@hasna/machines 0.0.24 → 0.0.25

package/README.md

@@ -118,6 +118,32 @@ machines topology --no-tailscale --json
 machines route --machine spark01 --json
 ```
 
+## Screen sharing
+
+Open Screen Sharing (VNC) to any machine using its best live route — no stale
+IP bookmarks. The route resolver picks the current LAN address or Tailscale name
+automatically, so it keeps working even when DHCP rotates a machine's IP.
+
+```bash
+machines screen machine005                 # open Screen Sharing.app → vnc://<user>@<live-route>
+machines screen machine005 --print         # print the vnc:// URL instead of opening
+machines screen machine005 --json          # full resolution detail (route, confidence, user)
+machines screen --all                      # open every reachable machine
+machines screen --all --print              # list resolved vnc:// URLs for the whole fleet
+```
+
+Enable Remote Management / Screen Sharing on a fresh macOS machine over SSH
+(kickstart + SRP + legacy VNC password so user-password auth works from
+Screen Sharing.app and Apple Remote Desktop):
+
+```bash
+machines screen-enable --machine machine005 --user jo --vnc-password steaua17
+machines screen-enable --machine machine005 --user jo --print   # show the SSH command, don't run it
+```
+
+`--vnc-password` is truncated to 8 characters by the legacy VNC protocol. The
+user comes from the manifest (`metadata.user`) when present, or `--user`.
+
 Consumers that need repo paths can resolve trust-aware workspace mappings
 without importing the full machines app:
 

package/dist/agent/index.js

@@ -979,7 +979,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          } else {}
+          }
         };
       }
       return this;

package/dist/cli/index.js

@@ -993,7 +993,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          } else {}
+          }
         };
       }
       return this;
@@ -2601,6 +2601,9 @@ var {
   Help
 } = import__.default;
 
+// src/cli/index.ts
+import { execFileSync } from "child_process";
+
 // node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
 var wrapAnsi16 = (offset = 0) => (code) => `\x1B[${code + offset}m`;
@@ -7165,6 +7168,7 @@ function writeManifest(manifest, path = getManifestPath()) {
     generatedAt: new Date().toISOString(),
     machines: normalizeMachines(manifest.machines)
   };
+  fleetSchema.parse(payload);
   writeFileSync(path, `${JSON.stringify(payload, null, 2)}
 `, "utf8");
   return path;
@@ -7200,9 +7204,10 @@ function manifestList() {
   return readManifest();
 }
 function manifestAdd(machine) {
+  const validatedMachine = machineSchema.parse(machine);
   const manifest = readManifest();
-  const nextMachines = manifest.machines.filter((entry) => entry.id !== machine.id);
-  nextMachines.push(machine);
+  const nextMachines = manifest.machines.filter((entry) => entry.id !== validatedMachine.id);
+  nextMachines.push(validatedMachine);
   const nextManifest = { ...manifest, machines: nextMachines };
   writeManifest(nextManifest);
   return nextManifest;
@@ -7227,6 +7232,7 @@ function manifestValidate() {
 }
 
 // src/commands/setup.ts
+import { homedir as homedir2 } from "os";
 init_db();
 function quote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
@@ -7275,11 +7281,11 @@ function buildPackageSteps(machine) {
     const manager = pkg.manager || (machine.platform === "macos" ? "brew" : "apt");
     let command = pkg.name;
     if (manager === "bun") {
-      command = `bun install -g ${pkg.name}`;
+      command = `bun install -g ${quote(pkg.name)}`;
     } else if (manager === "brew") {
-      command = `brew install ${pkg.name}`;
+      command = `brew install ${quote(pkg.name)}`;
     } else if (manager === "apt") {
-      command = `sudo apt-get install -y ${pkg.name}`;
+      command = `sudo apt-get install -y ${quote(pkg.name)}`;
     }
     return {
       id: `package-${index + 1}`,
@@ -7297,7 +7303,7 @@ function buildSetupPlan(machineId) {
   const target = selected || {
     id: currentMachineId,
     platform: "linux",
-    workspacePath: "~/workspace"
+    workspacePath: `${homedir2()}/workspace`
   };
   const steps = [...buildBaseSteps(target), ...buildPackageSteps(target)];
   return {
@@ -7343,7 +7349,7 @@ function runSetup(machineId, options = {}) {
 }
 
 // src/commands/backup.ts
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3, hostname as hostname3 } from "os";
 import { join as join3 } from "path";
 var MACHINES_BACKUP_BUCKET_ENV = "HASNA_MACHINES_S3_BUCKET";
 var MACHINES_BACKUP_BUCKET_FALLBACK_ENV = "MACHINES_S3_BUCKET";
@@ -7392,7 +7398,7 @@ function resolveBackupTarget(options = {}) {
   };
 }
 function defaultBackupSources() {
-  const home = homedir2();
+  const home = homedir3();
   return [
     join3(home, ".hasna"),
     join3(home, ".ssh"),
@@ -7401,7 +7407,7 @@ function defaultBackupSources() {
 }
 function buildBackupPlan(bucket, prefix) {
   const target = resolveBackupTarget({ bucket, prefix });
-  const archivePath = join3(homedir2(), ".hasna", "machines", "backup.tgz");
+  const archivePath = join3(homedir3(), ".hasna", "machines", "backup.tgz");
   const sources = defaultBackupSources();
   const steps = [
     {
@@ -7413,7 +7419,7 @@ function buildBackupPlan(bucket, prefix) {
     {
       id: "backup-upload",
       title: "Upload archive to S3",
-      command: `aws s3 cp ${quote2(archivePath)} s3://${target.bucket}/${target.prefix}/$(hostname)-backup.tgz`,
