@hasna/machines 0.0.18 → 0.0.19

package/dist/consumer.js

@@ -4212,6 +4212,7 @@ var machineSchema = exports_external.object({
   workspacePath: exports_external.string(),
   bunPath: exports_external.string().optional(),
   tags: exports_external.array(exports_external.string()).optional(),
+  metadata: exports_external.record(exports_external.unknown()).optional(),
   packages: exports_external.array(packageSchema).optional(),
   apps: exports_external.array(appSchema).optional(),
   files: exports_external.array(fileSchema).optional()
@@ -4514,7 +4515,8 @@ function discoverMachineTopology(options = {}) {
       topology: true,
       compatibility: true,
       route_resolution: true,
-      cli_json_fallback: true
+      cli_json_fallback: true,
+      workspace_path_mapping: true
     },
     generated_at: now.toISOString(),
     local_machine_id: localMachineId,
@@ -4639,6 +4641,215 @@ function resolveMachineRoute(machineId, options = {}) {
     warnings
   };
 }
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function metadataString(metadata, keys) {
+  for (const key of keys) {
+    const value = metadata[key];
+    if (typeof value === "string" && value.trim())
+      return value.trim();
+  }
+  return null;
+}
+function metadataBoolean(metadata, keys) {
+  for (const key of keys) {
+    const value = metadata[key];
+    if (typeof value === "boolean")
+      return value;
+  }
+  return null;
+}
+function metadataStringArray(metadata, keys) {
+  for (const key of keys) {
+    const value = metadata[key];
+    if (Array.isArray(value))
+      return value.filter((entry) => typeof entry === "string");
+  }
+  return [];
+}
+function readMappedPath(input) {
+  for (const containerName of input.containers) {
+    const container = input.metadata[containerName];
+    if (!isRecord(container))
+      continue;
+    for (const key of input.keys) {
+      const value = container[key];
+      if (typeof value === "string" && value.trim())
+        return value.trim();
+      if (isRecord(value)) {
+        const path = metadataString(value, ["path", "root", "workspacePath", "workspace_path"]);
+        if (path)
+          return path;
+      }
+    }
+  }
+  return null;
+}
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function joinPath(left, right) {
+  return `${trimTrailingSlash(left)}/${right.replace(/^\/+/, "")}`;
+}
+function inferRepoRoot(workspaceRoot, repoName) {
+  if (!workspaceRoot || !repoName)
+    return null;
+  const root = trimTrailingSlash(workspaceRoot);
+  if (root.endsWith(`/${repoName}`) || root === repoName)
+    return root;
+  if (root.endsWith("/workspace") || root.endsWith("/Workspace")) {
+    return joinPath(root, `hasna/opensource/${repoName}`);
+  }
+  return joinPath(root, repoName);
+}
+function projectPathFromMetadata(metadata, projectId, repoName) {
+  const keys = [projectId, repoName].filter((value) => Boolean(value));
+  return readMappedPath({
+    metadata,
+    containers: ["workspace_paths", "workspacePaths", "repo_paths", "repoPaths", "project_paths", "projectPaths", "projects"],
+    keys
+  });
+}
+function openFilesPathFromMetadata(metadata, projectId, repoName) {
+  const direct = metadataString(metadata, ["open_files_root", "openFilesRoot", "open_files_path", "openFilesPath"]);
+  if (direct)
+    return direct;
+  const keys = [projectId, repoName, "open-files", "open_files", "default"].filter((value) => Boolean(value));
+  return readMappedPath({
+    metadata,
+    containers: ["open_files_roots", "openFilesRoots", "open_files_paths", "openFilesPaths"],
+    keys
+  });
+}
+function trustStatus(machine) {
+  if (!machine)
+    return "unknown";
+  const explicit = metadataString(machine.metadata, ["trust_status", "trustStatus"]);
