@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.1

package/dist/fleets/provision/cloud-init.js

@@ -0,0 +1,375 @@
+import { PlatformConfigSchema } from "../../config/platform.config.descriptor.js";
+/**
+ * Shared cloud-init template for fleet-provisioned hosts (fleet-droplet F0.1).
+ *
+ * One template, two consumers: platform-web's `handleHostProvision` (the
+ * server-built `infra/sandbox` descriptor's user_data) and the fleet CLI
+ * launch path. The generated boot script:
+ *   1. curl-installs the `vibes` CLI from the public installer,
+ *   2. writes the one-time enrollment token into a root-only file (0600) at
+ *      `/root/.vibes/hosts/<host-id>.enroll-token` (the path `vibes fleet
+ *      daemon install` uses), the platform origin into a root-only env file
+ *      (0600) at `/etc/vibes/fleet-daemon.env`, and the daemon root's
+ *      `vibes.config.json` (`daemon-host-config.ts`): the host's declared
+ *      environment tier (`config['runtime.host'].environmentTier`) and the
+ *      fleet CLI plugin the daemon command needs,
+ *   3. writes a systemd SYSTEM unit whose working directory is the daemon root
+ *      and that runs `vibes fleet daemon --enroll-token-file <path>` headless
+ *      (the CLI binds that root from its cwd): argv carries
+ *      the token's PATH, never the token, so nothing sensitive appears in
+ *      `ps`; the daemon consumes and removes the file once it has persisted
+ *      the durable host token. The
+ *      `vibes fleet daemon install` service backend manages user units via
+ *      `systemctl --user`, which has no bus in cloud-init's root context, so
+ *      the unit is rendered here with the same `vibes-fleet-daemon-<host-id>`
+ *      naming,
+ *   4. verifies the installed CLI can run the daemon from the daemon root
+ *      (`vibes fleet daemon --help` exits 0 there) and ONLY THEN enables +
+ *      starts the unit.
+ *      `Restart=on-failure` retries transient enroll failures until the daemon
+ *      claims the token and persists the durable host token at
+ *      `/root/.vibes/hosts/<host-id>.json`; later runs ignore the (spent)
+ *      enroll token.
+ *
+ * Why the verify gate: the public installer ships a THIN SHIM and finishes it
+ * with `vibes update --global`, which needs the private `@vibesdotdev`
+ * registry. A bare droplet has no registry credential (none is embedded here —
+ * user_data is not a place for one), so that step fails and the installer
+ * deliberately exits 0 anyway. Without the gate, cloud-init enabled a unit
+ * whose binary exits 78 on every command; `Restart=on-failure` looped it
+ * forever and the platform showed "awaiting first heartbeat" indefinitely.
+ * With the gate, an unusable daemon writes {@link FLEET_DAEMON_UNUSABLE_MARKER_FILE}
+ * (`status=unusable`, `reason=...`, `remedy=...`), appends a timestamped line
+ * to {@link FLEET_CLOUD_INIT_LOG_FILE}, and leaves the unit written but
+ * DISABLED so an operator (or a later brokered install step) can repair the
+ * host graph and `systemctl enable --now` it.
+ *
+ * Why the daemon root declares the fleet CLI plugin and binds by cwd: the
+ * installer pulls the latest PUBLISHED CLI, not the one this template was
+ * built with, so the template may only rely on what every supported release
+ * accepts. A release whose global root does not compose `vibes fleet` (0.2.13)
+ * still composes it from a root that declares it; one that does registers it
+ * once (a plugin registers idempotently). Every release binds its workspace
+ * from the cwd, while 0.2.13 refuses `--workspace-root`, so neither unit
+ * passes that flag. The daemon reads its enrollment token from
+ * `--enroll-token-file` and its tier from the bound root.
+ *
+ * By default the unit runs `--relay` so the daemon dials OUT to the broker DO and
+ * a NAT'd droplet reachable only via public IP is still reachable over the relay
+ * by `getVibesRemote(hostId)` (the `--no-relay` default previously left provisioned
+ * hosts unreachable — fleet-relay NAT gap). Pass `relayReachable: false` for the
+ * legacy http-only public-IP path. The relay REQUIRES the same L5-gated pipeline
+ * (wired by construction in the daemon CLI), so relay-reachable never weakens the
+ * secure-by-default bind guards.
+ *
+ * Pure string builder: must stay workerd-safe (platform-web consumes it).
+ */
+// The build-runner toolchain (git + bun) setup script is a first-class
+// `extraScript` for this template; re-exported here so `@vibesdotdev/platform/fleets/provision`
+// (mapped to this file) is the single import home for both.
+export { BUILD_RUNNER_BUN_INSTALL_DIR, BUILD_RUNNER_BUN_INSTALL_URL, BUILD_RUNNER_BUN_VERSION, BUILD_RUNNER_SETUP_MARKER, buildBuildRunnerSetupScript } from "./build-runner-setup.js";
+// The desktop/GPU-host setup script (docker + vibes-desktop-base) is a first-class
+// `extraScript` for this template too; re-exported so `@vibesdotdev/platform/fleets/provision`
+// is the single import home for every provisioning script.
+export { DEFAULT_DESKTOP_SOURCE_REPO, DESKTOP_IMAGE_CONTEXT_DIR, DESKTOP_IMAGE_TAG, DESKTOP_HOST_SETUP_MARKER, buildDesktopHostSetupScript } from "./desktop-host-setup.js";
+export { GPU_HOST_SETUP_MARKER, buildGpuHostSetupScript } from "./gpu-host-setup.js";
+import { FLEET_DAEMON_CLI_PLUGIN, FLEET_DAEMON_HOST_CONFIG_FILE, fleetDaemonRootName, parseFleetDaemonTier, renderFleetDaemonHostConfig } from "./daemon-host-config.js";
+export const DEFAULT_VIBES_INSTALL_URL = PlatformConfigSchema.shape.fleetInstallUrl.parse(undefined);
+export const FLEET_DAEMON_ENV_FILE = '/etc/vibes/fleet-daemon.env';
+/**
+ * The secret key an operator publishes the one-time enrollment token under
+ * (`vibes secrets exec --with VIBES_FLEET_ENROLL_TOKEN -- vibes fleet daemon`);
+ * the daemon resolves it through `runtime.resolveCredential`, never the raw
+ * process environment. Cloud-init writes a token file instead.
