+  const checks = [
+    makeCheck2({
+      id: `package:${commandId(spec.name)}:command`,
+      kind: "package",
+      status: statusFor(spec.required, found),
+      target: spec.name,
+      expected: command,
+      actual: inspection.path ?? "missing",
+      detail: found ? `${command} found at ${inspection.path}` : `${command} command missing`,
+      source: inspection.source
+    })
+  ];
+  if (spec.expectedVersion) {
+    const actualVersion = extractVersion(inspection.version ?? "");
+    checks.push(makeCheck2({
+      id: `package:${commandId(spec.name)}:version`,
+      kind: "package",
+      status: actualVersion === spec.expectedVersion ? "ok" : statusFor(spec.required, false),
+      target: spec.name,
+      expected: spec.expectedVersion,
+      actual: actualVersion ?? inspection.version ?? "missing",
+      detail: actualVersion ? `version output: ${inspection.version}` : "version unavailable",
+      source: inspection.source
+    }));
+  }
+  return checks;
+}
+function workspaceCheck(machineId, spec, runner) {
+  const inspection = inspectWorkspace(machineId, spec, runner);
+  const target = spec.label ?? spec.path;
+  const checks = [
+    makeCheck2({
+      id: `workspace:${commandId(target)}:path`,
+      kind: "workspace",
+      status: statusFor(spec.required, inspection.exists),
+      target,
+      expected: spec.path,
+      actual: inspection.exists ? "exists" : "missing",
+      detail: inspection.exists ? `workspace exists at ${spec.path}` : inspection.stderr || `workspace missing at ${spec.path}`,
+      source: inspection.source
+    })
+  ];
+  if (spec.expectedPackageName) {
+    checks.push(makeCheck2({
+      id: `workspace:${commandId(target)}:package-name`,
+      kind: "workspace",
+      status: inspection.packageName === spec.expectedPackageName ? "ok" : statusFor(spec.required, false),
+      target,
+      expected: spec.expectedPackageName,
+      actual: inspection.packageName ?? (inspection.packageJson ? "missing-name" : "missing-package-json"),
+      detail: inspection.packageJson ? "package.json inspected" : "package.json missing",
+      source: inspection.source
+    }));
+  }
+  if (spec.expectedVersion) {
+    checks.push(makeCheck2({
+      id: `workspace:${commandId(target)}:version`,
+      kind: "workspace",
+      status: inspection.version === spec.expectedVersion ? "ok" : statusFor(spec.required, false),
+      target,
+      expected: spec.expectedVersion,
+      actual: inspection.version ?? (inspection.packageJson ? "missing-version" : "missing-package-json"),
+      detail: inspection.packageJson ? "package.json inspected" : "package.json missing",
+      source: inspection.source
+    }));
+  }
+  return checks;
+}
+function checkMachineCompatibility(options = {}) {
+  const machineId = options.machineId ?? getLocalMachineId();
+  const runner = options.runner ?? defaultRunner2;
+  const commands = options.commands ?? DEFAULT_COMMANDS;
+  const packages = options.packages ?? defaultPackages();
+  const workspaces = options.workspaces ?? [];
+  const checks = [];
+  for (const spec of commands)
+    checks.push(...commandCheck(machineId, spec, runner));
+  for (const spec of packages)
+    checks.push(...packageCheck(machineId, spec, runner));
+  for (const spec of workspaces)
+    checks.push(...workspaceCheck(machineId, spec, runner));
+  const summary = {
+    ok: checks.filter((check2) => check2.status === "ok").length,
+    warn: checks.filter((check2) => check2.status === "warn").length,
+    fail: checks.filter((check2) => check2.status === "fail").length
+  };
+  return {
+    ok: summary.fail === 0,
+    machine_id: machineId,
+    source: checks[0]?.source ?? "local",
+    generated_at: (options.now ?? new Date).toISOString(),
+    checks,
+    summary
+  };
+}
+
+// src/pg-migrations.ts
+var PG_MIGRATIONS = [
+  `
+  CREATE TABLE IF NOT EXISTS agent_heartbeats (
+    machine_id TEXT NOT NULL,
+    pid INTEGER NOT NULL,
+    status TEXT NOT NULL,