+  if (explicit === "trusted" || explicit === "untrusted" || explicit === "unknown")
+    return explicit;
+  const trusted = metadataBoolean(machine.metadata, ["trusted", "syncTrusted", "sync_trusted"]);
+  if (trusted === true)
+    return "trusted";
+  if (trusted === false)
+    return "untrusted";
+  if (machine.route_hints.some((hint) => hint.kind === "local"))
+    return "trusted";
+  if (machine.tags.includes("trusted"))
+    return "trusted";
+  return "unknown";
+}
+function authStatus(machine) {
+  if (!machine)
+    return "unknown";
+  const explicit = metadataString(machine.metadata, ["auth_status", "authStatus"]);
+  if (explicit === "authenticated" || explicit === "unauthenticated" || explicit === "unknown")
+    return explicit;
+  const authenticated = metadataBoolean(machine.metadata, ["authenticated", "sshAuthorized", "ssh_authorized"]);
+  if (authenticated === true)
+    return "authenticated";
+  if (authenticated === false)
+    return "unauthenticated";
+  if (machine.route_hints.some((hint) => hint.kind === "local"))
+    return "authenticated";
+  return "unknown";
+}
+function primaryMachine(machine, projectId, primaryMachineId) {
+  if (!machine)
+    return false;
+  if (primaryMachineId)
+    return machine.machine_id === primaryMachineId;
+  if (metadataBoolean(machine.metadata, ["primary", "primary_machine", "primaryMachine"]) === true)
+    return true;
+  const primaryProjects = metadataStringArray(machine.metadata, ["primary_projects", "primaryProjects"]);
+  if (primaryProjects.includes(projectId))
+    return true;
+  return machine.tags.includes("primary");
+}
+function metadataKeysForDiagnostics(metadata) {
+  return Object.keys(metadata).filter((key) => !/(secret|token|key|password|credential)/i.test(key)).sort();
+}
+function resolveMachineWorkspace(options) {
+  const topology = options.topology ?? discoverMachineTopology(options);
+  const warnings = [...topology.warnings];
+  const { machine, matchedBy } = findRouteMachine(topology, options.machineId);
+  const generatedAt = (options.now ?? new Date).toISOString();
+  const repoName = options.repoName ?? options.projectId;
+  const openFilesRepoName = options.openFilesRepoName ?? "open-files";
+  if (!machine) {
+    warnings.push(`machine_not_found:${options.machineId}`);
+    return {
+      schema_version: MACHINES_CONSUMER_CONTRACT_VERSION,
+      package: topology.package,
+      ok: false,
+      requested_machine_id: options.machineId,
+      machine_id: null,
+      generated_at: generatedAt,
+      project: { project_id: options.projectId, repo_name: repoName, canonical: Boolean(options.projectId) },
+      machine: { current: false, primary: false, trust_status: "unknown", auth_status: "unknown" },
+      paths: {
+        workspace_root: { path: null, source: "unresolved" },
+        project_root: { path: null, source: "unresolved" },
+        open_files_root: { path: null, source: "unresolved" }
+      },
+      evidence: {
+        topology: true,
+        matched_by: matchedBy,
+        manifest_declared: null,
+        metadata_keys: []
+      },
+      warnings
+    };
+  }
+  const metadata = machine.metadata;
+  const workspaceRootPath = options.workspaceRoot ?? machine.workspace_path;
+  const workspaceRootSource = options.workspaceRoot ? "argument" : machine.workspace_path ? "manifest" : "unresolved";
+  const metadataProjectRoot = projectPathFromMetadata(metadata, options.projectId, repoName);
+  const inferredProjectRoot = inferRepoRoot(workspaceRootPath, repoName);
+  const projectRootPath = options.projectRoot ?? metadataProjectRoot ?? inferredProjectRoot;
