@hasna/machines 0.0.2 → 0.0.4

package/dist/cli/index.js

@@ -6599,6 +6599,12 @@ function getManifestPath() {
 function getNotificationsPath() {
   return process.env["HASNA_MACHINES_NOTIFICATIONS_PATH"] || join2(getDataDir(), "notifications.json");
 }
+function getClipboardKeyPath() {
+  return process.env["HASNA_MACHINES_CLIPBOARD_KEY_PATH"] || join2(getDataDir(), "clipboard.key");
+}
+function getClipboardHistoryPath() {
+  return process.env["HASNA_MACHINES_CLIPBOARD_HISTORY_PATH"] || join2(getDataDir(), "clipboard-history.json");
+}
 function ensureParentDir(filePath) {
   if (filePath === ":memory:")
     return;
@@ -16698,17 +16704,95 @@ function diffMachines(leftMachineId, rightMachineId) {
   };
 }
 
+// src/remote.ts
+import { spawnSync as spawnSync2 } from "child_process";
+
+// src/commands/ssh.ts
+import { spawnSync } from "child_process";
+function envReachableHosts() {
+  const raw = process.env["HASNA_MACHINES_REACHABLE_HOSTS"];
+  return new Set((raw || "").split(",").map((value) => value.trim()).filter(Boolean));
+}
+function isReachable(host) {
+  const overrides = envReachableHosts();
+  if (overrides.size > 0) {
+    return overrides.has(host);
+  }
+  const probe = spawnSync("bash", ["-lc", `getent hosts ${host} >/dev/null 2>&1 || ping -c 1 -W 1 ${host} >/dev/null 2>&1`], {
+    stdio: "ignore"
+  });
+  return probe.status === 0;
+}
+function resolveSshTarget(machineId) {
+  const machine = getManifestMachine(machineId);
+  if (!machine) {
+    throw new Error(`Machine not found in manifest: ${machineId}`);
+  }
+  const current = detectCurrentMachineManifest();
+  if (machine.id === current.id) {
+    return {
+      machineId,
+      target: "localhost",
+      route: "local"
+    };
+  }
+  const lanTarget = machine.sshAddress || machine.hostname || machine.id;
+  const tailscaleTarget = machine.tailscaleName || machine.hostname || machine.id;
+  const route = isReachable(lanTarget) ? "lan" : "tailscale";
+  return {
+    machineId,
+    target: route === "lan" ? lanTarget : tailscaleTarget,
+    route
+  };
+}
+function buildSshCommand(machineId, remoteCommand) {
+  const resolved = resolveSshTarget(machineId);
+  return remoteCommand ? `ssh ${resolved.target} ${JSON.stringify(remoteCommand)}` : `ssh ${resolved.target}`;
+}
+
+// src/remote.ts
+function runMachineCommand(machineId, command) {
+  const localMachineId = getLocalMachineId();
+  const isLocal = machineId === localMachineId;
+  const route = isLocal ? "local" : resolveSshTarget(machineId).route;
+  const shellCommand = isLocal ? command : buildSshCommand(machineId, command);
+  const result = spawnSync2("bash", ["-lc", shellCommand], {
+    encoding: "utf8",
+    env: process.env
+  });
+  return {
+    machineId,
+    source: route,
+    stdout: result.stdout || "",
+    stderr: result.stderr || "",
+    exitCode: result.status ?? 1
+  };
+}
+
 // src/commands/apps.ts
 function getPackageName(app) {
   return app.packageName || app.name;
 }
+function getAppManager(machine, app) {
+  if (app.manager)
+    return app.manager;
+  if (machine.platform === "macos")
+    return "brew";
+  if (machine.platform === "windows")
+    return "winget";
+  return "apt";
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
 function buildAppCommand(machine, app) {
   const packageName = getPackageName(app);
-  if (app.manager === "custom") {
+  const manager = getAppManager(machine, app);
+  if (manager === "custom") {
     return packageName;
   }
   if (machine.platform === "macos") {
-    if (app.manager === "cask") {
+    if (manager === "cask") {
       return `brew install --cask ${packageName}`;
     }
     return `brew install ${packageName}`;
@@ -16718,18 +16802,48 @@ function buildAppCommand(machine, app) {
   }
   return `sudo apt-get install -y ${packageName}`;
 }
+function buildAppProbeCommand(machine, app) {
+  const packageName = shellQuote(getPackageName(app));
+  const manager = getAppManager(machine, app);
+  if (manager === "custom") {
+    return `if command -v ${packageName} >/dev/null 2>&1; then printf 'installed=1\\nversion=custom\\n'; else printf 'installed=0\\n'; fi`;
+  }
+  if (machine.platform === "macos") {
+    if (manager === "cask") {
+      return `if brew list --cask ${packageName} >/dev/null 2>&1; then printf 'installed=1\\nversion=installed\\n'; else printf 'installed=0\\n'; fi`;
+    }
+    return `if brew list --versions ${packageName} >/dev/null 2>&1; then printf 'installed=1\\nversion='; brew list --versions ${packageName} | awk '{print $2}'; printf '\\n'; else printf 'installed=0\\n'; fi`;
+  }
+  if (machine.platform === "windows") {
+    return `if winget list --id ${packageName} --exact >/dev/null 2>&1; then printf 'installed=1\\nversion=installed\\n'; else printf 'installed=0\\n'; fi`;
+  }
+  return `if dpkg-query -W -f='${"${Version}"}' ${packageName} >/tmp/machines-app-version 2>/dev/null; then printf 'installed=1\\nversion='; cat /tmp/machines-app-version; printf '\\n'; rm -f /tmp/machines-app-version; else printf 'installed=0\\n'; fi`;
+}
 function buildAppSteps(machine) {
   return (machine.apps || []).map((app) => ({
     id: `app-${app.name}`,
     title: `Install ${app.name} on ${machine.id}`,
     command: buildAppCommand(machine, app),
-    manager: app.manager === "custom" ? "custom" : machine.platform === "macos" ? "brew" : machine.platform === "windows" ? "custom" : "apt",
+    manager: getAppManager(machine, app) === "custom" ? "custom" : machine.platform === "macos" ? "brew" : machine.platform === "windows" ? "custom" : "apt",
     privileged: machine.platform === "linux"
   }));
 }
 function resolveMachine(machineId) {
   return (machineId ? getManifestMachine(machineId) : null) || detectCurrentMachineManifest();
 }
+function parseProbeOutput(app, machine, stdout) {
+  const lines = stdout.trim().split(`
+`).filter(Boolean);
+  const installedLine = lines.find((line) => line.startsWith("installed="));
+  const versionLine = lines.find((line) => line.startsWith("version="));
+  return {
+    name: app.name,
+    packageName: getPackageName(app),
+    manager: getAppManager(machine, app),
+    installed: installedLine === "installed=1",
+    version: versionLine?.slice("version=".length) || undefined
+  };
+}
 function listApps(machineId) {
   const machine = resolveMachine(machineId);
   return {
@@ -16746,6 +16860,26 @@ function buildAppsPlan(machineId) {
     executed: 0
   };
 }
+function getAppsStatus(machineId) {
+  const machine = resolveMachine(machineId);
+  const apps = (machine.apps || []).map((app) => {
+    const probe = runMachineCommand(machine.id, buildAppProbeCommand(machine, app));
+    return parseProbeOutput(app, machine, probe.stdout);
+  });
+  return {
+    machineId: machine.id,
+    source: apps.length > 0 ? runMachineCommand(machine.id, "true").source : machine.id === detectCurrentMachineManifest().id ? "local" : runMachineCommand(machine.id, "true").source,
+    apps
+  };
+}
+function diffApps(machineId) {
+  const status = getAppsStatus(machineId);
+  return {
+    ...status,
+    missing: status.apps.filter((app) => !app.installed).map((app) => app.name),
+    installed: status.apps.filter((app) => app.installed).map((app) => app.name)
+  };
+}
 function runAppsInstall(machineId, options = {}) {
   const plan = buildAppsPlan(machineId);
   if (!options.apply)
@@ -16779,6 +16913,13 @@ var AI_CLI_PACKAGES = {
   codex: "@openai/codex",
   gemini: "@google/gemini-cli"
 };
+function getToolBinary(tool) {
+  if (tool === "claude")
+    return process.env["HASNA_MACHINES_CLAUDE_BINARY"] || "claude";
+  if (tool === "codex")
+    return process.env["HASNA_MACHINES_CODEX_BINARY"] || "codex";
+  return process.env["HASNA_MACHINES_GEMINI_BINARY"] || "gemini";
+}
 function normalizeTools(tools) {
   if (!tools || tools.length === 0) {
     return ["claude", "codex", "gemini"];
@@ -16798,8 +16939,27 @@ function buildInstallSteps(machine, tools) {
     manager: "bun"
   }));
 }
+function resolveMachine2(machineId) {
+  return (machineId ? getManifestMachine(machineId) : null) || detectCurrentMachineManifest();
+}
+function buildProbeCommand(tool) {
+  const binary = getToolBinary(tool);
+  return `if command -v ${binary} >/dev/null 2>&1; then printf 'installed=1\\nversion='; ${binary} --version 2>/dev/null | head -n 1; printf '\\n'; else printf 'installed=0\\n'; fi`;
+}