+      command: `aws s3 cp ${quote2(archivePath)} ${quote2(`s3://${target.bucket}/${target.prefix}/${hostname3()}-backup.tgz`)}`,
       manager: "custom"
     }
   ];
@@ -7452,13 +7458,13 @@ function runBackup(bucket, prefix, options = {}) {
 }
 
 // src/commands/cert.ts
-import { homedir as homedir3, platform as platform2 } from "os";
+import { homedir as homedir4, platform as platform2 } from "os";
 import { join as join4 } from "path";
 function quote3(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function certDir() {
-  return join4(homedir3(), ".hasna", "machines", "certs");
+  return join4(homedir4(), ".hasna", "machines", "certs");
 }
 function buildCertPlan(domains) {
   if (domains.length === 0) {
@@ -7618,12 +7624,12 @@ function diffMachines(leftMachineId, rightMachineId) {
 // src/remote.ts
 init_db();
 import { spawnSync as spawnSync2 } from "child_process";
-import { hostname as hostname4 } from "os";
+import { hostname as hostname5 } from "os";
 
 // src/topology.ts
 init_db();
 import { existsSync as existsSync5 } from "fs";
-import { arch as arch2, hostname as hostname3, platform as platform3, userInfo as userInfo2 } from "os";
+import { arch as arch2, hostname as hostname4, platform as platform3, userInfo as userInfo2 } from "os";
 import { spawnSync } from "child_process";
 init_paths();
 var MACHINES_CONSUMER_CONTRACT_VERSION = 1;
@@ -7847,7 +7853,7 @@ function discoverMachineTopology(options = {}) {
     capabilities: getMachinesConsumerCapabilities(),
     generated_at: now.toISOString(),
     local_machine_id: localMachineId,
-    local_hostname: hostname3(),
+    local_hostname: hostname4(),
     current_platform: normalizePlatform2(),
     manifest_path_known: existsSync5(getManifestPath()),
     machines,
@@ -7872,7 +7878,7 @@ function routeTargetMatches(machine, requested) {
 }
 function findRouteMachine(topology, requestedMachineId) {
   const requested = normalizeMachineAlias(requestedMachineId);
-  if (requested === "local" || requested === "localhost" || requested === normalizeMachineAlias(hostname3()) || requested === normalizeMachineAlias(topology.local_machine_id)) {
+  if (requested === "local" || requested === "localhost" || requested === normalizeMachineAlias(hostname4()) || requested === normalizeMachineAlias(topology.local_machine_id)) {
     return {
       machine: topology.machines.find((machine) => machine.machine_id === topology.local_machine_id) ?? null,
       matchedBy: "local_alias"
@@ -8497,7 +8503,7 @@ function shellQuote3(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
 function machineIsLocal(machineId, localMachineId) {
-  return machineId === "local" || machineId === "localhost" || machineId === localMachineId || machineId === hostname4();
+  return machineId === "local" || machineId === "localhost" || machineId === localMachineId || machineId === hostname5();
 }
 function resolveMachineCommand(machineId, command, localMachineId = getLocalMachineId()) {
   if (machineIsLocal(machineId, localMachineId)) {
@@ -8549,20 +8555,21 @@ function shellQuote4(value) {
 }
 function buildAppCommand(machine, app) {
   const packageName = getPackageName(app);
+  const quotedPackageName = shellQuote4(packageName);
   const manager = getAppManager(machine, app);
   if (manager === "custom") {
     return packageName;
   }
   if (machine.platform === "macos") {
     if (manager === "cask") {
-      return `brew install --cask ${packageName}`;
+      return `brew install --cask ${quotedPackageName}`;
     }
-    return `brew install ${packageName}`;
+    return `brew install ${quotedPackageName}`;
   }
   if (machine.platform === "windows") {
-    return `winget install ${packageName}`;
+    return `winget install ${quotedPackageName}`;
   }
-  return `sudo apt-get install -y ${packageName}`;
+  return `sudo apt-get install -y ${quotedPackageName}`;
 }
 function buildAppProbeCommand(machine, app) {
   const packageName = shellQuote4(getPackageName(app));
@@ -9145,8 +9152,55 @@ function listPorts(machineId) {
   };
 }
 
+// src/commands/screen.ts
+function shellQuote6(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function splitTarget(target) {
+  const at = target.indexOf("@");
+  if (at === -1)
+    return [null, target];
+  return [target.slice(0, at), target.slice(at + 1)];
+}
+function resolveScreenTarget(machineId, options = {}) {
+  const resolved = resolveMachineRoute(machineId, options);
+  if (!resolved.ok || !resolved.target) {
+    throw new Error(`Machine route not found: ${machineId}`);
+  }
+  if (resolved.route === "unknown") {
+    throw new Error(`Machine route is not reachable for screen sharing: ${machineId}`);
+  }
+  let [user, host] = splitTarget(resolved.target);
+  if (!user) {
+    const topology = options.topology ?? discoverMachineTopology(options);
+    const entry = topology.machines.find((m) => m.machine_id === (resolved.machine_id ?? machineId));
+    user = entry?.user ?? null;
+  }
+  const url = user ? `vnc://${user}@${host}` : `vnc://${host}`;
+  return {
+    machineId: resolved.machine_id ?? machineId,
+    user,
+    host,
+    url,
+    route: resolved.route,
+    confidence: resolved.confidence,
+    warnings: resolved.warnings
+  };
+}
+function buildScreenEnableRemoteCommand(user, vncPassword) {
+  const kickstart = "/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart";
+  const lines = [
+    `dseditgroup -o edit -a ${shellQuote6(user)} -t user com.apple.access_screensharing 2>/dev/null || true`,
+    "defaults write /Library/Preferences/com.apple.RemoteManagement AllowSRPForNetworkNodes -bool true",
