@hasna/machines 0.0.37 → 0.0.38

package/dist/commands/daemon.d.ts

@@ -0,0 +1,76 @@
+export type DaemonServicePlatform = "macos" | "linux";
+export type DaemonServiceMode = "user" | "system";
+export type DaemonServiceAction = "install" | "uninstall" | "restart" | "status" | "logs";
+export interface DaemonServiceOptions {
+    action: DaemonServiceAction;
+    platform?: DaemonServicePlatform | "darwin";
+    mode?: DaemonServiceMode;
+    serviceName?: string;
+    executable?: string;
+    intervalMs?: number;
+    storagePush?: boolean;
+    doctorSummary?: boolean;
+    privateMetadata?: boolean | readonly string[];
+    env?: readonly string[];
+}
+export interface DaemonServiceCommand {
+    id: string;
+    description: string;
+    program: string;
+    args: string[];
+    sudo: boolean;
+    mutates: boolean;
+    allowFailure?: boolean;
+    env?: Record<string, string>;
+}
+export interface DaemonServiceFile {
+    id: string;
+    description: string;
+    path: string;
+    mode: string;
+    content: string;
+}
+export interface DaemonServicePlan {
+    platform: DaemonServicePlatform;
+    mode: DaemonServiceMode;
+    action: DaemonServiceAction;
+    serviceName: string;
+    serviceId: string;
+    executable: string;
+    intervalMs: number;
+    commands: DaemonServiceCommand[];
+    files: DaemonServiceFile[];
+    warnings: string[];
+    manualSteps: string[];
+}
+export interface DaemonServiceRunOptions {
+    apply?: boolean;
+    yes?: boolean;
+}
+export interface DaemonServiceCommandResult {
+    id: string;
+    command: string[];
+    skipped: boolean;
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+    error?: string;
+}
+export interface DaemonServiceRunResult {
+    mode: "plan" | "apply";
+    applied: boolean;
+    plan: DaemonServicePlan;
+    filesWritten: string[];
+    commands: DaemonServiceCommandResult[];
+    warnings: string[];
+}
+export declare function buildDaemonServicePlan(options: DaemonServiceOptions): DaemonServicePlan;
+export declare function runDaemonServicePlan(plan: DaemonServicePlan, options?: DaemonServiceRunOptions): DaemonServiceRunResult;
+export declare function buildDaemonInstallPlan(options?: Omit<DaemonServiceOptions, "action">): DaemonServicePlan;
+export declare function buildDaemonUninstallPlan(options?: Omit<DaemonServiceOptions, "action">): DaemonServicePlan;
+export declare function buildDaemonRestartPlan(options?: Omit<DaemonServiceOptions, "action">): DaemonServicePlan;
+export declare function buildDaemonStatusPlan(options?: Omit<DaemonServiceOptions, "action">): DaemonServicePlan;
+export declare function buildDaemonLogsPlan(options?: Omit<DaemonServiceOptions, "action">): DaemonServicePlan;
+export declare function renderLaunchdPlist(options?: Omit<DaemonServiceOptions, "action">): string;
+export declare function renderSystemdUnit(options?: Omit<DaemonServiceOptions, "action">): string;
+//# sourceMappingURL=daemon.d.ts.map

package/dist/commands/daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../src/commands/daemon.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,OAAO,CAAC;AACtD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAClD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE1F,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,CAAC,EAAE,qBAAqB,GAAG,QAAQ,CAAC;IAC5C,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAAC;IAC9C,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,iBAAiB,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,0BAA0B,EAAE,CAAC;IACvC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAoBD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,GAAG,iBAAiB,CAgBvF;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,GAAE,uBAA4B,GAAG,sBAAsB,CAsG3H;AAED,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAM,GAAG,iBAAiB,CAE5G;AAED,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAM,GAAG,iBAAiB,CAE9G;AAED,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAM,GAAG,iBAAiB,CAE5G;AAED,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAM,GAAG,iBAAiB,CAE3G;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAM,GAAG,iBAAiB,CAEzG;AAED,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAM,GAAG,MAAM,CAG7F;AAED,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAM,GAAG,MAAM,CAG5F"}