+    updated_at TIMESTAMPTZ NOT NULL,
+    PRIMARY KEY (machine_id, pid)
+  );
+
+  CREATE TABLE IF NOT EXISTS setup_runs (
+    id TEXT PRIMARY KEY,
+    machine_id TEXT NOT NULL,
+    status TEXT NOT NULL,
+    details_json TEXT NOT NULL DEFAULT '[]',
+    created_at TIMESTAMPTZ NOT NULL,
+    updated_at TIMESTAMPTZ NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS sync_runs (
+    id TEXT PRIMARY KEY,
+    machine_id TEXT NOT NULL,
+    status TEXT NOT NULL,
+    actions_json TEXT NOT NULL DEFAULT '[]',
+    created_at TIMESTAMPTZ NOT NULL,
+    updated_at TIMESTAMPTZ NOT NULL
+  );
+  `
+];
+
+// src/remote-storage.ts
+import pg from "pg";
+function translatePlaceholders(sql) {
+  let index = 0;
+  return sql.replace(/\?/g, () => `$${++index}`);
+}
+function normalizeParams(params) {
+  const flat = params.length === 1 && Array.isArray(params[0]) ? params[0] : params;
+  return flat.map((value) => value === undefined ? null : value);
+}
+function sslConfigFor(connectionString) {
+  return connectionString.includes("sslmode=require") || connectionString.includes("ssl=true") ? { rejectUnauthorized: false } : undefined;
+}
+
+class PgAdapterAsync {
+  pool;
+  constructor(connectionString) {
+    this.pool = new pg.Pool({ connectionString, ssl: sslConfigFor(connectionString) });
+  }
+  async run(sql, ...params) {
+    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
+    return { changes: result.rowCount ?? 0 };
+  }
+  async all(sql, ...params) {
+    const result = await this.pool.query(translatePlaceholders(sql), normalizeParams(params));
+    return result.rows;
+  }
+  async close() {
+    await this.pool.end();
+  }
+}
+
+// src/storage-sync.ts
+var STORAGE_TABLES = [
+  "agent_heartbeats",
+  "setup_runs",
+  "sync_runs"
+];
+var MACHINES_STORAGE_ENV = "HASNA_MACHINES_DATABASE_URL";
+var MACHINES_STORAGE_FALLBACK_ENV = "MACHINES_DATABASE_URL";
+var MACHINES_STORAGE_MODE_ENV = "HASNA_MACHINES_STORAGE_MODE";
+var MACHINES_STORAGE_MODE_FALLBACK_ENV = "MACHINES_STORAGE_MODE";
+var STORAGE_DATABASE_ENV = [MACHINES_STORAGE_ENV, MACHINES_STORAGE_FALLBACK_ENV];
+var PRIMARY_KEYS = {
+  agent_heartbeats: ["machine_id", "pid"],
+  setup_runs: ["id"],
+  sync_runs: ["id"]
+};
+function readEnv(name) {
+  const value = process.env[name]?.trim();
+  return value || undefined;
+}
+function normalizeStorageMode(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (normalized === "local" || normalized === "hybrid" || normalized === "remote")
+    return normalized;
+  return;
+}
+function getStorageDatabaseEnvName() {
+  for (const name of STORAGE_DATABASE_ENV) {
+    if (readEnv(name))
+      return name;
+  }
+  return null;
+}
+function getStorageDatabaseEnv() {
+  const name = getStorageDatabaseEnvName();
+  return name ? { name } : null;
+}
+function getStorageDatabaseUrl() {
+  const env = getStorageDatabaseEnv();
+  return env ? readEnv(env.name) ?? null : null;
+}
+function getStorageMode() {
+  const mode = normalizeStorageMode(readEnv(MACHINES_STORAGE_MODE_ENV)) ?? normalizeStorageMode(readEnv(MACHINES_STORAGE_MODE_FALLBACK_ENV));
+  if (mode)
+    return mode;
+  return getStorageDatabaseUrl() ? "hybrid" : "local";
+}
+async function getStoragePg() {
+  const url = getStorageDatabaseUrl();
+  if (!url) {
+    throw new Error("Missing HASNA_MACHINES_DATABASE_URL or MACHINES_DATABASE_URL");
+  }
+  return new PgAdapterAsync(url);
+}
+async function runStorageMigrations(remote) {
+  for (const sql of PG_MIGRATIONS)
+    await remote.run(sql);
+}
+async function storagePush(options) {
+  const remote = await getStoragePg();
+  const db = getDb();
+  try {
+    await runStorageMigrations(remote);
+    const results = [];
+    for (const table of resolveTables(options?.tables)) {
+      results.push(await pushTable(db, remote, table));
+    }
+    recordSyncMeta(db, "push", results);
+    return results;
+  } finally {
+    await remote.close();
+  }
+}
+async function storagePull(options) {
