@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.2

package/dist/cli/fleets/commands/fleet.daemon.install.command.descriptor.js

@@ -0,0 +1,70 @@
+/**
+ * `vibes fleet daemon install` — render + install the fleet daemon as a login/boot
+ * service: a launchd plist (macOS), a systemd unit (Linux), or a scheduled task
+ * (Windows, ONLOGON). Runs `vibes fleet daemon` so the host comes back online
+ * automatically after a reboot.
+ */
+const descriptor = {
+    kind: 'cli/command',
+    id: 'fleet.daemon.install',
+    name: 'install',
+    description: 'Install the fleet daemon as an OS service (launchd on macOS, systemd on Linux, scheduled task on Windows)',
+    group: 'fleet',
+    arguments: [],
+    options: [
+        {
+            flags: '--host-id <id>',
+            description: 'Host ID (required, e.g. studio-mini)'
+        },
+        {
+            flags: '--enroll-token <token>',
+            description: 'One-time enrollment token to enroll on first start (omit if already enrolled). Written to ' +
+                '~/.vibes/hosts/<id>.enroll-token (0600), never into the service definition. Visible in `ps` ' +
+                'during install; prefer --enroll-token-file or the VIBES_FLEET_ENROLL_TOKEN secret ' +
+                '(vibes secrets exec --with VIBES_FLEET_ENROLL_TOKEN -- vibes fleet daemon install ...).'
+        },
+        {
+            flags: '--enroll-token-file <path>',
+            description: 'Existing file (mode 0600) holding the one-time enrollment token; the service references the ' +
+                'path and the daemon removes the file after enrollment.'
+        },
+        {
+            flags: '--tier <tier>',
+            description: "The host's environment tier (local, dev, staging or production; required, no default). Written to " +
+                '<vibesHome>/hosts/<id>.daemon-root/vibes.config.json as config runtime.host; the service binds that ' +
+                'root with --workspace-root, so the daemon can resolve its credentials.'
+        },
+        {
+            flags: '--listen <address>',
+            description: 'Bind address for the RPC server (default 127.0.0.1:0)'
+        },
+        {
+            flags: '--token <token>',
+            description: 'Connection bearer for the daemon (required for a non-loopback --listen). Stored in ' +
+                'fleet.daemon-credentials (<vibesHome>/hosts/<id>.daemon-token, 0600), never in the service ' +
+                'definition. Visible in `ps` during install; prefer --token-file.'
+        },
+        {
+            flags: '--token-file <path>',
+            description: 'File (mode 0600) holding the connection bearer; install copies it into fleet.daemon-credentials. ' +
+                'Re-running install with neither flag moves a bearer an older install left in the service env into the store.'
+        },
+        {
+            flags: '--labels <labels>',
+            description: 'Comma-separated capability labels the service daemon reports + enforces (e.g. sandbox:code-execution to let chat/code sessions run commands on this machine)'
+        },
+        {
+            flags: '--print',
+            description: 'Print the generated plist/unit/task to stdout instead of installing'
+        },
+        {
+            flags: '--scope <scope>',
+            description: 'Service scope: user (default) or system (requires sudo)'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=fleet.daemon.install.command.descriptor.js.map

package/dist/cli/fleets/commands/fleet.daemon.install.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.install.command.descriptor.js","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.install.command.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,2GAA2G;IACxH,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,EAAE;IACb,OAAO,EAAE;QACR;YACC,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,sCAAsC;SACnD;QACD;YACC,KAAK,EAAE,wBAAwB;YAC/B,WAAW,EACV,4FAA4F;gBAC5F,8FAA8F;gBAC9F,oFAAoF;gBACpF,yFAAyF;SAC1F;QACD;YACC,KAAK,EAAE,4BAA4B;YACnC,WAAW,EACV,8FAA8F;gBAC9F,wDAAwD;SACzD;QACD;YACC,KAAK,EAAE,eAAe;YACtB,WAAW,EACV,oGAAoG;gBACpG,sGAAsG;gBACtG,wEAAwE;SACzE;QACD;YACC,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,uDAAuD;SACpE;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EACV,qFAAqF;gBACrF,6FAA6F;gBAC7F,kEAAkE;SACnE;QACD;YACC,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EACV,mGAAmG;gBACnG,8GAA8G;SAC/G;QACD;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EACV,8JAA8J;SAC/J;QACD;YACC,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,qEAAqE;SAClF;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,yDAAyD;SACtE;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/fleets/commands/fleet.daemon.install.command.impl.d.ts

@@ -0,0 +1,115 @@
+/**
+ * `vibes fleet daemon install` implementation.
+ *
+ * Generates a launchd plist (macOS), systemd unit (Linux), or scheduled task
+ * (Windows, ONLOGON) that runs `vibes fleet daemon --host-id <id>` at login/boot.
