@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.2

package/dist/fleets/provision/gpu-host-setup.d.ts

@@ -0,0 +1,25 @@
+/**
+ * GPU compute host provisioning for fleet hosts.
+ *
+ * A `--gpu` launch boots stock Ubuntu, which has no NVIDIA driver. This block
+ * makes containers able to use the GPU:
+ *   1. when `nvidia-smi` fails, installs the newest open server driver branch
+ *      that `ubuntu-drivers` recommends for compute AND that ships kernel
+ *      modules prebuilt for the running kernel (no DKMS build, no reboot),
+ *      loads it and stops setup if `nvidia-smi` still fails. A driver-bearing
+ *      image skips it,
+ *   2. installs Docker Engine when absent and enables dockerd,
+ *   3. installs the NVIDIA Container Toolkit when absent and registers the
+ *      `nvidia` runtime with Docker when Docker does not list it.
+ *
+ * It installs no workload. ComfyUI, rigging or motion models arrive through
+ * `--setup` or a workspace recipe; the desktop image stays behind `--desktop`.
+ *
+ * Pure string builder (workerd-safe): it may flow through platform-web's
+ * provision handler. Every step is guarded, so re-running cloud-init is a no-op.
+ */
+/** Stable marker comment — lets callers/tests detect the block in a rendered cloud-init. */
+export declare const GPU_HOST_SETUP_MARKER = "vibes fleet gpu host (nvidia driver check + docker + nvidia container runtime)";
+/** Returns the idempotent bash that readies a GPU droplet for `docker run --gpus all`. */
+export declare function buildGpuHostSetupScript(): string;
+//# sourceMappingURL=gpu-host-setup.d.ts.map

package/dist/fleets/provision/gpu-host-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gpu-host-setup.d.ts","sourceRoot":"","sources":["../../../src/fleets/provision/gpu-host-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,qBAAqB,mFAAmF,CAAC;AAEtH,0FAA0F;AAC1F,wBAAgB,uBAAuB,IAAI,MAAM,CA+DhD"}