+  const remote = await getStoragePg();
+  const db = getDb();
+  try {
+    await runStorageMigrations(remote);
+    const results = [];
+    for (const table of resolveTables(options?.tables)) {
+      results.push(await pullTable(remote, db, table));
+    }
+    recordSyncMeta(db, "pull", results);
+    return results;
+  } finally {
+    await remote.close();
+  }
+}
+async function storageSync(options) {
+  const pull = await storagePull(options);
+  const push = await storagePush(options);
+  return { pull, push };
+}
+function getSyncMetaAll() {
+  const db = getDb();
+  ensureSyncMetaTable(db);
+  return db.query("SELECT table_name, last_synced_at, direction FROM _machines_sync_meta ORDER BY table_name, direction").all();
+}
+function getStorageStatus() {
+  const activeEnv = getStorageDatabaseEnv();
+  return {
+    configured: Boolean(activeEnv),
+    mode: getStorageMode(),
+    env: STORAGE_DATABASE_ENV,
+    activeEnv: activeEnv?.name ?? null,
+    service: "machines",
+    tables: STORAGE_TABLES,
+    sync: getSyncMetaAll()
+  };
+}
+function resolveTables(tables) {
+  if (!tables || tables.length === 0)
+    return [...STORAGE_TABLES];
+  const allowed = new Set(STORAGE_TABLES);
+  const requested = tables.map((table) => table.trim()).filter(Boolean);
+  const invalid = requested.filter((table) => !allowed.has(table));
+  if (invalid.length > 0)
+    throw new Error(`Unknown machines storage table(s): ${invalid.join(", ")}`);
+  return requested;
+}
+async function pushTable(db, remote, table) {
+  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
+  try {
+    if (!tableExists(db, table))
+      return result;
+    const rows = db.query(`SELECT * FROM ${quoteIdent(table)}`).all();
+    result.rowsRead = rows.length;
+    if (rows.length === 0)
+      return result;
+    const remoteColumns = await getRemoteColumns(remote, table);
+    const columns = filterRemoteColumns(remoteColumns, Object.keys(rows[0]));
+    result.rowsWritten = await upsertPg(remote, table, columns, rows);
+  } catch (error) {
+    result.errors.push(error instanceof Error ? error.message : String(error));
+  }
+  return result;
+}
+async function pullTable(remote, db, table) {
+  const result = { table, rowsRead: 0, rowsWritten: 0, errors: [] };
+  try {
+    if (!tableExists(db, table))
+      return result;
+    const rows = await remote.all(`SELECT * FROM ${quoteIdent(table)}`);
+    result.rowsRead = rows.length;
+    if (rows.length === 0)
+      return result;
+    const columns = filterLocalColumns(db, table, Object.keys(rows[0]));
+    result.rowsWritten = upsertSqlite(db, table, columns, rows);
+  } catch (error) {
+    result.errors.push(error instanceof Error ? error.message : String(error));
+  }
+  return result;
+}
+async function getRemoteColumns(remote, table) {
+  const rows = await remote.all("SELECT column_name FROM information_schema.columns WHERE table_schema = 'public' AND table_name = ?", table);
+  return new Set(rows.map((row) => row.column_name));
+}
+function filterRemoteColumns(remoteColumns, columns) {
+  if (remoteColumns.size === 0)
+    return columns;
+  return columns.filter((column) => remoteColumns.has(column));
+}
+function filterLocalColumns(db, table, columns) {
+  const rows = db.query(`PRAGMA table_info(${quoteIdent(table)})`).all();
+  const allowed = new Set(rows.map((row) => row.name));
+  return columns.filter((column) => allowed.has(column));
+}
+async function upsertPg(remote, table, columns, rows) {
+  if (columns.length === 0)
+    return 0;
+  const primaryKeys = PRIMARY_KEYS[table];
+  const columnList = columns.map(quoteIdent).join(", ");
+  const placeholders = columns.map(() => "?").join(", ");
+  const keyList = primaryKeys.map(quoteIdent).join(", ");
+  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
+  const fallbackKey = primaryKeys[0];
+  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = EXCLUDED.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = EXCLUDED.${quoteIdent(fallbackKey)}`;