+ *
+ * No credential value enters the service definition. The connection bearer
+ * (`--token`, or `--token-file <0600 path>`) is written into the by-id
+ * `fleet.daemon-credentials` store (`<vibesHome>/hosts/<id>.daemon-token`,
+ * 0600) through the store's `set`; the daemon resolves it with
+ * `runtime.resolveCredential`. The one-time enrollment token
+ * is written to a private file (`~/.vibes/hosts/<id>.enroll-token`, mode 0600)
+ * and the service passes only `--enroll-token-file <path>`; the daemon enrolls
+ * on first start, persists the durable host token, and removes the file. A
+ * service definition is world-readable on most hosts (`/Library/LaunchDaemons`,
+ * `~/.config/systemd/user`) and its argv shows in `ps`, which is why neither
+ * `EnvironmentVariables` nor `ProgramArguments` ever carries the token.
+ *
+ * The installed service runs the PERSISTED-TOKEN daemon, so it needs either a
+ * durable token already on disk (`~/.vibes/hosts/<id>.json`, written by a prior
+ * enrollment) OR an enrollment token to enroll on first start — from
+ * `--enroll-token-file`, the `VIBES_FLEET_ENROLL_TOKEN` secret (resolved
+ * through `runtime.resolveCredential`), or `--enroll-token`. We
+ * PRECHECK this so the old silent "service installed but never starts" failure
+ * becomes an actionable error. We also pass the platform origin as the
+ * daemon's `--broker-origin` so the agent can reach the platform API and the
+ * relay broker (without it the host would enroll but never go Online).
+ *
+ * Upgrade: a service an older release installed carries `FLEET_DAEMON_TOKEN`
+ * in its env, which the daemon no longer reads. Re-running install reads the
+ * installed definition back through the OS service backend (only the file the
+ * backend itself wrote); when it carries the bearer and the store holds none,
+ * the bearer moves into the store before the service is rewritten without it.
+ *
+ * Tier: the daemon resolves every credential through `runtime.resolveCredential`,
+ * which refuses `tier-undeclared` on a host with no environment tier, and an
+ * installed service has no shell or workspace to inherit one from. So install
+ * requires `--tier` (no default) and writes it as the daemon root's
+ * `config['runtime.host']` (`<vibesHome>/hosts/<id>.daemon-root/vibes.config.json`);
+ * the service binds that root with `--workspace-root`.
+ *
+ * Uses fleet's service-backends (moved from hq — L7 deferral fulfillment).
+ */
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { type FleetDaemonTier } from '@vibesdotdev/platform/fleets/provision';
+import { type HostTokenRoots } from '../lib/host-token-store.ts';
+import { type FleetTokenRuntime } from './fleet.daemon.token-env.ts';
+/** The daemon root for `hostId` under the handed roots: the service binds it with `--workspace-root`. */
+export declare function daemonRootDir(roots: HostTokenRoots, hostId: string): string;
+/**
+ * Write the daemon root's declared host config (`config['runtime.host']`,
+ * the host's environment tier). Not a credential; the directory is private
+ * to the user like the rest of the hosts store.
+ */
+export declare function writeDaemonHostConfig(runtime: VibesRuntime, roots: HostTokenRoots, hostId: string, tier: FleetDaemonTier): Promise<string>;
+/**
+ * Decide how the installed service obtains its enrollment token, without
+ * putting the value anywhere but a private file. Pure decision; the write is
+ * deferred to the caller so `--print` stays side-effect free.
+ */
+export declare function planEnrollTokenFile(input: {
+    /** The handed runtime: its roots hold the host-token store, its stores answer the secret. */
+    readonly runtime: FleetTokenRuntime;
+    readonly roots: HostTokenRoots;
+    readonly hostId: string;
+    readonly argvToken?: string;
+    readonly tokenFileOption?: string;
+}): Promise<{
+    readonly kind: 'existing';
+    readonly path: string;
+} | {
+    readonly kind: 'write';
+    readonly path: string;
+    readonly token: string;
+    readonly source: 'argv' | 'secret';
+} | undefined>;
+/**
+ * The connection bearer the operator hands install: `--token` (argv,
+ * ps-visible) first, then `--token-file <path>` (a private file, refused when
+ * other users can read it, the enrollment-token file's check). A named file
+ * that is absent or empty is an error: the operator asked for its bearer.
+ */
+export declare function resolveInstallBearer(input: {
+    readonly runtime: VibesRuntime;
+    readonly argvToken?: string;
+    readonly tokenFile?: string;
+}): Promise<{
+    readonly token: string;
+    readonly source: 'argv' | 'file';
+} | undefined>;
+/**
+ * Put the daemon's connection bearer into the `fleet.daemon-credentials`
+ * store before the service is (re)written, migrating a legacy definition's
+ * env bearer when the operator supplied none and the store holds none.
+ * Returns what happened, naming sources only, never the value.