package/dist/fleets/provision/gpu-host-setup.js

@@ -0,0 +1,88 @@
+/**
+ * GPU compute host provisioning for fleet hosts.
+ *
+ * A `--gpu` launch boots stock Ubuntu, which has no NVIDIA driver. This block
+ * makes containers able to use the GPU:
+ *   1. when `nvidia-smi` fails, installs the newest open server driver branch
+ *      that `ubuntu-drivers` recommends for compute AND that ships kernel
+ *      modules prebuilt for the running kernel (no DKMS build, no reboot),
+ *      loads it and stops setup if `nvidia-smi` still fails. A driver-bearing
+ *      image skips it,
+ *   2. installs Docker Engine when absent and enables dockerd,
+ *   3. installs the NVIDIA Container Toolkit when absent and registers the
+ *      `nvidia` runtime with Docker when Docker does not list it.
+ *
+ * It installs no workload. ComfyUI, rigging or motion models arrive through
+ * `--setup` or a workspace recipe; the desktop image stays behind `--desktop`.
+ *
+ * Pure string builder (workerd-safe): it may flow through platform-web's
+ * provision handler. Every step is guarded, so re-running cloud-init is a no-op.
+ */
+/** Stable marker comment — lets callers/tests detect the block in a rendered cloud-init. */
+export const GPU_HOST_SETUP_MARKER = 'vibes fleet gpu host (nvidia driver check + docker + nvidia container runtime)';
+/** Returns the idempotent bash that readies a GPU droplet for `docker run --gpus all`. */
+export function buildGpuHostSetupScript() {
+    return `
+# === ${GPU_HOST_SETUP_MARKER} ===
+set -euo pipefail
+export HOME=/root
+export DEBIAN_FRONTEND=noninteractive
+# The fleet cloud-init runs with umask 077 for its secrets; apt's _apt sandbox
+# cannot read a 0600 keyring (measured: NO_PUBKEY on nvidia-container-toolkit).
+umask 022
+
+# First boot races unattended-upgrades for the dpkg lock; wait for it.
+APT='apt-get -o DPkg::Lock::Timeout=900 -y'
+
+if ! nvidia-smi >/dev/null 2>&1; then
+  $APT update
+  $APT install ubuntu-drivers-common
+  # Newest recommended open server branch with modules prebuilt for the running
+  # kernel: a fresh image's kernel can trail the archive, and the newest branch
+  # may only ship modules for newer kernels (measured: 615 had none for
+  # 6.8.0-142, 595 did).
+  kernel=$(uname -r)
+  branch=""
+  for candidate in $(ubuntu-drivers list --gpgpu 2>/dev/null | grep -o 'nvidia-driver-[0-9]*-server-open' | grep -o '[0-9][0-9]*' | sort -rn || true); do
+    if apt-cache show "linux-modules-nvidia-\${candidate}-server-open-\${kernel}" >/dev/null 2>&1; then
+      branch=$candidate
+      break
+    fi
+  done
+  if [ -z "$branch" ]; then
+    echo "gpu-host: no recommended open server NVIDIA driver ships modules for kernel \${kernel}" >&2
+    exit 1
+  fi
+  # The -generic meta keeps modules installed for every kernel update, so a
+  # reboot or a resume from snapshot into a newer kernel still has a driver.
+  $APT install "linux-modules-nvidia-\${branch}-server-open-\${kernel}" \\
+    "linux-modules-nvidia-\${branch}-server-open-generic" \\
+    "nvidia-headless-no-dkms-\${branch}-server-open" "nvidia-utils-\${branch}-server"
+  modprobe nvidia
+  if ! nvidia-smi >/dev/null 2>&1; then
+    echo "gpu-host: nvidia-smi still fails after installing driver branch \${branch}" >&2
+    exit 1
+  fi
+fi
+
+if ! command -v docker >/dev/null 2>&1; then
+  curl -fsSL https://get.docker.com | sh
+fi
+systemctl enable --now docker
+
+if ! command -v nvidia-ctk >/dev/null 2>&1; then
+  curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey \\
+    | gpg --dearmor --yes -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
+  curl -fsSL https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list \\
+    | sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' \\
+    > /etc/apt/sources.list.d/nvidia-container-toolkit.list
+  $APT update
+  $APT install nvidia-container-toolkit
+fi
+if ! docker info --format '{{json .Runtimes}}' | grep -q '"nvidia"'; then
+  nvidia-ctk runtime configure --runtime=docker
+  systemctl restart docker
+fi
+`.trimStart();
+}
+//# sourceMappingURL=gpu-host-setup.js.map

package/dist/fleets/provision/gpu-host-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gpu-host-setup.js","sourceRoot":"","sources":["../../../src/fleets/provision/gpu-host-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,qBAAqB,GAAG,gFAAgF,CAAC;AAEtH,0FAA0F;AAC1F,MAAM,UAAU,uBAAuB;IACtC,OAAO;QACA,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4D5B,CAAC,SAAS,EAAE,CAAC;AACd,CAAC"}

package/dist/fleets/provision/harness-bootstrap.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Owner-canonical harness bootstrap block for fleet host cloud-init.
+ *
+ * The fleet launch path resolves every requested harness host against the
+ * External runtime's `external/operation` registry (`launch.ts`) and passes
+ * the validated coordinates here. This builder owns one thing: rendering
+ * those coordinates as the exact CLI invocation the External projector
+ * derives (`external/src/cli/runtime-projection.ts`):
+ *
+ *   vibes dev external <hostId> <commandName>
+ *
+ * where the projected group always carries `host.id` as an alias
+ * (`uniqueCLIAliases(name, [host.id, ...hostAliases])`) and the command name
+ * is `cli.name ?? operation` (`operationCommand`). The projector adds NO
+ * implicit argument — arguments/options exist only when the descriptor's own
+ * `cli` config declares them — so no workspace argument is synthesized here.
+ *
+ * No vendor list, host id enum, or install recipe lives here. Nothing is
+ * rendered unless launch already validated an owner-advertised `bootstrap`
+ * operation on the operator's runtime; the owner keeps the mechanism.
+ *
+ * Composition contract (owned by `launch.ts`): this block runs AFTER the
+ * workspace toolchain/setup script and BEFORE the host-local PM daemon unit.
+ * It re-asserts `set -euo pipefail`, so a failed bootstrap aborts the boot
+ * script and the PM daemon is never enabled: a host must not start dispatch
+ * lanes for a harness it could not bootstrap.
+ *
+ * That is launch-time ordering honesty only. It does NOT observe post-boot
+ * harness readiness — a readiness capability file or heartbeat needs an owner
+ * that does not exist yet, so launch deliberately writes no `harness:<id>`
+ * label (a static label would claim observed state nobody measured).
+ *
+ * Pure string builder: workerd-safe, no Node/Bun filesystem or runtime APIs.
+ */
+export declare const HARNESS_BOOTSTRAP_SETUP_MARKER = "vibes fleet harness bootstrap (owner-advertised)";
+/** One validated owner coordinate: runtime `hostId` + projected command name. */
+export interface HarnessBootstrapCommand {
+    /** External host id the runtime advertised the operation under. */
+    hostId: string;
+    /** Projected CLI command (`cli.name ?? operation`) under `vibes dev external <hostId>`. */
+    commandName: string;
+}
+export declare function isShellSafeHarnessBootstrapToken(value: string): boolean;
+/**
+ * Render one canonical bootstrap invocation per validated harness host,
+ * in the order the caller resolved them.
+ */
+export declare function buildHarnessBootstrapScript(commands: readonly HarnessBootstrapCommand[]): string;
+//# sourceMappingURL=harness-bootstrap.d.ts.map