+  for (const row of rows) {
+    await remote.run(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders})
+       ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`, ...columns.map((column) => coerceForPg(row[column])));
+  }
+  return rows.length;
+}
+function upsertSqlite(db, table, columns, rows) {
+  if (columns.length === 0)
+    return 0;
+  const primaryKeys = PRIMARY_KEYS[table];
+  const columnList = columns.map(quoteIdent).join(", ");
+  const placeholders = columns.map(() => "?").join(", ");
+  const keyList = primaryKeys.map(quoteIdent).join(", ");
+  const updateColumns = columns.filter((column) => !primaryKeys.includes(column));
+  const fallbackKey = primaryKeys[0];
+  const setClause = updateColumns.length > 0 ? updateColumns.map((column) => `${quoteIdent(column)} = excluded.${quoteIdent(column)}`).join(", ") : `${quoteIdent(fallbackKey)} = excluded.${quoteIdent(fallbackKey)}`;
+  const statement = db.query(`INSERT INTO ${quoteIdent(table)} (${columnList}) VALUES (${placeholders})
+     ON CONFLICT (${keyList}) DO UPDATE SET ${setClause}`);
+  const insert = db.transaction((batch) => {
+    for (const row of batch)
+      statement.run(...columns.map((column) => coerceForSqlite(row[column])));
+  });
+  insert(rows);
+  return rows.length;
+}
+function recordSyncMeta(db, direction, results) {
+  ensureSyncMetaTable(db);
+  const now = new Date().toISOString();
+  const statement = db.query(`
+    INSERT INTO _machines_sync_meta (table_name, last_synced_at, direction)
+    VALUES (?, ?, ?)
+    ON CONFLICT(table_name, direction) DO UPDATE SET last_synced_at = excluded.last_synced_at
+  `);
+  for (const result of results) {
+    if (result.errors.length > 0)
+      continue;
+    statement.run(result.table, now, direction);
+  }
+}
+function ensureSyncMetaTable(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS _machines_sync_meta (
+      table_name TEXT NOT NULL,
+      last_synced_at TEXT,
+      direction TEXT NOT NULL CHECK(direction IN ('push', 'pull')),
+      PRIMARY KEY (table_name, direction)
+    )
+  `);
+}
+function tableExists(db, table) {
+  const row = db.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?").get(table);
+  return Boolean(row);
+}
+function quoteIdent(identifier) {
+  return `"${identifier.replace(/"/g, '""')}"`;
+}
+function coerceForPg(value) {
+  if (value === undefined || value === null)
+    return null;
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array)
+    return value;
+  if (typeof value === "object")
+    return JSON.stringify(value);
+  return value;
+}
+function coerceForSqlite(value) {
+  if (value === undefined || value === null)
+    return null;
+  if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean")
+    return value;
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array)
+    return value;
+  if (typeof value === "object")
+    return JSON.stringify(value);
+  return String(value);
+}
 // src/mcp/server.ts
+function buildServer(version = getPackageVersion()) {
+  return createMcpServer(version);
+}
 function createMcpServer(version) {
   const server = new McpServer({ name: "machines", version });
   server.tool("machines_status", "Return local machine fleet status paths and machine identity.", {}, async () => ({
@@ -5789,6 +6525,33 @@ function createMcpServer(version) {
   server.tool("machines_setup_apply", "Execute setup actions for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier"), yes: exports_external.boolean().describe("Confirmation flag for execution") }, async ({ machine_id, yes }) => ({ content: [{ type: "text", text: JSON.stringify(runSetup(machine_id, { apply: true, yes }), null, 2) }] }));
   server.tool("machines_sync_preview", "Preview sync actions for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({ content: [{ type: "text", text: JSON.stringify(buildSyncPlan(machine_id), null, 2) }] }));