+  const projectRootSource = options.projectRoot ? "argument" : metadataProjectRoot ? "manifest_metadata" : inferredProjectRoot ? "inferred" : "unresolved";
+  const metadataOpenFilesRoot = openFilesPathFromMetadata(metadata, options.projectId, openFilesRepoName);
+  const inferredOpenFilesRoot = inferRepoRoot(workspaceRootPath, openFilesRepoName);
+  const openFilesRootPath = options.openFilesRoot ?? metadataOpenFilesRoot ?? inferredOpenFilesRoot;
+  const openFilesRootSource = options.openFilesRoot ? "argument" : metadataOpenFilesRoot ? "manifest_metadata" : inferredOpenFilesRoot ? "inferred" : "unresolved";
+  if (projectRootSource === "inferred")
+    warnings.push(`project_root_inferred:${options.projectId}`);
+  if (openFilesRootSource === "inferred")
+    warnings.push(`open_files_root_inferred:${options.projectId}`);
+  if (!projectRootPath)
+    warnings.push(`project_root_unresolved:${options.projectId}`);
+  return {
+    schema_version: MACHINES_CONSUMER_CONTRACT_VERSION,
+    package: topology.package,
+    ok: Boolean(projectRootPath),
+    requested_machine_id: options.machineId,
+    machine_id: machine.machine_id,
+    generated_at: generatedAt,
+    project: {
+      project_id: options.projectId,
+      repo_name: repoName,
+      canonical: Boolean(options.projectId && repoName)
+    },
+    machine: {
+      current: machine.machine_id === topology.local_machine_id,
+      primary: primaryMachine(machine, options.projectId, options.primaryMachineId),
+      trust_status: trustStatus(machine),
+      auth_status: authStatus(machine)
+    },
+    paths: {
+      workspace_root: { path: workspaceRootPath, source: workspaceRootSource },
+      project_root: { path: projectRootPath, source: projectRootSource },
+      open_files_root: { path: openFilesRootPath, source: openFilesRootSource }
+    },
+    evidence: {
+      topology: true,
+      matched_by: matchedBy,
+      manifest_declared: machine.manifest_declared,
+      metadata_keys: metadataKeysForDiagnostics(metadata)
+    },
+    warnings
+  };
+}
 function getLocalMachineTopology(options = {}) {
   const topology = discoverMachineTopology(options);
   return topology.machines.find((machine) => machine.machine_id === topology.local_machine_id) ?? {
@@ -4974,6 +5185,7 @@ function checkMachineCompatibility(options = {}) {
 export {
   runMachineCommand,
   resolveSshTarget,
+  resolveMachineWorkspace,
   resolveMachineRoute,
   resolveMachineCommand,
   getPackageVersion,

package/dist/index.js

@@ -11008,6 +11008,7 @@ var machineSchema = exports_external.object({
   workspacePath: exports_external.string(),
   bunPath: exports_external.string().optional(),
   tags: exports_external.array(exports_external.string()).optional(),
+  metadata: exports_external.record(exports_external.unknown()).optional(),
   packages: exports_external.array(packageSchema).optional(),
   apps: exports_external.array(appSchema).optional(),
   files: exports_external.array(fileSchema).optional()
@@ -11314,7 +11315,8 @@ function discoverMachineTopology(options = {}) {
       topology: true,
       compatibility: true,
       route_resolution: true,
-      cli_json_fallback: true
+      cli_json_fallback: true,
+      workspace_path_mapping: true
     },
     generated_at: now.toISOString(),
     local_machine_id: localMachineId,
@@ -11439,6 +11441,215 @@ function resolveMachineRoute(machineId, options = {}) {
     warnings
   };
 }
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function metadataString(metadata, keys) {
+  for (const key of keys) {
+    const value = metadata[key];
+    if (typeof value === "string" && value.trim())
+      return value.trim();
+  }
+  return null;
+}
+function metadataBoolean(metadata, keys) {
+  for (const key of keys) {