+    `${kickstart} -configure -clientopts -setvnclegacy -vnclegacy yes -setvncpw -vncpw ${shellQuote6(vncPassword)}`,
+    `${kickstart} -activate -configure -access -on -users ${shellQuote6(user)} -privs -all -restart -agent -menu`
+  ];
+  return lines.join(" && ");
+}
+
 // src/commands/sync.ts
 import { existsSync as existsSync7, lstatSync, readFileSync as readFileSync5, symlinkSync, copyFileSync } from "fs";
+import { homedir as homedir5 } from "os";
 init_paths();
 init_db();
 function quote4(value) {
@@ -9166,13 +9220,13 @@ function packageCheckCommand(machine, packageName, manager = machine.platform ==
 }
 function packageInstallCommand(machine, packageName, manager = machine.platform === "macos" ? "brew" : "apt") {
   if (manager === "bun") {
-    return `bun install -g ${packageName}`;
+    return `bun install -g ${quote4(packageName)}`;
   }
   if (manager === "brew") {
-    return `brew install ${packageName}`;
+    return `brew install ${quote4(packageName)}`;
   }
   if (manager === "apt") {
-    return `sudo apt-get install -y ${packageName}`;
+    return `sudo apt-get install -y ${quote4(packageName)}`;
   }
   return packageName;
 }
@@ -9225,7 +9279,7 @@ function buildSyncPlan(machineId) {
   const target = selected || {
     id: currentMachineId,
     platform: "linux",
-    workspacePath: "~/workspace"
+    workspacePath: `${homedir5()}/workspace`
   };
   const actions = [
     ...detectPackageActions(target),
@@ -9492,7 +9546,7 @@ var DEFAULT_COMMANDS = [
 function defaultPackages() {
   return [{ name: "@hasna/machines", command: "machines", expectedVersion: getPackageVersion(), required: true }];
 }
-function shellQuote6(value) {
+function shellQuote7(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
 function commandId(value) {
@@ -9543,7 +9597,7 @@ function defaultRunner2(machineId, command) {
   return runMachineCommand(machineId, command);
 }
 function inspectCommand(machineId, spec, runner) {
-  const command = shellQuote6(spec.command);
+  const command = shellQuote7(spec.command);
   const versionArgs = spec.versionArgs ?? "--version";
   const script = [
     `cmd=${command}`,
@@ -9572,7 +9626,7 @@ function fieldCommand(field) {
 }
 function inspectWorkspace(machineId, spec, runner) {
   const script = [
-    `path=${shellQuote6(spec.path)}`,
+    `path=${shellQuote7(spec.path)}`,
     'printf "exists=%s\\n" "$(test -d "$path" && printf yes || printf no)"',
     'pkg="$path/package.json"',
     'printf "package_json=%s\\n" "$(test -f "$pkg" && printf yes || printf no)"',
@@ -11318,6 +11372,11 @@ manifestCommand.command("add").description("Add or replace a machine in the flee
     console.log(JSON.stringify(manifestAdd(machine2), null, 2));
     return;
   }
+  for (const key of ["id", "platform", "workspacePath"]) {
+    if (typeof options[key] !== "string" || !options[key].trim()) {
+      throw new Error(`manifest add requires --${key === "workspacePath" ? "workspace-path" : key} unless --from-stdin is used`);
+    }
+  }
   const packages = Array.isArray(options["package"]) ? options["package"].map((name) => ({ name: String(name) })) : undefined;
   const files = Array.isArray(options["file"]) ? options["file"].map((value) => {
     const [source, target, mode] = String(value).split(":");
@@ -11623,6 +11682,68 @@ program2.command("ssh").description("Choose the best SSH route for a machine").r
   }
   console.log(buildSshCommand(options.machine, options.cmd));
 });
+program2.command("screen").description("Open Screen Sharing (VNC) to a machine using its best live route").argument("[machine]", "Machine identifier").option("--machine <id>", "Machine identifier (alternative to positional arg)").option("--all", "Open every reachable machine", false).option("--print", "Print the vnc:// URL instead of opening it", false).option("-j, --json", "Print JSON output", false).action((machineArg, options) => {
+  if (options.all) {
+    const topology = discoverMachineTopology();
+    const results = topology.machines.map((m) => {
+      try {
+        const resolved2 = resolveScreenTarget(m.machine_id, { topology });
+        return { machine: m.machine_id, ok: true, url: resolved2.url, route: resolved2.route };
+      } catch (error) {
+        return { machine: m.machine_id, ok: false, error: error instanceof Error ? error.message : String(error) };
+      }
+    });
+    if (options.json) {
+      console.log(JSON.stringify(results, null, 2));
+      return;
+    }
+    for (const r of results) {
+      if (r.ok && r.url) {
+        if (!options.print)
+          execFileSync("open", [r.url], { stdio: "ignore" });
+        console.log(`${r.ok ? "\u2713" : "\u2717"} ${r.machine.padEnd(14)} ${r.url ?? r.error}`);
+      } else {
+        console.log(`\u2717 ${r.machine.padEnd(14)} ${r.error}`);
+      }
+    }
+    return;
+  }
+  const machineId = machineArg ?? options.machine;
+  if (!machineId) {
+    console.error("Provide a machine: machines screen <id>  (or --all)");
+    process.exitCode = 1;
+    return;
+  }
+  const resolved = resolveScreenTarget(machineId);
+  if (options.json) {
+    console.log(JSON.stringify(resolved, null, 2));
+    return;
+  }
+  if (options.print) {
+    console.log(resolved.url);
+    return;
+  }
+  execFileSync("open", [resolved.url], { stdio: "ignore" });
+  console.log(`Opening Screen Sharing \u2192 ${resolved.url} (route: ${resolved.route})`);
+});
