@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.1

package/dist/cli/fleets/commands/fleet.build.command.impl.js

@@ -0,0 +1,165 @@
+import { valueFreeFailure } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import { writeStdoutLine, commandWriters } from '@vibesdotdev/cli/output';
+import { writeJson } from '@vibesdotdev/cli/output';
+import { CapabilityError, settle } from '@vibesdotdev/kernel';
+import { BuildJobDescriptorSchema } from '@vibesdotdev/infra-core/kinds';
+import { FleetBuildJobDescriptorSchema } from "../../../fleets/build-job-action.js";
+import { FleetBuildOptionsSchema, BuildArtifactSummarySchema } from "../../../schemas/fleet-cli.js";
+import { getAuthedPlatformClient } from "../lib/authed-platform.js";
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+const BUILD_JOB_KIND = 'infra/build-job';
+const TERMINAL_STATUSES = new Set(['succeeded', 'failed', 'canceled']);
+/**
+ * Resolve a declared `infra/build-job` descriptor by id from the registry
+ * (`runtime.query('infra/build-job')`), which the boot's discovery pass filled.
+ *
+ * Returns `FleetBuildJobDescriptor` (not the generic `BuildJobDescriptor`)
+ * because the adapter check below already narrows `config.adapter` to
+ * `'fleet-build-job'` — the one place that narrowing happens, so the caller
+ * (`execute()`) can pass the result straight to
+ * `buildJobDescriptorToHostActionForm()` with the narrowed descriptor type.
+ */
+export async function resolveFleetBuildJobDescriptor(runtime, id) {
+    const descriptor = runtime.query(BUILD_JOB_KIND).withId(id).firstDescriptor();
+    if (!descriptor) {
+        const known = runtime.query(BUILD_JOB_KIND).ids().sort();
+        throw new CapabilityError(`Unknown ${BUILD_JOB_KIND} "${id}". Known build jobs: ${known.join(', ') || '(none discovered)'}`, 'NOT_FOUND');
+    }
+    const build = BuildJobDescriptorSchema.parse(descriptor);
+    if (build.config?.adapter !== 'fleet-build-job') {
+        throw new CapabilityError(`infra/build-job "${id}" uses adapter "${build.config?.adapter ?? '(none)'}", not "fleet-build-job". ` +
+            '`vibes fleet build` only dispatches fleet-adapter build jobs.', 'INVALID_INPUT');
+    }
+    return FleetBuildJobDescriptorSchema.parse(build);
+}
+/**
+ * Warns about descriptor fields the fleet path does NOT carry to the host, so a
+ * declared-but-ignored field never masquerades as a "succeeded" build: `env`
+ * (secrets are never placed on a host). A publish target is never dropped —
+ * `buildJobDescriptorToHostActionForm` carries a host-publishable one and
+ * refuses any other (`fleet-build-publish-unsupported`). Pure function so it's
+ * unit-tested independent of the full `execute()` flow — see
+ * `__tests__/fleet.build.command.test.ts`.
+ */
+export function describeDroppedEnv(descriptor) {
+    return descriptor.env && descriptor.env.length > 0 ? 'env requirements' : null;
+}
+function summarizeArtifacts(result) {
+    const parsed = BuildArtifactSummarySchema.safeParse(result);
+    if (!parsed.success)
+        return [];
+    return (parsed.data.artifacts ?? []).map((artifact) => artifact.name ?? artifact.path ?? '(unnamed)');
+}
+export default {
+    async execute(args, opts, context) {
+        const logger = getLogger('platform', context.runtime);
+        const asJson = Boolean(opts.json);
+        const options = FleetBuildOptionsSchema.parse({ ...opts, id: args.id });
+        const id = options.id;
+        if (!id)
+            throw new Error('Provide a build-job id, e.g. `vibes fleet build vibes-cli-release`');
+        const resolved = await settle(() => resolveFleetBuildJobDescriptor(context.runtime, id));
+        if (!resolved.ok) {
+            const error = resolved.cause;
+            logger.error('Fleet command operation failed.', { error: valueFreeFailure(error) });
+            const message = error instanceof Error ? error.message : String(error);
+            if (asJson)
+                await writeJson(context.runtime, { error: message });
+            else
+                (await commandWriters(context.runtime)).log(message);
+            requestCLIExit(1);
+        }
+        const descriptor = resolved.value;
+        const dropped = describeDroppedEnv(descriptor);
+        if (dropped) {
+            (await commandWriters(context.runtime)).log(`WARNING: "${id}" declares ${dropped} that the fleet path does NOT carry to the host. ` +
+                'Secrets/env are never placed on a fleet host.');
+        }
+        const overrides = {
+            ref: options.sha,
+            hostPoolId: options.pool,
+            runnerLabel: options.runnerLabel
+        };
+        const { buildJobDescriptorToHostActionForm } = await import('../../../fleets/build-job-action.js');
+        const form = await buildJobDescriptorToHostActionForm(descriptor, overrides);
+        const dryRun = Boolean(opts.dryRun);
+        if (dryRun) {
+            if (asJson) {
+                // Pure JSON only — never mix prose with writeJson on stdout.