+ */
+export declare function storeDaemonBearer(input: {
+    readonly runtime: VibesRuntime;
+    readonly hostId: string;
+    readonly explicit?: {
+        readonly token: string;
+        readonly source: 'argv' | 'file';
+    };
+    /** The installed definition's env, read back by the OS service backend. */
+    readonly installed?: {
+        readonly path: string;
+        readonly env: Readonly<Record<string, string>>;
+    };
+}): Promise<'stored' | 'migrated' | 'legacy-dropped' | 'untouched'>;
+declare const _default: {
+    execute(_args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=fleet.daemon.install.command.impl.d.ts.map

package/dist/cli/fleets/commands/fleet.daemon.install.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.install.command.impl.d.ts","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.install.command.impl.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvE,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAKN,KAAK,eAAe,EACpB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAON,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AAUpC,OAAO,EAGN,KAAK,iBAAiB,EACtB,MAAM,6BAA6B,CAAC;AAErC,yGAAyG;AACzG,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAMhJ;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAChD,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CACR;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAA;CAAE,GAC7G,SAAS,CACX,CAkBA;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAiBpF;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACjF,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,CAAC;CAC/F,GAAG,OAAO,CAAC,QAAQ,GAAG,UAAU,GAAG,gBAAgB,GAAG,WAAW,CAAC,CAiBlE;;mBAGqB,cAAc,QAAQ,cAAc,WAAW,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AADnG,wBAsIE"}

package/dist/cli/fleets/commands/fleet.daemon.install.command.impl.js

@@ -0,0 +1,211 @@
+import { FleetDaemonInstallOptionsSchema } from "../../../schemas/cli/daemon-install.js";
+import { writeStdoutLine, commandWriters } from '@vibesdotdev/cli/output';
+import { resolveFileSystemAdapter, publishPrivateFile } from '@vibesdotdev/filesystem';
+import { getPathRoots, getRuntimePath } from '@vibesdotdev/paths';
+import { getFleetServiceBackend, renderFleetServiceUnit } from '@vibesdotdev/platform/fleets/service-backends';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { FLEET_DAEMON_HOST_CONFIG_FILE, fleetDaemonRootName, parseFleetDaemonTier, renderFleetDaemonHostConfig } from '@vibesdotdev/platform/fleets/provision';
+import { buildFleetDaemonInstallDescriptor } from "./fleet.daemon.service-descriptor.js";
+import { defaultEnrollTokenFile, defaultTokenFile, hostsDir, readEnrollTokenFile, readHostToken, writeEnrollTokenFile } from "../lib/host-token-store.js";
+import { FLEET_DAEMON_CREDENTIALS_STORE_ID, FLEET_DAEMON_TOKEN_KEY, defaultDaemonTokenFile, readFleetDaemonBearer, registerFleetDaemonCredentials, setFleetDaemonBearer } from "../lib/daemon-credentials-store.js";
+import { resolvePlatformOriginAsync } from "../lib/origins.js";
+import { FLEET_ENROLL_TOKEN_ENV, resolveFleetEnrollToken } from "./fleet.daemon.token-env.js";
+/** The daemon root for `hostId` under the handed roots: the service binds it with `--workspace-root`. */
+export function daemonRootDir(roots, hostId) {
+    return `${hostsDir(roots)}/${fleetDaemonRootName(hostId)}`;
+}
+/**
+ * Write the daemon root's declared host config (`config['runtime.host']`,
+ * the host's environment tier). Not a credential; the directory is private
+ * to the user like the rest of the hosts store.
+ */
+export async function writeDaemonHostConfig(runtime, roots, hostId, tier) {
+    const dir = daemonRootDir(roots, hostId);
+    const filesystem = await resolveFileSystemAdapter(runtime);
+    await filesystem.mkdir(dir, { recursive: true, mode: 0o700 });
+    await publishPrivateFile(filesystem, filesystem.join(dir, FLEET_DAEMON_HOST_CONFIG_FILE), renderFleetDaemonHostConfig(tier));
+    return dir;
+}
+/**
+ * Decide how the installed service obtains its enrollment token, without
+ * putting the value anywhere but a private file. Pure decision; the write is
+ * deferred to the caller so `--print` stays side-effect free.
+ */
+export async function planEnrollTokenFile(input) {
+    if (input.tokenFileOption) {
+        const path = (await getRuntimePath(input.runtime)).resolve(input.tokenFileOption);
+        if (!await readEnrollTokenFile(input.runtime, path)) {
+            throw new Error(`--enroll-token-file ${path} is absent or empty, so the installed service could not enroll.`);
+        }
+        return { kind: 'existing', path };
+    }
+    const resolved = await resolveFleetEnrollToken(input.runtime, { argvToken: input.argvToken });
+    if (!resolved)
+        return undefined;
+    return {
+        kind: 'write',
+        path: defaultEnrollTokenFile(input.roots, input.hostId),
+        token: resolved.token,
+        source: resolved.source === 'argv' ? 'argv' : 'secret'
+    };
+}
+/**
+ * The connection bearer the operator hands install: `--token` (argv,
+ * ps-visible) first, then `--token-file <path>` (a private file, refused when
+ * other users can read it, the enrollment-token file's check). A named file
+ * that is absent or empty is an error: the operator asked for its bearer.
+ */
+export async function resolveInstallBearer(input) {
+    if (input.argvToken)
+        return { token: input.argvToken, source: 'argv' };
+    if (!input.tokenFile)
+        return undefined;
+    const paths = await getRuntimePath(input.runtime);
+    // A relative path is relative to the working directory the host captured.