package/dist/commands/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAWD,wBAAgB,YAAY,CAAC,OAAO,GAAE,YAAiB,GAAG,SAAS,CAyBlE;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CA+J5C;AAcD,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,YAAiB,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CA6H7F"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAWD,wBAAgB,YAAY,CAAC,OAAO,GAAE,YAAiB,GAAG,SAAS,CA4BlE;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CA6K5C;AAuBD,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,YAAiB,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAmJ7F"}

package/dist/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,wBAAgB,SAAS,IAAI,WAAW,CA8BvC"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAY/C,wBAAgB,SAAS,IAAI,WAAW,CAmCvC"}

package/dist/consumer.js

@@ -102,6 +102,21 @@ class SqliteAdapter {
   }
 }
 var adapter = null;
+var AGENT_HEARTBEAT_COLUMNS = [
+  { name: "daemon_version", definition: "TEXT" },
+  { name: "agent_mode", definition: "TEXT" },
+  { name: "platform", definition: "TEXT" },
+  { name: "os_version", definition: "TEXT" },
+  { name: "os_build", definition: "TEXT" },
+  { name: "arch", definition: "TEXT" },
+  { name: "uptime_seconds", definition: "INTEGER" },
+  { name: "tool_versions_json", definition: "TEXT" },
+  { name: "tailscale_json", definition: "TEXT" },
+  { name: "storage_sync_status", definition: "TEXT" },
+  { name: "storage_sync_last_error", definition: "TEXT" },
+  { name: "doctor_summary_json", definition: "TEXT" },
+  { name: "private_metadata", definition: "INTEGER NOT NULL DEFAULT 0" }
+];
 function createTables(db) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS agent_heartbeats (
@@ -109,9 +124,23 @@ function createTables(db) {
       pid INTEGER NOT NULL,
       status TEXT NOT NULL,
       updated_at TEXT NOT NULL,
+      daemon_version TEXT,
+      agent_mode TEXT,
+      platform TEXT,
+      os_version TEXT,
+      os_build TEXT,
+      arch TEXT,
+      uptime_seconds INTEGER,
+      tool_versions_json TEXT,
+      tailscale_json TEXT,
+      storage_sync_status TEXT,
+      storage_sync_last_error TEXT,
+      doctor_summary_json TEXT,
+      private_metadata INTEGER NOT NULL DEFAULT 0,
       PRIMARY KEY (machine_id, pid)
     )
   `);
+  migrateAgentHeartbeats(db);
   db.exec(`
     CREATE TABLE IF NOT EXISTS setup_runs (
       id TEXT PRIMARY KEY,
@@ -133,6 +162,15 @@ function createTables(db) {
     )
   `);
 }
+function migrateAgentHeartbeats(db) {
+  const columns = db.query("PRAGMA table_info(agent_heartbeats)").all();
+  const existing = new Set(columns.map((column) => column.name));
+  for (const column of AGENT_HEARTBEAT_COLUMNS) {
+    if (existing.has(column.name))
+      continue;
+    db.exec(`ALTER TABLE agent_heartbeats ADD COLUMN ${column.name} ${column.definition}`);
+  }
+}
 function getAdapter(path = getDbPath()) {
   if (path === ":memory:") {
     const memoryAdapter = new SqliteAdapter(path);
@@ -161,13 +199,44 @@ function closeDb() {
     adapter = null;
   }
 }
-function upsertHeartbeat(machineId, pid = process.pid, status = "online") {
+function upsertHeartbeat(machineId, pid = process.pid, status = "online", metadata = {}) {
   const db = getDb();
-  db.query(`INSERT INTO agent_heartbeats (machine_id, pid, status, updated_at)
-     VALUES (?, ?, ?, ?)
+  db.query(`INSERT INTO agent_heartbeats (
+       machine_id,
+       pid,
+       status,
+       updated_at,
+       daemon_version,
+       agent_mode,
+       platform,
+       os_version,
+       os_build,
+       arch,
+       uptime_seconds,