+                await writeJson(context.runtime, { dryRun: true, form });
+            }
+            else {
+                await writeStdoutLine(context.runtime, `Dry-run — CreateHostActionRunForm that WOULD be enqueued for "${id}":\n`);
+                await writeStdoutLine(context.runtime, JSON.stringify(form, null, 2));
+                await writeStdoutLine(context.runtime, `\nNo action was enqueued. Re-run without --dry-run to dispatch for real.`);
+            }
+            return;
+        }
+        const platform = await getAuthedPlatformClient(context.runtime);
+        const enqueued = await settle(() => platform.hosts.createAction(form));
+        if (!enqueued.ok) {
+            const error = enqueued.cause;
+            logger.error('Fleet command operation failed.', { error: valueFreeFailure(error) });
+            const message = error instanceof Error ? error.message : String(error);
+            const hint = /auth|token|401|sign|unauthor/i.test(message)
+                ? 'Not signed in. Run `vibes auth login`, then retry.'
+                : `Failed to enqueue build job: ${message}`;
+            if (asJson)
+                await writeJson(context.runtime, { error: hint });
+            else
+                (await commandWriters(context.runtime)).log(hint);
+            requestCLIExit(1);
+        }
+        const action = enqueued.value;
+        if (!asJson) {
+            await writeStdoutLine(context.runtime, `Queued host action ${action.id} (kind=${action.actionKind}, status=${action.status})`);
+        }
+        const wait = opts.wait !== false; // commander --no-wait sets opts.wait === false
+        if (!wait) {
+            if (asJson)
+                await writeJson(context.runtime, { result: action });
+            return;
+        }
+        const pollIntervalMs = options.pollIntervalMs;
+        const timeoutMs = options.timeoutMs;
+        const deadline = Date.now() + timeoutMs;
+        let latest = action;
+        while (!TERMINAL_STATUSES.has(latest.status)) {
+            if (Date.now() >= deadline) {
+                const message = `Timed out after ${timeoutMs}ms waiting for host action ${action.id} (last status: ${latest.status}).`;
+                if (asJson)
+                    await writeJson(context.runtime, { error: message, result: latest });
+                else
+                    (await commandWriters(context.runtime)).log(message);
+                requestCLIExit(1);
+            }
+            // No readiness event for a host action: poll on the runtime's lifecycle (RC07).