+ */
+export const FLEET_ENROLL_TOKEN_ENV = 'VIBES_FLEET_ENROLL_TOKEN';
+/** A provisioned droplet's Vibes home: the daemon's unit runs with HOME=/root. */
+const FLEET_CLOUD_INIT_VIBES_HOME = '/root/.vibes';
+/** The one-time enrollment token file cloud-init writes (0600) for `hostId`. */
+export function fleetCloudInitEnrollTokenFile(hostId) {
+    return `${FLEET_CLOUD_INIT_VIBES_HOME}/hosts/${hostId}.enroll-token`;
+}
+/** The root the provisioned daemon binds (its unit's working directory); it carries the declared tier and the fleet CLI plugin. */
+export function fleetCloudInitDaemonRoot(hostId) {
+    return `${FLEET_CLOUD_INIT_VIBES_HOME}/hosts/${fleetDaemonRootName(hostId)}`;
+}
+/** Installed CLI path the unit executes; the installer honours VIBES_INSTALL_DIR. */
+export const FLEET_CLOUD_INIT_VIBES_BIN = '/root/.local/bin/vibes';
+/**
+ * Written (0600, root) when the installed CLI cannot run `fleet daemon`. Key=value
+ * lines: `status=unusable`, `reason=<verify output>`, `checkedAt=<iso>`,
+ * `remedy=<what to run>`. Absent on a healthy host. A future host-side status
+ * report can forward this so the platform shows `daemon unusable: <reason>`.
+ */
+export const FLEET_DAEMON_UNUSABLE_MARKER_FILE = '/etc/vibes/fleet-daemon.unusable';
+/** Timestamped boot-script log (in addition to /var/log/cloud-init-output.log). */
+export const FLEET_CLOUD_INIT_LOG_FILE = '/root/.vibes/logs/vibes-fleet-cloud-init.log';
+/** The command whose exit status, run from the daemon root, decides whether the unit is enabled. */
+export const FLEET_DAEMON_VERIFY_COMMAND = `${FLEET_CLOUD_INIT_VIBES_BIN} fleet daemon --help`;
+/**
+ * Bunfig the brokered registry lease is written into (0600), resolved from the
+ * script's own HOME so a harness can run the rendered script under a temporary
+ * root instead of the real /root.
+ */
+export const FLEET_REGISTRY_BUNFIG_FILE = '${HOME}/.bunfig.toml';
+/**
+ * The bunfig `vibes update --global` requires, measured on a real droplet
+ * 2026-09-07. Every field matters and each was wrong once:
+ *
+ *  - the scope key carries its `@`. Bun matches either spelling, which is why
+ *    a `bun add @vibesdotdev/…` smoke test passed while the droplet failed —
+ *    but the CLI's own precondition looks for `"@vibesdotdev"` and exits 78
+ *    with "the @vibesdotdev package scope has no credential" without it.
+ *  - `linker = "hoisted"` is a measured decision, not a default: under
+ *    "isolated" a workspaces glob member that is not also a dependency is
+ *    never linked, which breaks the host graph.
+ *  - the token is an ENV VAR REFERENCE. Nothing writes a credential to the
+ *    droplet's disk; the lease is exported for the one command that needs it.
+ *
+ * Bunfig files do NOT merge — the one bun reads for an install replaces the
+ * rest — so this file must be complete, not a fragment. The shape is
+ * `renderSeedBunfig()` in @vibesdotdev/plugins; `cloud-init.test.ts` pins the
+ * two together.
+ */
+export const FLEET_REGISTRY_NPM_SCOPE = '@vibesdotdev';
+/** Registry the lease authenticates against; trailing slash as the seed writes it. */
+export const FLEET_REGISTRY_URL = PlatformConfigSchema.shape.fleetRegistryUrl.parse(undefined);
+/** Env var the bunfig references, and the one the lease is exported as. */
+export const FLEET_REGISTRY_TOKEN_ENV = 'VIBES_REGISTRY_TOKEN';
+/** Bun linker the host graph requires. */
+export const FLEET_REGISTRY_LINKER = 'hoisted';
+const HOST_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const ENROLL_TOKEN_PATTERN = /^[A-Za-z0-9._-]{8,256}$/;
+const LABEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9:._/-]{0,127}$/;
+/**
+ * Optional host-local PM service. Harness binaries remain owned by their setup
+ * hooks. The daemon binds its workspace from its working directory, never an
+ * environment variable (rc02-rc03 §2.2); `--workspace-root` is refused by
+ * published CLIs the installer may pull.
+ */
+export function buildPmDaemonServiceScript() {
+    return `
+# Host-local PM daemon; run only after workspace/tool setup.
+mkdir -p /root/workspace /root/.vibes/logs
+cat > /etc/systemd/system/vibes-pm-daemon.service <<'VIBES_PM_UNIT'
+[Unit]
+Description=Vibes PM Daemon (host-local lanes)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+Environment="HOME=/root"
+Environment="PATH=/root/.local/bin:/root/.bun/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+WorkingDirectory=/root/workspace
+ExecStart=${FLEET_CLOUD_INIT_VIBES_BIN} pm daemon serve --detached
+Restart=on-failure
+RestartSec=10
+StandardOutput=append:/root/.vibes/logs/vibes-pm-daemon.log
+StandardError=append:/root/.vibes/logs/vibes-pm-daemon.err
+
+[Install]
+WantedBy=multi-user.target
+VIBES_PM_UNIT
+systemctl daemon-reload
+# Verify PM itself; a working fleet command does not prove this plugin is installed.