+    const cwd = paths.isAbsolute(input.tokenFile) ? undefined : input.runtime.localEnvironment.getCwd?.();
+    if (!paths.isAbsolute(input.tokenFile) && !cwd) {
+        throw new CapabilityError(`--token-file ${input.tokenFile} is relative and this host captured no working directory; pass an absolute path.`, 'INVALID_INPUT', { reason: 'token-file-relative-without-cwd', retryable: false });
+    }
+    const path = cwd ? paths.resolve(cwd, input.tokenFile) : input.tokenFile;
+    const token = await readEnrollTokenFile(input.runtime, path);
+    if (!token)
+        throw new Error(`--token-file ${path} is absent or empty, so no connection bearer could be stored.`);
+    return { token, source: 'file' };
+}
+/**
+ * Put the daemon's connection bearer into the `fleet.daemon-credentials`
+ * store before the service is (re)written, migrating a legacy definition's
+ * env bearer when the operator supplied none and the store holds none.
+ * Returns what happened, naming sources only, never the value.
+ */
+export async function storeDaemonBearer(input) {
+    const legacy = input.installed?.env[FLEET_DAEMON_TOKEN_KEY];
+    // Nothing to write or migrate: the store is left as it is, unread.
+    if (!input.explicit && !legacy)
+        return 'untouched';
+    const retract = registerFleetDaemonCredentials(input.runtime, input.hostId);
+    try {
+        if (input.explicit) {
+            await setFleetDaemonBearer(input.runtime, input.explicit.token);
+            return 'stored';
+        }
+        if (!legacy)
+            return 'untouched';
+        if ((await readFleetDaemonBearer(input.runtime)) !== undefined)
+            return 'legacy-dropped';
+        await setFleetDaemonBearer(input.runtime, legacy);
+        return 'migrated';
+    }
+    finally {
+        retract();
+    }
+}
+export default {
+    async execute(_args, opts, context) {
+        const runtime = context.runtime;
+        const roots = getPathRoots(runtime);
+        const options = FleetDaemonInstallOptionsSchema.parse(opts);
+        const output = await commandWriters(runtime);
+        const hostId = options.hostId;
+        const scope = options.scope;
+        const listen = options.listen;
+        const tokenArgv = options.token;
+        const tokenFileOption = options.tokenFile ?? options['token-file'];
+        const enrollTokenArgv = options.enrollToken ?? options['enroll-token'];
+        const enrollTokenFileOption = options.enrollTokenFile ?? options['enroll-token-file'];
+        const printOnly = options.print;
+        // The daemon's environment tier, declared here (no default): without it
+        // every credential read the installed daemon makes is `tier-undeclared`.
+        const tier = parseFleetDaemonTier(options.tier);
+        const platformOrigin = await resolvePlatformOriginAsync(runtime);
+        // Same parse the `fleet daemon` command applies — the service must carry
+        // the exact label posture the operator chose (labels drive BOTH heartbeat
+        // advertisement and the daemon's own remote-execution authz grant).
+        const labels = options.labels?.split(',').map(label => label.trim()).filter(Boolean);
+        const enrollPlan = await planEnrollTokenFile({
+            runtime,
+            roots,
+            hostId,
+            argvToken: enrollTokenArgv,
+            tokenFileOption: enrollTokenFileOption
+        });
+        const bearer = await resolveInstallBearer({ runtime, argvToken: tokenArgv, tokenFile: tokenFileOption });
+        if (tokenArgv) {
+            output.log('[fleet daemon install] WARN: --token rides argv and is visible to every process on this host (ps). ' +
+                'Prefer --token-file <path> (mode 0600).');
+        }
+        if (enrollTokenArgv) {
+            output.log('[fleet daemon install] WARN: --enroll-token rides argv and is visible to every process on this host (ps). ' +
+                `Prefer --enroll-token-file <path> or the ${FLEET_ENROLL_TOKEN_ENV} secret.`);
+        }
+        // Precheck: the service can only start if it can obtain a durable host token —
+        // either one is already persisted, or an enrollment token is supplied to enroll
+        // on first start. Otherwise the daemon exits immediately and the service flaps
+        // silently. Convert that into a clear, actionable error.