+            await context.runtime.lifecycle.delay(pollIntervalMs);
+            latest = await platform.hosts.getAction(action.id);
+            if (!asJson)
+                await writeStdoutLine(context.runtime, `  status=${latest.status}${latest.hostId ? ` host=${latest.hostId}` : ''}`);
+        }
+        if (asJson) {
+            await writeJson(context.runtime, { result: latest });
+            return;
+        }
+        await writeStdoutLine(context.runtime, `\nBuild job "${id}" finished: ${latest.status}`);
+        if (latest.error)
+            await writeStdoutLine(context.runtime, `  error: ${latest.error}`);
+        const artifacts = summarizeArtifacts(latest.result);
+        if (artifacts.length > 0) {
+            await writeStdoutLine(context.runtime, `  artifacts (${artifacts.length}):`);
+            for (const artifact of artifacts)
+                await writeStdoutLine(context.runtime, `    - ${artifact}`);
+        }
+        if (latest.logs) {
+            await writeStdoutLine(context.runtime, '\n----- logs (tail) -----');
+            await writeStdoutLine(context.runtime, latest.logs.slice(-4000));
+            await writeStdoutLine(context.runtime, '----- end logs -----');
+        }
+        if (latest.status !== 'succeeded')
+            requestCLIExit(1);
+    }
+};
+//# sourceMappingURL=fleet.build.command.impl.js.map

package/dist/cli/fleets/commands/fleet.build.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.build.command.impl.js","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.build.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AA8B1E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,EAAqB,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAGpG,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAA0B,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhG;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CACnD,OAAqB,EACrB,EAAU;IAEV,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC;IAE9E,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,eAAe,CACxB,WAAW,cAAc,KAAK,EAAE,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,EAAE,EACjG,WAAW,CACX,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,iBAAiB,EAAE,CAAC;QACjD,MAAM,IAAI,eAAe,CACxB,oBAAoB,EAAE,mBAAmB,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,QAAQ,4BAA4B;YACtG,+DAA+D,EAC/D,eAAe,CACf,CAAC;IACH,CAAC;IACD,OAAO,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAgD;IAClF,OAAO,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AAChF,CAAC;AAED,SAAS,kBAAkB,CAAS,MAAc;IACjD,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC;AACvG,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,IAAoB,EAAE,IAAoB,EAAE,OAAuB;QAChF,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAE/F,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,8BAA8B,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;YAE7B,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpF,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,MAAM;gBAAE,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;;gBAC5D,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1D,cAAc,CAAC,CAAC,CAAC,CAAC;QAEnB,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC;QAElC,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,OAAO,EAAE,CAAC;YACb,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC1C,aAAa,EAAE,cAAc,OAAO,mDAAmD;gBACvF,+CAA+C,CAC/C,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG;YACjB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SAChC,CAAC;QACF,MAAM,EAAE,kCAAkC,EAAE,GAAG,MAAM,MAAM,CAC1D,qCAAqC,CACrC,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,kCAAkC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAE7E,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACZ,IAAI,MAAM,EAAE,CAAC;gBACZ,6DAA6D;gBAC7D,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;iBAAM,CAAC;gBACP,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,iEAAiE,EAAE,MAAM,CAAC,CAAC;gBAClH,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACtE,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,0EAA0E,CAAC,CAAC;YACpH,CAAC;YACD,OAAO;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;YAE7B,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpF,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC;gBACzD,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,gCAAgC,OAAO,EAAE,CAAC;YAC7C,IAAI,MAAM;gBAAE,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;;gBACzD,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvD,cAAc,CAAC,CAAC,CAAC,CAAC;QAEnB,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC;QAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,MAAM,CAAC,EAAE,UAAU,MAAM,CAAC,UAAU,YAAY,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAChI,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,+CAA+C;QACjF,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,MAAM;gBAAE,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACjE,OAAO;QACR,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,IAAI,MAAM,GAAG,MAAM,CAAC;QACpB,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,mBAAmB,SAAS,8BAA8B,MAAM,CAAC,EAAE,kBAAkB,MAAM,CAAC,MAAM,IAAI,CAAC;gBACvH,IAAI,MAAM;oBAAE,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;;oBAC5E,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC1D,cAAc,CAAC,CAAC,CAAC,CAAC;YAEnB,CAAC;YACD,gFAAgF;YAChF,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACtD,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM;gBAAE,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClI,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACrD,OAAO;QACR,CAAC;QAED,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,eAAe,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC;YAC7E,KAAK,MAAM,QAAQ,IAAI,SAAS;gBAAE,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;YACpE,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;YAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;CACD,CAAC"}

package/dist/cli/fleets/commands/fleet.daemon.command.descriptor.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `vibes fleet daemon` — start the fleet daemon RPC server + host-agent
+ * enroll/heartbeat in one process.
+ *
+ * The CLI wires the runtime-authz plugin into the daemon pipeline by
+ * construction — an ungated non-loopback daemon stays impossible. The bind-guard
+ * test is the permanent regression fence (fleet.md §4.5, hqx-w1 §3).