+function parseProbe(tool, stdout) {
+  const lines = stdout.trim().split(`
+`).filter(Boolean);
+  const installedLine = lines.find((line) => line.startsWith("installed="));
+  const versionLine = lines.find((line) => line.startsWith("version="));
+  return {
+    tool,
+    packageName: AI_CLI_PACKAGES[tool],
+    installed: installedLine === "installed=1",
+    version: versionLine?.slice("version=".length) || undefined
+  };
+}
 function buildClaudeInstallPlan(machineId, tools) {
-  const machine = (machineId ? getManifestMachine(machineId) : null) || detectCurrentMachineManifest();
+  const machine = resolveMachine2(machineId);
   return {
     machineId: machine.id,
     mode: "plan",
@@ -16807,6 +16967,24 @@ function buildClaudeInstallPlan(machineId, tools) {
     executed: 0
   };
 }
+function getClaudeCliStatus(machineId, tools) {
+  const machine = resolveMachine2(machineId);
+  const normalizedTools = normalizeTools(tools);
+  const route = runMachineCommand(machine.id, "true").source;
+  return {
+    machineId: machine.id,
+    source: route,
+    tools: normalizedTools.map((tool) => parseProbe(tool, runMachineCommand(machine.id, buildProbeCommand(tool)).stdout))
+  };
+}
+function diffClaudeCli(machineId, tools) {
+  const status = getClaudeCliStatus(machineId, tools);
+  return {
+    ...status,
+    missing: status.tools.filter((tool) => !tool.installed).map((tool) => tool.tool),
+    installed: status.tools.filter((tool) => tool.installed).map((tool) => tool.tool)
+  };
+}
 function runClaudeInstall(machineId, tools, options = {}) {
   const plan = buildClaudeInstallPlan(machineId, tools);
   if (!options.apply)
@@ -16919,6 +17097,138 @@ var notificationConfigSchema = exports_external.object({
 function sortChannels(channels) {
   return [...channels].sort((left, right) => left.id.localeCompare(right.id));
 }
+function shellQuote2(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function hasCommand(binary) {
+  const result = Bun.spawnSync(["bash", "-lc", `command -v ${binary} >/dev/null 2>&1`], {
+    stdout: "ignore",
+    stderr: "ignore",
+    env: process.env
+  });
+  return result.exitCode === 0;
+}
+function buildNotificationPreview(channel, event, message) {
+  if (channel.type === "email") {
+    return `send email to ${channel.target}: [${event}] ${message}`;
+  }
+  if (channel.type === "webhook") {
+    return `POST ${channel.target} with payload {"event":"${event}","message":"${message}"}`;
+  }
+  return `${channel.target} --event ${event} --message ${JSON.stringify(message)}`;
+}
+async function dispatchEmail(channel, event, message) {
+  const subject = `[${event}] machines notification`;
+  const body = `To: ${channel.target}
+Subject: ${subject}
+Content-Type: text/plain; charset=utf-8
+
+${message}
+`;
+  if (hasCommand("sendmail")) {
+    const result = Bun.spawnSync(["bash", "-lc", "sendmail -t"], {
+      stdin: new TextEncoder().encode(body),
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (result.exitCode !== 0) {
+      throw new Error(result.stderr.toString().trim() || `sendmail exited with ${result.exitCode}`);
+    }
+    return {
+      channelId: channel.id,
+      event,
+      delivered: true,
+      transport: channel.type,
+      detail: `Delivered via sendmail to ${channel.target}`
+    };
+  }
+  if (hasCommand("mail")) {
+    const command = `printf %s ${shellQuote2(message)} | mail -s ${shellQuote2(subject)} ${shellQuote2(channel.target)}`;
+    const result = Bun.spawnSync(["bash", "-lc", command], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (result.exitCode !== 0) {
+      throw new Error(result.stderr.toString().trim() || `mail exited with ${result.exitCode}`);
+    }
+    return {
+      channelId: channel.id,
+      event,
+      delivered: true,
+      transport: channel.type,
+      detail: `Delivered via mail to ${channel.target}`
+    };
+  }
+  throw new Error("No local email transport available. Install sendmail or mail.");
+}
+async function dispatchWebhook(channel, event, message) {
+  const response = await fetch(channel.target, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      channelId: channel.id,
+      event,
+      message,
+      sentAt: new Date().toISOString()
+    })
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Webhook responded ${response.status}: ${text || response.statusText}`);
+  }
+  return {
+    channelId: channel.id,
+    event,
+    delivered: true,
+    transport: channel.type,
+    detail: `Webhook accepted with HTTP ${response.status}`
+  };
+}
+async function dispatchCommand(channel, event, message) {
+  const result = Bun.spawnSync(["bash", "-lc", channel.target], {
+    stdout: "pipe",
+    stderr: "pipe",
+    env: {
+      ...process.env,
+      HASNA_MACHINES_NOTIFICATION_CHANNEL: channel.id,
+      HASNA_MACHINES_NOTIFICATION_EVENT: event,
+      HASNA_MACHINES_NOTIFICATION_MESSAGE: message
+    }
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(result.stderr.toString().trim() || `command exited with ${result.exitCode}`);
+  }
+  const stdout = result.stdout.toString().trim();
+  return {
+    channelId: channel.id,
+    event,
+    delivered: true,
+    transport: channel.type,
+    detail: stdout || "Command completed successfully"
+  };
+}
+async function dispatchChannel(channel, event, message) {
+  if (!channel.enabled) {
+    return {
+      channelId: channel.id,
+      event,
+      delivered: false,
+      transport: channel.type,
+      detail: "Channel is disabled"
+    };
+  }
+  if (channel.type === "email") {
+    return dispatchEmail(channel, event, message);
+  }
+  if (channel.type === "webhook") {
+    return dispatchWebhook(channel, event, message);
+  }
+  return dispatchCommand(channel, event, message);
+}
 function getDefaultNotificationConfig() {
   return {
     version: 1,
@@ -16962,16 +17272,34 @@ function removeNotificationChannel(channelId) {
     channels: config.channels.filter((channel) => channel.id !== channelId)
   });
 }
-function buildNotificationPreview(channel, event, message) {
-  if (channel.type === "email") {
-    return `send email to ${channel.target}: [${event}] ${message}`;
-  }
-  if (channel.type === "webhook") {
-    return `POST ${channel.target} with payload {"event":"${event}","message":"${message}"}`;
+async function dispatchNotificationEvent(event, message, options = {}) {
+  const channels = readNotificationConfig().channels.filter((channel) => {
+    if (options.channelId && channel.id !== options.channelId) {
+      return false;
+    }
+    return channel.events.includes(event) || event === "manual.test";
+  });
+  const deliveries = [];
+  for (const channel of channels) {
+    try {
+      deliveries.push(await dispatchChannel(channel, event, message));
+    } catch (error) {
+      deliveries.push({
+        channelId: channel.id,
+        event,
+        delivered: false,
+        transport: channel.type,
+        detail: error instanceof Error ? error.message : String(error)
+      });
+    }
   }
-  return `${channel.target} --event ${event} --message ${JSON.stringify(message)}`;
+  return {
+    event,
+    message,
+    deliveries
+  };
 }
-function testNotificationChannel(channelId, event = "manual.test", message = "machines notification test", options = {}) {
+async function testNotificationChannel(channelId, event = "manual.test", message = "machines notification test", options = {}) {
   const channel = readNotificationConfig().channels.find((entry) => entry.id === channelId);
   if (!channel) {
     throw new Error(`Notification channel not found: ${channelId}`);
@@ -16982,77 +17310,25 @@ function testNotificationChannel(channelId, event = "manual.test", message = "ma
       channelId,
       mode: "plan",
       delivered: false,
-      preview
+      preview,
+      detail: "Preview only"
     };
   }
   if (!options.yes) {
     throw new Error("Notification test execution requires --yes.");
   }
-  if (channel.type === "command") {
-    const result = Bun.spawnSync(["bash", "-lc", preview], {
-      stdout: "pipe",
-      stderr: "pipe",
-      env: process.env
-    });
-    if (result.exitCode !== 0) {
-      throw new Error(`Notification command failed (${channel.id}): ${result.stderr.toString().trim()}`);
-    }
-  }
+  const delivery = await dispatchChannel(channel, event, message);
   return {
     channelId,
     mode: "apply",