+        const hasPersistedToken = !!(await readHostToken(runtime, defaultTokenFile(roots, hostId), hostId));
+        if (!hasPersistedToken && !enrollPlan) {
+            throw new Error(`No durable host token found for "${hostId}" and no enrollment token given, so the ` +
+                `installed service could not start.\n` +
+                `Mint one with: vibes fleet enroll-token create --host-id ${hostId}\n` +
+                `then pass it to install without putting it on argv:\n` +
+                `    vibes fleet daemon install --host-id ${hostId} --tier ${tier} --enroll-token-file <path>\n` +
+                `    vibes secrets exec --with ${FLEET_ENROLL_TOKEN_ENV} -- vibes fleet daemon install --host-id ${hostId} --tier ${tier}\n` +
+                `or enroll once interactively first, then re-run install:\n` +
+                `    vibes fleet daemon --host-id ${hostId} --enroll-token-file <path>`);
+        }
+        const descriptor = buildFleetDaemonInstallDescriptor(runtime, {
+            hostId,
+            workspaceRoot: daemonRootDir(roots, hostId),
+            listen,
+            enrollTokenFile: enrollPlan?.path,
+            labels,
+            brokerOrigin: platformOrigin,
+            scope
+        });
+        if (printOnly) {
+            const unit = await renderFleetServiceUnit(runtime, descriptor);
+            await writeStdoutLine(runtime, unit);
+            if (enrollPlan?.kind === 'write') {
+                output.log(`[fleet daemon install] --print: enrollment token not written; install writes it to ${enrollPlan.path} (mode 0600).`);
+            }
+            output.log(`[fleet daemon install] --print: host config not written; install writes tier '${tier}' to ` +
+                `${`${daemonRootDir(roots, hostId)}/${FLEET_DAEMON_HOST_CONFIG_FILE}`}.`);
+            if (bearer) {
+                output.log(`[fleet daemon install] --print: connection bearer not stored; install writes it to store ` +
+                    `${FLEET_DAEMON_CREDENTIALS_STORE_ID} (${defaultDaemonTokenFile(roots, hostId)}, mode 0600).`);
+            }
+            return;
+        }
+        const daemonRoot = await writeDaemonHostConfig(runtime, roots, hostId, tier);
+        await writeStdoutLine(runtime, `[fleet daemon install] Declared environment tier '${tier}' in ${daemonRoot}/${FLEET_DAEMON_HOST_CONFIG_FILE}.`);
+        if (enrollPlan?.kind === 'write') {
+            await writeEnrollTokenFile(runtime, enrollPlan.path, enrollPlan.token);
+            await writeStdoutLine(runtime, `[fleet daemon install] Enrollment token (from ${enrollPlan.source}) written to ${enrollPlan.path} (mode 0600); ` +
+                'the daemon removes it after enrollment.');
+        }
+        const backend = await getFleetServiceBackend(runtime);
+        // The bearer reaches the store before the service is (re)written, so the
+        // daemon the backend (re)starts finds it there.
+        const installed = await backend.readInstalled(descriptor);
+        const bearerFile = defaultDaemonTokenFile(roots, hostId);
+        const bearerOutcome = await storeDaemonBearer({ runtime, hostId, explicit: bearer, installed });
+        if (bearerOutcome === 'stored') {
+            await writeStdoutLine(runtime, `[fleet daemon install] Connection bearer (from ${bearer?.source}) stored in ` +
+                `${FLEET_DAEMON_CREDENTIALS_STORE_ID} (${bearerFile}, mode 0600).`);
+        }
+        else if (bearerOutcome === 'migrated') {
+            await writeStdoutLine(runtime, `[fleet daemon install] Moved the connection bearer from the installed service env ` +
+                `(${installed?.path}) into ${FLEET_DAEMON_CREDENTIALS_STORE_ID} (${bearerFile}, mode 0600); ` +
+                `the service is rewritten without ${FLEET_DAEMON_TOKEN_KEY}.`);
+        }
+        else if (bearerOutcome === 'legacy-dropped') {
+            await writeStdoutLine(runtime, `[fleet daemon install] The installed service env (${installed?.path}) carried ${FLEET_DAEMON_TOKEN_KEY}; ` +
+                `${FLEET_DAEMON_CREDENTIALS_STORE_ID} already holds a bearer, which is kept. ` +
+                'The service is rewritten without the env copy.');
+        }
+        await backend.register(descriptor);
+        await writeStdoutLine(runtime, `[fleet daemon install] Installed service: ${descriptor.id}` +
+            (descriptor.autoStart ? ' (started + will run at login)' : ' (registered, not started)'));
+    }
+};
+//# sourceMappingURL=fleet.daemon.install.command.impl.js.map

package/dist/cli/fleets/commands/fleet.daemon.install.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.install.command.impl.js","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.install.