+if (cd /root/workspace && timeout 120 ${FLEET_CLOUD_INIT_VIBES_BIN} pm daemon serve --help >/dev/null 2>&1); then
+  systemctl enable --now vibes-pm-daemon.service
+else
+  echo 'PM daemon unavailable; service written but not enabled. Repair the CLI, then enable vibes-pm-daemon.service.' >&2
+  exit 1
+fi
+`;
+}
+export function fleetDaemonServiceName(hostId) {
+    return `vibes-fleet-daemon-${hostId}`;
+}
+function assertHttpUrl(value, field) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch (cause) {
+        throw new Error(`${field} must be a valid URL, got: ${value}`, { cause });
+    }
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        throw new Error(`${field} must be http(s), got: ${value}`);
+    }
+    if (/['\s]/.test(value)) {
+        throw new Error(`${field} must not contain quotes or whitespace`);
+    }
+    return value;
+}
+export function buildFleetCloudInit(input) {
+    if (!HOST_ID_PATTERN.test(input.hostId)) {
+        throw new Error(`Invalid hostId for cloud-init (kebab-case required): ${input.hostId}`);
+    }
+    if (!ENROLL_TOKEN_PATTERN.test(input.enrollToken)) {
+        throw new Error('Invalid enrollment token for cloud-init (unsafe characters or length)');
+    }
+    const labels = input.labels ?? [];
+    for (const label of labels) {
+        if (!LABEL_PATTERN.test(label)) {
+            throw new Error(`Invalid capability label for cloud-init: ${label}`);
+        }
+    }
+    const platformOrigin = new URL(assertHttpUrl(input.platformOrigin, 'platformOrigin')).origin;
+    const installUrl = assertHttpUrl(input.installUrl ?? DEFAULT_VIBES_INSTALL_URL, 'installUrl');
+    const registryUrl = assertHttpUrl(input.registryUrl ?? FLEET_REGISTRY_URL, 'registryUrl');
+    const serviceName = fleetDaemonServiceName(input.hostId);
+    const labelsFlag = labels.length > 0 ? ` --labels ${labels.join(',')}` : '';
+    // Relay-reachable by default (NAT gap fix): a provisioned droplet dials OUT to
+    // the broker so `getVibesRemote(hostId)` resolves it even behind NAT. The daemon
+    // CLI wires the L5 gates by construction, so `--relay` never weakens the bind
+    // guards. `relayReachable: false` restores the legacy http-only public-IP path.
+    const relayFlag = input.relayReachable === false ? '--no-relay' : '--relay';
+    // No --enroll-token here: argv carries only the token FILE's path. A token
+    // (or a `${VAR}` expansion of one) on ExecStart would be visible in `ps`
+    // for the process lifetime.
+    const tier = parseFleetDaemonTier(input.environmentTier);
+    const enrollTokenFile = fleetCloudInitEnrollTokenFile(input.hostId);
+    const daemonRoot = fleetCloudInitDaemonRoot(input.hostId);
+    const execStart = `${FLEET_CLOUD_INIT_VIBES_BIN} fleet daemon --host-id ${input.hostId} ` +
+        `--enroll-token-file ${enrollTokenFile} --broker-origin ${platformOrigin} ${relayFlag}${labelsFlag}`;
+    // The installer is allowed to fail here (network blip, download 404): the
+    // verify gate below reports "binary missing" through the same marker instead
+    // of aborting cloud-init before anything diagnostic was written.
+    const script = `#!/bin/bash
+set -euo pipefail
+
+export HOME=/root
+export VIBES_INSTALL_DIR=/root/.local/bin
+
+mkdir -p /root/.vibes/logs
+fleet_log() {
+  printf '%s fleet cloud-init: %s\\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$1" | tee -a ${FLEET_CLOUD_INIT_LOG_FILE}
+}
+
+installer_status=0
+curl -fsSL '${installUrl}' | bash || installer_status=$?
+if [ "\${installer_status}" -ne 0 ]; then
+  fleet_log "installer exited \${installer_status}; continuing so the verify step can record why"
+fi
+
+install -d -m 0700 /etc/vibes
+cat > ${FLEET_DAEMON_ENV_FILE} <<'VIBES_FLEET_ENV'
+PUBLIC_VIBES_PLATFORM_ORIGIN=${platformOrigin}
+VIBES_FLEET_ENV
+chmod 0600 ${FLEET_DAEMON_ENV_FILE}
+
+# The one-time enrollment token, in a root-only file the daemon consumes and
+# removes; its service argv names only the path.
+install -d -m 0700 ${FLEET_CLOUD_INIT_VIBES_HOME}/hosts
+(umask 077 && cat > ${enrollTokenFile} <<'VIBES_FLEET_ENROLL_TOKEN'
+${input.enrollToken}
+VIBES_FLEET_ENROLL_TOKEN
+)
+chmod 0600 ${enrollTokenFile}
+
+# The daemon's bound root declares this host's environment tier (the daemon's
+# credential reads refuse an undeclared tier, and none is defaulted) and the
+# fleet CLI plugin, which not every published CLI composes at its global root.
+install -d -m 0700 ${daemonRoot}
+cat > ${daemonRoot}/${FLEET_DAEMON_HOST_CONFIG_FILE} <<'VIBES_FLEET_HOST_CONFIG'
+${renderFleetDaemonHostConfig(tier, { plugins: [FLEET_DAEMON_CLI_PLUGIN] }).trimEnd()}
+VIBES_FLEET_HOST_CONFIG
+
+# Brokered install step. The installer's \`vibes update --global\` needs the
+# private @vibesdotdev registry and a bare droplet has no credential, so trade
+# the one-time ENROLLMENT token this host already carries for a short-lived,
+# read-only, owner-scoped registry lease and materialize with it. The lease
+# expires on its own; nothing long-lived is written.