+    const value = metadata[key];
+    if (typeof value === "boolean")
+      return value;
+  }
+  return null;
+}
+function metadataStringArray(metadata, keys) {
+  for (const key of keys) {
+    const value = metadata[key];
+    if (Array.isArray(value))
+      return value.filter((entry) => typeof entry === "string");
+  }
+  return [];
+}
+function readMappedPath(input) {
+  for (const containerName of input.containers) {
+    const container = input.metadata[containerName];
+    if (!isRecord(container))
+      continue;
+    for (const key of input.keys) {
+      const value = container[key];
+      if (typeof value === "string" && value.trim())
+        return value.trim();
+      if (isRecord(value)) {
+        const path = metadataString(value, ["path", "root", "workspacePath", "workspace_path"]);
+        if (path)
+          return path;
+      }
+    }
+  }
+  return null;
+}
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function joinPath(left, right) {
+  return `${trimTrailingSlash(left)}/${right.replace(/^\/+/, "")}`;
+}
+function inferRepoRoot(workspaceRoot, repoName) {
+  if (!workspaceRoot || !repoName)
+    return null;
+  const root = trimTrailingSlash(workspaceRoot);
+  if (root.endsWith(`/${repoName}`) || root === repoName)
+    return root;
+  if (root.endsWith("/workspace") || root.endsWith("/Workspace")) {
+    return joinPath(root, `hasna/opensource/${repoName}`);
+  }
+  return joinPath(root, repoName);
+}
+function projectPathFromMetadata(metadata, projectId, repoName) {
+  const keys = [projectId, repoName].filter((value) => Boolean(value));
+  return readMappedPath({
+    metadata,
+    containers: ["workspace_paths", "workspacePaths", "repo_paths", "repoPaths", "project_paths", "projectPaths", "projects"],
+    keys
+  });
+}
+function openFilesPathFromMetadata(metadata, projectId, repoName) {
+  const direct = metadataString(metadata, ["open_files_root", "openFilesRoot", "open_files_path", "openFilesPath"]);
+  if (direct)
+    return direct;
+  const keys = [projectId, repoName, "open-files", "open_files", "default"].filter((value) => Boolean(value));
+  return readMappedPath({
+    metadata,
+    containers: ["open_files_roots", "openFilesRoots", "open_files_paths", "openFilesPaths"],
+    keys
+  });
+}
+function trustStatus(machine) {
+  if (!machine)
+    return "unknown";
+  const explicit = metadataString(machine.metadata, ["trust_status", "trustStatus"]);
+  if (explicit === "trusted" || explicit === "untrusted" || explicit === "unknown")
+    return explicit;
+  const trusted = metadataBoolean(machine.metadata, ["trusted", "syncTrusted", "sync_trusted"]);
+  if (trusted === true)
+    return "trusted";
+  if (trusted === false)
+    return "untrusted";
+  if (machine.route_hints.some((hint) => hint.kind === "local"))
+    return "trusted";
+  if (machine.tags.includes("trusted"))
+    return "trusted";
+  return "unknown";
+}
+function authStatus(machine) {
+  if (!machine)
+    return "unknown";
+  const explicit = metadataString(machine.metadata, ["auth_status", "authStatus"]);
+  if (explicit === "authenticated" || explicit === "unauthenticated" || explicit === "unknown")
+    return explicit;
+  const authenticated = metadataBoolean(machine.metadata, ["authenticated", "sshAuthorized", "ssh_authorized"]);
+  if (authenticated === true)
+    return "authenticated";
+  if (authenticated === false)
+    return "unauthenticated";
+  if (machine.route_hints.some((hint) => hint.kind === "local"))
+    return "authenticated";
+  return "unknown";
+}
+function primaryMachine(machine, projectId, primaryMachineId) {
+  if (!machine)
+    return false;
+  if (primaryMachineId)
+    return machine.machine_id === primaryMachineId;