package/dist/fleets/provision/harness-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-bootstrap.d.ts","sourceRoot":"","sources":["../../../src/fleets/provision/harness-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,eAAO,MAAM,8BAA8B,qDAAqD,CAAC;AAEjG,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACvC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,WAAW,EAAE,MAAM,CAAC;CACpB;AASD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvE;AAUD;;;GAGG;AACH,wBAAgB,2BAA2B,CAC1C,QAAQ,EAAE,SAAS,uBAAuB,EAAE,GAC1C,MAAM,CAqBR"}

package/dist/fleets/provision/harness-bootstrap.js

@@ -0,0 +1,72 @@
+/**
+ * Owner-canonical harness bootstrap block for fleet host cloud-init.
+ *
+ * The fleet launch path resolves every requested harness host against the
+ * External runtime's `external/operation` registry (`launch.ts`) and passes
+ * the validated coordinates here. This builder owns one thing: rendering
+ * those coordinates as the exact CLI invocation the External projector
+ * derives (`external/src/cli/runtime-projection.ts`):
+ *
+ *   vibes dev external <hostId> <commandName>
+ *
+ * where the projected group always carries `host.id` as an alias
+ * (`uniqueCLIAliases(name, [host.id, ...hostAliases])`) and the command name
+ * is `cli.name ?? operation` (`operationCommand`). The projector adds NO
+ * implicit argument — arguments/options exist only when the descriptor's own
+ * `cli` config declares them — so no workspace argument is synthesized here.
+ *
+ * No vendor list, host id enum, or install recipe lives here. Nothing is
+ * rendered unless launch already validated an owner-advertised `bootstrap`
+ * operation on the operator's runtime; the owner keeps the mechanism.
+ *
+ * Composition contract (owned by `launch.ts`): this block runs AFTER the
+ * workspace toolchain/setup script and BEFORE the host-local PM daemon unit.
+ * It re-asserts `set -euo pipefail`, so a failed bootstrap aborts the boot
+ * script and the PM daemon is never enabled: a host must not start dispatch
+ * lanes for a harness it could not bootstrap.
+ *
+ * That is launch-time ordering honesty only. It does NOT observe post-boot
+ * harness readiness — a readiness capability file or heartbeat needs an owner
+ * that does not exist yet, so launch deliberately writes no `harness:<id>`
+ * label (a static label would claim observed state nobody measured).
+ *
+ * Pure string builder: workerd-safe, no Node/Bun filesystem or runtime APIs.
+ */
+import { FLEET_CLOUD_INIT_VIBES_BIN } from "./cloud-init.js";
+export const HARNESS_BOOTSTRAP_SETUP_MARKER = 'vibes fleet harness bootstrap (owner-advertised)';
+/**
+ * Conservative shell-safe token for the two rendered coordinates. The runtime
+ * descriptor schema allows wider strings; a coordinate that cannot be rendered
+ * plainly is refused rather than quoted into ambiguity.
+ */
+const HARNESS_BOOTSTRAP_TOKEN_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
+export function isShellSafeHarnessBootstrapToken(value) {
+    return HARNESS_BOOTSTRAP_TOKEN_PATTERN.test(value);
+}
+function assertSafeToken(value, field) {
+    if (!isShellSafeHarnessBootstrapToken(value)) {
+        throw new Error(`Invalid ${field} for harness bootstrap (shell-safe token required): ${value}`);
+    }
+}
+/**
+ * Render one canonical bootstrap invocation per validated harness host,
+ * in the order the caller resolved them.
+ */
+export function buildHarnessBootstrapScript(commands) {
+    if (commands.length === 0)
+        return '';
+    for (const command of commands) {
+        assertSafeToken(command.hostId, 'harness host id');
+        assertSafeToken(command.commandName, 'harness bootstrap command');
+    }
+    const lines = commands.map((command) => `${FLEET_CLOUD_INIT_VIBES_BIN} dev external ${command.hostId} ${command.commandName}`);
+    return `
+# === ${HARNESS_BOOTSTRAP_SETUP_MARKER} ===
+# One owner-canonical invocation per validated harness host. The coordinate is
+# what the External CLI projector derives; the absolute \`vibes\` path matches
+# the rest of cloud-init (the installer's PATH is not assumed).
+set -euo pipefail
+${lines.join('\n')}
+`;
+}
+//# sourceMappingURL=harness-bootstrap.js.map