-    delivered: channel.enabled,
-    preview
+    delivered: delivery.delivered,
+    preview,
+    detail: delivery.detail
   };
 }
 
 // src/commands/ports.ts
-import { spawnSync as spawnSync2 } from "child_process";
-
-// src/commands/ssh.ts
-import { spawnSync } from "child_process";
-function envReachableHosts() {
-  const raw = process.env["HASNA_MACHINES_REACHABLE_HOSTS"];
-  return new Set((raw || "").split(",").map((value) => value.trim()).filter(Boolean));
-}
-function isReachable(host) {
-  const overrides = envReachableHosts();
-  if (overrides.size > 0) {
-    return overrides.has(host);
-  }
-  const probe = spawnSync("bash", ["-lc", `getent hosts ${host} >/dev/null 2>&1 || ping -c 1 -W 1 ${host} >/dev/null 2>&1`], {
-    stdio: "ignore"
-  });
-  return probe.status === 0;
-}
-function resolveSshTarget(machineId) {
-  const machine = getManifestMachine(machineId);
-  if (!machine) {
-    throw new Error(`Machine not found in manifest: ${machineId}`);
-  }
-  const current = detectCurrentMachineManifest();
-  if (machine.id === current.id) {
-    return {
-      machineId,
-      target: "localhost",
-      route: "local"
-    };
-  }
-  const lanTarget = machine.sshAddress || machine.hostname || machine.id;
-  const tailscaleTarget = machine.tailscaleName || machine.hostname || machine.id;
-  const route = isReachable(lanTarget) ? "lan" : "tailscale";
-  return {
-    machineId,
-    target: route === "lan" ? lanTarget : tailscaleTarget,
-    route
-  };
-}
-function buildSshCommand(machineId, remoteCommand) {
-  const resolved = resolveSshTarget(machineId);
-  return remoteCommand ? `ssh ${resolved.target} ${JSON.stringify(remoteCommand)}` : `ssh ${resolved.target}`;
-}
-
-// src/commands/ports.ts
+import { spawnSync as spawnSync3 } from "child_process";
 function parseSsOutput(output) {
   return output.trim().split(`
 `).map((line) => line.trim()).filter(Boolean).map((line) => {
@@ -17094,7 +17370,7 @@ function listPorts(machineId) {
   const isLocal = targetMachineId === getLocalMachineId();
   const localCommand = "if command -v ss >/dev/null 2>&1; then ss -ltnpH; else lsof -nP -iTCP -sTCP:LISTEN; fi";
   const command = isLocal ? localCommand : buildSshCommand(targetMachineId, localCommand);
-  const result = spawnSync2("bash", ["-lc", command], { encoding: "utf8" });
+  const result = spawnSync3("bash", ["-lc", command], { encoding: "utf8" });
   if (result.status !== 0) {
     throw new Error(result.stderr || `Failed to list ports for ${targetMachineId}`);
   }
@@ -17289,6 +17565,59 @@ function getStatus() {
   };
 }
 
+// src/commands/doctor.ts
+function makeCheck(id, status, summary, detail) {
+  return { id, status, summary, detail };
+}
+function parseKeyValueOutput(stdout) {
+  return Object.fromEntries(stdout.trim().split(`
+`).map((line) => line.split("=")).filter((parts) => parts.length === 2).map(([key, value]) => [key, value]));
+}
+function buildDoctorCommand() {
+  return [
+    'data_dir="${HASNA_MACHINES_DIR:-$HOME/.hasna/machines}"',
+    'manifest_path="${HASNA_MACHINES_MANIFEST_PATH:-$data_dir/machines.json}"',
+    'db_path="${HASNA_MACHINES_DB_PATH:-$data_dir/machines.db}"',
+    'notifications_path="${HASNA_MACHINES_NOTIFICATIONS_PATH:-$data_dir/notifications.json}"',
+    `printf 'manifest_path=%s\\n' "$manifest_path"`,
+    `printf 'db_path=%s\\n' "$db_path"`,
+    `printf 'notifications_path=%s\\n' "$notifications_path"`,
+    `printf 'manifest_exists=%s\\n' "$(test -e "$manifest_path" && printf yes || printf no)"`,
+    `printf 'db_exists=%s\\n' "$(test -e "$db_path" && printf yes || printf no)"`,
+    `printf 'notifications_exists=%s\\n' "$(test -e "$notifications_path" && printf yes || printf no)"`,
+    `printf 'bun=%s\\n' "$(bun --version 2>/dev/null || printf missing)"`,
+    `printf 'ssh=%s\\n' "$(command -v ssh >/dev/null 2>&1 && printf ok || printf missing)"`,
+    `printf 'machines=%s\\n' "$(command -v machines 2>/dev/null || printf missing)"`,
+    `printf 'machines_agent=%s\\n' "$(command -v machines-agent 2>/dev/null || printf missing)"`,
+    `printf 'machines_mcp=%s\\n' "$(command -v machines-mcp 2>/dev/null || printf missing)"`
+  ].join("; ");
+}
+function runDoctor(machineId = getLocalMachineId()) {
+  const manifest = readManifest();
+  const commandChecks = runMachineCommand(machineId, buildDoctorCommand());
+  const details = parseKeyValueOutput(commandChecks.stdout);
+  const machineInManifest = manifest.machines.find((machine) => machine.id === machineId);
+  const checks = [
+    makeCheck("manifest-entry", machineInManifest ? "ok" : "warn", machineInManifest ? "Machine exists in manifest" : "Machine missing from manifest", machineInManifest ? JSON.stringify(machineInManifest) : `No manifest entry for ${machineId}`),
+    makeCheck("manifest-path", details["manifest_exists"] === "yes" ? "ok" : "warn", "Manifest path check", `${details["manifest_path"] || "unknown"} ${details["manifest_exists"] === "yes" ? "exists" : "missing"}`),
+    makeCheck("db-path", details["db_exists"] === "yes" ? "ok" : "warn", "DB path check", `${details["db_path"] || "unknown"} ${details["db_exists"] === "yes" ? "exists" : "missing"}`),
+    makeCheck("notifications-path", details["notifications_exists"] === "yes" ? "ok" : "warn", "Notifications path check", `${details["notifications_path"] || "unknown"} ${details["notifications_exists"] === "yes" ? "exists" : "missing"}`),
+    makeCheck("bun", details["bun"] && details["bun"] !== "missing" ? "ok" : "fail", "Bun availability", details["bun"] || "missing"),
+    makeCheck("machines-cli", details["machines"] && details["machines"] !== "missing" ? "ok" : "warn", "machines CLI availability", details["machines"] || "missing"),
+    makeCheck("machines-agent-cli", details["machines_agent"] && details["machines_agent"] !== "missing" ? "ok" : "warn", "machines-agent availability", details["machines_agent"] || "missing"),
+    makeCheck("machines-mcp-cli", details["machines_mcp"] && details["machines_mcp"] !== "missing" ? "ok" : "warn", "machines-mcp availability", details["machines_mcp"] || "missing"),
+    makeCheck("ssh", details["ssh"] === "ok" ? "ok" : "warn", "SSH availability", details["ssh"] || "missing")
+  ];
+  return {
+    machineId,
+    source: commandChecks.source,
+    manifestPath: details["manifest_path"],
+    dbPath: details["db_path"],
+    notificationsPath: details["notifications_path"],
+    checks
+  };
+}
+
 // src/commands/serve.ts
 function escapeHtml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
@@ -17300,13 +17629,27 @@ function getServeInfo(options = {}) {
     host,
     port,
     url: `http://${host}:${port}`,
-    routes: ["/", "/health", "/api/status", "/api/manifest", "/api/notifications"]
+    routes: [
+      "/",
+      "/health",
+      "/api/status",
+      "/api/manifest",
+      "/api/notifications",
+      "/api/doctor",
+      "/api/self-test",
+      "/api/apps/status",
+      "/api/apps/diff",
+      "/api/install-claude/status",
+      "/api/install-claude/diff",
+      "/api/notifications/test"
+    ]
   };
 }
 function renderDashboardHtml() {
   const status = getStatus();
   const manifest = manifestList();
   const notifications = listNotificationChannels();
+  const doctor = runDoctor();
   return `<!doctype html>
 <html lang="en">
   <head>
@@ -17322,21 +17665,26 @@ function renderDashboardHtml() {
       .card { background: #121933; border: 1px solid #243057; border-radius: 16px; padding: 20px; }
       .stat { font-size: 32px; font-weight: 700; margin-top: 8px; }
       table { width: 100%; border-collapse: collapse; }
-      th, td { text-align: left; padding: 10px 8px; border-bottom: 1px solid #243057; }
+      th, td { text-align: left; padding: 10px 8px; border-bottom: 1px solid #243057; vertical-align: top; }
       code { color: #9ed0ff; }
       .badge { display: inline-block; border-radius: 999px; padding: 4px 10px; font-size: 12px; }
-      .online { background: #12351f; color: #74f0a7; }
-      .offline { background: #3b1a1a; color: #ff8c8c; }
-      .unknown { background: #2f2b16; color: #ffd76a; }
+      .online, .ok { background: #12351f; color: #74f0a7; }
+      .offline, .fail { background: #3b1a1a; color: #ff8c8c; }
+      .unknown, .warn { background: #2f2b16; color: #ffd76a; }
+      ul { margin: 8px 0 0; padding-left: 18px; }
+      .muted { color: #9fb0d9; }