+program2.command("screen-enable").description("Enable Remote Management / Screen Sharing on a macOS machine over SSH").requiredOption("--machine <id>", "Machine identifier").option("--user <user>", "macOS user to grant screen-sharing (overrides manifest)").option("--vnc-password <pw>", "Legacy VNC password (<=8 chars honored)", "").option("--print", "Print the remote command instead of running it", false).action((options) => {
+  const screen = resolveScreenTarget(options.machine);
+  const user = options.user ?? screen.user;
+  if (!user) {
+    console.error(`No SSH user known for ${options.machine}; pass --user <name> or set metadata.user in the manifest.`);
+    process.exitCode = 1;
+    return;
+  }
+  const vncPw = (options.vncPassword || "").slice(0, 8);
+  const remoteCmd = buildScreenEnableRemoteCommand(user, vncPw);
+  const sshCmd = buildSshCommand(options.machine, `sudo -p '' bash -c ${JSON.stringify(remoteCmd)}`);
+  if (options.print) {
+    console.log(sshCmd);
+    return;
+  }
+  console.log(`Run this to enable Screen Sharing on ${options.machine} (will prompt for sudo on the target):`);
+  console.log(`  ${sshCmd}`);
+});
 program2.command("ports").description("List listening ports on a machine").option("--machine <id>", "Machine identifier").option("-j, --json", "Print JSON output", false).action((options) => {
   const result = listPorts(options.machine);
   console.log(JSON.stringify(result, null, 2));
@@ -11787,4 +11908,10 @@ healCommand.command("uninstall").description("Remove the systemd watchdog servic
   }
   console.log(renderList("uninstall", uninstallHealService()));
 });
-await program2.parseAsync(process.argv);
+try {
+  await program2.parseAsync(process.argv);
+} catch (error) {
+  const message = error instanceof Error ? error.message : String(error);
+  console.error(source_default.red(message));
+  process.exit(1);
+}

package/dist/commands/apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../../src/commands/apps.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAGhB,eAAe,EACf,WAAW,EAEZ,MAAM,aAAa,CAAC;AA8FrB,wBAAgB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,EAAE,CAAA;CAAE,CAM3F;AAED,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAQ7D;AAED,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAWlE;AAED,wBAAgB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,cAAc,CAO3D;AAED,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,WAAW,CA0BhH"}
+{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../../src/commands/apps.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAGhB,eAAe,EACf,WAAW,EAEZ,MAAM,aAAa,CAAC;AA+FrB,wBAAgB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,EAAE,CAAA;CAAE,CAM3F;AAED,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAQ7D;AAED,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAWlE;AAED,wBAAgB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,cAAc,CAO3D;AAED,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,WAAW,CA0BhH"}

package/dist/commands/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/commands/manifest.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAElE,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,YAAY,IAAI,aAAa,CAE5C;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,aAAa,CAOnE;AAED,wBAAgB,+BAA+B,IAAI,aAAa,CAE/D;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAErE;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,CAQ/D;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CAEhD"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/commands/manifest.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAElE,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,YAAY,IAAI,aAAa,CAE5C;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,aAAa,CAQnE;AAED,wBAAgB,+BAA+B,IAAI,aAAa,CAE/D;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAErE;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,CAQ/D;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CAEhD"}

package/dist/commands/screen.d.ts

@@ -0,0 +1,35 @@
+import { type MachineRouteOptions, type MachineRouteKind, type MachineRouteConfidence } from "../topology.js";
+export interface ResolvedScreenTarget {
+    machineId: string;
+    user: string | null;
+    host: string;
+    url: string;
+    route: MachineRouteKind;
+    confidence: MachineRouteConfidence;
+    warnings: string[];
+}
+/**
+ * Resolve the best screen-sharing (VNC) target for a machine.
+ * Prefers the live LAN route over Tailscale (lower latency for screen sharing),
+ * and always produces a `vnc://user@host` URL when a user is known.
+ */
+export declare function resolveScreenTarget(machineId: string, options?: MachineRouteOptions): ResolvedScreenTarget;
+/**
+ * Build the macOS command that opens Screen Sharing to a machine.
+ * `open vnc://user@host` launches Screen Sharing.app pointed at the resolved route.
+ */
+export declare function buildScreenCommand(machineId: string, options?: MachineRouteOptions): string;
+/**
+ * Build the remote command that ENABLES Remote Management / Screen Sharing on a
+ * macOS target via `kickstart`, plus the SRP + legacy-VNC password tweaks that
+ * make user-password auth work reliably from Screen Sharing.app and ARD.
+ *
+ * `vncPassword` is truncated to 8 chars by the VNC protocol; callers should pass
+ * an <=8 char value (or accept that only the first 8 chars are honored by legacy
+ * VNC clients).
+ *
+ * Returns the shell command to run AS ROOT on the target (caller pipes the sudo
+ * password or runs under an already-root context).