+#
+# The token is read back OUT of the root-only token file rather than inlined
+# here, so it appears exactly once in this script, and the request body goes
+# over stdin (--data @-) so it never lands on curl's argv where ps would show
+# it. A failure is not fatal: the verify gate below still records why the
+# daemon is unusable.
+registry_lease_status=0
+registry_lease_body=$(printf '{"hostId":"%s","token":"%s"}' '${input.hostId}' "$(cat ${enrollTokenFile})" | curl -fsSL -X POST -H 'content-type: application/json' --data @- '${platformOrigin}/api/hosts/${input.hostId}/registry-lease' 2>/dev/null) || registry_lease_status=$?
+registry_lease_token=""
+if [ "\${registry_lease_status}" -eq 0 ]; then
+  registry_lease_token=$(printf '%s' "\${registry_lease_body}" | grep -o '"token":"[^"]*"' | head -n 1 | cut -d'"' -f4 || true)
+fi
+if [ -n "\${registry_lease_token}" ]; then
+  umask 077
+  cat > ${FLEET_REGISTRY_BUNFIG_FILE} <<'VIBES_FLEET_BUNFIG'
+[install]
+linker = "${FLEET_REGISTRY_LINKER}"
+auto = "disable"
+
+[install.scopes]
+"${FLEET_REGISTRY_NPM_SCOPE}" = { url = "${registryUrl}", token = "$${FLEET_REGISTRY_TOKEN_ENV}" }
+VIBES_FLEET_BUNFIG
+  chmod 0600 ${FLEET_REGISTRY_BUNFIG_FILE}
+  fleet_log "registry lease issued; materializing the plugin host"
+  materialize_status=0
+  ${FLEET_REGISTRY_TOKEN_ENV}="\${registry_lease_token}" ${FLEET_CLOUD_INIT_VIBES_BIN} update --global >>${FLEET_CLOUD_INIT_LOG_FILE} 2>&1 || materialize_status=$?
+  if [ "\${materialize_status}" -ne 0 ]; then
+    fleet_log "'update --global' exited \${materialize_status} with the lease; the verify step reports why"
+  fi
+else
+  fleet_log "no registry lease (request exit \${registry_lease_status}); the host graph stays unmaterialized"
+fi
+
+cat > /etc/systemd/system/${serviceName}.service <<'VIBES_FLEET_UNIT'
+[Unit]
+Description=Vibes Fleet Daemon (${input.hostId})
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=0
+
+[Service]
+Type=simple
+Environment="HOME=/root"
+EnvironmentFile=${FLEET_DAEMON_ENV_FILE}
+WorkingDirectory=${daemonRoot}
+ExecStart=${execStart}
+Restart=on-failure
+RestartSec=10
+StandardOutput=append:/root/.vibes/logs/${serviceName}.log
+StandardError=append:/root/.vibes/logs/${serviceName}.err
+
+[Install]
+WantedBy=multi-user.target
+VIBES_FLEET_UNIT
+
+systemctl daemon-reload
+
+# Verify the installed CLI can run the daemon BEFORE enabling the unit, from
+# the daemon root the unit runs in (its config composes the command). The
+# public installer exits 0 even when \`vibes update --global\` could not
+# materialize the plugin host (a bare droplet has no @vibesdotdev registry
+# credential); the thin shim then exits 78 on every command, and an enabled
+# unit would crash-loop under Restart=on-failure forever while the platform
+# waited for a first heartbeat that can never come.
+rm -f ${FLEET_DAEMON_UNUSABLE_MARKER_FILE}
+daemon_verify_status=0
+daemon_verify_output=$(cd ${daemonRoot} && timeout 120 ${FLEET_DAEMON_VERIFY_COMMAND} 2>&1 >/dev/null) || daemon_verify_status=$?
+if [ "\${daemon_verify_status}" -eq 0 ]; then
+  fleet_log "verified '${FLEET_DAEMON_VERIFY_COMMAND}' (exit 0); enabling ${serviceName}.service"
+  systemctl enable --now ${serviceName}.service
+else
+  daemon_verify_reason="'${FLEET_DAEMON_VERIFY_COMMAND}' exited \${daemon_verify_status}"
+  if [ "\${installer_status}" -ne 0 ]; then
+    daemon_verify_reason="\${daemon_verify_reason} after installer exit \${installer_status}"
+  fi
+  daemon_verify_last_line=$(printf '%s\\n' "\${daemon_verify_output}" | grep -v '^[[:space:]]*$' | tail -n 1 || true)
+  if [ -n "\${daemon_verify_last_line}" ]; then
+    daemon_verify_reason="\${daemon_verify_reason}: \${daemon_verify_last_line}"
+  fi
+  umask 077
+  cat > ${FLEET_DAEMON_UNUSABLE_MARKER_FILE} <<VIBES_FLEET_UNUSABLE
+status=unusable
+reason=\${daemon_verify_reason}
+checkedAt=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+unit=${serviceName}.service
+remedy=run '${FLEET_CLOUD_INIT_VIBES_BIN} update --global' as root (it names the missing configuration), then 'systemctl enable --now ${serviceName}.service' and remove this file
+VIBES_FLEET_UNUSABLE
+  fleet_log "daemon unusable: \${daemon_verify_reason}; ${serviceName}.service written but left DISABLED; see ${FLEET_DAEMON_UNUSABLE_MARKER_FILE}"
+fi
+`;
+    const configured = input.extraScript ? `${script}${input.extraScript}\n` : script;
+    return input.pmDaemon ? `${configured}${buildPmDaemonServiceScript()}` : configured;
+}
+//# sourceMappingURL=cloud-init.js.map