+      .refresh { font-size: 12px; color: #6b7fa3; margin-left: auto; }
+      .updated { transition: opacity 0.3s; }
     </style>
   </head>
   <body>
     <main>
-      <h1>Machines Dashboard</h1>
+      <h1>Machines Dashboard <span class="refresh" id="last-updated"></span></h1>
       <div class="grid">
         <section class="card"><div>Manifest machines</div><div class="stat">${status.manifestMachineCount}</div></section>
         <section class="card"><div>Heartbeats</div><div class="stat">${status.heartbeatCount}</div></section>
         <section class="card"><div>Notification channels</div><div class="stat">${notifications.channels.length}</div></section>
+        <section class="card"><div>Doctor warnings</div><div class="stat">${doctor.checks.filter((entry) => entry.status !== "ok").length}</div></section>
       </div>
 
       <section class="card" style="margin-top:16px">
@@ -17354,21 +17702,119 @@ function renderDashboardHtml() {
         </table>
       </section>
 
+      <section class="card" style="margin-top:16px">
+        <h2>Doctor</h2>
+        <table>
+          <thead><tr><th>Check</th><th>Status</th><th>Detail</th></tr></thead>
+          <tbody id="doctor-tbody">
+            ${doctor.checks.map((entry) => `<tr>
+              <td>${escapeHtml(entry.summary)}</td>
+              <td><span class="badge ${escapeHtml(entry.status)}">${escapeHtml(entry.status)}</span></td>
+              <td class="muted">${escapeHtml(entry.detail)}</td>
+            </tr>`).join("")}
+          </tbody>
+        </table>
+      </section>
+
+      <section class="card" style="margin-top:16px">
+        <h2>Apps</h2>
+        <p class="muted">Use <code>/api/apps/status</code> for the full app inventory payload.</p>
+      </section>
+
+      <section class="card" style="margin-top:16px">
+        <h2>AI CLIs</h2>
+        <p class="muted">Use <code>/api/install-claude/status</code> for the full CLI inventory payload.</p>
+      </section>
+
+      <section class="card" style="margin-top:16px">
+        <h2>Self Test</h2>
+        <p class="muted">Use <code>/api/self-test</code> for the full smoke-check payload.</p>
+      </section>
+
       <section class="card" style="margin-top:16px">
         <h2>Manifest</h2>
-        <pre>${escapeHtml(JSON.stringify(manifest, null, 2))}</pre>
+        <pre id="manifest-json">${escapeHtml(JSON.stringify(manifest, null, 2))}</pre>
       </section>
     </main>
+    <script>
+      // Auto-refresh dashboard data every 15s
+      const REFRESH_INTERVAL = 15000;
+      async function refreshData() {
+        try {
+          const [statusRes, doctorRes] = await Promise.all([
+            fetch("/api/status"),
+            fetch("/api/doctor"),
+          ]);
+          const status = await statusRes.json();
+          const doctor = await doctorRes.json();
+
+          // Update stat cards
+          const stats = document.querySelectorAll(".stat");
+          if (stats[0]) stats[0].textContent = status.manifestMachineCount;
+          if (stats[1]) stats[1].textContent = status.heartbeatCount;
+
+          // Update machine table
+          const tbody = document.querySelector("tbody");
+          if (tbody && status.machines) {
+            tbody.innerHTML = status.machines
+              .map((m) =>
+                "<tr>" +
+                "<td><code>" + m.machineId + "</code></td>" +
+                "<td>" + (m.platform || "unknown") + "</td>" +
+                '<td><span class="badge ' + m.heartbeatStatus + '">' + m.heartbeatStatus + '</span></td>' +
+                "<td>" + (m.lastHeartbeatAt || "\\u2014") + "</td>" +
+                "</tr>"
+              )
+              .join("");
+          }
+
+          // Update doctor table
+          const doctorTbody = document.getElementById("doctor-tbody");
+          if (doctorTbody && doctor.checks) {
+            doctorTbody.innerHTML = doctor.checks
+              .map((c) =>
+                "<tr>" +
+                "<td>" + c.summary + "</td>" +
+                '<td><span class="badge ' + c.status + '">' + c.status + '</span></td>' +
+                '<td class="muted">' + c.detail + "</td>" +
+                "</tr>"
+              )
+              .join("");
+          }
+
+          // Update timestamp
+          document.getElementById("last-updated").textContent =
+            "updated " + new Date().toLocaleTimeString();
+        } catch (e) {
+          // Silently ignore fetch errors during page unload
+        }
+      }
+      document.getElementById("last-updated").textContent =
+        "updated " + new Date().toLocaleTimeString();
+      setInterval(refreshData, REFRESH_INTERVAL);
+    </script>
   </body>
 </html>`;
 }
+async function parseJsonBody(request) {
+  try {
+    return await request.json();
+  } catch {
+    return {};
+  }
+}
+function jsonError(message, status = 400) {
+  return Response.json({ error: message }, { status });
+}
 function startDashboardServer(options = {}) {
   const info = getServeInfo(options);
   return Bun.serve({
     hostname: info.host,
     port: info.port,
-    fetch(request) {
+    async fetch(request) {
       const url = new URL(request.url);
+      const machineId = url.searchParams.get("machine") || undefined;
+      const tools = url.searchParams.get("tools")?.split(",").map((value) => value.trim()).filter(Boolean);
       if (url.pathname === "/health") {
         return Response.json({ ok: true, ...getServeInfo(options) });
       }
@@ -17381,6 +17827,43 @@ function startDashboardServer(options = {}) {
       if (url.pathname === "/api/notifications") {
         return Response.json(listNotificationChannels());
       }
+      if (url.pathname === "/api/doctor") {
+        return Response.json(runDoctor(machineId));
+      }
+      if (url.pathname === "/api/self-test") {
+        return Response.json(runSelfTest());
+      }
+      if (url.pathname === "/api/apps/status") {
+        return Response.json(getAppsStatus(machineId));
+      }
+      if (url.pathname === "/api/apps/diff") {
+        return Response.json(diffApps(machineId));
+      }
+      if (url.pathname === "/api/install-claude/status") {
+        return Response.json(getClaudeCliStatus(machineId, tools));
+      }
+      if (url.pathname === "/api/install-claude/diff") {
+        return Response.json(diffClaudeCli(machineId, tools));
+      }
+      if (url.pathname === "/api/notifications/test") {
+        if (request.method !== "POST") {
+          return jsonError("Use POST for notification tests.", 405);
+        }
+        const body = await parseJsonBody(request);
+        const channelId = typeof body["channelId"] === "string" ? body["channelId"] : undefined;
+        if (!channelId) {
+          return jsonError("channelId is required.");
+        }
+        const event = typeof body["event"] === "string" ? body["event"] : undefined;
+        const message = typeof body["message"] === "string" ? body["message"] : undefined;
+        const apply = body["apply"] === true;
+        const yes = body["yes"] === true;
+        try {
+          return Response.json(await testNotificationChannel(channelId, event, message, { apply, yes }));
+        } catch (error) {
+          return jsonError(error instanceof Error ? error.message : String(error));
+        }
+      }
       return new Response(renderDashboardHtml(), {
         headers: {
           "content-type": "text/html; charset=utf-8"
@@ -17390,11 +17873,279 @@ function startDashboardServer(options = {}) {
   });
 }
 
+// src/commands/self-test.ts
+function check(id, status, summary, detail) {
+  return { id, status, summary, detail };
+}
+function runSelfTest() {
+  const version = getPackageVersion();
+  const status = getStatus();
+  const doctor = runDoctor();
+  const serveInfo = getServeInfo();
+  const html = renderDashboardHtml();
+  const notifications = listNotificationChannels();
+  const apps = listApps(status.machineId);
+  const appsDiff = diffApps(status.machineId);
+  const cliPlan = buildClaudeInstallPlan(status.machineId);
+  return {
+    machineId: getLocalMachineId(),
+    checks: [
+      check("package-version", version === "0.0.0" ? "fail" : "ok", "Package version resolves", version),
+      check("status", "ok", "Status loads", JSON.stringify({ machines: status.manifestMachineCount, heartbeats: status.heartbeatCount })),