+ */
+export declare function buildScreenEnableRemoteCommand(user: string, vncPassword: string): string;
+//# sourceMappingURL=screen.d.ts.map

package/dist/commands/screen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen.d.ts","sourceRoot":"","sources":["../../src/commands/screen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgD,KAAK,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE5J,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,gBAAgB,CAAC;IACxB,UAAU,EAAE,sBAAsB,CAAC;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAgBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,oBAAoB,CA+B9G;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,MAAM,CAG/F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAcxF"}

package/dist/commands/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAmB,WAAW,EAAa,MAAM,aAAa,CAAC;AAsE3E,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAqB9D;AAED,wBAAgB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,WAAW,CAoC1G"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAmB,WAAW,EAAa,MAAM,aAAa,CAAC;AAsE3E,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,CAqB9D;AAED,wBAAgB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,WAAW,CAoC1G"}

package/dist/commands/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/commands/sync.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAA+B,UAAU,EAAE,MAAM,aAAa,CAAC;AAiF3E,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,CAwB5D;AAwBD,wBAAgB,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,UAAU,CAyCxG"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/commands/sync.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAA+B,UAAU,EAAE,MAAM,aAAa,CAAC;AAiF3E,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,CAwB5D;AAwBD,wBAAgB,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,UAAU,CAyCxG"}

package/dist/consumer.js

@@ -4264,6 +4264,7 @@ function writeManifest(manifest, path = getManifestPath()) {
     generatedAt: new Date().toISOString(),
     machines: normalizeMachines(manifest.machines)
   };
+  fleetSchema.parse(payload);
   writeFileSync(path, `${JSON.stringify(payload, null, 2)}
 `, "utf8");
   return path;

package/dist/index.d.ts

@@ -21,6 +21,7 @@ export * from "./commands/self-test.js";
 export * from "./commands/serve.js";
 export * from "./commands/setup.js";
 export * from "./commands/ssh.js";
+export * from "./commands/screen.js";
 export * from "./commands/sync.js";
 export * from "./commands/status.js";
 export * from "./commands/workspace.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,0BAA0B,CAAC;AACzC,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,kCAAkC,EAClC,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtH,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,0BAA0B,CAAC;AACzC,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,kCAAkC,EAClC,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtH,cAAc,cAAc,CAAC"}

package/dist/index.js

@@ -11060,6 +11060,7 @@ function writeManifest(manifest, path = getManifestPath()) {
     generatedAt: new Date().toISOString(),
     machines: normalizeMachines(manifest.machines)
   };
+  fleetSchema.parse(payload);
   writeFileSync(path, `${JSON.stringify(payload, null, 2)}
 `, "utf8");
   return path;
@@ -12465,7 +12466,7 @@ function getAgentStatus(machineId = getLocalMachineId()) {
   }));
 }
 // src/commands/backup.ts
-import { homedir as homedir2 } from "os";
+import { homedir as homedir2, hostname as hostname5 } from "os";
 import { join as join3 } from "path";
 var MACHINES_BACKUP_BUCKET_ENV = "HASNA_MACHINES_S3_BUCKET";
 var MACHINES_BACKUP_BUCKET_FALLBACK_ENV = "MACHINES_S3_BUCKET";
@@ -12535,7 +12536,7 @@ function buildBackupPlan(bucket, prefix) {
     {
       id: "backup-upload",
       title: "Upload archive to S3",
-      command: `aws s3 cp ${quote(archivePath)} s3://${target.bucket}/${target.prefix}/$(hostname)-backup.tgz`,
+      command: `aws s3 cp ${quote(archivePath)} ${quote(`s3://${target.bucket}/${target.prefix}/${hostname5()}-backup.tgz`)}`,
       manager: "custom"
     }
   ];
@@ -12590,20 +12591,21 @@ function shellQuote5(value) {
 }
 function buildAppCommand(machine, app) {
   const packageName = getPackageName(app);
+  const quotedPackageName = shellQuote5(packageName);
   const manager = getAppManager(machine, app);
   if (manager === "custom") {
     return packageName;
   }
   if (machine.platform === "macos") {
     if (manager === "cask") {
-      return `brew install --cask ${packageName}`;
+      return `brew install --cask ${quotedPackageName}`;
     }
-    return `brew install ${packageName}`;
+    return `brew install ${quotedPackageName}`;
   }
   if (machine.platform === "windows") {
-    return `winget install ${packageName}`;
+    return `winget install ${quotedPackageName}`;
   }
-  return `sudo apt-get install -y ${packageName}`;
+  return `sudo apt-get install -y ${quotedPackageName}`;
 }
 function buildAppProbeCommand(machine, app) {
   const packageName = shellQuote5(getPackageName(app));
@@ -12889,9 +12891,10 @@ function manifestList() {
   return readManifest();
 }
 function manifestAdd(machine) {
+  const validatedMachine = machineSchema.parse(machine);
   const manifest = readManifest();
-  const nextMachines = manifest.machines.filter((entry) => entry.id !== machine.id);
-  nextMachines.push(machine);
+  const nextMachines = manifest.machines.filter((entry) => entry.id !== validatedMachine.id);
+  nextMachines.push(validatedMachine);
   const nextManifest = { ...manifest, machines: nextMachines };
   writeManifest(nextManifest);
   return nextManifest;
