robopark 2.8.35 → 3.0.0

package/dist/robopark/setup-livekit.js

@@ -0,0 +1,300 @@
+/**
+ * RoboPark — `robopark setup-livekit`.
+ *
+ * Dispatches an opencode agent over the mesh to install and start a LiveKit
+ * server on the fleet hub via Docker. After the agent reports success, the
+ * scheduler is told about the new LiveKit server.
+ *
+ * Usage:
+ *   robopark setup-livekit --hub-url http://HUB_IP:47913 --token <mesh_token>
+ *
+ * If --hub-url is omitted, the hub is discovered over Tailscale.
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { homedir, hostname } from 'node:os';
+import { join } from 'node:path';
+import chalk from 'chalk';
+import { discoverContext } from './discovery.js';
+function loadMeshToken() {
+    const paths = [
+        join(homedir(), '.robopark', 'mesh.token'),
+        join(homedir(), '.config', 'infinicode-nodejs', 'config.json'),
+        join(homedir(), '.infinicode-nodejs', 'config.json'),
+        join(homedir(), 'AppData', 'Roaming', 'infinicode-nodejs', 'Config', 'config.json'),
+    ];
+    for (const p of paths) {
+        if (!existsSync(p))
+            continue;
+        try {
+            if (p.endsWith('mesh.token'))
+                return readFileSync(p, 'utf8').trim();
+            const cfg = JSON.parse(readFileSync(p, 'utf8'));
+            if (cfg.federation?.token)
+                return cfg.federation.token;
+        }
+        catch { /* ignore */ }
+    }
+    return process.env.ROBOPARK_MESH_TOKEN;
+}
+function randId() {
+    return `${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+}
+function envelope(kind, from, data, opts = {}) {
+    return { v: 1, id: randId(), kind, from, to: opts.to, ts: Date.now(), auth: opts.auth, data };
+}
+async function meshRpc(targetUrl, token, env) {
+    const url = `${targetUrl.replace(/\/$/, '')}/fed/rpc?token=${encodeURIComponent(token)}`;
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(env),
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => '');
+        throw new Error(`mesh RPC ${res.status}: ${text}`);
+    }
+    return (await res.json());
+}
+async function getHubManifest(hubUrl, token) {
+    try {
+        const url = `${hubUrl.replace(/\/$/, '')}/fed/manifest?token=${encodeURIComponent(token)}`;
+        const res = await fetch(url, { headers: { accept: 'application/json' } });
+        if (!res.ok)
+            return { nodeId: null, platform: null };
+        const manifest = (await res.json());
+        return { nodeId: manifest.nodeId || manifest.id || null, platform: manifest.platform ?? null };
+    }
+    catch {
+        return { nodeId: null, platform: null };
+    }
+}
+/** Fallback: GET /fed/status returns the hub's own NodeManifest under `self`,
+ *  including `platform`. Used when /fed/manifest doesn't carry it. */
+async function getHubPlatformFromStatus(hubUrl, token) {
+    try {
+        const url = `${hubUrl.replace(/\/$/, '')}/fed/status?token=${encodeURIComponent(token)}`;
+        const res = await fetch(url, { headers: { accept: 'application/json' } });
+        if (!res.ok)
+            return null;
+        const status = (await res.json());
+        return status.self?.platform ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+const LIVEKIT_SETUP_PROMPT_HEADER = `You are the RoboPark infrastructure agent running on the fleet hub.
+
+GOAL: Install and start a LiveKit server in Docker on this machine so the RoboPark scheduler can mint tokens and the robot preview agent can publish camera/audio.
+
+DO NOT ask the user for confirmation. Execute the steps directly. If a step is already done, skip it and report it.