package/dist/fleets/provision/harness-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-bootstrap.js","sourceRoot":"","sources":["../../../src/fleets/provision/harness-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAE7D,MAAM,CAAC,MAAM,8BAA8B,GAAG,kDAAkD,CAAC;AAUjG;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,oCAAoC,CAAC;AAE7E,MAAM,UAAU,gCAAgC,CAAC,KAAa;IAC7D,OAAO,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACpD,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACd,WAAW,KAAK,uDAAuD,KAAK,EAAE,CAC9E,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAC1C,QAA4C;IAE5C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACnD,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CACzB,CAAC,OAAO,EAAE,EAAE,CACX,GAAG,0BAA0B,iBAAiB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CACtF,CAAC;IAEF,OAAO;QACA,8BAA8B;;;;;EAKpC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;CACjB,CAAC;AACF,CAAC"}

package/dist/fleets/provision/index.d.ts

@@ -0,0 +1,8 @@
+export * from './cloud-init.ts';
+export * from './portable-bootstrap.ts';
+export * from './build-runner-setup.ts';
+export * from './desktop-host-setup.ts';
+export * from './workspace-host-setup.ts';
+export * from './harness-bootstrap.ts';
+export * from './daemon-host-config.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/fleets/provision/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/fleets/provision/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC"}

package/dist/fleets/provision/index.js

@@ -0,0 +1,8 @@
+export * from "./cloud-init.js";
+export * from "./portable-bootstrap.js";
+export * from "./build-runner-setup.js";
+export * from "./desktop-host-setup.js";
+export * from "./workspace-host-setup.js";
+export * from "./harness-bootstrap.js";
+export * from "./daemon-host-config.js";
+//# sourceMappingURL=index.js.map

package/dist/fleets/provision/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/fleets/provision/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC"}

package/dist/fleets/provision/portable-bootstrap.d.ts

@@ -0,0 +1,27 @@
+export interface PortableFleetBootstrapInput {
+    hostId: string;
+    platformOrigin: string;
+    labels?: string[];
+    installUrl?: string;
+    /** The existing workspace the daemon binds (it runs from there). */
+    workspace?: string;
+    /**
+     * The workspace's own composition file, `<workspace>/vibes.config.{ts,js,mjs}`,
+     * checked present before launch. No config is handed across the launch
+     * (rc04 D2): the daemon binds the workspace and bootstrap loads its config. A
+     * host's own plugin set is its CLI floor (`hostConfig`), never this path.
+     */
+    configPath?: string;
+}
+/**
+ * Portable Bash entrypoint. The enrollment credential arrives only in the
+ * script's transient process environment; the script moves it into a private
+ * token file (0600, written by the `printf` builtin under `umask 077`, never
+ * on an argv) and the daemon consumes it through `--enroll-token-file`, so the
+ * daemon never reads a credential from its environment. The daemon binds the
+ * workspace and reads its composition there, so that composition declares the
+ * host's environment tier (`config['runtime.host']`) the daemon's credential
+ * reads need.
+ */
+export declare function buildPortableFleetBootstrap(input: PortableFleetBootstrapInput): string;
+//# sourceMappingURL=portable-bootstrap.d.ts.map