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AA8CvF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/G,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EACN,6BAA6B,EAC7B,mBAAmB,EACnB,oBAAoB,EACpB,2BAA2B,EAE3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EACN,sBAAsB,EACtB,gBAAgB,EAChB,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EAEpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,iCAAiC,EACjC,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,EACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACN,sBAAsB,EACtB,uBAAuB,EAEvB,MAAM,6BAA6B,CAAC;AAErC,yGAAyG;AACzG,MAAM,UAAU,aAAa,CAAC,KAAqB,EAAE,MAAc;IAClE,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAqB,EAAE,KAAqB,EAAE,MAAc,EAAE,IAAqB;IAC9H,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,MAAM,kBAAkB,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,EAAE,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7H,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAOzC;IAKA,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACd,uBAAuB,IAAI,iEAAiE,CAC5F,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,sBAAsB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;QACvD,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;KACtD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAI1C;IACA,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvE,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClD,0EAA0E;IAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;IACtG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CACxB,gBAAgB,KAAK,CAAC,SAAS,kFAAkF,EACjH,eAAe,EACf,EAAE,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK,EAAE,CAC/D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,+DAA+D,CAAC,CAAC;IACjH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAMvC;IACA,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC5D,mEAAmE;IACnE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC;IACnD,MAAM,OAAO,GAAG,8BAA8B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,CAAC;QACJ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChE,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,WAAW,CAAC;QAChC,IAAI,CAAC,MAAM,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,gBAAgB,CAAC;QACxF,MAAM,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,UAAU,CAAC;IACnB,CAAC;YAAS,CAAC;QACV,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,KAAqB,EAAE,IAAoB,EAAE,OAAuB;QACjF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,+BAA+B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAChC,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;QACnE,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;QACvE,MAAM,qBAAqB,GAAG,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAChC,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACjE,yEAAyE;QACzE,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAErF,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC5C,OAAO;YACP,KAAK;YACL,MAAM;YACN,SAAS,EAAE,eAAe;YAC1B,eAAe,EAAE,qBAAqB;SACtC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;QACzG,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CACT,qGAAqG;gBACpG,yCAAyC,CAC1C,CAAC;QACH,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CACT,4GAA4G;gBAC3G,4CAA4C,sBAAsB,UAAU,CAC7E,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,gFAAgF;QAChF,+EAA+E;QAC/E,yDAAyD;QACzD,MAAM,iBAAiB,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpG,IAAI,CAAC,iBAAiB,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACd,oCAAoC,MAAM,0CAA0C;gBACnF,sCAAsC;gBACtC,4DAA4D,MAAM,IAAI;gBACtE,uDAAuD;gBACvD,4CAA4C,MAAM,WAAW,IAAI,+BAA+B;gBAChG,iCAAiC,sBAAsB,4CAA4C,MAAM,WAAW,IAAI,IAAI;gBAC5H,4DAA4D;gBAC5D,oCAAoC,MAAM,6BAA6B,CACxE,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,iCAAiC,CAAC,OAAO,EAAE;YAC7D,MAAM;YACN,aAAa,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC;YAC3C,MAAM;YACN,eAAe,EAAE,UAAU,EAAE,IAAI;YACjC,MAAM;YACN,YAAY,EAAE,cAAc;YAC5B,KAAK;SACL,CAAC,CAAC;QAEH,IAAI,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC/D,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,CACT,sFAAsF,UAAU,CAAC,IAAI,eAAe,CACpH,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,CACT,iFAAiF,IAAI,OAAO;gBAC3F,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,6BAA6B,EAAE,GAAG,CACzE,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACZ,MAAM,CAAC,GAAG,CACT,2FAA2F;oBAC1F,GAAG,iCAAiC,KAAK,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAC9F,CAAC;YACH,CAAC;YACD,OAAO;QACR,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7E,MAAM,eAAe,CAAC,OAAO,EAAE,qDAAqD,IAAI,QAAQ,UAAU,IAAI,6BAA6B,GAAG,CAAC,CAAC;QAEhJ,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,oBAAoB,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,eAAe,CAAC,OAAO,EAC5B,iDAAiD,UAAU,CAAC,MAAM,gBAAgB,UAAU,CAAC,IAAI,gBAAgB;gBAChH,yCAAyC,CAC1C,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACtD,yEAAyE;QACzE,gDAAgD;QAChD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAChG,IAAI,aAAa,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,eAAe,CAAC,OAAO,EAC5B,kDAAkD,MAAM,EAAE,MAAM,cAAc;gBAC7E,GAAG,iCAAiC,KAAK,UAAU,eAAe,CACnE,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;YACzC,MAAM,eAAe,CAAC,OAAO,EAC5B,oFAAoF;gBACnF,IAAI,SAAS,EAAE,IAAI,UAAU,iCAAiC,KAAK,UAAU,gBAAgB;gBAC7F,oCAAoC,sBAAsB,GAAG,CAC9D,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,KAAK,gBAAgB,EAAE,CAAC;YAC/C,MAAM,eAAe,CAAC,OAAO,EAC5B,qDAAqD,SAAS,EAAE,IAAI,aAAa,sBAAsB,IAAI;gBAC1G,GAAG,iCAAiC,0CAA0C;gBAC9E,gDAAgD,CACjD,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,eAAe,CAAC,OAAO,EAC5B,6CAA6C,UAAU,CAAC,EAAE,EAAE;YAC3D,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CACzF,CAAC;IACH,CAAC;CACD,CAAC"}

package/dist/cli/fleets/commands/fleet.daemon.service-descriptor.d.ts

@@ -0,0 +1,66 @@
+import type { FleetServiceDescriptor, ServiceScope } from '@vibesdotdev/platform/fleets/service-backends';
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+interface PathResolutionOptions {
+    readonly platform?: NodeJS.Platform;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly homeDir?: string;
+}
+/**
+ * What the installed service passes on the daemon's argv. Argv is copied
+ * verbatim into the launchd plist `ProgramArguments`, the systemd `ExecStart`,
+ * and the schtasks wrapper, and is readable by every user on the host through
+ * `ps` — so NO credential value is representable here, only paths and posture.