+`;
+const LIVEKIT_SETUP_PROMPT_FOOTER = `
+IMPORTANT: this is a headless fleet node. Do not open a browser. Only run shell commands and report the final LiveKit URL + credentials in a JSON code block like:
+\`\`\`json
+{
+  "url": "ws://127.0.0.1:7880",
+  "api_key": "...",
+  "api_secret": "...",
+  "running": true
+}
+\`\`\`
+`;
+const LIVEKIT_SETUP_STEPS_LINUX = `Steps:
+1. Check if Docker is installed and running. If not, install Docker (apt-get install docker.io on Debian/Ubuntu, or dnf install docker on Fedora, or use the official convenience script if needed) and start it with systemctl.
+2. Pull the official LiveKit server image: docker pull livekit/livekit-server:latest
+3. Create a directory /opt/livekit if it does not exist.
+4. Generate API credentials: run the LiveKit CLI container to create a key/secret and save them to /opt/livekit/keys.yaml:
+   docker run --rm livekit/livekit-server:latest generate-keys
+   Parse the output and write it as a YAML file with fields api_key and api_secret.
+5. Start the LiveKit server container with host networking on port 7880:
+   docker run -d --name livekit-server --restart unless-stopped --network host \\
+     -v /opt/livekit/keys.yaml:/etc/livekit/keys.yaml:ro \\
+     livekit/livekit-server:latest \\
+     --config /etc/livekit/keys.yaml --bind 0.0.0.0 --port 7880
+6. Wait up to 30 seconds and verify it is healthy: curl -sf http://127.0.0.1:7880
+7. Report back the WebSocket URL (ws://THIS_MACHINE_TAILSCALE_IP:7880 or ws://127.0.0.1:7880), the api_key, the api_secret, and whether the container is running.
+`;
+// Windows hosts: Docker Desktop does not support --network host, so ports are
+// mapped explicitly. --dev mode ships with well-known devkey/secret, which
+// sidesteps the `generate-keys` dance (that container command is awkward to
+// run/parse consistently from PowerShell).
+const LIVEKIT_SETUP_STEPS_WINDOWS = `Steps (Windows host — use PowerShell, NOT bash):
+1. Check if Docker Desktop is installed and running: docker info
+   If it is not installed, stop and report that Docker Desktop must be installed manually (winget install Docker.DockerDesktop), since it requires a GUI/WSL2 backend and cannot be silently installed headlessly.
+2. Pull the official LiveKit server image: docker pull livekit/livekit-server:latest
+3. Start the LiveKit server container in --dev mode (uses the well-known devkey/secret credentials, no key generation needed). Docker Desktop on Windows does not support --network host, so map ports explicitly:
+   docker run -d --name livekit-server --restart unless-stopped \`
+     -p 7880:7880 -p 7881:7881 -p 7881:7881/udp -p 50000-50100:50000-50100/udp \`
+     livekit/livekit-server:latest --dev --bind 0.0.0.0
+   (If a container named livekit-server already exists, remove it first with: docker rm -f livekit-server)
+4. Wait up to 30 seconds and verify it is healthy: curl.exe -sf http://127.0.0.1:7880 (or Invoke-WebRequest)
+5. The credentials in --dev mode are fixed: api_key = devkey, api_secret = secret.
+6. Report back the WebSocket URL (ws://THIS_MACHINE_TAILSCALE_IP:7880 or ws://127.0.0.1:7880), api_key "devkey", api_secret "secret", and whether the container is running.
+`;
+// Used when the hub's platform could not be determined before dispatch: ask
+// the agent to detect its own OS first, then follow the matching branch.
+const LIVEKIT_SETUP_STEPS_AUTODETECT = `Steps:
+0. FIRST, detect your own OS before running anything else:
+   - On Windows, $env:OS will be "Windows_NT" (PowerShell) — or the presence of \`Get-Command\` with no \`uname\` binary.
+   - On Linux/macOS, \`uname\` will succeed and print Linux/Darwin.
+   Branch into ONE of the two command sets below based on that detection. Do not run both.