package/dist/fleets/provision/portable-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portable-bootstrap.d.ts","sourceRoot":"","sources":["../../../src/fleets/provision/portable-bootstrap.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,2BAA2B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AASD;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,GAAG,MAAM,CA4DtF"}

package/dist/fleets/provision/portable-bootstrap.js

@@ -0,0 +1,78 @@
+import { DEFAULT_VIBES_INSTALL_URL, FLEET_REGISTRY_LINKER, FLEET_REGISTRY_NPM_SCOPE, FLEET_REGISTRY_URL } from "./cloud-init.js";
+const COMPOSITION_FILE = /^vibes\.config\.(?:ts|js|mjs)$/;
+function quote(value) {
+    if (value.includes('\0'))
+        throw new Error('Bootstrap values cannot contain NUL');
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+/**
+ * Portable Bash entrypoint. The enrollment credential arrives only in the
+ * script's transient process environment; the script moves it into a private
+ * token file (0600, written by the `printf` builtin under `umask 077`, never
+ * on an argv) and the daemon consumes it through `--enroll-token-file`, so the
+ * daemon never reads a credential from its environment. The daemon binds the
+ * workspace and reads its composition there, so that composition declares the
+ * host's environment tier (`config['runtime.host']`) the daemon's credential
+ * reads need.
+ */
+export function buildPortableFleetBootstrap(input) {
+    if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(input.hostId))
+        throw new Error('Invalid hostId');
+    const origin = new URL(input.platformOrigin);
+    const installer = new URL(input.installUrl ?? DEFAULT_VIBES_INSTALL_URL);
+    for (const url of [origin, installer]) {
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) {
+            throw new Error('Bootstrap URLs must be HTTP(S) without credentials');
+        }
+    }
+    const workspace = input.workspace ?? '/workspace';
+    if (input.configPath !== undefined) {
+        const slash = input.configPath.lastIndexOf('/');
+        const dir = input.configPath.slice(0, slash);
+        const file = input.configPath.slice(slash + 1);
+        if (dir !== workspace.replace(/\/+$/, '') || !COMPOSITION_FILE.test(file)) {
+            throw new Error('configPath must be the workspace\'s own vibes.config.{ts,js,mjs}; no config is handed across a launch');
+        }
+    }
+    const labels = input.labels ?? [];
+    if (labels.some((label) => !/^[A-Za-z0-9][A-Za-z0-9:._/-]{0,127}$/.test(label))) {
+        throw new Error('Invalid capability label');
+    }
+    return `#!/bin/bash
+set -euo pipefail
+export HOME="\${HOME:-/root}"
+export PATH="\${PATH:-/usr/local/bin:/usr/bin:/bin}"
+export VIBES_INSTALL_DIR="$HOME/.local/bin"
+export PUBLIC_VIBES_PLATFORM_ORIGIN=${quote(origin.origin)}
+enrollment="\${VIBES_FLEET_ENROLL_TOKEN:?Missing fleet enrollment credential}"
+unset VIBES_FLEET_ENROLL_TOKEN VIBES_HOST_ENTRYPOINT VIBES_REGISTRY_TOKEN
+[[ \${#enrollment} -ge 8 && \${#enrollment} -le 256 && "$enrollment" != *[!A-Za-z0-9._-]* ]] || { printf 'Invalid fleet enrollment credential\\n' >&2; exit 64; }
+umask 077
+installer=$(mktemp)
+trap 'rm -f "$installer"' EXIT
+curl -fsSL ${quote(installer.href)} -o "$installer"
+bash "$installer"
+rm -f "$installer"
+trap - EXIT
+lease=$(printf '{"hostId":"%s","token":"%s"}' ${quote(input.hostId)} "$enrollment" |
+  curl -fsSL -X POST -H 'content-type: application/json' --data @- ${quote(`${origin.origin}/api/hosts/${input.hostId}/registry-lease`)} |
+  python3 -c 'import json,sys; value=json.load(sys.stdin).get("token"); assert isinstance(value,str) and value; print(value,end="")')
+cat > "$HOME/.bunfig.toml" <<'FLEET_BUNFIG'
+[install]
+linker = "${FLEET_REGISTRY_LINKER}"
+auto = "disable"
+[install.scopes]
+"${FLEET_REGISTRY_NPM_SCOPE}" = { url = "${FLEET_REGISTRY_URL}", token = "$VIBES_REGISTRY_TOKEN" }
+FLEET_BUNFIG
+VIBES_REGISTRY_TOKEN="$lease" "$VIBES_INSTALL_DIR/vibes" update --global
+unset lease
+cd ${quote(workspace)}
+${input.configPath ? `test -f ${quote(input.configPath)}\n` : ''}"$VIBES_INSTALL_DIR/vibes" fleet daemon --help
+install -d -m 0700 "$HOME/.vibes/hosts"
+enroll_file="$HOME/.vibes/hosts/"${quote(`${input.hostId}.enroll-token`)}
+printf '%s\\n' "$enrollment" > "$enroll_file"
+unset enrollment
+exec "$VIBES_INSTALL_DIR/vibes" fleet daemon --host-id ${quote(input.hostId)} --enroll-token-file "$enroll_file" --relay${labels.length ? ` --labels ${quote(labels.join(','))}` : ''}
+`;
+}
+//# sourceMappingURL=portable-bootstrap.js.map