+       tool_versions_json,
+       tailscale_json,
+       storage_sync_status,
+       storage_sync_last_error,
+       doctor_summary_json,
+       private_metadata
+     )
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
      ON CONFLICT(machine_id, pid) DO UPDATE SET
        status = excluded.status,
-       updated_at = excluded.updated_at`).run(machineId, pid, status, new Date().toISOString());
+       updated_at = excluded.updated_at,
+       daemon_version = excluded.daemon_version,
+       agent_mode = excluded.agent_mode,
+       platform = excluded.platform,
+       os_version = excluded.os_version,
+       os_build = excluded.os_build,
+       arch = excluded.arch,
+       uptime_seconds = excluded.uptime_seconds,
+       tool_versions_json = excluded.tool_versions_json,
+       tailscale_json = excluded.tailscale_json,
+       storage_sync_status = excluded.storage_sync_status,
+       storage_sync_last_error = excluded.storage_sync_last_error,
+       doctor_summary_json = excluded.doctor_summary_json,
+       private_metadata = excluded.private_metadata`).run(machineId, pid, status, new Date().toISOString(), metadata.daemonVersion ?? null, metadata.agentMode ?? null, metadata.platform ?? null, metadata.osVersion ?? null, metadata.osBuild ?? null, metadata.arch ?? null, metadata.uptimeSeconds == null ? null : Math.max(0, Math.floor(metadata.uptimeSeconds)), metadata.toolVersions ? JSON.stringify(metadata.toolVersions) : null, metadata.tailscale ? JSON.stringify(metadata.tailscale) : null, metadata.storageSyncStatus ?? null, metadata.storageSyncLastError ?? null, metadata.doctorSummary ? JSON.stringify(metadata.doctorSummary) : null, metadata.privateMetadata ? 1 : 0);
 }
 function getLocalMachineId() {
   return process.env["HASNA_MACHINES_MACHINE_ID"] || hostname();
@@ -175,12 +244,12 @@ function getLocalMachineId() {
 function listHeartbeats(machineId) {
   const db = getDb();
   if (machineId) {
-    return db.query(`SELECT machine_id, pid, status, updated_at
+    return db.query(`SELECT *
          FROM agent_heartbeats
          WHERE machine_id = ?
          ORDER BY updated_at DESC`).all(machineId);
   }
-  return db.query(`SELECT machine_id, pid, status, updated_at
+  return db.query(`SELECT *
        FROM agent_heartbeats
        ORDER BY updated_at DESC`).all();
 }
@@ -4188,6 +4257,11 @@ var coerce = {
 var NEVER = INVALID;
 // src/redaction.ts
 var REDACTED_VALUE = "[redacted]";
+var PRIVATE_METADATA_ENV = "HASNA_MACHINES_PRIVATE_METADATA";
+var PRIVATE_METADATA_FALLBACK_ENV = "MACHINES_PRIVATE_METADATA";
+var PRIVATE_OUTPUT_ENV = "HASNA_MACHINES_ALLOW_PRIVATE_OUTPUT";
+var PRIVATE_OUTPUT_FALLBACK_ENV = "MACHINES_ALLOW_PRIVATE_OUTPUT";
+var PRIVATE_OUTPUT_DENIED_WARNING = `private_output_denied:set ${PRIVATE_OUTPUT_ENV}=1 to allow private metadata output`;
 var SENSITIVE_KEY_PATTERN = /(password|passwd|token|credential|private[_-]?key|privateKey|api[_-]?key|github.*key|pem|secret)/i;
 var SECRET_REFERENCE_KEY_PATTERN = /(secret(ref(erence)?|key)?|secretRef|secretKey)$/i;
 var SENSITIVE_VALUE_PATTERNS = [
@@ -4198,9 +4272,21 @@ var SENSITIVE_VALUE_PATTERNS = [
   /\bAKIA[0-9A-Z]{16}\b/,
   /\bsk-[A-Za-z0-9_-]{20,}\b/
 ];
+var IPV4_PATTERN = /\b(?:10|127|169\.254|172\.(?:1[6-9]|2\d|3[0-1])|192\.168|100\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7]))(?:\.\d{1,3}){2}\b/g;
+var IPV6_PATTERN = /\b(?:fc|fd|fe80)[0-9a-f:]*:[0-9a-f:]+\b/gi;
+var DATABASE_URL_PATTERN = /\b(?:postgres(?:ql)?|mysql|mariadb|redis|mongodb|s3):\/\/[^\s"'<>]+/gi;