+
+--- IF WINDOWS (use PowerShell): ---
+${LIVEKIT_SETUP_STEPS_WINDOWS}
+
+--- IF LINUX/macOS (use bash/sh): ---
+${LIVEKIT_SETUP_STEPS_LINUX}
+`;
+function buildLivekitSetupPrompt(platform) {
+    let steps;
+    if (platform === 'win32') {
+        steps = LIVEKIT_SETUP_STEPS_WINDOWS;
+    }
+    else if (platform === 'linux' || platform === 'darwin') {
+        steps = LIVEKIT_SETUP_STEPS_LINUX;
+    }
+    else {
+        // Platform unknown ahead of dispatch — let the agent detect itself.
+        steps = LIVEKIT_SETUP_STEPS_AUTODETECT;
+    }
+    return LIVEKIT_SETUP_PROMPT_HEADER + '\n' + steps + LIVEKIT_SETUP_PROMPT_FOOTER;
+}
+function extractJson(text) {
+    const m = text.match(/\`\`\`json\s*([\s\S]*?)\s*\`\`\`/);
+    if (!m)
+        return null;
+    try {
+        return JSON.parse(m[1]);
+    }
+    catch {
+        return null;
+    }
+}
+async function registerLiveKitServer(schedulerUrl, info) {
+    const url = `${schedulerUrl.replace(/\/$/, '')}/api/servers`;
+    const body = {
+        id: 'livekit-hub-docker',
+        name: 'LiveKit Hub Docker',
+        url: info.url,
+        webhook_url: info.url.replace(/^wss?/, 'http'),
+        api_key: info.api_key,
+        api_secret: info.api_secret,
+        gpu_name: 'none',
+        gpu_vram_mb: 0,
+        max_sessions: 8,
+        status: 'online',
+    };
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => '');
+        throw new Error(`register server failed ${res.status}: ${text}`);
+    }
+}
+export async function roboparkSetupLivekit(opts) {
+    const ctx = await discoverContext();
+    const hubUrl = opts.hubUrl ?? (ctx.hub ? `http://${ctx.hub.ip}:${ctx.meshPort ?? 47913}` : undefined);
+    const token = opts.token ?? ctx.meshToken ?? loadMeshToken();
+    const schedulerUrl = opts.schedulerUrl ?? (hubUrl ? hubUrl.replace(/:\d+$/, ':8080') : undefined);
+    const timeoutMs = (opts.timeout ? parseInt(opts.timeout, 10) : 180) * 1000;
+    if (!hubUrl) {
+        console.log(chalk.red('  ✗ no hub discovered. Pass --hub-url http://HUB_IP:47913'));
+        process.exit(1);
+    }
+    if (!token) {
+        console.log(chalk.red('  ✗ no mesh token. Pass --token or run robopark setup first.'));
+        process.exit(1);
+    }
+    console.log(chalk.bold('\n  robopark setup-livekit'));
+    console.log(chalk.dim('  ' + '─'.repeat(52)));
+    console.log(`  hub:       ${chalk.cyan(hubUrl)}`);
+    console.log(`  scheduler: ${chalk.cyan(schedulerUrl ?? 'not provided')}`);
+    const from = hostname().split('.')[0];
+    const manifest = await getHubManifest(hubUrl, token);
+    let platform = manifest.platform;
+    if (!platform)
+        platform = await getHubPlatformFromStatus(hubUrl, token);
+    console.log(`  hub platform: ${chalk.cyan(platform ?? 'unknown (agent will self-detect)')}`);
+    console.log();
+    const prompt = buildLivekitSetupPrompt(platform);
+    if (opts.dryRun) {
+        console.log(chalk.yellow('  dry run — prompt that would be sent:'));
+        console.log(chalk.dim(prompt.split('\n').map(l => '  ' + l).join('\n')));
+        return;
+    }
+    const nodeId = manifest.nodeId;
+    if (!nodeId) {
+        console.log(chalk.red('  ✗ hub manifest not reachable. Is infinicode serve running on the hub?'));
+        process.exit(1);