   server.tool("machines_sync_apply", "Execute sync actions for a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier"), yes: exports_external.boolean().describe("Confirmation flag for execution") }, async ({ machine_id, yes }) => ({ content: [{ type: "text", text: JSON.stringify(runSync(machine_id, { apply: true, yes }), null, 2) }] }));
+  server.tool("machines_topology", "Discover local, manifest, heartbeat, SSH, and Tailscale machine topology.", { include_tailscale: exports_external.boolean().optional().describe("Whether to probe tailscale status --json") }, async ({ include_tailscale }) => ({
+    content: [{ type: "text", text: JSON.stringify(discoverMachineTopology({ includeTailscale: include_tailscale !== false }), null, 2) }]
+  }));
+  server.tool("machines_compatibility", "Check remote package, command, and workspace compatibility for open-* consumers.", {
+    machine_id: exports_external.string().optional().describe("Machine identifier"),
+    commands: exports_external.array(exports_external.object({
+      command: exports_external.string(),
+      expectedVersion: exports_external.string().optional(),
+      versionArgs: exports_external.string().optional(),
+      required: exports_external.boolean().optional()
+    })).optional().describe("Commands to check"),
+    packages: exports_external.array(exports_external.object({
+      name: exports_external.string(),
+      command: exports_external.string().optional(),
+      expectedVersion: exports_external.string().optional(),
+      required: exports_external.boolean().optional()
+    })).optional().describe("Package-backed CLI checks"),
+    workspaces: exports_external.array(exports_external.object({
+      path: exports_external.string(),
+      label: exports_external.string().optional(),
+      expectedPackageName: exports_external.string().optional(),
+      expectedVersion: exports_external.string().optional(),
+      required: exports_external.boolean().optional()
+    })).optional().describe("Workspace paths and package metadata to check")
+  }, async ({ machine_id, commands, packages, workspaces }) => ({
+    content: [{ type: "text", text: JSON.stringify(checkMachineCompatibility({ machineId: machine_id, commands, packages, workspaces }), null, 2) }]
+  }));
   server.tool("machines_diff", "Show manifest differences between two machines.", {
     left_machine_id: exports_external.string().describe("Left machine identifier"),
     right_machine_id: exports_external.string().optional().describe("Right machine identifier")
@@ -5850,24 +6613,116 @@ function createMcpServer(version) {
   server.tool("machines_serve_dashboard", "Render the current dashboard HTML.", {}, async () => ({
     content: [{ type: "text", text: renderDashboardHtml() }]
   }));
+  server.tool("storage_status", "Show machines storage sync configuration and local sync history.", {}, async () => ({
+    content: [{ type: "text", text: JSON.stringify(getStorageStatus(), null, 2) }]
+  }));
+  server.tool("storage_push", "Push local machine runtime data to storage PostgreSQL.", { tables: exports_external.array(exports_external.string()).optional().describe("Optional table list to push") }, async ({ tables }) => ({ content: [{ type: "text", text: JSON.stringify(await storagePush(tables ? { tables } : undefined), null, 2) }] }));
+  server.tool("storage_pull", "Pull machine runtime data from storage PostgreSQL to local SQLite.", { tables: exports_external.array(exports_external.string()).optional().describe("Optional table list to pull") }, async ({ tables }) => ({ content: [{ type: "text", text: JSON.stringify(await storagePull(tables ? { tables } : undefined), null, 2) }] }));
+  server.tool("storage_sync", "Bidirectional machines storage sync: pull then push.", { tables: exports_external.array(exports_external.string()).optional().describe("Optional table list to sync") }, async ({ tables }) => ({ content: [{ type: "text", text: JSON.stringify(await storageSync(tables ? { tables } : undefined), null, 2) }] }));
   return server;
 }
 
-// src/mcp/index.ts