+var PRIVATE_HOST_PATTERN = /\b(?:[A-Za-z0-9._%+-]+@)?[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*(?:\.tailnet(?:\.[A-Za-z0-9-]+)*|\.ts\.net|\.private(?:\.[A-Za-z0-9-]+)*|\.internal|\.local)\b/gi;
 function isSensitiveKey(key) {
   return SENSITIVE_KEY_PATTERN.test(key);
 }
+function isPrivateMetadataEnabled(env = process.env) {
+  const value = env[PRIVATE_METADATA_ENV] ?? env[PRIVATE_METADATA_FALLBACK_ENV];
+  return ["1", "true", "yes", "on", "private"].includes(String(value ?? "").trim().toLowerCase());
+}
+function isPrivateOutputEnabled(env = process.env) {
+  const value = env[PRIVATE_OUTPUT_ENV] ?? env[PRIVATE_OUTPUT_FALLBACK_ENV];
+  return ["1", "true", "yes", "on", "private"].includes(String(value ?? "").trim().toLowerCase());
+}
 function isSecretReferenceKey(key) {
   return SECRET_REFERENCE_KEY_PATTERN.test(key);
 }
@@ -4213,6 +4299,17 @@ function isRecord(value) {
 function redactPath(value) {
   return value.replace(/\/home\/[^/\s]+/g, "/home/<user>").replace(/\/Users\/[^/\s]+/g, "/Users/<user>").replace(/[A-Za-z]:\\Users\\[^\\\s]+/g, "C:\\Users\\<user>");
 }
+function redactNetworkValue(value) {
+  if (!value.trim())
+    return value;
+  return REDACTED_VALUE;
+}
+function redactErrorMessage(value) {
+  return redactPath(value).replace(DATABASE_URL_PATTERN, (match) => {
+    const scheme = match.match(/^([a-z][a-z0-9+.-]*:\/\/)/i)?.[1] ?? "";
+    return `${scheme}${REDACTED_VALUE}`;
+  }).replace(IPV4_PATTERN, REDACTED_VALUE).replace(IPV6_PATTERN, REDACTED_VALUE).replace(PRIVATE_HOST_PATTERN, REDACTED_VALUE);
+}
 function redactPrivateRef(value) {
   const trimmed = value.trim();
   const scheme = trimmed.match(/^([a-z][a-z0-9+.-]*:\/\/)/i);
@@ -4718,6 +4815,16 @@ function routeRank(hint) {
 function selectRouteHint(hints) {
   return [...hints].sort((left, right) => routeRank(left) - routeRank(right))[0] ?? null;
 }
+function parseHeartbeatJson(value) {
+  if (!value)
+    return null;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
 function buildEntry(input) {
   const manifest = input.manifest;
   const peer = input.peer;
@@ -4740,6 +4847,22 @@ function buildEntry(input) {
     manifest_declared: Boolean(manifest),
     heartbeat_status: input.heartbeat?.status ?? "unknown",
     last_heartbeat_at: input.heartbeat?.updated_at ?? null,
+    agent: {
+      pid: input.heartbeat?.pid ?? null,
+      daemon_version: input.heartbeat?.daemon_version ?? null,
+      mode: input.heartbeat?.agent_mode ?? null,
+      private_metadata: Boolean(input.heartbeat?.private_metadata),
+      platform: input.heartbeat?.platform ?? null,
+      os_version: input.heartbeat?.os_version ?? null,
+      os_build: input.heartbeat?.os_build ?? null,
+      arch: input.heartbeat?.arch ?? null,
+      uptime_seconds: input.heartbeat?.uptime_seconds ?? null,
+      tool_versions: parseHeartbeatJson(input.heartbeat?.tool_versions_json),
+      tailscale: parseHeartbeatJson(input.heartbeat?.tailscale_json),
+      storage_sync_status: input.heartbeat?.storage_sync_status ?? null,
+      storage_sync_last_error: input.heartbeat?.storage_sync_last_error ?? null,
+      doctor_summary: parseHeartbeatJson(input.heartbeat?.doctor_summary_json)
+    },
     tailscale: {
       dns_name: manifest?.tailscaleName ?? peer?.DNSName?.replace(/\.$/, "") ?? null,
       ips: peer?.TailscaleIPs ?? [],
@@ -4799,6 +4922,72 @@ function discoverMachineTopology(options = {}) {
     warnings
   };
 }
+function redactFleetString(value) {
+  if (!value)
+    return value;
+  return redactErrorMessage(value);
+}
+function redactPublicRecord(value) {
+  if (!value)
+    return null;