+    }
+    console.log(chalk.dim(`  hub node id: ${nodeId}`));
+    const dispatchEnv = envelope('task.dispatch', from, {
+        description: 'Install LiveKit server on hub via Docker',
+        capabilities: ['shell', 'docker', 'reasoning'],
+        prompt,
+        agent: 'opencode',
+        context: { role: 'hub', site: 'fleet-hub' },
+    }, { to: nodeId, auth: token });
+    console.log(chalk.dim('  dispatching opencode agent to hub…'));
+    const accepted = await meshRpc(hubUrl, token, dispatchEnv);
+    if (!accepted || accepted.kind !== 'task.accepted') {
+        const err = accepted?.data && typeof accepted.data === 'object' ? JSON.stringify(accepted.data) : 'unknown';
+        console.log(chalk.red(`  ✗ dispatch failed: ${err}`));
+        process.exit(1);
+    }
+    const { runId } = accepted.data;
+    console.log(chalk.dim(`  run id: ${runId}`));
+    const start = Date.now();
+    let lastStatus = null;
+    let result = null;
+    while (Date.now() - start < timeoutMs) {
+        await new Promise(r => setTimeout(r, 3000));
+        const statusEnv = envelope('task.status', from, { runId }, { to: nodeId, auth: token });
+        result = await meshRpc(hubUrl, token, statusEnv);
+        const rec = (result?.data ?? {});
+        if (rec.status !== lastStatus) {
+            lastStatus = rec.status ?? null;
+            console.log(`  status: ${chalk.cyan(rec.status ?? 'unknown')}${rec.error ? chalk.red(` — ${rec.error}`) : ''}`);
+        }
+        if (rec.status === 'completed' || rec.status === 'failed')
+            break;
+    }
+    if (!result) {
+        console.log(chalk.red('  ✗ no response from hub'));
+        process.exit(1);
+    }
+    const rec = result.data;
+    if (rec.status !== 'completed') {
+        console.log(chalk.red(`  ✗ LiveKit setup failed: ${rec.error || 'unknown'}`));
+        if (rec.outputs)
+            console.log(chalk.dim(JSON.stringify(rec.outputs, null, 2)));
+        process.exit(1);
+    }
+    const content = rec.outputs?.map(o => o.content).filter(Boolean).join('\n') || '';
+    const parsed = extractJson(content);
+    if (!parsed || !parsed.url || !parsed.api_key || !parsed.api_secret) {
+        console.log(chalk.yellow('  ⚠ agent finished but did not return LiveKit credentials in a JSON block'));
+        console.log(chalk.dim(content));
+        process.exit(1);
+    }
+    console.log(chalk.green('  ✓ LiveKit server reported running'));
+    console.log(`    url:  ${chalk.cyan(String(parsed.url))}`);
+    console.log(`    key:  ${chalk.cyan(String(parsed.api_key))}`);
+    if (schedulerUrl) {
+        try {
+            await registerLiveKitServer(schedulerUrl, {
+                url: String(parsed.url),
+                api_key: String(parsed.api_key),
+                api_secret: String(parsed.api_secret),
+            });
+            console.log(chalk.green(`  ✓ registered LiveKit server with scheduler`));
+        }
+        catch (e) {
+            console.log(chalk.yellow(`  ⚠ could not register with scheduler: ${e.message}`));
+        }
+    }
+}

package/dist/robopark/setup.js

@@ -0,0 +1,286 @@
+/**
+ * RoboPark — `robopark setup`.
+ *
+ * One-liner setup per production machine. Each role turns on the right defaults
+ * and hides the mesh vocabulary.