+ *
+ * Relay mode (fleet-relay §3, R3):
+ *   `--relay` (default ON for non-loopback / home use): dials out to the broker DO
+ *   so the cloud can reach this machine through NAT. Uses the persisted durable host
+ *   token (do NOT alias the enroll token — F1 finding). The L5 gates are wired by
+ *   construction; an ungated relay daemon is impossible (same guard as http).
+ *
+ *   `--listen <addr>` stays the loopback-dev path and implies `--no-relay` unless
+ *   `--relay` is explicitly passed. On a typical home machine:
+ *     `vibes fleet daemon --host-id studio-mini`  → relay on, loopback on
+ *     `vibes fleet daemon --host-id studio-mini --listen :54321`  → http only
+ */
+import type { CLICommandAssetDescriptor } from '@vibesdotdev/cli/schemas/descriptors';
+declare const descriptor: CLICommandAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=fleet.daemon.command.descriptor.d.ts.map

package/dist/cli/fleets/commands/fleet.daemon.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.command.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAEtF,QAAA,MAAM,UAAU,EAAE,yBA2FjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/fleets/commands/fleet.daemon.command.descriptor.js

@@ -0,0 +1,104 @@
+/**
+ * `vibes fleet daemon` — start the fleet daemon RPC server + host-agent
+ * enroll/heartbeat in one process.
+ *
+ * The CLI wires the runtime-authz plugin into the daemon pipeline by
+ * construction — an ungated non-loopback daemon stays impossible. The bind-guard
+ * test is the permanent regression fence (fleet.md §4.5, hqx-w1 §3).
+ *
+ * Relay mode (fleet-relay §3, R3):
+ *   `--relay` (default ON for non-loopback / home use): dials out to the broker DO
+ *   so the cloud can reach this machine through NAT. Uses the persisted durable host
+ *   token (do NOT alias the enroll token — F1 finding). The L5 gates are wired by
+ *   construction; an ungated relay daemon is impossible (same guard as http).
+ *
+ *   `--listen <addr>` stays the loopback-dev path and implies `--no-relay` unless
+ *   `--relay` is explicitly passed. On a typical home machine:
+ *     `vibes fleet daemon --host-id studio-mini`  → relay on, loopback on
+ *     `vibes fleet daemon --host-id studio-mini --listen :54321`  → http only
+ */
+const descriptor = {
+    kind: 'cli/command',
+    id: 'fleet.daemon',
+    // Hosts invocations for many agents; the process itself acts for none.
+    effects: { serve: { surface: 'worker', purpose: 'worker', admission: false, hotReload: false } },
+    name: 'daemon',
+    description: 'Run the fleet daemon RPC server on this machine (enroll + heartbeat + serve + relay)',
+    group: 'fleet',
+    arguments: [],
+    options: [
+        {
+            flags: '--host-id <id>',
+            description: 'Host ID (kebab-case, e.g. studio-mini). Required.'
+        },
+        {
+            flags: '--enroll-token <token>',
+            description: 'One-time enrollment token from `vibes fleet enroll-token create`. Visible in `ps` to every ' +
+                'user on this host; prefer --enroll-token-file or the VIBES_FLEET_ENROLL_TOKEN secret.'
+        },
+        {
+            flags: '--enroll-token-file <path>',
+            description: 'File holding the one-time enrollment token (mode 0600). Consumed and removed once the host ' +
+                'token is persisted. Precedence: --enroll-token, --enroll-token-file, the VIBES_FLEET_ENROLL_TOKEN secret.'
+        },
+        {
+            flags: '--host-token <token>',
+            description: 'Existing durable host token (if already enrolled). Visible in `ps`; prefer ' +
+                'the VIBES_FLEET_HOST_TOKEN secret or the persisted --token-file.'
+        },
+        {
+            flags: '--token-file <path>',
+            description: 'Path for persisted host token state (default ~/.vibes/hosts/<host-id>.json)'
+        },
+        {
+            flags: '--listen <address>',
+            description: 'Bind address for the http RPC server (default 127.0.0.1:0). ' +
+                'Non-loopback requires a connection bearer (--token, or the stored bearer `vibes fleet daemon install` ' +
+                'writes) and wires L5 gates by construction. ' +
+                'Implies --no-relay unless --relay is also passed.'