+ */
+interface FleetDaemonArgsOptions {
+    readonly hostId: string;
+    /**
+     * The daemon root the service binds (`--workspace-root`): its
+     * `vibes.config.json` declares the host's environment tier
+     * (`config['runtime.host']`), which every credential read the daemon makes
+     * requires. A path, not a credential.
+     */
+    readonly workspaceRoot?: string;
+    readonly listen?: string;
+    /**
+     * Path of the one-time enrollment token file (mode 0600) for FIRST-RUN
+     * enrollment. On first start the daemon reads it, enrolls, persists the
+     * durable host token to `~/.vibes/hosts/<id>.json`, and removes the file;
+     * on every restart the file is absent and the persisted token is used.
+     * Omit when a durable token is already persisted.
+     */
+    readonly enrollTokenFile?: string;
+    /**
+     * Capability labels the daemon reports in heartbeats AND enforces at its own
+     * L5 gate (`sandbox:code-execution` grants remote peers runtime/execution —
+     * see lib/daemon-policy.ts). Baked into the service args so an installed
+     * service keeps the exact posture the operator chose at install time.
+     */
+    readonly labels?: string[];
+    /**
+     * Platform origin passed as `--broker-origin`: the host agent reaches the
+     * platform API through it and it is the relay broker origin. An origin is
+     * not a credential, so argv carries it.
+     */
+    readonly brokerOrigin?: string;
+}
+/**
+ * The service definition carries no credential: the connection bearer lives
+ * in the `fleet.daemon-credentials` store (`<vibesHome>/hosts/<id>.daemon-token`),
+ * which `vibes fleet daemon install` writes and the daemon resolves through
+ * `runtime.resolveCredential`. The descriptor's env is therefore empty.
+ */
+interface FleetDaemonServiceDescriptorOptions extends FleetDaemonArgsOptions {
+    readonly scope: ServiceScope;
+    readonly pathResolution?: PathResolutionOptions;
+}
+export declare function resolveFleetDaemonVibesBin(runtime: Pick<RuntimeRef, 'localEnvironment' | 'getEnv'>, options?: PathResolutionOptions): string;
+export declare function buildFleetDaemonArgs(opts: FleetDaemonArgsOptions): string[];
+export declare function buildFleetDaemonServiceDescriptor(runtime: Pick<RuntimeRef, 'localEnvironment' | 'getEnv'>, opts: FleetDaemonServiceDescriptorOptions): FleetServiceDescriptor;
+export declare function buildFleetDaemonInstallDescriptor(runtime: Pick<RuntimeRef, 'localEnvironment' | 'getEnv'>, opts: FleetDaemonServiceDescriptorOptions): FleetServiceDescriptor;
+export declare function buildFleetDaemonUninstallDescriptor(runtime: Pick<RuntimeRef, 'localEnvironment' | 'getEnv'>, opts: {
+    readonly hostId: string;
+    readonly scope: ServiceScope;
+    readonly pathResolution?: PathResolutionOptions;
+}): FleetServiceDescriptor;
+export {};
+//# sourceMappingURL=fleet.daemon.service-descriptor.d.ts.map

package/dist/cli/fleets/commands/fleet.daemon.service-descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.service-descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.service-descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,+CAA+C,CAAC;AAC1G,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,UAAU,qBAAqB;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,UAAU,sBAAsB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;GAKG;AACH,UAAU,mCAAoC,SAAQ,sBAAsB;IAC3E,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;CAChD;AAcD,wBAAgB,0BAA0B,CACzC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,kBAAkB,GAAG,QAAQ,CAAC,EACxD,OAAO,GAAE,qBAA0B,GACjC,MAAM,CAeR;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAa3E;AAED,wBAAgB,iCAAiC,CAChD,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,kBAAkB,GAAG,QAAQ,CAAC,EACxD,IAAI,EAAE,mCAAmC,GACvC,sBAAsB,CAsBxB;AAED,wBAAgB,iCAAiC,CAChD,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,kBAAkB,GAAG,QAAQ,CAAC,EACxD,IAAI,EAAE,mCAAmC,GACvC,sBAAsB,CAExB;AAED,wBAAgB,mCAAmC,CAClD,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,kBAAkB,GAAG,QAAQ,CAAC,EACxD,IAAI,EAAE;IACL,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;CAChD,GACC,sBAAsB,CAMxB"}

package/dist/cli/fleets/commands/fleet.daemon.service-descriptor.js

@@ -0,0 +1,77 @@
+function resolveHome(runtime, options = {}) {
+    if (options.homeDir)
+        return options.homeDir;
+    const accountHome = runtime.localEnvironment.accountHome?.();
+    if (accountHome)
+        return accountHome;
+    const readEnv = (key) => options.env ? options.env[key] : runtime.getEnv(key);
+    return readEnv('HOME') ?? readEnv('USERPROFILE') ?? '';
+}
+export function resolveFleetDaemonVibesBin(runtime, options = {}) {
+    // The runtime exposes one env key at a time (`getEnv`); the host-facts view
+    // carries no full env snapshot. `options.env` is the only whole-env override
+    // a caller may pass (install commands compose it explicitly).