+      check("doctor", doctor.checks.some((entry) => entry.status === "fail") ? "warn" : "ok", "Doctor completed", `${doctor.checks.length} checks`),
+      check("serve-info", "ok", "Dashboard info renders", `${serveInfo.url} routes=${serveInfo.routes.length}`),
+      check("dashboard-html", html.includes("Machines Dashboard") ? "ok" : "fail", "Dashboard HTML renders", html.slice(0, 80)),
+      check("notifications", "ok", "Notifications config loads", `${notifications.channels.length} channels`),
+      check("apps", "ok", "Apps manifest loads", `${apps.apps.length} apps`),
+      check("apps-diff", appsDiff.missing.length === 0 ? "ok" : "warn", "Apps diff computed", `missing=${appsDiff.missing.length} installed=${appsDiff.installed.length}`),
+      check("install-claude-plan", cliPlan.steps.length > 0 ? "ok" : "warn", "Install plan renders", `${cliPlan.steps.length} steps`)
+    ]
+  };
+}
+
+// src/commands/clipboard.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync8, readFileSync as readFileSync7, rmSync, writeFileSync as writeFileSync5 } from "fs";
+import { join as join9 } from "path";
+var DEFAULT_CONFIG = {
+  version: 1,
+  enabled: true,
+  port: 19452,
+  maxHistory: 500,
+  maxSizeBytes: 10 * 1024 * 1024,
+  skipPatterns: [
+    "password",
+    "secret",
+    "token",
+    "-----BEGIN",
+    "AKIA"
+  ]
+};
+function resolveConfigPath(configPath) {
+  if (configPath)
+    return configPath;
+  return join9(getDataDir(), "clipboard-config.json");
+}
+function resolveHistoryPath(historyPath) {
+  if (historyPath)
+    return historyPath;
+  return getClipboardHistoryPath();
+}
+function getDefaultConfig() {
+  return { ...DEFAULT_CONFIG, skipPatterns: [...DEFAULT_CONFIG.skipPatterns] };
+}
+function readConfig(configPath) {
+  const path = resolveConfigPath(configPath);
+  if (!existsSync8(path)) {
+    return getDefaultConfig();
+  }
+  const parsed = JSON.parse(readFileSync7(path, "utf8"));
+  return { ...getDefaultConfig(), ...parsed };
+}
+function writeConfig(config, configPath) {
+  const path = resolveConfigPath(configPath);
+  ensureParentDir(path);
+  writeFileSync5(path, `${JSON.stringify(config, null, 2)}
+`, "utf8");
+}
+function readHistory(historyPath) {
+  const path = resolveHistoryPath(historyPath);
+  if (!existsSync8(path)) {
+    return [];
+  }
+  try {
+    return JSON.parse(readFileSync7(path, "utf8"));
+  } catch {
+    return [];
+  }
+}
+function getOrCreateClipboardKey() {
+  const keyPath = getClipboardKeyPath();
+  if (existsSync8(keyPath)) {
+    return readFileSync7(keyPath, "utf8").trim();
+  }
+  const key = createHash("sha256").update(crypto.randomUUID()).digest("hex").slice(0, 32);
+  ensureParentDir(keyPath);
+  writeFileSync5(keyPath, `${key}
+`, "utf8");
+  return key;
+}
+function getDefaultClipboardConfig() {
+  return getDefaultConfig();
+}
+function getConfigPath2(configPath) {
+  return resolveConfigPath(configPath);
+}
+function readClipboardConfig(configPath) {
+  return readConfig(configPath);
+}
+function writeClipboardConfig(config, configPath) {
+  writeConfig(config, configPath);
+}
+function readClipboardHistory(historyPath) {
+  return readHistory(historyPath);
+}
+function clearClipboardHistory(historyPath) {
+  const path = resolveHistoryPath(historyPath);
+  if (existsSync8(path)) {
+    rmSync(path);
+  }
+}
+function getClipboardStatus(historyPath) {
+  const history = readHistory(historyPath);
+  const config = readConfig();
+  return {
+    running: false,
+    port: config.port,
+    historyCount: history.length
+  };
+}
+
+// src/cli-utils.ts
+function parseIntegerOption(value, label, constraints = {}) {
+  const parsed = Number.parseInt(value, 10);
+  const { min, max } = constraints;
+  if (!Number.isFinite(parsed) || !/^-?\d+$/.test(value.trim())) {
+    throw new Error(`Invalid value for ${label}: ${value}`);
+  }
+  if (min !== undefined && parsed < min) {
+    throw new Error(`Invalid value for ${label}: ${value}. Expected >= ${min}.`);
+  }
+  if (max !== undefined && parsed > max) {
+    throw new Error(`Invalid value for ${label}: ${value}. Expected <= ${max}.`);
+  }
+  return parsed;
+}
+function renderKeyValueTable(entries) {
+  const width = entries.reduce((max, [key]) => Math.max(max, key.length), 0);
+  return entries.map(([key, value]) => `${key.padEnd(width)}  ${value}`).join(`
+`);
+}
+function renderList(title, items) {
+  if (items.length === 0) {
+    return `${title}: none`;
+  }
+  return `${title}:
+${items.map((item) => `- ${item}`).join(`
+`)}`;
+}
+
 // src/cli/index.ts
+import { rmSync as rmSync2 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 var program2 = new Command;
-program2.name("machines").description("Machine fleet management CLI + MCP for developers").version(getPackageVersion());
+function printJsonOrText(data, text, json = false) {
+  if (json || program2.opts().quiet) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  console.log(text);
+}
+function renderAppsListResult(result) {
+  return [
+    `machine: ${result.machineId}`,
+    renderList("apps", result.apps.map((app) => `${app.name}${app.manager ? ` (${app.manager})` : ""}`))
+  ].join(`
+`);
+}
+function renderAppsStatusResult(result) {
+  const lines = result.apps.map((app) => {
+    const state = app.installed ? source_default.green("installed") : source_default.yellow("missing");
+    return `${app.name.padEnd(18)} ${state} ${app.version ? `v${app.version}` : ""}`.trimEnd();
+  });
+  return [`machine: ${result.machineId} (${result.source})`, ...lines].join(`
+`);
+}
+function renderAppsDiffResult(result) {
+  return [
+    `machine: ${result.machineId} (${result.source})`,
+    renderList("missing", result.missing),
+    renderList("installed", result.installed)
+  ].join(`
+`);
+}
+function renderClaudeStatusResult(result) {
+  const lines = result.tools.map((tool) => {
+    const state = tool.installed ? source_default.green("installed") : source_default.yellow("missing");
+    return `${tool.tool.padEnd(8)} ${state} ${tool.version || ""}`.trimEnd();
+  });
+  return [`machine: ${result.machineId} (${result.source})`, ...lines].join(`
+`);
+}
+function renderClaudeDiffResult(result) {
+  return [
+    `machine: ${result.machineId} (${result.source})`,
+    renderList("missing", result.missing),
+    renderList("installed", result.installed)
+  ].join(`
+`);
+}
+function renderNotificationConfigResult(config) {
+  if (config.channels.length === 0) {
+    return "notification channels: none";
+  }
+  return config.channels.map((channel) => `${channel.id} ${channel.enabled ? source_default.green("enabled") : source_default.yellow("disabled")} ${channel.type} -> ${channel.target}`).join(`
+`);
+}
+function renderNotificationTestResult(result) {
+  return renderKeyValueTable([
+    ["channel", result.channelId],
+    ["mode", result.mode],
+    ["delivered", String(result.delivered)],
+    ["detail", result.detail],
+    ["preview", result.preview]
+  ]);
+}
+function renderNotificationDispatchResult(result) {
+  return [
+    `event: ${result.event}`,
+    `message: ${result.message}`,
+    ...result.deliveries.map((delivery) => `${delivery.channelId} ${delivery.delivered ? source_default.green("delivered") : source_default.red("failed")} ${delivery.transport} ${delivery.detail}`)
+  ].join(`
+`);
+}
+function renderDoctorResult(report) {
+  const header = `machine: ${report.machineId} (${report.source})`;
+  const lines = report.checks.map((check2) => {
+    const status = check2.status === "ok" ? source_default.green(check2.status) : check2.status === "warn" ? source_default.yellow(check2.status) : source_default.red(check2.status);
+    return `${check2.id.padEnd(20)} ${status} ${check2.detail}`;
+  });
+  return [header, ...lines].join(`
+`);
+}
+function renderSelfTestResult(result) {
+  return [
+    `machine: ${result.machineId}`,
+    ...result.checks.map((check2) => {
+      const status = check2.status === "ok" ? source_default.green(check2.status) : check2.status === "warn" ? source_default.yellow(check2.status) : source_default.red(check2.status);
+      return `${check2.id.padEnd(20)} ${status} ${check2.detail}`;
+    })
+  ].join(`
+`);
+}
+function renderFleetStatus(status) {
+  return [
+    renderKeyValueTable([
+      ["machine", status.machineId],
+      ["manifest", status.manifestPath],
+      ["db", status.dbPath],