package/dist/fleets/provision/cloud-init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-init.js","sourceRoot":"","sources":["../../../src/fleets/provision/cloud-init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH,uEAAuE;AACvE,gGAAgG;AAChG,4DAA4D;AAC5D,OAAO,EACN,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,2BAA2B,EAC3B,MAAM,yBAAyB,CAAC;AAEjC,mFAAmF;AACnF,+FAA+F;AAC/F,2DAA2D;AAC3D,OAAO,EACN,2BAA2B,EAC3B,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,2BAA2B,EAE3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAErF,OAAO,EACN,uBAAuB,EACvB,6BAA6B,EAC7B,mBAAmB,EACnB,oBAAoB,EACpB,2BAA2B,EAC3B,MAAM,yBAAyB,CAAC;AAEjC,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACrG,MAAM,CAAC,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;AACnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AACjE,kFAAkF;AAClF,MAAM,2BAA2B,GAAG,cAAc,CAAC;AACnD,gFAAgF;AAChF,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC3D,OAAO,GAAG,2BAA2B,UAAU,MAAM,eAAe,CAAC;AACtE,CAAC;AACD,mIAAmI;AACnI,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACtD,OAAO,GAAG,2BAA2B,UAAU,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AACD,qFAAqF;AACrF,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AACnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,kCAAkC,CAAC;AACpF,mFAAmF;AACnF,MAAM,CAAC,MAAM,yBAAyB,GAAG,8CAA8C,CAAC;AACxF,oGAAoG;AACpG,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,0BAA0B,sBAAsB,CAAC;AAE/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEvD,sFAAsF;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAE/F,2EAA2E;AAC3E,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE/D,0CAA0C;AAC1C,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAE/C,MAAM,eAAe,GAAG,2BAA2B,CAAC;AACpD,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AACvD,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B;IACzC,OAAO;;;;;;;;;;;;;;YAcI,0BAA0B;;;;;;;;;;;wCAWE,0BAA0B;;;;;;CAMjE,CAAC;AACF,CAAC;AAkCD,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACpD,OAAO,sBAAsB,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IAClD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA0B;IAC7D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,wDAAwD,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;IACF,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7F,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,IAAI,yBAAyB,EAAE,YAAY,CAAC,CAAC;IAC9F,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,IAAI,kBAAkB,EAAE,aAAa,CAAC,CAAC;IAE1F,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,+EAA+E;IAC/E,iFAAiF;IACjF,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,4BAA4B;IAC5B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,SAAS,GACd,GAAG,0BAA0B,2BAA2B,KAAK,CAAC,MAAM,GAAG;QACvE,uBAAuB,eAAe,oBAAoB,cAAc,IAAI,SAAS,GAAG,UAAU,EAAE,CAAC;IAEtG,0EAA0E;IAC1E,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,MAAM,GAAG;;;;;;;;uFAQuE,yBAAyB;;;;cAIlG,UAAU;;;;;;QAMhB,qBAAqB;+BACE,cAAc;;aAEhC,qBAAqB;;;;qBAIb,2BAA2B;sBAC1B,eAAe;EACnC,KAAK,CAAC,WAAW;;;aAGN,eAAe;;;;;qBAKP,UAAU;QACvB,UAAU,IAAI,6BAA6B;EACjD,2BAA2B,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;+DAetB,KAAK,CAAC,MAAM,YAAY,eAAe,0EAA0E,cAAc,cAAc,KAAK,CAAC,MAAM;;;;;;;UAO9M,0BAA0B;;YAExB,qBAAqB;;;;GAI9B,wBAAwB,gBAAgB,WAAW,gBAAgB,wBAAwB;;eAE/E,0BAA0B;;;IAGrC,wBAAwB,+BAA+B,0BAA0B,sBAAsB,yBAAyB;;;;;;;;4BAQxG,WAAW;;kCAEL,KAAK,CAAC,MAAM;;;;;;;;kBAQ5B,qBAAqB;mBACpB,UAAU;YACjB,SAAS;;;0CAGqB,WAAW;yCACZ,WAAW;;;;;;;;;;;;;;;QAe5C,iCAAiC;;4BAEb,UAAU,mBAAmB,2BAA2B;;yBAE3D,2BAA2B,wBAAwB,WAAW;2BAC5D,WAAW;;2BAEX,2BAA2B;;;;;;;;;UAS5C,iCAAiC;;;;OAIpC,WAAW;cACJ,0BAA0B,gGAAgG,WAAW;;0DAEzF,WAAW,2CAA2C,iCAAiC;;CAEhJ,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAClF,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,0BAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AACrF,CAAC"}

package/dist/fleets/provision/daemon-host-config.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The fleet daemon's declared host config (rc04 §2.1, C7).
+ *
+ * An installed fleet daemon (launchd, systemd or Windows) resolves its
+ * connection bearer and its enrollment and host tokens through
+ * `runtime.resolveCredential`, which refuses `tier-undeclared` on a host with
+ * no environment tier. The tier is never defaulted: whoever installs or
+ * provisions the daemon declares it, and it reaches the daemon as composition
+ * config, `config['runtime.host'].environmentTier`, in a `vibes.config.json`
+ * at the root the daemon's service binds (`--workspace-root` for a local
+ * install, the unit's working directory for a provisioned host).
+ *
+ * Pure (workerd-safe): the CLI installer and the cloud-init template both
+ * render the same file from here.
+ */
+import { EnvironmentTierSchema } from '@vibesdotdev/kernel/schemas/scope';
+import type * as z from 'zod/v4';
+/** The tiers a daemon host may declare (the kernel's `EnvironmentTierSchema`). */
+export declare const FLEET_DAEMON_TIERS: ("local" | "dev" | "staging" | "production")[];
+export type FleetDaemonTier = z.infer<typeof EnvironmentTierSchema>;
+/** The root config file the daemon's bound root carries. */
+export declare const FLEET_DAEMON_HOST_CONFIG_FILE = "vibes.config.json";
+/** The daemon root's directory name under `<vibesHome>/hosts`. */
+export declare function fleetDaemonRootName(hostId: string): string;
+/** Admit a declared tier; anything else (including none) is refused, never defaulted. */
+export declare function parseFleetDaemonTier(value: string | undefined): FleetDaemonTier;
+/**
+ * The fleet CLI plugin: the daemon root of a provisioned host declares it, so
+ * `vibes fleet daemon` composes from that root whatever the installer's
+ * global CLI composes (rc04 §2.1; consumer-local plugin selection).