+ *
+ *   robopark setup --hub --name livekit-1 --site "Tel Aviv" --start --auto-start
+ *   robopark setup --robot --name robobmw --start --auto-start
+ *   robopark setup --control --start
+ */
+import chalk from 'chalk';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { spawn } from 'node:child_process';
+import { discoverContext, generateToken } from './discovery.js';
+import { registerAutoStart, unregisterAutoStart } from './auto-start.js';
+import { ensureMotorService } from './motor-control.js';
+import { resolveInfinicodeBin } from './serve.js';
+const DEFAULT_MESH_PORT = 47913;
+const DEFAULT_SCHEDULER_PORT = 8080;
+function saveToken(token) {
+    const dir = join(homedir(), '.robopark');
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, 'mesh.token'), token, 'utf8');
+}
+/** Run an external command and detach unless foreground is requested. */
+function runDetached(cmd, args, env) {
+    const proc = spawn(cmd, args, {
+        stdio: 'ignore',
+        detached: true,
+        env: { ...process.env, ...env },
+    });
+    proc.on('error', (err) => {
+        console.log(chalk.red(`  ✗ failed to start ${cmd}: ${err.message}`));
+    });
+    proc.unref();
+}
+/** Resolve the infinicode CLI and return the argv to spawn it. */
+async function infinicodeArgv(args) {
+    const bin = await resolveInfinicodeBin();
+    if (bin)
+        return [bin.node, bin.script, ...args];
+    // Fallback: assume `infinicode` is on PATH. This will fail on Windows if the
+    // .cmd shim is not resolvable, but the resolved-bin path above is the
+    // intended path for all npm installs.
+    return ['infinicode', ...args];
+}
+/** Build a Windows-task-friendly command string from an argv array. */
+function commandString(argv) {
+    return argv.map(a => /[^a-zA-Z0-9_./:=,-]/.test(a) ? `"${a.replace(/"/g, '""')}"` : a).join(' ');
+}
+export async function roboparkSetup(config, opts) {
+    const role = opts.role ?? 'control';
+    const ctx = await discoverContext({ lan: ['robot', 'voice-vision', 'motor'].includes(role) && !opts.tailscale });
+    const token = opts.token ?? ctx.meshToken ?? generateToken();
+    const port = opts.port ? parseInt(opts.port, 10) : DEFAULT_MESH_PORT;
+    const name = opts.name ?? ctx.localName;
+    const gatewayHost = opts.gateway ?? (ctx.gateway ? `ws://${ctx.gateway.host}:${ctx.gateway.port ?? 18789}` : undefined);
+    const gatewayToken = opts.gatewayToken ?? ctx.gateway?.token;
+    saveToken(token);
+    console.log(chalk.bold('\n  robopark setup'));
+    console.log(chalk.dim('  ' + '─'.repeat(52)));
+    console.log(`  role:   ${chalk.yellow(role)}`);
+    console.log(`  name:   ${chalk.cyan(name)}${opts.site ? chalk.dim('  @ ' + opts.site) : ''}`);
+    console.log(`  mesh:   ${chalk.cyan('0.0.0.0:' + port)}`);
+    console.log(`  token:  ${chalk.green(token)}`);
+    if (gatewayHost)
+        console.log(`  gateway:${chalk.cyan(gatewayHost)}`);
+    console.log();
+    if (role === 'hub') {
+        await setupHub(config, opts, { name, token, port, gatewayHost, gatewayToken });
+    }
+    else if (role === 'robot' || role === 'voice-vision' || role === 'motor') {
+        const deviceRole = role === 'robot' ? 'combined' : role === 'voice-vision' ? 'voice_vision' : 'motor';
+        await setupRobot(config, opts, ctx, { name, token, port }, deviceRole);
+    }
+    else {
+        await setupControl(config, opts, ctx, { name, token, port });
+    }
+}
+async function setupHub(config, opts, internal) {
+    const fed = {
+        ...(config.get('federation') ?? {}),
+        enabled: true,
+        role: 'hub',
+        port: internal.port,
+        displayName: internal.name,