package/dist/fleets/provision/portable-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portable-bootstrap.js","sourceRoot":"","sources":["../../../src/fleets/provision/portable-bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,MAAM,iBAAiB,CAAC;AAkBzB,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AAE1D,SAAS,KAAK,CAAC,KAAa;IAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACjF,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAkC;IAC7E,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,yBAAyB,CAAC,CAAC;IACzE,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACvE,CAAC;IACF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,YAAY,CAAC;IAClD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/C,IAAI,GAAG,KAAK,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CACd,uGAAuG,CACvG,CAAC;QACH,CAAC;IACF,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;;;;;sCAK8B,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;;;;;;;aAO7C,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;;;;gDAIc,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;qEACE,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,cAAc,KAAK,CAAC,MAAM,iBAAiB,CAAC;;;;YAI3H,qBAAqB;;;GAG9B,wBAAwB,gBAAgB,kBAAkB;;;;KAIxD,KAAK,CAAC,SAAS,CAAC;EACnB,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;;mCAE7B,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,eAAe,CAAC;;;yDAGf,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,8CAA8C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;CACpL,CAAC;AACF,CAAC"}

package/dist/fleets/provision/workspace-host-setup.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Composable workspace host setup script builder for fleet and session hosts.
+ *
+ * Appended as an `extraScript` to `buildFleetCloudInit`.
+ * Pure string builder: workerd-safe, no Node/Bun filesystem or runtime APIs.
+ *
+ * Idempotent: guards toolchain installations and clones so re-running is safe.
+ * Non-prescriptive: accepts arbitrary repositories, toolchains, and setup hooks.
+ */
+import type { WorkspaceEnvironmentConfig } from '../../schemas/hosts/workspace.ts';
+export declare const WORKSPACE_HOST_SETUP_MARKER = "vibes fleet workspace-host setup (composable environment)";
+/**
+ * Renders the idempotent Docker Engine installation block used by both
+ * workspace hosts and build-runner hosts.
+ */
+export declare function renderDockerInstallBlock(): string;
+/**
+ * Builds the complete workspace host setup bash script.
+ * Pure string builder suitable for cloud-init extraScript execution.
+ */
+export declare function buildWorkspaceHostSetupScript(config: WorkspaceEnvironmentConfig): string;
+//# sourceMappingURL=workspace-host-setup.d.ts.map

package/dist/fleets/provision/workspace-host-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-host-setup.d.ts","sourceRoot":"","sources":["../../../src/fleets/provision/workspace-host-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACX,0BAA0B,EAG1B,MAAM,kCAAkC,CAAC;AAE1C,eAAO,MAAM,2BAA2B,8DAA8D,CAAC;AAgBvG;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAMjD;AA6KD;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,0BAA0B,GAAG,MAAM,CAwBxF"}