+        },
+        {
+            flags: '--token <token>',
+            description: 'Connection bearer token for the http RPC server. Visible in `ps` to every user on this host; ' +
+                'prefer the bearer `vibes fleet daemon install --token-file` stores in fleet.daemon-credentials ' +
+                '(<vibesHome>/hosts/<host-id>.daemon-token, 0600), which this flag overrides. ' +
+                'A bearer authorizes a connection, not an invoke — L5 gates still fire per-invoke.'
+        },
+        {
+            flags: '--relay',
+            description: 'Enable relay mode: dial out to the broker DO so the cloud can reach this machine ' +
+                'through NAT (fleet-relay §3). Default ON when no --listen address is given. ' +
+                'Requires a persisted durable host token (enroll first). L5 gates are wired by construction.'
+        },
+        {
+            flags: '--no-relay',
+            description: 'Disable relay mode. The daemon only listens on the local --listen address. ' +
+                'Default when --listen is explicitly given.'
+        },
+        {
+            flags: '--broker-origin <url>',
+            description: 'Platform-web origin for the relay broker and host agent (default: the declared `platform` service). '
+        },
+        {
+            flags: '--labels <labels>',
+            description: 'Comma-separated capability labels reported in heartbeats (e.g. sandbox:code-execution,build)'
+        },
+        {
+            flags: '--heartbeat-interval <seconds>',
+            description: 'Heartbeat interval in seconds (default 60)'
+        },
+        {
+            flags: '--once',
+            description: 'Enroll/heartbeat once and exit (useful for testing)'
+        },
+        {
+            flags: '--no-agent',
+            description: 'Skip host-agent enroll/heartbeat; only run the RPC server'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=fleet.daemon.command.descriptor.js.map

package/dist/cli/fleets/commands/fleet.daemon.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.command.descriptor.js","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,cAAc;IAClB,uEAAuE;IACvE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;IAChG,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,sFAAsF;IACnG,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,EAAE;IACb,OAAO,EAAE;QACR;YACC,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,mDAAmD;SAChE;QACD;YACC,KAAK,EAAE,wBAAwB;YAC/B,WAAW,EACV,6FAA6F;gBAC7F,uFAAuF;SACxF;QACD;YACC,KAAK,EAAE,4BAA4B;YACnC,WAAW,EACV,6FAA6F;gBAC7F,2GAA2G;SAC5G;QACD;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EACV,6EAA6E;gBAC7E,kEAAkE;SACnE;QACD;YACC,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,6EAA6E;SAC1F;QACD;YACC,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EACV,8DAA8D;gBAC9D,wGAAwG;gBACxG,8CAA8C;gBAC9C,mDAAmD;SACpD;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EACV,+FAA+F;gBAC/F,iGAAiG;gBACjG,+EAA+E;gBAC/E,mFAAmF;SACpF;QACD;YACC,KAAK,EAAE,SAAS;YAChB,WAAW,EACV,mFAAmF;gBACnF,8EAA8E;gBAC9E,6FAA6F;SAC9F;QACD;YACC,KAAK,EAAE,YAAY;YACnB,WAAW,EACV,6EAA6E;gBAC7E,4CAA4C;SAC7C;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EACV,sGAAsG;SACvG;QACD;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EACV,8FAA8F;SAC/F;QACD;YACC,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,4CAA4C;SACzD;QACD;YACC,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,qDAAqD;SAClE;QACD;YACC,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,2DAA2D;SACxE;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/fleets/commands/fleet.daemon.command.impl.d.ts

@@ -0,0 +1,65 @@
+/**
+ * `vibes fleet daemon` implementation.
+ *
+ * Starts the fleet daemon RPC server + host-agent enroll/heartbeat in one
+ * process. The CLI wires the runtime-authz plugin into the daemon pipeline by
+ * construction — an ungated non-loopback daemon stays impossible. The bind-guard
+ * test is the permanent regression fence (fleet.md §4.5, hqx-w1 §3).