+  if (metadataBoolean(machine.metadata, ["primary", "primary_machine", "primaryMachine"]) === true)
+    return true;
+  const primaryProjects = metadataStringArray(machine.metadata, ["primary_projects", "primaryProjects"]);
+  if (primaryProjects.includes(projectId))
+    return true;
+  return machine.tags.includes("primary");
+}
+function metadataKeysForDiagnostics(metadata) {
+  return Object.keys(metadata).filter((key) => !/(secret|token|key|password|credential)/i.test(key)).sort();
+}
+function resolveMachineWorkspace(options) {
+  const topology = options.topology ?? discoverMachineTopology(options);
+  const warnings = [...topology.warnings];
+  const { machine, matchedBy } = findRouteMachine(topology, options.machineId);
+  const generatedAt = (options.now ?? new Date).toISOString();
+  const repoName = options.repoName ?? options.projectId;
+  const openFilesRepoName = options.openFilesRepoName ?? "open-files";
+  if (!machine) {
+    warnings.push(`machine_not_found:${options.machineId}`);
+    return {
+      schema_version: MACHINES_CONSUMER_CONTRACT_VERSION,
+      package: topology.package,
+      ok: false,
+      requested_machine_id: options.machineId,
+      machine_id: null,
+      generated_at: generatedAt,
+      project: { project_id: options.projectId, repo_name: repoName, canonical: Boolean(options.projectId) },
+      machine: { current: false, primary: false, trust_status: "unknown", auth_status: "unknown" },
+      paths: {
+        workspace_root: { path: null, source: "unresolved" },
+        project_root: { path: null, source: "unresolved" },
+        open_files_root: { path: null, source: "unresolved" }
+      },
+      evidence: {
+        topology: true,
+        matched_by: matchedBy,
+        manifest_declared: null,
+        metadata_keys: []
+      },
+      warnings
+    };
+  }
+  const metadata = machine.metadata;
+  const workspaceRootPath = options.workspaceRoot ?? machine.workspace_path;
+  const workspaceRootSource = options.workspaceRoot ? "argument" : machine.workspace_path ? "manifest" : "unresolved";
+  const metadataProjectRoot = projectPathFromMetadata(metadata, options.projectId, repoName);
+  const inferredProjectRoot = inferRepoRoot(workspaceRootPath, repoName);
+  const projectRootPath = options.projectRoot ?? metadataProjectRoot ?? inferredProjectRoot;
+  const projectRootSource = options.projectRoot ? "argument" : metadataProjectRoot ? "manifest_metadata" : inferredProjectRoot ? "inferred" : "unresolved";
+  const metadataOpenFilesRoot = openFilesPathFromMetadata(metadata, options.projectId, openFilesRepoName);
+  const inferredOpenFilesRoot = inferRepoRoot(workspaceRootPath, openFilesRepoName);
+  const openFilesRootPath = options.openFilesRoot ?? metadataOpenFilesRoot ?? inferredOpenFilesRoot;
+  const openFilesRootSource = options.openFilesRoot ? "argument" : metadataOpenFilesRoot ? "manifest_metadata" : inferredOpenFilesRoot ? "inferred" : "unresolved";
+  if (projectRootSource === "inferred")
+    warnings.push(`project_root_inferred:${options.projectId}`);
+  if (openFilesRootSource === "inferred")
+    warnings.push(`open_files_root_inferred:${options.projectId}`);
+  if (!projectRootPath)
+    warnings.push(`project_root_unresolved:${options.projectId}`);
+  return {
+    schema_version: MACHINES_CONSUMER_CONTRACT_VERSION,
+    package: topology.package,
+    ok: Boolean(projectRootPath),
+    requested_machine_id: options.machineId,
+    machine_id: machine.machine_id,
+    generated_at: generatedAt,
+    project: {
+      project_id: options.projectId,
+      repo_name: repoName,
+      canonical: Boolean(options.projectId && repoName)
+    },
+    machine: {
+      current: machine.machine_id === topology.local_machine_id,