@@ -13741,6 +13744,7 @@ function runSelfTest() {
   };
 }
 // src/commands/setup.ts
+import { homedir as homedir4 } from "os";
 function quote3(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -13788,11 +13792,11 @@ function buildPackageSteps(machine) {
     const manager = pkg.manager || (machine.platform === "macos" ? "brew" : "apt");
     let command = pkg.name;
     if (manager === "bun") {
-      command = `bun install -g ${pkg.name}`;
+      command = `bun install -g ${quote3(pkg.name)}`;
     } else if (manager === "brew") {
-      command = `brew install ${pkg.name}`;
+      command = `brew install ${quote3(pkg.name)}`;
     } else if (manager === "apt") {
-      command = `sudo apt-get install -y ${pkg.name}`;
+      command = `sudo apt-get install -y ${quote3(pkg.name)}`;
     }
     return {
       id: `package-${index + 1}`,
@@ -13810,7 +13814,7 @@ function buildSetupPlan(machineId) {
   const target = selected || {
     id: currentMachineId,
     platform: "linux",
-    workspacePath: "~/workspace"
+    workspacePath: `${homedir4()}/workspace`
   };
   const steps = [...buildBaseSteps(target), ...buildPackageSteps(target)];
   return {
@@ -13854,8 +13858,58 @@ function runSetup(machineId, options = {}) {
   recordSetupRun(plan.machineId, "completed", summary);
   return summary;
 }
+// src/commands/screen.ts
+function shellQuote7(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function splitTarget(target) {
+  const at = target.indexOf("@");
+  if (at === -1)
+    return [null, target];
+  return [target.slice(0, at), target.slice(at + 1)];
+}
+function resolveScreenTarget(machineId, options = {}) {
+  const resolved = resolveMachineRoute(machineId, options);
+  if (!resolved.ok || !resolved.target) {
+    throw new Error(`Machine route not found: ${machineId}`);
+  }
+  if (resolved.route === "unknown") {
+    throw new Error(`Machine route is not reachable for screen sharing: ${machineId}`);
+  }
+  let [user, host] = splitTarget(resolved.target);
+  if (!user) {
+    const topology = options.topology ?? discoverMachineTopology(options);
+    const entry = topology.machines.find((m) => m.machine_id === (resolved.machine_id ?? machineId));
+    user = entry?.user ?? null;
+  }
+  const url = user ? `vnc://${user}@${host}` : `vnc://${host}`;
+  return {
+    machineId: resolved.machine_id ?? machineId,
+    user,
+    host,
+    url,
+    route: resolved.route,
+    confidence: resolved.confidence,
+    warnings: resolved.warnings
+  };
+}
+function buildScreenCommand(machineId, options = {}) {
+  const resolved = resolveScreenTarget(machineId, options);
+  return `open ${resolved.url}`;
+}
+function buildScreenEnableRemoteCommand(user, vncPassword) {
+  const kickstart = "/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart";
+  const lines = [
+    `dseditgroup -o edit -a ${shellQuote7(user)} -t user com.apple.access_screensharing 2>/dev/null || true`,
+    "defaults write /Library/Preferences/com.apple.RemoteManagement AllowSRPForNetworkNodes -bool true",
+    `${kickstart} -configure -clientopts -setvnclegacy -vnclegacy yes -setvncpw -vncpw ${shellQuote7(vncPassword)}`,
+    `${kickstart} -activate -configure -access -on -users ${shellQuote7(user)} -privs -all -restart -agent -menu`
+  ];
+  return lines.join(" && ");
+}
 // src/commands/sync.ts
 import { existsSync as existsSync7, lstatSync, readFileSync as readFileSync5, symlinkSync, copyFileSync } from "fs";
+import { homedir as homedir5 } from "os";
 function quote4(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -13873,13 +13927,13 @@ function packageCheckCommand(machine, packageName, manager = machine.platform ==
 }
 function packageInstallCommand(machine, packageName, manager = machine.platform === "macos" ? "brew" : "apt") {
   if (manager === "bun") {
-    return `bun install -g ${packageName}`;
+    return `bun install -g ${quote4(packageName)}`;
   }
   if (manager === "brew") {
-    return `brew install ${packageName}`;
+    return `brew install ${quote4(packageName)}`;
   }
   if (manager === "apt") {
-    return `sudo apt-get install -y ${packageName}`;
+    return `sudo apt-get install -y ${quote4(packageName)}`;
   }
   return packageName;
 }
@@ -13932,7 +13986,7 @@ function buildSyncPlan(machineId) {
   const target = selected || {
     id: currentMachineId,
     platform: "linux",
-    workspacePath: "~/workspace"
+    workspacePath: `${homedir5()}/workspace`
   };
   const actions = [
     ...detectPackageActions(target),
@@ -14877,7 +14931,7 @@ var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]
 var cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
 var base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
 var base64url = /^[A-Za-z0-9_-]*$/;
-var hostname5 = /^([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+$/;
+var hostname6 = /^([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+$/;
 var e164 = /^\+(?:[0-9]){6,14}[0-9]$/;
 var dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`;
 var date = /* @__PURE__ */ new RegExp(`^${dateSource}$`);
@@ -15489,7 +15543,7 @@ var $ZodURL = /* @__PURE__ */ $constructor("$ZodURL", (inst, def) => {
             code: "invalid_format",
             format: "url",
             note: "Invalid hostname",
-            pattern: hostname5.source,
+            pattern: hostname6.source,
             input: payload.value,
             inst,
             continue: !def.abort
@@ -17478,7 +17532,7 @@ class JSONSchemaGenerator {
               if (val === undefined) {
                 if (this.unrepresentable === "throw") {