+ */
+export declare const FLEET_DAEMON_CLI_PLUGIN = "@vibesdotdev/platform/fleets/cli/plugin";
+export interface FleetDaemonHostConfigOptions {
+    /** Workspace plugins the daemon root declares; omitted when empty. */
+    readonly plugins?: readonly string[];
+}
+/** The daemon root's `vibes.config.json`: the host's declared tier, plus any plugins its daemon command needs. */
+export declare function renderFleetDaemonHostConfig(tier: FleetDaemonTier, options?: FleetDaemonHostConfigOptions): string;
+//# sourceMappingURL=daemon-host-config.d.ts.map

package/dist/fleets/provision/daemon-host-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-host-config.d.ts","sourceRoot":"","sources":["../../../src/fleets/provision/daemon-host-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,CAAC;AAEjC,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,gDAAgC,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,4DAA4D;AAC5D,eAAO,MAAM,6BAA6B,sBAAsB,CAAC;AAEjE,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,eAAe,CAQ/E;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,4CAA4C,CAAC;AAEjF,MAAM,WAAW,4BAA4B;IAC5C,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,kHAAkH;AAClH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,eAAe,EAAE,OAAO,GAAE,4BAAiC,GAAG,MAAM,CAIrH"}

package/dist/fleets/provision/daemon-host-config.js

@@ -0,0 +1,44 @@
+/**
+ * The fleet daemon's declared host config (rc04 §2.1, C7).
+ *
+ * An installed fleet daemon (launchd, systemd or Windows) resolves its
+ * connection bearer and its enrollment and host tokens through
+ * `runtime.resolveCredential`, which refuses `tier-undeclared` on a host with
+ * no environment tier. The tier is never defaulted: whoever installs or
+ * provisions the daemon declares it, and it reaches the daemon as composition
+ * config, `config['runtime.host'].environmentTier`, in a `vibes.config.json`
+ * at the root the daemon's service binds (`--workspace-root` for a local
+ * install, the unit's working directory for a provisioned host).
+ *
+ * Pure (workerd-safe): the CLI installer and the cloud-init template both
+ * render the same file from here.
+ */
+import { EnvironmentTierSchema } from '@vibesdotdev/kernel/schemas/scope';
+/** The tiers a daemon host may declare (the kernel's `EnvironmentTierSchema`). */
+export const FLEET_DAEMON_TIERS = EnvironmentTierSchema.options;
+/** The root config file the daemon's bound root carries. */
+export const FLEET_DAEMON_HOST_CONFIG_FILE = 'vibes.config.json';
+/** The daemon root's directory name under `<vibesHome>/hosts`. */
+export function fleetDaemonRootName(hostId) {
+    return `${hostId}.daemon-root`;
+}
+/** Admit a declared tier; anything else (including none) is refused, never defaulted. */
+export function parseFleetDaemonTier(value) {
+    const parsed = EnvironmentTierSchema.safeParse(value);
+    if (parsed.success)
+        return parsed.data;
+    throw new Error(`The fleet daemon's environment tier must be declared as one of ${FLEET_DAEMON_TIERS.join(', ')}; got ${value === undefined ? 'none' : JSON.stringify(value)}.`);
+}
+/**
+ * The fleet CLI plugin: the daemon root of a provisioned host declares it, so
+ * `vibes fleet daemon` composes from that root whatever the installer's
+ * global CLI composes (rc04 §2.1; consumer-local plugin selection).
+ */
+export const FLEET_DAEMON_CLI_PLUGIN = '@vibesdotdev/platform/fleets/cli/plugin';
+/** The daemon root's `vibes.config.json`: the host's declared tier, plus any plugins its daemon command needs. */
+export function renderFleetDaemonHostConfig(tier, options = {}) {
+    const plugins = options.plugins ?? [];
+    const config = { config: { 'runtime.host': { environmentTier: parseFleetDaemonTier(tier) } } };
+    return `${JSON.stringify(plugins.length > 0 ? { plugins: [...plugins], ...config } : config, null, '\t')}\n`;
+}
+//# sourceMappingURL=daemon-host-config.js.map

package/dist/fleets/provision/daemon-host-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-host-config.js","sourceRoot":"","sources":["../../../src/fleets/provision/daemon-host-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAG1E,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,OAAO,CAAC;AAGhE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,MAAc;IACjD,OAAO,GAAG,MAAM,cAAc,CAAC;AAChC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAC7D,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,MAAM,IAAI,KAAK,CACd,kEAAkE,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,SAC9F,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CACpD,GAAG,CACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,yCAAyC,CAAC;AAOjF,kHAAkH;AAClH,MAAM,UAAU,2BAA2B,CAAC,IAAqB,EAAE,UAAwC,EAAE;IAC5G,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,EAAE,eAAe,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;IAC/F,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;AAC9G,CAAC"}

package/dist/fleets/provision/desktop-host-setup.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Desktop-host provisioning for fleet hosts (D3 desktop recipe).
+ *
+ * A freshly provisioned fleet droplet ships only the compiled `vibes` daemon; the
+ * `desktop` tool drives a `vibes-desktop-base` Docker container (the FastAPI driver
+ * on :8765 — see `docker-desktop-base/`). A bare host can't run it. This module
+ * renders the idempotent bash that:
+ *   1. installs Docker Engine (get.docker.com convenience script) + enables dockerd,
+ *   2. makes `vibes-desktop-base:latest` available — either by PULLING a published
+ *      `imageRef` (retagged local), or by BUILDING it from a sparse git checkout of
+ *      `docker-desktop-base/` in the Framework Forge destination (default).