+      primary: primaryMachine(machine, options.projectId, options.primaryMachineId),
+      trust_status: trustStatus(machine),
+      auth_status: authStatus(machine)
+    },
+    paths: {
+      workspace_root: { path: workspaceRootPath, source: workspaceRootSource },
+      project_root: { path: projectRootPath, source: projectRootSource },
+      open_files_root: { path: openFilesRootPath, source: openFilesRootSource }
+    },
+    evidence: {
+      topology: true,
+      matched_by: matchedBy,
+      manifest_declared: machine.manifest_declared,
+      metadata_keys: metadataKeysForDiagnostics(metadata)
+    },
+    warnings
+  };
+}
 function getLocalMachineTopology(options = {}) {
   const topology = discoverMachineTopology(options);
   return topology.machines.find((machine) => machine.machine_id === topology.local_machine_id) ?? {
@@ -11796,9 +12007,52 @@ function getAgentStatus(machineId = getLocalMachineId()) {
 // src/commands/backup.ts
 import { homedir as homedir2 } from "os";
 import { join as join3 } from "path";
+var MACHINES_BACKUP_BUCKET_ENV = "HASNA_MACHINES_S3_BUCKET";
+var MACHINES_BACKUP_BUCKET_FALLBACK_ENV = "MACHINES_S3_BUCKET";
+var MACHINES_BACKUP_PREFIX_ENV = "HASNA_MACHINES_S3_PREFIX";
+var MACHINES_BACKUP_PREFIX_FALLBACK_ENV = "MACHINES_S3_PREFIX";
+var DEFAULT_BACKUP_PREFIX = "machines";
 function quote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function readEnv2(name) {
+  const value = process.env[name]?.trim();
+  return value || undefined;
+}
+function readBackupBucketEnv() {
+  const primary = readEnv2(MACHINES_BACKUP_BUCKET_ENV);
+  if (primary)
+    return { bucket: primary, bucketSource: MACHINES_BACKUP_BUCKET_ENV };
+  const fallback = readEnv2(MACHINES_BACKUP_BUCKET_FALLBACK_ENV);
+  if (fallback)
+    return { bucket: fallback, bucketSource: MACHINES_BACKUP_BUCKET_FALLBACK_ENV };
+  return null;
+}
+function readBackupPrefixEnv() {
+  const primary = readEnv2(MACHINES_BACKUP_PREFIX_ENV);
+  if (primary)
+    return { prefix: primary, prefixSource: MACHINES_BACKUP_PREFIX_ENV };
+  const fallback = readEnv2(MACHINES_BACKUP_PREFIX_FALLBACK_ENV);
+  if (fallback)
+    return { prefix: fallback, prefixSource: MACHINES_BACKUP_PREFIX_FALLBACK_ENV };
+  return null;
+}
+function resolveBackupTarget(options = {}) {
+  const explicitBucket = options.bucket?.trim();
+  const envBucket = explicitBucket ? null : readBackupBucketEnv();
+  const bucket = explicitBucket || envBucket?.bucket;
+  if (!bucket) {
+    throw new Error(`Missing S3 backup bucket. Pass --bucket or set ${MACHINES_BACKUP_BUCKET_ENV} or ${MACHINES_BACKUP_BUCKET_FALLBACK_ENV}.`);
+  }
+  const explicitPrefix = options.prefix?.trim();
+  const envPrefix = explicitPrefix ? null : readBackupPrefixEnv();
+  return {
+    bucket,
+    prefix: explicitPrefix || envPrefix?.prefix || DEFAULT_BACKUP_PREFIX,
+    bucketSource: explicitBucket ? "argument" : envBucket.bucketSource,
+    prefixSource: explicitPrefix ? "argument" : envPrefix?.prefixSource || "default"
+  };
+}
 function defaultBackupSources() {
   const home = homedir2();
   return [
@@ -11807,7 +12061,8 @@ function defaultBackupSources() {
     join3(home, ".secrets")
   ];
 }
-function buildBackupPlan(bucket, prefix = "machines") {
+function buildBackupPlan(bucket, prefix) {
+  const target = resolveBackupTarget({ bucket, prefix });
   const archivePath = join3(homedir2(), ".hasna", "machines", "backup.tgz");
   const sources = defaultBackupSources();
   const steps = [
@@ -11820,7 +12075,7 @@ function buildBackupPlan(bucket, prefix = "machines") {
     {
       id: "backup-upload",
       title: "Upload archive to S3",
-      command: `aws s3 cp ${quote(archivePath)} s3://${bucket}/${prefix}/$(hostname)-backup.tgz`,