                   throw new Error("Literal `undefined` cannot be represented in JSON Schema");
-                } else {}
+                }
               } else if (typeof val === "bigint") {
                 if (this.unrepresentable === "throw") {
                   throw new Error("BigInt literals cannot be represented in JSON Schema");
@@ -23307,6 +23361,7 @@ export {
   runAppsInstall,
   resolveTables,
   resolveSshTarget,
+  resolveScreenTarget,
   resolveMachineWorkspace,
   resolveMachineRoute,
   resolveBackupTarget,
@@ -23380,6 +23435,8 @@ export {
   buildSshCommand,
   buildSetupPlan,
   buildServer,
+  buildScreenEnableRemoteCommand,
+  buildScreenCommand,
   buildClaudeInstallPlan,
   buildCertPlan,
   buildBackupPlan,

package/dist/manifests.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifests.d.ts","sourceRoot":"","sources":["../src/manifests.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAoBjE,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcxB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAItB,CAAC;AAoBH,wBAAgB,kBAAkB,IAAI,aAAa,CAMlD;AAED,wBAAgB,YAAY,CAAC,IAAI,SAAoB,GAAG,aAAa,CAMpE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,SAAoB,GAAG,aAAa,CAExE;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,SAAoB,GAAG,MAAM,CAUvF;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,SAAoB,GAAG,eAAe,GAAG,IAAI,CAEtG;AAED,wBAAgB,4BAA4B,IAAI,eAAe,CAiB9D"}
+{"version":3,"file":"manifests.d.ts","sourceRoot":"","sources":["../src/manifests.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAoBjE,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcxB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAItB,CAAC;AAoBH,wBAAgB,kBAAkB,IAAI,aAAa,CAMlD;AAED,wBAAgB,YAAY,CAAC,IAAI,SAAoB,GAAG,aAAa,CAMpE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,SAAoB,GAAG,aAAa,CAExE;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,SAAoB,GAAG,MAAM,CAWvF;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,SAAoB,GAAG,eAAe,GAAG,IAAI,CAEtG;AAED,wBAAgB,4BAA4B,IAAI,eAAe,CAiB9D"}

package/dist/mcp/index.js

@@ -4017,7 +4017,7 @@ var coerce = {
 };
 var NEVER = INVALID;
 // src/commands/backup.ts
-import { homedir } from "os";
+import { homedir, hostname } from "os";
 import { join as join2 } from "path";
 var MACHINES_BACKUP_BUCKET_ENV = "HASNA_MACHINES_S3_BUCKET";
 var MACHINES_BACKUP_BUCKET_FALLBACK_ENV = "MACHINES_S3_BUCKET";
@@ -4087,7 +4087,7 @@ function buildBackupPlan(bucket, prefix) {
     {
       id: "backup-upload",
       title: "Upload archive to S3",
-      command: `aws s3 cp ${quote(archivePath)} s3://${target.bucket}/${target.prefix}/$(hostname)-backup.tgz`,
+      command: `aws s3 cp ${quote(archivePath)} ${quote(`s3://${target.bucket}/${target.prefix}/${hostname()}-backup.tgz`)}`,
       manager: "custom"
     }
   ];
@@ -4127,7 +4127,7 @@ function runBackup(bucket, prefix, options = {}) {
 
 // src/manifests.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { arch, homedir as homedir2, hostname, platform, userInfo } from "os";
+import { arch, homedir as homedir2, hostname as hostname2, platform, userInfo } from "os";
 import { dirname as dirname3 } from "path";
 
 // src/paths.ts
@@ -4235,6 +4235,7 @@ function writeManifest(manifest, path = getManifestPath()) {
     generatedAt: new Date().toISOString(),
     machines: normalizeMachines(manifest.machines)
   };
+  fleetSchema.parse(payload);
   writeFileSync(path, `${JSON.stringify(payload, null, 2)}
 `, "utf8");
   return path;
@@ -4243,12 +4244,12 @@ function getManifestMachine(machineId, path = getManifestPath()) {
   return readManifest(path).machines.find((machine) => machine.id === machineId) || null;
 }
 function detectCurrentMachineManifest() {
-  const machineId = process.env["HASNA_MACHINES_MACHINE_ID"] || hostname();
+  const machineId = process.env["HASNA_MACHINES_MACHINE_ID"] || hostname2();
   const user = userInfo().username;
   const bunDir = dirname3(process.execPath);
   return {
     id: machineId,
-    hostname: hostname(),
+    hostname: hostname2(),
     sshAddress: `${user}@${machineId}`,
     tailscaleName: machineId,
     platform: normalizePlatform(),
@@ -4263,11 +4264,11 @@ function detectCurrentMachineManifest() {
 
 // src/remote.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { hostname as hostname4 } from "os";
+import { hostname as hostname5 } from "os";
 
 // src/db.ts
 import { Database } from "bun:sqlite";
-import { hostname as hostname2 } from "os";
+import { hostname as hostname3 } from "os";
 class SqliteAdapter {
   raw;
   constructor(path) {
@@ -4332,7 +4333,7 @@ function getDb(path = getDbPath()) {
   return getAdapter(path).raw;
 }
 function getLocalMachineId() {
-  return process.env["HASNA_MACHINES_MACHINE_ID"] || hostname2();
+  return process.env["HASNA_MACHINES_MACHINE_ID"] || hostname3();
 }
 function listHeartbeats(machineId) {
   const db = getDb();
@@ -4366,7 +4367,7 @@ function recordSyncRun(machineId, status, actions) {
 
 // src/topology.ts
 import { existsSync as existsSync4 } from "fs";
-import { arch as arch2, hostname as hostname3, platform as platform2, userInfo as userInfo2 } from "os";
+import { arch as arch2, hostname as hostname4, platform as platform2, userInfo as userInfo2 } from "os";
 import { spawnSync } from "child_process";
 var MACHINES_CONSUMER_CONTRACT_VERSION = 1;
 var MACHINES_PACKAGE_NAME = "@hasna/machines";
@@ -4589,7 +4590,7 @@ function discoverMachineTopology(options = {}) {
     capabilities: getMachinesConsumerCapabilities(),
     generated_at: now.toISOString(),
     local_machine_id: localMachineId,
-    local_hostname: hostname3(),