+      ["notifications", status.notificationsPath],
+      ["manifest machines", String(status.manifestMachineCount)],
+      ["heartbeats", String(status.heartbeatCount)],
+      ["setup runs", String(status.recentSetupRuns)],
+      ["sync runs", String(status.recentSyncRuns)]
+    ]),
+    "",
+    ...status.machines.map((machine) => `${machine.machineId.padEnd(18)} ${machine.platform || "unknown"} ${machine.heartbeatStatus} ${machine.lastHeartbeatAt || "\u2014"}`)
+  ].join(`
+`);
+}
+program2.name("machines").description("Machine fleet management CLI + MCP for developers").version(getPackageVersion()).option("-q, --quiet", "Suppress non-essential output");
 var manifestCommand = program2.command("manifest").description("Manage the fleet manifest");
 var appsCommand = program2.command("apps").description("Manage installed applications per machine");
+var notificationsCommand = program2.command("notifications").description("Manage fleet alert delivery channels");
+var clipboardCommand = program2.command("clipboard").description("Real-time clipboard sync across fleet machines");
+var installClaudeCommand = program2.command("install-claude").description("Install or inspect Claude, Codex, and Gemini CLIs");
 manifestCommand.command("init").description("Create an empty fleet manifest").action(() => {
   console.log(manifestInit());
 });
@@ -17422,16 +18173,22 @@ manifestCommand.command("get").description("Print a single machine from the mani
 manifestCommand.command("remove").description("Remove a machine from the manifest").argument("<id>", "Machine identifier").action((id) => {
   console.log(JSON.stringify(manifestRemove(id), null, 2));
 });
-manifestCommand.command("add").description("Add or replace a machine in the fleet manifest").requiredOption("--id <id>", "Machine identifier").requiredOption("--platform <platform>", "linux | macos | windows").requiredOption("--workspace-path <path>", "Primary workspace path").option("--hostname <hostname>", "Machine hostname").option("--ssh-address <sshAddress>", "Machine SSH address").option("--tailscale-name <tailscaleName>", "Machine Tailscale DNS name").option("--connection <connection>", "local | ssh | tailscale").option("--bun-path <path>", "Bun executable directory").option("--tag <tag...>", "Machine tags").option("--package <name...>", "Desired packages").option("--app <spec...>", "Desired apps as name[:manager[:packageName]]").option("--file <spec...>", "File sync spec source:target[:copy|symlink]").action((options) => {
+manifestCommand.command("add").description("Add or replace a machine in the fleet manifest").option("--id <id>", "Machine identifier").option("--platform <platform>", "linux | macos | windows").option("--workspace-path <path>", "Primary workspace path").option("--hostname <hostname>", "Machine hostname").option("--ssh-address <sshAddress>", "Machine SSH address").option("--tailscale-name <tailscaleName>", "Machine Tailscale DNS name").option("--connection <connection>", "local | ssh | tailscale").option("--bun-path <path>", "Bun executable directory").option("--tag <tag...>", "Machine tags").option("--package <name...>", "Desired packages").option("--app <spec...>", "Desired apps as name[:manager[:packageName]]").option("--file <spec...>", "File sync spec source:target[:copy|symlink]").option("--metadata <json>", "Machine metadata as JSON").option("--from-stdin", "Read the full MachineManifest JSON from stdin").action((options) => {
+  if (options["from-stdin"]) {
+    if (process.stdin.isTTY) {
+      console.error("error: --from-stdin requires piped input");
+      process.exit(1);
+    }
+    const input = readFileSync8(0, "utf8");
+    const machine2 = JSON.parse(input);
+    console.log(JSON.stringify(manifestAdd(machine2), null, 2));
+    return;
+  }
   const packages = Array.isArray(options["package"]) ? options["package"].map((name) => ({ name: String(name) })) : undefined;
   const files = Array.isArray(options["file"]) ? options["file"].map((value) => {
     const [source, target, mode] = String(value).split(":");
     const normalizedMode = mode === "symlink" ? "symlink" : mode === "copy" ? "copy" : undefined;
-    return {
-      source,
-      target,
-      mode: normalizedMode
-    };
+    return { source, target, mode: normalizedMode };
   }) : undefined;
   const apps = Array.isArray(options["app"]) ? options["app"].map((value) => {
     const [name, manager, packageName] = String(value).split(":");
@@ -17441,6 +18198,7 @@ manifestCommand.command("add").description("Add or replace a machine in the flee
       packageName
     };
   }) : undefined;
+  const metadata = typeof options["metadata"] === "string" ? JSON.parse(options["metadata"]) : undefined;
   const machine = {
     id: String(options["id"]),
     hostname: options["hostname"] ? String(options["hostname"]) : undefined,
@@ -17451,6 +18209,7 @@ manifestCommand.command("add").description("Add or replace a machine in the flee
     workspacePath: String(options["workspacePath"]),
     bunPath: options["bunPath"] ? String(options["bunPath"]) : undefined,
     tags: Array.isArray(options["tag"]) ? options["tag"].map(String) : undefined,
+    metadata,
     packages,
     apps,
     files
@@ -17459,65 +18218,55 @@ manifestCommand.command("add").description("Add or replace a machine in the flee
 });
 appsCommand.command("list").description("List manifest-managed apps for a machine").option("--machine <id>", "Machine identifier").option("-j, --json", "Print JSON output", false).action((options) => {
   const result = listApps(options.machine);
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+  printJsonOrText(result, renderAppsListResult(result), options.json);
+});
+appsCommand.command("status").description("Check installed state for manifest-managed apps").option("--machine <id>", "Machine identifier").option("-j, --json", "Print JSON output", false).action((options) => {
+  const result = getAppsStatus(options.machine);
+  printJsonOrText(result, renderAppsStatusResult(result), options.json);
+});
+appsCommand.command("diff").description("Show missing and installed manifest-managed apps").option("--machine <id>", "Machine identifier").option("-j, --json", "Print JSON output", false).action((options) => {
+  const result = diffApps(options.machine);
+  printJsonOrText(result, renderAppsDiffResult(result), options.json);
 });
-appsCommand.command("plan").description("Preview app install steps for a machine").option("--machine <id>", "Machine identifier").option("-j, --json", "Print JSON output", false).action((options) => {
+appsCommand.command("plan").description("Preview app install steps for a machine").option("--machine <id>", "Machine identifier").action((options) => {
   const result = buildAppsPlan(options.machine);
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+  console.log(JSON.stringify(result, null, 2));
 });
-appsCommand.command("apply").description("Install manifest-managed apps for a machine").option("--machine <id>", "Machine identifier").option("--yes", "Confirm execution", false).option("-j, --json", "Print JSON output", false).action((options) => {
+appsCommand.command("apply").description("Install manifest-managed apps for a machine").option("--machine <id>", "Machine identifier").option("--yes", "Confirm execution", false).action((options) => {
   const result = runAppsInstall(options.machine, { apply: true, yes: options.yes });
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+  console.log(JSON.stringify(result, null, 2));
 });
 program2.command("setup").description("Prepare a machine from the fleet manifest").option("--machine <id>", "Machine identifier").option("--apply", "Execute provisioning commands instead of previewing the plan", false).option("--yes", "Confirm execution when using --apply", false).option("-j, --json", "Print JSON output", false).action((options) => {
   const result = options.apply ? runSetup(options.machine, { apply: true, yes: options.yes }) : buildSetupPlan(options.machine);
-  if (options.json) {
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
   console.log(JSON.stringify(result, null, 2));
 });
 program2.command("sync").description("Reconcile a machine against the fleet manifest").option("--machine <id>", "Machine identifier").option("--apply", "Execute reconciliation commands instead of previewing the plan", false).option("--yes", "Confirm execution when using --apply", false).option("-j, --json", "Print JSON output", false).action((options) => {