package/dist/fleets/provision/workspace-host-setup.js

@@ -0,0 +1,219 @@
+/**
+ * Composable workspace host setup script builder for fleet and session hosts.
+ *
+ * Appended as an `extraScript` to `buildFleetCloudInit`.
+ * Pure string builder: workerd-safe, no Node/Bun filesystem or runtime APIs.
+ *
+ * Idempotent: guards toolchain installations and clones so re-running is safe.
+ * Non-prescriptive: accepts arbitrary repositories, toolchains, and setup hooks.
+ */
+export const WORKSPACE_HOST_SETUP_MARKER = 'vibes fleet workspace-host setup (composable environment)';
+/** Sanitize a token, slug, or single-line string for safe bash single-quoted inclusion. */
+function escapeBashSingleQuote(str) {
+    return str.replace(/'/g, `'\\''`);
+}
+/** Validate git ref or path to prevent shell metacharacter injection. */
+const SAFE_PATH_PATTERN = /^[a-zA-Z0-9_.\-/@:+]+$/;
+function assertSafePath(value, fieldName) {
+    if (!SAFE_PATH_PATTERN.test(value)) {
+        throw new Error(`Invalid ${fieldName} for workspace setup: unsafe characters detected`);
+    }
+}
+/**
+ * Renders the idempotent Docker Engine installation block used by both
+ * workspace hosts and build-runner hosts.
+ */
+export function renderDockerInstallBlock() {
+    return `if ! command -v docker >/dev/null 2>&1; then
+  echo "Installing docker..."
+  curl -fsSL https://get.docker.com | sh
+  systemctl enable --now docker
+fi`;
+}
+/**
+ * Renders toolchain installation commands for requested toolchains.
+ * Guards each toolchain check so re-running is a no-op.
+ */
+function renderToolchains(toolchains) {
+    if (!toolchains || toolchains.length === 0)
+        return '';
+    const blocks = ['# --- Toolchains ---'];
+    for (const toolchain of toolchains) {
+        const lower = toolchain.toLowerCase().trim();
+        switch (lower) {
+            case 'bun':
+                blocks.push(`
+if ! command -v bun >/dev/null 2>&1; then
+  echo "Installing bun..."
+  curl -fsSL https://bun.sh/install | bash
+  ln -sf /root/.bun/bin/bun /usr/local/bin/bun
+fi`);
+                break;
+            case 'node':
+            case 'nodejs':
+                blocks.push(`
+if ! command -v node >/dev/null 2>&1; then
+  echo "Installing nodejs..."
+  curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+  apt-get install -y nodejs
+fi`);
+                break;
+            case 'rust':
+            case 'cargo':
+                blocks.push(`
+if ! command -v cargo >/dev/null 2>&1; then
+  echo "Installing rust toolchain..."
+  curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+  ln -sf /root/.cargo/bin/* /usr/local/bin/ || true
+fi`);
+                break;
+            case 'python':
+            case 'python3':
+                blocks.push(`
+if ! command -v python3 >/dev/null 2>&1; then
+  echo "Installing python3..."
+  apt-get update && apt-get install -y python3 python3-pip python3-venv
+fi`);
+                break;
+            case 'go':
+            case 'golang':
+                blocks.push(`
+if ! command -v go >/dev/null 2>&1; then
+  echo "Installing go..."
+  apt-get update && apt-get install -y golang-go
+fi`);
+                break;
+            case 'docker':
+                blocks.push(`\n${renderDockerInstallBlock()}`);
+                break;
+            default:
+                // Generic package attempt via apt-get if standard package name
+                if (/^[a-z0-9-]+$/.test(lower)) {
+                    blocks.push(`
+if ! dpkg -s '${lower}' >/dev/null 2>&1; then
+  apt-get install -y '${lower}' || true
+fi`);
+                }
+                break;
+        }
+    }
+    return blocks.join('\n');
+}
+/**
+ * Renders repository clone and checkout commands.
+ */
+function renderRepositories(repositories) {
+    if (!repositories || repositories.length === 0)
+        return '';
+    const blocks = [
+        '# --- Repositories ---',