+    const readEnv = (key) => options.env ? options.env[key] : runtime.getEnv(key);
+    const cliPath = readEnv('VIBES_CLI_PATH');
+    if (cliPath)
+        return cliPath;
+    const platform = options.platform ?? runtime.localEnvironment.getPlatform?.();
+    const home = resolveHome(runtime, options);
+    if (platform === 'win32') {
+        const base = readEnv('LOCALAPPDATA') ?? (home ? `${home}\\AppData\\Local` : 'C:\\AppData\\Local');
+        return `${base}\\vibes\\bin\\vibes.exe`.replace(/\//g, '\\');
+    }
+    return `${home}/.local/bin/vibes`.replace(/\/+/g, '/');
+}
+export function buildFleetDaemonArgs(opts) {
+    const args = [
+        ...(opts.workspaceRoot ? ['--workspace-root', opts.workspaceRoot] : []),
+        'fleet',
+        'daemon',
+        '--host-id',
+        opts.hostId
+    ];
+    if (opts.listen)
+        args.push('--listen', opts.listen);
+    if (opts.enrollTokenFile)
+        args.push('--enroll-token-file', opts.enrollTokenFile);
+    if (opts.labels?.length)
+        args.push('--labels', opts.labels.join(','));
+    if (opts.brokerOrigin)
+        args.push('--broker-origin', opts.brokerOrigin);
+    return args;
+}
+export function buildFleetDaemonServiceDescriptor(runtime, opts) {
+    const label = `com.vibes.fleet-daemon.${opts.hostId}`;
+    return {
+        id: `vibes-fleet-daemon-${opts.hostId}`,
+        name: `Vibes Fleet Daemon (${opts.hostId})`,
+        description: `Fleet daemon RPC server for host ${opts.hostId}`,
+        command: resolveFleetDaemonVibesBin(runtime, opts.pathResolution),
+        args: buildFleetDaemonArgs({
+            hostId: opts.hostId,
+            workspaceRoot: opts.workspaceRoot,
+            listen: opts.listen,
+            enrollTokenFile: opts.enrollTokenFile,
+            labels: opts.labels,
+            brokerOrigin: opts.brokerOrigin
+        }),
+        env: {},
+        workingDirectory: resolveHome(runtime, opts.pathResolution),
+        keepAlive: true,
+        autoStart: true,
+        scope: opts.scope,
+        label
+    };
+}
+export function buildFleetDaemonInstallDescriptor(runtime, opts) {
+    return buildFleetDaemonServiceDescriptor(runtime, opts);
+}
+export function buildFleetDaemonUninstallDescriptor(runtime, opts) {
+    return buildFleetDaemonServiceDescriptor(runtime, {
+        hostId: opts.hostId,
+        scope: opts.scope,
+        pathResolution: opts.pathResolution
+    });
+}
+//# sourceMappingURL=fleet.daemon.service-descriptor.js.map

package/dist/cli/fleets/commands/fleet.daemon.service-descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet.daemon.service-descriptor.js","sourceRoot":"","sources":["../../../../src/cli/fleets/commands/fleet.daemon.service-descriptor.ts"],"names":[],"mappings":"AA2DA,SAAS,WAAW,CACnB,OAAwD,EACxD,UAAiC,EAAE;IAEnC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7D,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,MAAM,OAAO,GAAG,CAAC,GAAW,EAAsB,EAAE,CACnD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,0BAA0B,CACzC,OAAwD,EACxD,UAAiC,EAAE;IAEnC,4EAA4E;IAC5E,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,CAAC,GAAW,EAAsB,EAAE,CACnD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,kBAAkB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAClG,OAAO,GAAG,IAAI,yBAAyB,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAA4B;IAChE,MAAM,IAAI,GAAG;QACZ,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO;QACP,QAAQ;QACR,WAAW;QACX,IAAI,CAAC,MAAM;KACX,CAAC;IACF,IAAI,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,eAAe;QAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACjF,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iCAAiC,CAChD,OAAwD,EACxD,IAAyC;IAEzC,MAAM,KAAK,GAAG,0BAA0B,IAAI,CAAC,MAAM,EAAE,CAAC;IACtD,OAAO;QACN,EAAE,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;QACvC,IAAI,EAAE,uBAAuB,IAAI,CAAC,MAAM,GAAG;QAC3C,WAAW,EAAE,oCAAoC,IAAI,CAAC,MAAM,EAAE;QAC9D,OAAO,EAAE,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC;QACjE,IAAI,EAAE,oBAAoB,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;SAC/B,CAAC;QACF,GAAG,EAAE,EAAE;QACP,gBAAgB,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC;QAC3D,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK;KACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC,CAChD,OAAwD,EACxD,IAAyC;IAEzC,OAAO,iCAAiC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,mCAAmC,CAClD,OAAwD,EACxD,IAIC;IAED,OAAO,iCAAiC,CAAC,OAAO,EAAE;QACjD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,cAAc,EAAE,IAAI,CAAC,cAAc;KACnC,CAAC,CAAC;AACJ,CAAC"}