+    local_hostname: hostname4(),
     current_platform: normalizePlatform2(),
     manifest_path_known: existsSync4(getManifestPath()),
     machines,
@@ -4614,7 +4615,7 @@ function routeTargetMatches(machine, requested) {
 }
 function findRouteMachine(topology, requestedMachineId) {
   const requested = normalizeMachineAlias(requestedMachineId);
-  if (requested === "local" || requested === "localhost" || requested === normalizeMachineAlias(hostname3()) || requested === normalizeMachineAlias(topology.local_machine_id)) {
+  if (requested === "local" || requested === "localhost" || requested === normalizeMachineAlias(hostname4()) || requested === normalizeMachineAlias(topology.local_machine_id)) {
     return {
       machine: topology.machines.find((machine) => machine.machine_id === topology.local_machine_id) ?? null,
       matchedBy: "local_alias"
@@ -5239,7 +5240,7 @@ function shellQuote3(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
 function machineIsLocal(machineId, localMachineId) {
-  return machineId === "local" || machineId === "localhost" || machineId === localMachineId || machineId === hostname4();
+  return machineId === "local" || machineId === "localhost" || machineId === localMachineId || machineId === hostname5();
 }
 function resolveMachineCommand(machineId, command, localMachineId = getLocalMachineId()) {
   if (machineIsLocal(machineId, localMachineId)) {
@@ -5291,20 +5292,21 @@ function shellQuote4(value) {
 }
 function buildAppCommand(machine, app) {
   const packageName = getPackageName(app);
+  const quotedPackageName = shellQuote4(packageName);
   const manager = getAppManager(machine, app);
   if (manager === "custom") {
     return packageName;
   }
   if (machine.platform === "macos") {
     if (manager === "cask") {
-      return `brew install --cask ${packageName}`;
+      return `brew install --cask ${quotedPackageName}`;
     }
-    return `brew install ${packageName}`;
+    return `brew install ${quotedPackageName}`;
   }
   if (machine.platform === "windows") {
-    return `winget install ${packageName}`;
+    return `winget install ${quotedPackageName}`;
   }
-  return `sudo apt-get install -y ${packageName}`;
+  return `sudo apt-get install -y ${quotedPackageName}`;
 }
 function buildAppProbeCommand(machine, app) {
   const packageName = shellQuote4(getPackageName(app));
@@ -6106,9 +6108,10 @@ function manifestList() {
   return readManifest();
 }
 function manifestAdd(machine) {
+  const validatedMachine = machineSchema.parse(machine);
   const manifest = readManifest();
-  const nextMachines = manifest.machines.filter((entry) => entry.id !== machine.id);
-  nextMachines.push(machine);
+  const nextMachines = manifest.machines.filter((entry) => entry.id !== validatedMachine.id);
+  nextMachines.push(validatedMachine);
   const nextManifest = { ...manifest, machines: nextMachines };
   writeManifest(nextManifest);
   return nextManifest;
@@ -6374,6 +6377,7 @@ function renderDashboardHtml() {
 }
 
 // src/commands/setup.ts
+import { homedir as homedir4 } from "os";
 function quote3(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -6421,11 +6425,11 @@ function buildPackageSteps(machine) {
     const manager = pkg.manager || (machine.platform === "macos" ? "brew" : "apt");
     let command = pkg.name;
     if (manager === "bun") {
-      command = `bun install -g ${pkg.name}`;
+      command = `bun install -g ${quote3(pkg.name)}`;
     } else if (manager === "brew") {
-      command = `brew install ${pkg.name}`;
+      command = `brew install ${quote3(pkg.name)}`;
     } else if (manager === "apt") {
-      command = `sudo apt-get install -y ${pkg.name}`;
+      command = `sudo apt-get install -y ${quote3(pkg.name)}`;
     }
     return {
       id: `package-${index + 1}`,
@@ -6443,7 +6447,7 @@ function buildSetupPlan(machineId) {
   const target = selected || {
     id: currentMachineId,
     platform: "linux",
-    workspacePath: "~/workspace"
+    workspacePath: `${homedir4()}/workspace`
   };
   const steps = [...buildBaseSteps(target), ...buildPackageSteps(target)];
   return {
@@ -6490,6 +6494,7 @@ function runSetup(machineId, options = {}) {
 
 // src/commands/sync.ts
 import { existsSync as existsSync7, lstatSync, readFileSync as readFileSync5, symlinkSync, copyFileSync } from "fs";
+import { homedir as homedir5 } from "os";
 function quote4(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -6507,13 +6512,13 @@ function packageCheckCommand(machine, packageName, manager = machine.platform ==
 }
 function packageInstallCommand(machine, packageName, manager = machine.platform === "macos" ? "brew" : "apt") {
   if (manager === "bun") {
-    return `bun install -g ${packageName}`;
+    return `bun install -g ${quote4(packageName)}`;
   }
   if (manager === "brew") {
-    return `brew install ${packageName}`;
+    return `brew install ${quote4(packageName)}`;
   }
   if (manager === "apt") {
-    return `sudo apt-get install -y ${packageName}`;
+    return `sudo apt-get install -y ${quote4(packageName)}`;
   }
   return packageName;
 }
@@ -6566,7 +6571,7 @@ function buildSyncPlan(machineId) {
   const target = selected || {
     id: currentMachineId,
     platform: "linux",
-    workspacePath: "~/workspace"
+    workspacePath: `${homedir5()}/workspace`
   };
   const actions = [
     ...detectPackageActions(target),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/machines",
-  "version": "0.0.24",
+  "version": "0.0.25",
   "description": "Machine fleet management CLI + MCP for developers",
   "type": "module",
   "license": "Apache-2.0",