+        'mkdir -p /root/workspace'
+    ];
+    for (let i = 0; i < repositories.length; i++) {
+        const repo = repositories[i];
+        const targetRelPath = repo.path && repo.path !== '.' ? repo.path : '';
+        const targetDir = targetRelPath
+            ? `/root/workspace/${targetRelPath}`
+            : `/root/workspace`;
+        assertSafePath(repo.url, 'repo.url');
+        if (repo.ref)
+            assertSafePath(repo.ref, 'repo.ref');
+        if (targetRelPath)
+            assertSafePath(targetRelPath, 'repo.path');
+        const depthFlag = repo.depth ? `--depth ${repo.depth}` : '';
+        const refFlag = repo.ref ? `--branch '${escapeBashSingleQuote(repo.ref)}'` : '';
+        const refMirror = repo.referencePath ? `--reference '${escapeBashSingleQuote(repo.referencePath)}'` : '';
+        blocks.push(`
+# Repo [${i}]: ${repo.url} -> ${targetDir}
+if [ ! -d '${targetDir}/.git' ]; then
+  mkdir -p '${targetDir}'
+  echo "Cloning ${repo.url} into ${targetDir}..."
+  git clone ${depthFlag} ${refFlag} ${refMirror} '${escapeBashSingleQuote(repo.url)}' '${targetDir}' || {
+    # If branch clone fails (e.g. ref is a SHA), clone default then fetch and checkout
+    git clone ${depthFlag} ${refMirror} '${escapeBashSingleQuote(repo.url)}' '${targetDir}'
+    if [ -n "${repo.ref ?? ''}" ]; then
+      cd '${targetDir}'
+      git fetch origin '${escapeBashSingleQuote(repo.ref ?? '')}' || true
+      git checkout '${escapeBashSingleQuote(repo.ref ?? '')}'
+    fi
+  }
+else
+  echo "Directory ${targetDir} already exists, pulling updates..."
+  cd '${targetDir}'
+  git fetch --all || true
+  ${repo.ref ? `git checkout '${escapeBashSingleQuote(repo.ref)}' || true` : ''}
+fi`);
+    }
+    return blocks.join('\n');
+}
+/**
+ * Renders user-defined bootstrap setup hooks.
+ */
+function renderSetupHooks(hooks) {
+    if (!hooks || hooks.length === 0)
+        return '';
+    const blocks = ['# --- Setup Hooks ---'];
+    for (let i = 0; i < hooks.length; i++) {
+        const hook = hooks[i];
+        const name = hook.name ?? `hook-${i + 1}`;
+        const hookDir = hook.cwd
+            ? `/root/workspace/${hook.cwd}`
+            : `/root/workspace`;
+        const envExports = hook.env
+            ? Object.entries(hook.env)
+                .map(([k, v]) => `export ${k}='${escapeBashSingleQuote(v)}'`)
+                .join('\n')
+            : '';
+        blocks.push(`
+# Setup Hook [${i + 1}]: ${name}
+echo "Executing setup step: ${name}..."
+(
+  cd '${hookDir}'
+  ${envExports}
+  ${hook.command}
+)`);
+    }
+    return blocks.join('\n');
+}
+/**
+ * Renders global environment variables.
+ */
+function renderGlobalEnv(env) {
+    const entries = Object.entries(env);
+    if (entries.length === 0)
+        return '';
+    const lines = entries.map(([k, v]) => `export ${k}='${escapeBashSingleQuote(v)}'`);
+    return `
+# --- Global Environment ---
+${lines.join('\n')}
+`;
+}
+/**
+ * Builds the complete workspace host setup bash script.
+ * Pure string builder suitable for cloud-init extraScript execution.
+ */
+export function buildWorkspaceHostSetupScript(config) {
+    const envBlock = renderGlobalEnv(config.env);
+    const toolchainsBlock = renderToolchains(config.toolchains);
+    const reposBlock = renderRepositories(config.repositories);
+    const hooksBlock = renderSetupHooks(config.setup);
+    return `
+# === ${WORKSPACE_HOST_SETUP_MARKER} ===
+set -euo pipefail
+
+mkdir -p /root/workspace
+
+# Ensure essential tools are present
+command -v git >/dev/null 2>&1 || { apt-get update && apt-get install -y git curl unzip; }
+
+${envBlock}
+${toolchainsBlock}
+${reposBlock}
+${hooksBlock}
+
+# Export workspace readiness capability label for the daemon
+mkdir -p /root/.vibes/capabilities
+touch /root/.vibes/capabilities/workspace-ready
+`;
+}
+//# sourceMappingURL=workspace-host-setup.js.map