+ *
+ * The script is a caller-supplied `extraScript` for {@link buildFleetCloudInit} — it
+ * is appended AFTER daemon enrollment is wired, inside the same `#!/bin/bash` +
+ * `set -euo pipefail` cloud-init shell. Because the same string can flow through
+ * platform-web's `handleHostProvision` (workerd), this is a PURE string builder:
+ * NO Node/Bun APIs, no filesystem, no secrets.
+ *
+ * Idempotency: guards every install (`command -v docker`, an image-presence check),
+ * so re-running cloud-init is a no-op. Composable with
+ * {@link buildBuildRunnerSetupScript}: a desktop host that also builds needs git+bun
+ * (the source-build path here reuses git, which the build-runner script installs).
+ */
+/** The Forge destination the desktop image is built from when no `imageRef` is given. */
+export declare const DEFAULT_DESKTOP_SOURCE_REPO = "ssh://git@git.vibes.dev/vibesdotdev/framework.git";
+/** The git ref (branch/tag/sha) the desktop image is built from when none is given. */
+export declare const DEFAULT_DESKTOP_SOURCE_REF = "cutover";
+/** The subtree that holds the `vibes-desktop-base` Dockerfile + driver source. */
+export declare const DESKTOP_IMAGE_CONTEXT_DIR = "docker-desktop-base";
+/** The image tag the `desktop` tool resolves by default (desktop constants). */
+export declare const DESKTOP_IMAGE_TAG = "vibes-desktop-base:latest";
+/** Stable marker comment — lets callers/tests detect the block in a rendered cloud-init. */
+export declare const DESKTOP_HOST_SETUP_MARKER = "vibes fleet desktop host (docker + vibes-desktop-base)";
+export interface DesktopHostSetupOptions {
+    /**
+     * When set, PULL this published image and retag it `vibes-desktop-base:latest`
+     * instead of building from source. Must be a shell-safe registry ref.
+     */
+    imageRef?: string;
+    /**
+     * Git repo to sparse-checkout `docker-desktop-base/` from for the source build.
+     * Defaults to {@link DEFAULT_DESKTOP_SOURCE_REPO}. Ignored when `imageRef` is set.
+     */
+    sourceRepo?: string;
+    /** Git ref (branch/tag/sha) to check out for the source build. Defaults to `main`. */
+    sourceRef?: string;
+}
+/**
+ * Returns the idempotent bash that installs Docker + makes `vibes-desktop-base:latest`
+ * available on a fleet host. A GPU desktop also takes {@link buildGpuHostSetupScript}
+ * (rendered first) for `--gpus all`. Intended as the `extraScript`
+ * for {@link buildFleetCloudInit}. Pure string builder (workerd-safe).
+ */
+export declare function buildDesktopHostSetupScript(options?: DesktopHostSetupOptions): string;
+//# sourceMappingURL=desktop-host-setup.d.ts.map

package/dist/fleets/provision/desktop-host-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-host-setup.d.ts","sourceRoot":"","sources":["../../../src/fleets/provision/desktop-host-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,yFAAyF;AACzF,eAAO,MAAM,2BAA2B,sDAAsD,CAAC;AAC/F,uFAAuF;AACvF,eAAO,MAAM,0BAA0B,YAAY,CAAC;AACpD,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAC/D,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,8BAA8B,CAAC;AAC7D,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,2DAA2D,CAAC;AAElG,MAAM,WAAW,uBAAuB;IACvC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AASD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,GAAE,uBAA4B,GAAG,MAAM,CA6CzF"}

package/dist/fleets/provision/desktop-host-setup.js

@@ -0,0 +1,91 @@
+/**
+ * Desktop-host provisioning for fleet hosts (D3 desktop recipe).
+ *
+ * A freshly provisioned fleet droplet ships only the compiled `vibes` daemon; the
+ * `desktop` tool drives a `vibes-desktop-base` Docker container (the FastAPI driver
+ * on :8765 — see `docker-desktop-base/`). A bare host can't run it. This module
+ * renders the idempotent bash that:
+ *   1. installs Docker Engine (get.docker.com convenience script) + enables dockerd,
+ *   2. makes `vibes-desktop-base:latest` available — either by PULLING a published
+ *      `imageRef` (retagged local), or by BUILDING it from a sparse git checkout of
+ *      `docker-desktop-base/` in the Framework Forge destination (default).
+ *
+ * The script is a caller-supplied `extraScript` for {@link buildFleetCloudInit} — it
+ * is appended AFTER daemon enrollment is wired, inside the same `#!/bin/bash` +
+ * `set -euo pipefail` cloud-init shell. Because the same string can flow through
+ * platform-web's `handleHostProvision` (workerd), this is a PURE string builder:
+ * NO Node/Bun APIs, no filesystem, no secrets.
+ *
+ * Idempotency: guards every install (`command -v docker`, an image-presence check),
+ * so re-running cloud-init is a no-op. Composable with
+ * {@link buildBuildRunnerSetupScript}: a desktop host that also builds needs git+bun
+ * (the source-build path here reuses git, which the build-runner script installs).
+ */
+// A docker image ref / git URL / git ref embedded in the boot script MUST NOT carry
+// quotes, whitespace, or shell metacharacters — it is interpolated into bash.