+  const redacted = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (/(host|hostname|dns|ip|ips|user|username|serial|address|target|url|token|secret|password|credential)/i.test(key)) {
+      redacted[key] = REDACTED_VALUE;
+      continue;
+    }
+    if (typeof entry === "string") {
+      redacted[key] = redactFleetString(entry);
+    } else if (Array.isArray(entry)) {
+      redacted[key] = entry.map((item) => {
+        if (typeof item === "string")
+          return redactFleetString(item);
+        if (item && typeof item === "object")
+          return redactPublicRecord(item);
+        return item;
+      });
+    } else if (entry && typeof entry === "object") {
+      redacted[key] = redactPublicRecord(entry);
+    } else {
+      redacted[key] = entry;
+    }
+  }
+  return redactSensitiveValue(redacted);
+}
+function redactTopologyForOutput(topology, options = {}) {
+  if (options.privateMetadata)
+    return topology;
+  return {
+    ...topology,
+    local_hostname: REDACTED_VALUE,
+    warnings: topology.warnings.map(redactFleetString),
+    machines: topology.machines.map((machine) => ({
+      ...machine,
+      hostname: machine.hostname ? REDACTED_VALUE : null,
+      user: machine.user ? REDACTED_VALUE : null,
+      tailscale: {
+        ...machine.tailscale,
+        dns_name: machine.tailscale.dns_name ? REDACTED_VALUE : null,
+        ips: machine.tailscale.ips.map(() => REDACTED_VALUE)
+      },
+      ssh: {
+        ...machine.ssh,
+        address: machine.ssh.address ? REDACTED_VALUE : null,
+        command_target: machine.ssh.command_target ? REDACTED_VALUE : null
+      },
+      route_hints: machine.route_hints.map((hint) => ({
+        ...hint,
+        target: REDACTED_VALUE
+      })),
+      agent: {
+        ...machine.agent,
+        tailscale: redactPublicRecord(machine.agent.tailscale),
+        storage_sync_last_error: machine.agent.storage_sync_last_error ? redactFleetString(machine.agent.storage_sync_last_error) : null,
+        doctor_summary: redactPublicRecord(machine.agent.doctor_summary)
+      }
+    }))
+  };
+}
 function normalizeMachineAlias(value) {
   return value.trim().replace(/\.$/, "").toLowerCase();
 }
@@ -5023,6 +5212,20 @@ function resolveMachineRoute(machineId, options = {}) {
     warnings
   };
 }
+function redactRouteForOutput(route, options = {}) {
+  if (options.privateMetadata)
+    return route;
+  return {
+    ...route,
+    target: route.target ? REDACTED_VALUE : null,
+    command_target: route.command_target ? REDACTED_VALUE : null,
+    warnings: route.warnings.map(redactFleetString),
+    evidence: {
+      ...route.evidence,
+      selected_hint: route.evidence.selected_hint ? { ...route.evidence.selected_hint, target: REDACTED_VALUE } : null
+    }
+  };
+}
 function isRecord2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -5522,6 +5725,22 @@ function getLocalMachineTopology(options = {}) {
     manifest_declared: false,
     heartbeat_status: "unknown",
     last_heartbeat_at: null,
+    agent: {
+      pid: null,
+      daemon_version: null,
+      mode: null,
+      private_metadata: false,
+      platform: null,
+      os_version: null,
+      os_build: null,
+      arch: null,
+      uptime_seconds: null,
+      tool_versions: null,
+      tailscale: null,
+      storage_sync_status: null,
+      storage_sync_last_error: null,
+      doctor_summary: null
+    },
     tailscale: { dns_name: null, ips: [], online: null, active: null, last_seen: null },
     ssh: { address: null, route: "local", command_target: "localhost" },
     route_hints: [{ kind: "local", target: "localhost", reachable: true }],