-function getPkgVersion() {
+// src/mcp/http.ts
+var DEFAULT_HTTP_PORT = 8821;
+var HTTP_NAME = "machines";
+function isHttpMode(args = process.argv.slice(2)) {
+  return args.includes("--http") || process.env.MCP_HTTP === "1";
+}
+function resolveHttpPort(args = process.argv.slice(2)) {
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--port" && args[i + 1]) {
+      return parsePort(args[i + 1]);
+    }
+    if (arg.startsWith("--port=")) {
+      return parsePort(arg.slice("--port=".length));
+    }
+  }
+  const envPort = process.env.MCP_HTTP_PORT;
+  if (envPort) {
+    return parsePort(envPort);
+  }
+  return DEFAULT_HTTP_PORT;
+}
+function parsePort(raw) {
+  const port = Number.parseInt(raw, 10);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error(`Invalid port: ${raw}`);
+  }
+  return port;
+}
+function pathnameFromRequest(req) {
+  return new URL(req.url ?? "/", "http://127.0.0.1").pathname;
+}
+async function readRequestBody(req) {
+  if (req.method !== "POST" && req.method !== "DELETE") {
+    return;
+  }
+  const chunks = [];
+  for await (const chunk of req) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  const text = Buffer.concat(chunks).toString("utf8");
+  if (!text) {
+    return;
+  }
+  return JSON.parse(text);
+}
+async function handleMcpRequest(req, res) {
+  const server = buildServer();
+  const transport = new StreamableHTTPServerTransport({
+    sessionIdGenerator: undefined
+  });
+  await server.connect(transport);
   try {
-    const pkgPath = join6(dirname4(fileURLToPath2(import.meta.url)), "..", "..", "package.json");
-    return JSON.parse(readFileSync6(pkgPath, "utf8")).version || "0.0.0";
-  } catch {
-    return "0.0.0";
+    const body = await readRequestBody(req);
+    await transport.handleRequest(req, res, body);
+  } finally {
+    res.on("close", () => {
+      transport.close().catch(() => {
+        return;
+      });
+      server.close().catch(() => {
+        return;
+      });
+    });
   }
 }
+function startHttpServer(options = {}) {
+  const host = options.host ?? "127.0.0.1";
+  const port = options.port ?? resolveHttpPort();
+  const name = options.name ?? HTTP_NAME;
+  const httpServer = createServer(async (req, res) => {
+    const path = pathnameFromRequest(req);
+    if (req.method === "GET" && path === "/health") {
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ status: "ok", name }));
+      return;
+    }
+    if (path === "/mcp") {
+      await handleMcpRequest(req, res);
+      return;
+    }
+    res.writeHead(404, { "content-type": "application/json" });
+    res.end(JSON.stringify({ error: "Not found" }));
+  });
+  httpServer.listen(port, host, () => {
+    const address = httpServer.address();
+    const boundPort = typeof address === "object" && address ? address.port : port;
+    console.error(`machines-mcp HTTP listening on http://${host}:${boundPort}`);
+  });
+  return httpServer;
+}
+
+// src/mcp/index.ts
 function printHelp() {
   console.log(`Usage: machines-mcp [options]
 
-MCP server for machine fleet management tools (stdio transport)
+MCP server for machine fleet management tools (stdio transport by default)
 
 Options:
+  --http         Start Streamable HTTP transport on 127.0.0.1 (or MCP_HTTP=1)
+  --port <n>     HTTP port (default: 8821, or MCP_HTTP_PORT env)
   -V, --version  output the version number
   -h, --help     display help for command`);
 }
@@ -5877,9 +6732,13 @@ if (args.includes("--help") || args.includes("-h")) {
   process.exit(0);
 }
 if (args.includes("--version") || args.includes("-V")) {
-  console.log(getPkgVersion());
+  console.log(getPackageVersion());
   process.exit(0);
 }
-var server = createMcpServer(getPkgVersion());
-var transport = new StdioServerTransport;
-await server.connect(transport);
+if (isHttpMode(args)) {
+  startHttpServer({ port: resolveHttpPort(args) });
+} else {
+  const server = buildServer();
+  const transport = new StdioServerTransport;
+  await server.connect(transport);
+}