   const result = options.apply ? runSync(options.machine, { apply: true, yes: options.yes }) : buildSyncPlan(options.machine);
-  if (options.json) {
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
   console.log(JSON.stringify(result, null, 2));
 });
 program2.command("diff").description("Show manifest differences between two machines").requiredOption("--left <id>", "Left machine identifier").option("--right <id>", "Right machine identifier (defaults to current machine)").option("-j, --json", "Print JSON output", false).action((options) => {
   const result = diffMachines(options.left, options.right);
-  if (options.json) {
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
   console.log(JSON.stringify(result, null, 2));
 });
 program2.command("backup").description("Create and optionally upload a machine backup archive").requiredOption("--bucket <name>", "S3 bucket name").option("--prefix <prefix>", "S3 key prefix", "machines").option("--apply", "Execute backup commands instead of previewing the plan", false).option("--yes", "Confirm execution when using --apply", false).option("-j, --json", "Print JSON output", false).action((options) => {
   const result = options.apply ? runBackup(options.bucket, options.prefix, { apply: true, yes: options.yes }) : buildBackupPlan(options.bucket, options.prefix);
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+  console.log(JSON.stringify(result, null, 2));
 });
 var certCommand = program2.command("cert").description("Manage mkcert-based local SSL certificates");
 certCommand.command("issue").description("Plan or issue certificates for one or more domains").argument("<domains...>", "Domains to include in the certificate").option("--apply", "Execute certificate commands instead of previewing them", false).option("--yes", "Confirm execution when using --apply", false).option("-j, --json", "Print JSON output", false).action((domains, options) => {
   const result = options.apply ? runCertPlan(domains, { apply: true, yes: options.yes }) : buildCertPlan(domains);
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+  console.log(JSON.stringify(result, null, 2));
 });
 var dnsCommand = program2.command("dns").description("Manage local domain mappings");
-var notificationsCommand = program2.command("notifications").description("Manage fleet alert delivery channels");
 dnsCommand.command("add").description("Add or replace a local domain mapping").requiredOption("--domain <domain>", "Domain name").requiredOption("--port <port>", "Target port").option("--target-host <host>", "Target host", "127.0.0.1").option("-j, --json", "Print JSON output", false).action((options) => {
-  const result = addDomainMapping(options.domain, Number.parseInt(options.port, 10), options.targetHost);
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+  const result = addDomainMapping(options.domain, parseIntegerOption(options.port, "port", { min: 1, max: 65535 }), options.targetHost);
+  console.log(JSON.stringify(result, null, 2));
 });
-dnsCommand.command("list").description("List saved local domain mappings").option("-j, --json", "Print JSON output", false).action((options) => {
-  const result = listDomainMappings();
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+dnsCommand.command("list").description("List saved local domain mappings").option("-j, --json", "Print JSON output", false).action(() => {
+  console.log(JSON.stringify(listDomainMappings(), null, 2));
+});
+dnsCommand.command("render").description("Render hosts/proxy configuration for a domain").argument("<domain>", "Domain name").option("-j, --json", "Print JSON output", false).action((domain) => {
+  console.log(JSON.stringify(renderDomainMapping(domain), null, 2));
 });
 notificationsCommand.command("add").description("Add or replace a notification channel").requiredOption("--id <id>", "Channel identifier").requiredOption("--type <type>", "email | webhook | command").requiredOption("--target <target>", "Email, webhook URL, or shell command").option("--event <event...>", "Events routed to this channel", ["setup_failed", "sync_failed"]).option("--disabled", "Create the channel in disabled state", false).option("-j, --json", "Print JSON output", false).action((options) => {
   const result = addNotificationChannel({
@@ -17527,41 +18276,107 @@ notificationsCommand.command("add").description("Add or replace a notification c
     events: options.event,
     enabled: !options.disabled
   });
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+  printJsonOrText(result, renderNotificationConfigResult(result), options.json);
 });
 notificationsCommand.command("list").description("List configured notification channels").option("-j, --json", "Print JSON output", false).action((options) => {
   const result = listNotificationChannels();
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+  printJsonOrText(result, renderNotificationConfigResult(result), options.json);
 });
-notificationsCommand.command("test").description("Preview or execute a notification test").requiredOption("--channel <id>", "Channel identifier").option("--event <name>", "Event name", "manual.test").option("--message <message>", "Test message", "machines notification test").option("--apply", "Execute the notification test instead of previewing it", false).option("--yes", "Confirm execution when using --apply", false).option("-j, --json", "Print JSON output", false).action((options) => {
-  const result = testNotificationChannel(options.channel, options.event, options.message, {
+notificationsCommand.command("test").description("Preview or execute a notification test").requiredOption("--channel <id>", "Channel identifier").option("--event <name>", "Event name", "manual.test").option("--message <message>", "Test message", "machines notification test").option("--apply", "Execute the notification test instead of previewing it", false).option("--yes", "Confirm execution when using --apply", false).option("-j, --json", "Print JSON output", false).action(async (options) => {
+  const result = await testNotificationChannel(options.channel, options.event, options.message, {
     apply: options.apply,
     yes: options.yes
   });
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+  printJsonOrText(result, renderNotificationTestResult(result), options.json);
+});
+notificationsCommand.command("dispatch").description("Dispatch an event to matching notification channels").requiredOption("--event <name>", "Event name").requiredOption("--message <message>", "Message body").option("--channel <id>", "Limit delivery to one channel").option("-j, --json", "Print JSON output", false).action(async (options) => {
+  const result = await dispatchNotificationEvent(options.event, options.message, { channelId: options.channel });
+  printJsonOrText(result, renderNotificationDispatchResult(result), options.json);
 });
 notificationsCommand.command("remove").description("Remove a notification channel").argument("<id>", "Channel identifier").option("-j, --json", "Print JSON output", false).action((id, options) => {
   const result = removeNotificationChannel(id);
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+  printJsonOrText(result, renderNotificationConfigResult(result), options.json);
+});
+clipboardCommand.command("init").description("Initialize clipboard sync (generate shared secret)").option("-j, --json", "Print JSON output", false).action((options) => {
+  const key = getOrCreateClipboardKey();
+  const config = getDefaultClipboardConfig();
+  writeClipboardConfig(config);
+  const result = { keyPath: getClipboardKeyPath(), key, configPath: getConfigPath2(), config };
+  printJsonOrText(result, `clipboard initialized
+key: ${key}
+port: ${config.port}`, options.json);
 });
-dnsCommand.command("render").description("Render hosts/proxy configuration for a domain").argument("<domain>", "Domain name").option("-j, --json", "Print JSON output", false).action((domain, options) => {
-  const result = renderDomainMapping(domain);
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+clipboardCommand.command("status").description("Check clipboard sync status").option("-j, --json", "Print JSON output", false).action((options) => {
+  const status = getClipboardStatus();