+const SHELL_SAFE_TOKEN = /^[A-Za-z0-9._:/@+-]{1,255}$/;
+/** The Forge destination the desktop image is built from when no `imageRef` is given. */
+export const DEFAULT_DESKTOP_SOURCE_REPO = 'ssh://git@git.vibes.dev/vibesdotdev/framework.git';
+/** The git ref (branch/tag/sha) the desktop image is built from when none is given. */
+export const DEFAULT_DESKTOP_SOURCE_REF = 'cutover';
+/** The subtree that holds the `vibes-desktop-base` Dockerfile + driver source. */
+export const DESKTOP_IMAGE_CONTEXT_DIR = 'docker-desktop-base';
+/** The image tag the `desktop` tool resolves by default (desktop constants). */
+export const DESKTOP_IMAGE_TAG = 'vibes-desktop-base:latest';
+/** Stable marker comment — lets callers/tests detect the block in a rendered cloud-init. */
+export const DESKTOP_HOST_SETUP_MARKER = 'vibes fleet desktop host (docker + vibes-desktop-base)';
+function assertShellSafe(value, field) {
+    if (!SHELL_SAFE_TOKEN.test(value)) {
+        throw new Error(`${field} must be a shell-safe token (no quotes/whitespace/metacharacters): ${value}`);
+    }
+    return value;
+}
+/**
+ * Returns the idempotent bash that installs Docker + makes `vibes-desktop-base:latest`
+ * available on a fleet host. A GPU desktop also takes {@link buildGpuHostSetupScript}
+ * (rendered first) for `--gpus all`. Intended as the `extraScript`
+ * for {@link buildFleetCloudInit}. Pure string builder (workerd-safe).
+ */
+export function buildDesktopHostSetupScript(options = {}) {
+    const imageRef = options.imageRef ? assertShellSafe(options.imageRef, 'imageRef') : undefined;
+    const sourceRepo = assertShellSafe(options.sourceRepo ?? DEFAULT_DESKTOP_SOURCE_REPO, 'sourceRepo');
+    const sourceRef = assertShellSafe(options.sourceRef ?? DEFAULT_DESKTOP_SOURCE_REF, 'sourceRef');
+    const imageBlock = imageRef
+        ? `
+# Pull the published desktop image and retag to the tool's default tag.
+if [ -z "$(docker images -q ${DESKTOP_IMAGE_TAG} 2>/dev/null)" ]; then
+  docker pull ${imageRef}
+  docker tag ${imageRef} ${DESKTOP_IMAGE_TAG}
+fi
+`
+        : `
+# Build vibes-desktop-base from Framework's ${DESKTOP_IMAGE_CONTEXT_DIR}/ (sparse
+# checkout keeps the download tiny). Requires git (the build-runner setup installs it;
+# apt-installed here too so a desktop-only host still builds).
+if [ -z "$(docker images -q ${DESKTOP_IMAGE_TAG} 2>/dev/null)" ]; then
+  command -v git >/dev/null 2>&1 || { apt-get update && apt-get install -y git; }
+  rm -rf /root/.vibes/desktop-image-src
+  git clone --filter=blob:none --no-checkout --depth 1 --branch ${sourceRef} ${sourceRepo} /root/.vibes/desktop-image-src
+  git -C /root/.vibes/desktop-image-src sparse-checkout set --no-cone ${DESKTOP_IMAGE_CONTEXT_DIR}
+  git -C /root/.vibes/desktop-image-src checkout
+  docker build -t ${DESKTOP_IMAGE_TAG} /root/.vibes/desktop-image-src/${DESKTOP_IMAGE_CONTEXT_DIR}
+fi
+`;
+    return (`
+# === ${DESKTOP_HOST_SETUP_MARKER} — desktop tool hosts ===
+# Idempotent: guards reinstall + image build so a re-run of cloud-init is a no-op.
+set -euo pipefail
+export HOME=/root
+export DEBIAN_FRONTEND=noninteractive
+
+if ! command -v docker >/dev/null 2>&1; then
+  curl -fsSL https://get.docker.com | sh
+fi
+systemctl enable --now docker
+${imageBlock}
+# Fail loudly if the image is still missing — a desktop host with no image can't
+# start the tool.
+docker image inspect ${DESKTOP_IMAGE_TAG} >/dev/null 2>&1 || { echo 'desktop-host: ${DESKTOP_IMAGE_TAG} missing after setup' >&2; exit 1; }
+`.trimStart());
+}
+//# sourceMappingURL=desktop-host-setup.js.map

package/dist/fleets/provision/desktop-host-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-host-setup.js","sourceRoot":"","sources":["../../../src/fleets/provision/desktop-host-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,oFAAoF;AACpF,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAEvD,yFAAyF;AACzF,MAAM,CAAC,MAAM,2BAA2B,GAAG,mDAAmD,CAAC;AAC/F,uFAAuF;AACvF,MAAM,CAAC,MAAM,0BAA0B,GAAG,SAAS,CAAC;AACpD,kFAAkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAC/D,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,2BAA2B,CAAC;AAC7D,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,wDAAwD,CAAC;AAiBlG,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACpD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sEAAsE,KAAK,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAmC,EAAE;IAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,IAAI,2BAA2B,EAAE,YAAY,CAAC,CAAC;IACpG,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,IAAI,0BAA0B,EAAE,WAAW,CAAC,CAAC;IAEhG,MAAM,UAAU,GAAG,QAAQ;QAC1B,CAAC,CAAC;;8BAE0B,iBAAiB;gBAC/B,QAAQ;eACT,QAAQ,IAAI,iBAAiB;;CAE3C;QACC,CAAC,CAAC;8CAC0C,yBAAyB;;;8BAGzC,iBAAiB;;;kEAGmB,SAAS,IAAI,UAAU;wEACjB,yBAAyB;;oBAE7E,iBAAiB,mCAAmC,yBAAyB;;CAEhG,CAAC;IAED,OAAO,CACN;QACM,yBAAyB;;;;;;;;;;EAU/B,UAAU;;;uBAGW,iBAAiB,6CAA6C,iBAAiB;CACrG,CAAC,SAAS,EAAE,CACX,CAAC;AACH,CAAC"}