package/dist/db.d.ts

@@ -7,13 +7,41 @@ export declare class SqliteAdapter {
 export declare function getAdapter(path?: string): SqliteAdapter;
 export declare function getDb(path?: string): Database;
 export declare function closeDb(): void;
-export declare function upsertHeartbeat(machineId: string, pid?: number, status?: "online" | "offline"): void;
+export interface HeartbeatUpsertMetadata {
+    daemonVersion?: string | null;
+    agentMode?: string | null;
+    platform?: string | null;
+    osVersion?: string | null;
+    osBuild?: string | null;
+    arch?: string | null;
+    uptimeSeconds?: number | null;
+    toolVersions?: Record<string, unknown> | null;
+    tailscale?: Record<string, unknown> | null;
+    storageSyncStatus?: string | null;
+    storageSyncLastError?: string | null;
+    doctorSummary?: Record<string, unknown> | null;
+    privateMetadata?: boolean;
+}
+export declare function upsertHeartbeat(machineId: string, pid?: number, status?: "online" | "offline", metadata?: HeartbeatUpsertMetadata): void;
 export declare function getLocalMachineId(): string;
 export interface StoredHeartbeat {
     machine_id: string;
     pid: number;
     status: string;
     updated_at: string;
+    daemon_version: string | null;
+    agent_mode: string | null;
+    platform: string | null;
+    os_version: string | null;
+    os_build: string | null;
+    arch: string | null;
+    uptime_seconds: number | null;
+    tool_versions_json: string | null;
+    tailscale_json: string | null;
+    storage_sync_status: string | null;
+    storage_sync_last_error: string | null;
+    doctor_summary_json: string | null;
+    private_metadata: number;
 }
 export declare function listHeartbeats(machineId?: string): StoredHeartbeat[];
 export declare function countRuns(table: "setup_runs" | "sync_runs"): number;

package/dist/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAItC,qBAAa,aAAa;IACxB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;gBAEX,IAAI,EAAE,MAAM;IAIxB,KAAK,IAAI,IAAI;CAGd;AAsCD,wBAAgB,UAAU,CAAC,IAAI,SAAc,GAAG,aAAa,CAqB5D;AAED,wBAAgB,KAAK,CAAC,IAAI,SAAc,GAAG,QAAQ,CAElD;AAED,wBAAgB,OAAO,IAAI,IAAI,CAK9B;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAc,EAAE,MAAM,GAAE,QAAQ,GAAG,SAAoB,GAAG,IAAI,CASnH;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,EAAE,CAoBpE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,WAAW,GAAG,MAAM,CAInE;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAOrG;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAOxF;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAOvF"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAItC,qBAAa,aAAa;IACxB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;gBAEX,IAAI,EAAE,MAAM;IAIxB,KAAK,IAAI,IAAI;CAGd;AA6ED,wBAAgB,UAAU,CAAC,IAAI,SAAc,GAAG,aAAa,CAqB5D;AAED,wBAAgB,KAAK,CAAC,IAAI,SAAc,GAAG,QAAQ,CAElD;AAED,wBAAgB,OAAO,IAAI,IAAI,CAK9B;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/C,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,GAAG,SAAc,EACjB,MAAM,GAAE,QAAQ,GAAG,SAAoB,EACvC,QAAQ,GAAE,uBAA4B,GACrC,IAAI,CA0DN;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,EAAE,CAoBpE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,WAAW,GAAG,MAAM,CAInE;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,IAAI,CAOrG;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAOxF;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAOvF"}

package/dist/index.d.ts

@@ -11,6 +11,7 @@ export * from "./commands/backup.js";
 export * from "./commands/apps.js";
 export * from "./commands/cert.js";
 export * from "./commands/dns.js";
+export * from "./commands/daemon.js";
 export * from "./commands/doctor.js";
 export * from "./commands/manifest.js";
 export * from "./commands/diff.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,0BAA0B,CAAC;AACzC,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,kCAAkC,EAClC,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtH,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,0BAA0B,CAAC;AACzC,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC;AACxB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,kCAAkC,EAClC,uBAAuB,EACvB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtH,cAAc,cAAc,CAAC"}