+  const config = readClipboardConfig();
+  const result = { ...status, enabled: config.enabled };
+  printJsonOrText(result, `clipboard sync ${config.enabled ? source_default.green("enabled") : source_default.yellow("disabled")} (port ${status.port}, ${status.historyCount} entries)`, options.json);
 });
-program2.command("install-claude").description("Install or update Claude, Codex, and Gemini CLIs across the fleet").option("--machine <id>", "Machine identifier").option("--tool <name...>", "CLI tools to install (claude, codex, gemini)").option("--apply", "Execute installation commands instead of previewing the plan", false).option("--yes", "Confirm execution when using --apply", false).option("-j, --json", "Print JSON output", false).action((options) => {
-  const result = options.apply ? runClaudeInstall(options.machine, options.tool, { apply: true, yes: options.yes }) : buildClaudeInstallPlan(options.machine, options.tool);
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+clipboardCommand.command("config").description("View or set clipboard sync config").option("--set <json>", "Set config values as JSON").option("-j, --json", "Print JSON output", false).action((options) => {
+  if (options.set) {
+    const partial = JSON.parse(options.set);
+    const config2 = { ...readClipboardConfig(), ...partial };
+    writeClipboardConfig(config2);
+  }
+  const config = readClipboardConfig();
+  printJsonOrText(config, renderKeyValueTable([
+    ["enabled", String(config.enabled)],
+    ["port", String(config.port)],
+    ["maxHistory", String(config.maxHistory)],
+    ["maxSizeBytes", `${config.maxSizeBytes} bytes`],
+    ["skipPatterns", config.skipPatterns.join(", ")]
+  ]), options.json);
+});
+clipboardCommand.command("history").description("Show clipboard sync history").option("-j, --json", "Print JSON output", false).option("--limit <n>", "Show only the last N entries", "20").action((options) => {
+  const limit = parseIntegerOption(options.limit, "limit", { min: 1, max: 100 });
+  const entries = readClipboardHistory().slice(0, limit);
+  if (options.json) {
+    console.log(JSON.stringify(entries, null, 2));
+    return;
+  }
+  if (entries.length === 0) {
+    console.log("clipboard history: empty");
+    return;
+  }
+  for (const entry of entries) {
+    const preview = entry.content.length > 80 ? `${entry.content.slice(0, 80)}...` : entry.content;
+    console.log(`${source_default.dim(entry.timestamp)} ${entry.sourceMachine.padEnd(12)} ${entry.contentType.padEnd(5)} ${preview.replace(/\n/g, " ")}`);
+  }
+});
+clipboardCommand.command("clear-history").description("Clear clipboard sync history").option("--yes", "Confirm without prompt", false).action((options) => {
+  if (!options.yes) {
+    console.error("error: this command requires --yes");
+    process.exit(1);
+  }
+  clearClipboardHistory();
+  console.log("clipboard history cleared");
+});
+clipboardCommand.command("key").description("Show or rotate the shared secret key").option("--rotate", "Generate a new key", false).option("-j, --json", "Print JSON output", false).action((options) => {
+  if (options.rotate) {
+    rmSync2(getClipboardKeyPath(), { force: true });
+  }
+  const key = getOrCreateClipboardKey();
+  printJsonOrText({ key }, key, options.json);
+});
+installClaudeCommand.command("status").description("Check installed state for Claude, Codex, and Gemini CLIs").option("--machine <id>", "Machine identifier").option("--tool <name...>", "CLI tools to inspect (claude, codex, gemini)").option("-j, --json", "Print JSON output", false).action((options) => {
+  const result = getClaudeCliStatus(options.machine, options.tool);
+  printJsonOrText(result, renderClaudeStatusResult(result), options.json);
+});
+installClaudeCommand.command("diff").description("Show missing and installed Claude, Codex, and Gemini CLIs").option("--machine <id>", "Machine identifier").option("--tool <name...>", "CLI tools to inspect (claude, codex, gemini)").option("-j, --json", "Print JSON output", false).action((options) => {
+  const result = diffClaudeCli(options.machine, options.tool);
+  printJsonOrText(result, renderClaudeDiffResult(result), options.json);
+});
+installClaudeCommand.command("plan").description("Preview CLI install steps").option("--machine <id>", "Machine identifier").option("--tool <name...>", "CLI tools to install (claude, codex, gemini)").option("-j, --json", "Print JSON output", false).action((options) => {
+  const result = buildClaudeInstallPlan(options.machine, options.tool);
+  console.log(JSON.stringify(result, null, 2));
+});
+installClaudeCommand.command("apply").description("Install or update the requested CLIs").option("--machine <id>", "Machine identifier").option("--tool <name...>", "CLI tools to install (claude, codex, gemini)").option("--yes", "Confirm execution when using apply", false).option("-j, --json", "Print JSON output", false).action((options) => {
+  const result = runClaudeInstall(options.machine, options.tool, { apply: true, yes: options.yes });
+  console.log(JSON.stringify(result, null, 2));
 });
 program2.command("install-tailscale").description("Install Tailscale on a machine").option("--machine <id>", "Machine identifier").option("--apply", "Execute installation commands instead of previewing the plan", false).option("--yes", "Confirm execution when using --apply", false).option("-j, --json", "Print JSON output", false).action((options) => {
   const result = options.apply ? runTailscaleInstall(options.machine, { apply: true, yes: options.yes }) : buildTailscaleInstallPlan(options.machine);
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+  console.log(JSON.stringify(result, null, 2));
 });
 program2.command("ssh").description("Choose the best SSH route for a machine").requiredOption("--machine <id>", "Machine identifier").option("--cmd <command>", "Remote command to run").option("-j, --json", "Print JSON output", false).action((options) => {
   if (options.json) {
@@ -17572,27 +18387,27 @@ program2.command("ssh").description("Choose the best SSH route for a machine").r
 });
 program2.command("ports").description("List listening ports on a machine").option("--machine <id>", "Machine identifier").option("-j, --json", "Print JSON output", false).action((options) => {
   const result = listPorts(options.machine);
-  const rendered = JSON.stringify(result, null, 2);
-  console.log(options.json ? rendered : rendered);
+  console.log(JSON.stringify(result, null, 2));
 });
 program2.command("status").description("Print local machine and storage status").option("-j, --json", "Print JSON output", false).action((options) => {
   const status = getStatus();
-  const rendered = JSON.stringify(status, null, 2);
-  console.log(options.json ? rendered : source_default.cyan(rendered));
+  printJsonOrText(status, renderFleetStatus(status), options.json);
+});
+program2.command("doctor").description("Run machine preflight checks").option("--machine <id>", "Machine identifier").option("-j, --json", "Print JSON output", false).action((options) => {
+  const result = runDoctor(options.machine);
+  printJsonOrText(result, renderDoctorResult(result), options.json);
+});
+program2.command("self-test").description("Run local package smoke checks").option("-j, --json", "Print JSON output", false).action((options) => {
+  const result = runSelfTest();
+  printJsonOrText(result, renderSelfTestResult(result), options.json);
 });
 program2.command("serve").description("Serve a local fleet dashboard and JSON API").option("--host <host>", "Host interface to bind", "0.0.0.0").option("--port <port>", "Port to bind", "7676").option("-j, --json", "Print serve config and exit", false).action((options) => {
-  const info = getServeInfo({
-    host: options.host,
-    port: Number.parseInt(options.port, 10)
-  });
+  const info = getServeInfo({ host: options.host, port: parseIntegerOption(options.port, "port", { min: 1, max: 65535 }) });
   if (options.json) {
     console.log(JSON.stringify(info, null, 2));
     return;
   }
-  const server = startDashboardServer({
-    host: info.host,
-    port: info.port
-  });
+  const server = startDashboardServer({ host: info.host, port: info.port });
   console.log(source_default.green(`machines dashboard listening on http://${server.hostname}:${server.port}`));
 });
 await program2.parseAsync(process.argv);