+      command: `aws s3 cp ${quote(archivePath)} s3://${target.bucket}/${target.prefix}/$(hostname)-backup.tgz`,
       manager: "custom"
     }
   ];
@@ -11831,7 +12086,7 @@ function buildBackupPlan(bucket, prefix = "machines") {
     executed: 0
   };
 }
-function runBackup(bucket, prefix = "machines", options = {}) {
+function runBackup(bucket, prefix, options = {}) {
   const plan = buildBackupPlan(bucket, prefix);
   if (!options.apply)
     return plan;
@@ -22228,6 +22483,7 @@ var MACHINE_MCP_TOOL_NAMES = [
   "machines_install_claude_preview",
   "machines_install_claude_apply",
   "machines_route_resolve",
+  "machines_workspace_resolve",
   "machines_ssh_resolve",
   "machines_ports",
   "machines_backup_preview",
@@ -22341,14 +22597,50 @@ function createMcpServer(version2) {
   server.tool("machines_route_resolve", "Resolve the best route for a machine using manifest, heartbeat, SSH, LAN, and Tailscale topology.", { machine_id: exports_external.string().describe("Machine identifier"), include_tailscale: exports_external.boolean().optional().describe("Whether to probe tailscale status --json") }, async ({ machine_id, include_tailscale }) => ({
     content: [{ type: "text", text: JSON.stringify(resolveMachineRoute(machine_id, { includeTailscale: include_tailscale !== false }), null, 2) }]
   }));
+  server.tool("machines_workspace_resolve", "Resolve sync-safe repo and open-files roots for an open-* consumer.", {
+    machine_id: exports_external.string().describe("Machine identifier"),
+    project_id: exports_external.string().describe("Canonical project id"),
+    repo_name: exports_external.string().optional().describe("Repository name; defaults to project id"),
+    open_files_repo_name: exports_external.string().optional().describe("Open-files repository name"),
+    primary_machine_id: exports_external.string().optional().describe("Primary machine id for this project"),
+    workspace_root: exports_external.string().optional().describe("Override the machine workspace root"),
+    project_root: exports_external.string().optional().describe("Override the resolved project root"),
+    open_files_root: exports_external.string().optional().describe("Override the resolved open-files root"),
+    include_tailscale: exports_external.boolean().optional().describe("Whether to probe tailscale status --json")
+  }, async ({
+    machine_id,
+    project_id,
+    repo_name,
+    open_files_repo_name,
+    primary_machine_id,
+    workspace_root,
+    project_root,
+    open_files_root,
+    include_tailscale
+  }) => ({
+    content: [{
+      type: "text",
+      text: JSON.stringify(resolveMachineWorkspace({
+        machineId: machine_id,
+        projectId: project_id,
+        repoName: repo_name,
+        openFilesRepoName: open_files_repo_name,
+        primaryMachineId: primary_machine_id,
+        workspaceRoot: workspace_root,
+        projectRoot: project_root,
+        openFilesRoot: open_files_root,
+        includeTailscale: include_tailscale !== false
+      }), null, 2)
+    }]
+  }));
   server.tool("machines_ssh_resolve", "Resolve the best SSH route for a machine.", { machine_id: exports_external.string().describe("Machine identifier"), remote_command: exports_external.string().optional().describe("Optional remote command") }, async ({ machine_id, remote_command }) => ({
     content: [{ type: "text", text: JSON.stringify({ resolved: resolveMachineRoute(machine_id), command: buildSshCommand(machine_id, remote_command) }, null, 2) }]
   }));
   server.tool("machines_ports", "List listening ports on a machine.", { machine_id: exports_external.string().optional().describe("Machine identifier") }, async ({ machine_id }) => ({