+ *
+ * Security contract (MUST NOT regress):
+ *   - A non-loopback bind REQUIRES a connection bearer: --token, or FLEET_DAEMON_TOKEN in
+ *     the `fleet.daemon-credentials` store (written by `vibes fleet daemon install`).
+ *   - The daemon pipeline always has L5's authz + friction interceptors.
+ *   - `startFleetDaemon` THROWS on a non-loopback bind with no gates or no tokens.
+ *   - Relay mode REQUIRES the same gated pipeline (fleet-relay §4).
+ *   - `startFleetDaemon` THROWS on relay mode with an ungated pipeline.
+ *
+ * Credentials never need argv (fleet.daemon.token-env.ts): the connection bearer
+ * resolves through `runtime.resolveCredential` from the by-id
+ * `fleet.daemon-credentials` store (`<vibesHome>/hosts/<id>.daemon-token`, 0600),
+ * the enrollment token comes from `VIBES_FLEET_ENROLL_TOKEN` or
+ * `--enroll-token-file` (0600, consumed once and removed), the durable host token
+ * from `VIBES_FLEET_HOST_TOKEN` or the persisted token file. The argv flags below
+ * stay supported and are `ps`-visible.
+ *
+ * Flags:
+ *   --host-id <id>              Required. The stable host id.
+ *   --enroll-token <token>      One-time enrollment token (ps-visible; prefer env/file).
+ *   --enroll-token-file <path>  File holding the one-time enrollment token (mode 0600).
+ *   --host-token <token>        Existing durable host token (ps-visible; prefer env/file).
+ *   --token-file <path>         Persisted host-token state (default ~/.vibes/hosts/<id>.json).
+ *   --listen <address>      Bind address (default 127.0.0.1:0). Implies --no-relay.
+ *   --token <token>         Connection bearer (ps-visible; overrides the store; required non-loopback).
+ *   --relay                 Enable relay mode (default ON when no --listen given).
+ *   --no-relay              Disable relay mode.
+ *   --broker-origin <url>   Platform origin for the broker (default: the declared `platform` service).
+ *   --labels <labels>       Comma-separated capability labels reported in heartbeats.
+ *   --heartbeat-interval <s> Heartbeat interval in seconds (default 60).
+ *   --once                  Enroll/heartbeat once and exit.
+ *   --no-agent              Skip host-agent; only run the RPC server.
+ */
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
+import type { ClientResolver, KindResolver } from '@vibesdotdev/platform/fleets/daemon';
+/** The file owner is optional, but an installed broken adapter must not be hidden. */
+export declare function resolveHostFilesystem(runtime: VibesRuntime): Promise<KindResolver | undefined>;
+/** Native custody is composed by its owner; the daemon exposes only its two validated verbs. */
+export declare function resolveHostWorkspaceCustody(runtime: VibesRuntime): Promise<KindResolver | undefined>;
+/**
+ * Resolve this host's remote-control `runtime/client`s from the ambient runtime,
+ * ONCE at daemon start, into a sync resolver closure the daemon root calls per
+ * `withId(id)` query. Returns `undefined` when none are registered (the daemon
+ * then does not expose `runtime/client` — a consumer's `query('runtime/client')`
+ * throws a precise "not exposed" error, degrading honestly).
+ *
+ * Every proxied client invoke still crosses the SAME L5-gated pipeline as
+ * execution (the daemon root wire-wraps the impl); this adds no ungated path.
+ * A single client that fails to resolve is logged and skipped (never silent) so
+ * one broken feature client cannot stop the daemon from exposing the others.
+ */
+export declare function resolveHostClients(runtime: VibesRuntime): Promise<ClientResolver | undefined>;
+declare const _default: {
+    execute(_args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=fleet.daemon.command.impl.d.ts.map

package/dist/cli/fleets/commands/fleet.daemon.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.command.impl.d.ts","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.command.impl.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAkD,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQxG,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAevE,OAAO,KAAK,EAGX,cAAc,EACd,YAAY,EAGZ,MAAM,qCAAqC,CAAC;AAqE7C,sFAAsF;AACtF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAMpG;AAED,gGAAgG;AAChG,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAO1G;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,YAAY,GACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAyCrC;;mBAKqB,cAAc,QAAQ,cAAc,WAAW,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AADnG,wBA0ZE"}