     content: [{ type: "text", text: JSON.stringify(listPorts(machine_id), null, 2) }]
   }));
-  server.tool("machines_backup_preview", "Preview backup steps for the current machine.", { bucket: exports_external.string().describe("S3 bucket name"), prefix: exports_external.string().optional().describe("S3 key prefix") }, async ({ bucket, prefix }) => ({ content: [{ type: "text", text: JSON.stringify(buildBackupPlan(bucket, prefix), null, 2) }] }));
-  server.tool("machines_backup_apply", "Execute backup steps for the current machine.", { bucket: exports_external.string().describe("S3 bucket name"), prefix: exports_external.string().optional().describe("S3 key prefix"), yes: exports_external.boolean().describe("Confirmation flag for execution") }, async ({ bucket, prefix, yes }) => ({ content: [{ type: "text", text: JSON.stringify(runBackup(bucket, prefix, { apply: true, yes }), null, 2) }] }));
+  server.tool("machines_backup_preview", "Preview backup steps for the current machine.", { bucket: exports_external.string().optional().describe("S3 bucket name; defaults to HASNA_MACHINES_S3_BUCKET or MACHINES_S3_BUCKET"), prefix: exports_external.string().optional().describe("S3 key prefix; defaults to HASNA_MACHINES_S3_PREFIX, MACHINES_S3_PREFIX, or machines") }, async ({ bucket, prefix }) => ({ content: [{ type: "text", text: JSON.stringify(buildBackupPlan(bucket, prefix), null, 2) }] }));
+  server.tool("machines_backup_apply", "Execute backup steps for the current machine.", { bucket: exports_external.string().optional().describe("S3 bucket name; defaults to HASNA_MACHINES_S3_BUCKET or MACHINES_S3_BUCKET"), prefix: exports_external.string().optional().describe("S3 key prefix; defaults to HASNA_MACHINES_S3_PREFIX, MACHINES_S3_PREFIX, or machines"), yes: exports_external.boolean().describe("Confirmation flag for execution") }, async ({ bucket, prefix, yes }) => ({ content: [{ type: "text", text: JSON.stringify(runBackup(bucket, prefix, { apply: true, yes }), null, 2) }] }));
   server.tool("machines_cert_preview", "Preview mkcert steps for one or more domains.", { domains: exports_external.array(exports_external.string()).describe("Domains to issue certificates for") }, async ({ domains }) => ({ content: [{ type: "text", text: JSON.stringify(buildCertPlan(domains), null, 2) }] }));
   server.tool("machines_cert_apply", "Execute mkcert steps for one or more domains.", { domains: exports_external.array(exports_external.string()).describe("Domains to issue certificates for"), yes: exports_external.boolean().describe("Confirmation flag for execution") }, async ({ domains, yes }) => ({ content: [{ type: "text", text: JSON.stringify(runCertPlan(domains, { apply: true, yes }), null, 2) }] }));
   server.tool("machines_dns_add", "Add or replace a local domain mapping.", { domain: exports_external.string().describe("Domain name"), port: exports_external.number().describe("Target port"), target_host: exports_external.string().optional().describe("Target host") }, async ({ domain, port, target_host }) => ({ content: [{ type: "text", text: JSON.stringify(addDomainMapping(domain, port, target_host), null, 2) }] }));
@@ -22407,7 +22699,9 @@ export {
   runAppsInstall,
   resolveTables,
   resolveSshTarget,
+  resolveMachineWorkspace,
   resolveMachineRoute,
+  resolveBackupTarget,
   renderDomainMapping,
   renderDashboardHtml,
   removeNotificationChannel,
@@ -22493,5 +22787,10 @@ export {
   MACHINES_STORAGE_ENV,
   MACHINES_PACKAGE_NAME,
   MACHINES_CONSUMER_CONTRACT_VERSION,
+  MACHINES_BACKUP_PREFIX_FALLBACK_ENV,
+  MACHINES_BACKUP_PREFIX_ENV,
+  MACHINES_BACKUP_BUCKET_FALLBACK_ENV,
+  MACHINES_BACKUP_BUCKET_ENV,
+  DEFAULT_BACKUP_PREFIX,
   CROSSREFS_KEY
 };