+        token: internal.token,
+        lan: true,
+    };
+    config.set('federation', fed);
+    const schedulerPort = opts.schedulerPort ? parseInt(opts.schedulerPort, 10) : DEFAULT_SCHEDULER_PORT;
+    const infinicodeArgs = [
+        'serve', '--hub',
+        '--name', internal.name,
+        '--port', String(internal.port),
+        '--token', internal.token,
+        '--lan',
+        '--dashboard',
+        `--scheduler-url`, `http://127.0.0.1:${schedulerPort}`,
+        '--auto-update',
+        '--supervised',
+    ];
+    if (internal.gatewayHost)
+        infinicodeArgs.push('--gateway', internal.gatewayHost);
+    if (internal.gatewayToken)
+        infinicodeArgs.push('--gateway-token', internal.gatewayToken);
+    console.log(chalk.dim('  hub commands:'));
+    console.log('  ' + chalk.cyan(`infinicode ${infinicodeArgs.join(' ')}`));
+    console.log('  ' + chalk.cyan(`robopark serve --port ${schedulerPort}`));
+    console.log();
+    if (opts.start) {
+        const hubArgv = await infinicodeArgv(infinicodeArgs);
+        console.log(chalk.dim('  starting infinicode hub…'));
+        runDetached(hubArgv[0], hubArgv.slice(1));
+        console.log(chalk.dim('  starting robopark scheduler…'));
+        runDetached(process.execPath, [process.argv[1], 'serve', '--port', String(schedulerPort)]);
+    }
+    if (opts.autoStart) {
+        const hubArgv = await infinicodeArgv(infinicodeArgs);
+        const reg = await registerAutoStart({
+            role: 'hub',
+            name: internal.name,
+            command: hubArgv[0],
+            args: hubArgv.slice(1),
+        });
+        console.log(reg.ok ? chalk.green(`  ✓ ${reg.message}`) : chalk.yellow(`  ⚠ ${reg.message}`));
+        const reg2 = await registerAutoStart({
+            role: 'hub-scheduler',
+            name: internal.name,
+            command: process.execPath,
+            args: [process.argv[1], 'serve', '--port', String(schedulerPort), '--foreground'],
+        });
+        console.log(reg2.ok ? chalk.green(`  ✓ ${reg2.message}`) : chalk.yellow(`  ⚠ ${reg2.message}`));
+    }
+}
+async function setupRobot(config, opts, ctx, internal, deviceRole = 'combined') {
+    if (opts.lan && opts.tailscale) {
+        console.log(chalk.red('  ✗ choose exactly one robot network: --lan or --tailscale'));
+        return;
+    }
+    const network = opts.tailscale ? 'tailscale' : 'lan';
+    const networkFlag = network === 'tailscale' ? '--tailscale' : '--lan';
+    let hubUrl = opts.hub ?? (ctx.hub ? `http://${ctx.hub.ip}:${internal.port}` : undefined);
+    if (!hubUrl) {
+        console.log(chalk.red('  ✗ no hub discovered. Pass --hub http://HUB_IP:47913'));
+        return;
+    }
+    if (network === 'lan') {
+        const reachable = async (url) => {
+            try {
+                const response = await fetch(`${url.replace(/\/+$/, '')}/fed/status`, {
+                    headers: { Authorization: `Bearer ${internal.token}` },
+                    signal: AbortSignal.timeout(2500),
+                });
+                return response.ok;
+            }
+            catch {
+                return false;
+            }
+        };
+        if (!await reachable(hubUrl)) {
+            const discovered = ctx.hub?.source === 'lan'
+                ? `http://${ctx.hub.ip}:${internal.port}`
+                : undefined;
+            if (!discovered || !await reachable(discovered)) {
+                console.log(chalk.red(`  ✗ hub is unreachable from this robot: ${hubUrl}`));
+                console.log(chalk.dim('  verify the hub is running with --lan, then rerun setup'));
+                return;
+            }
+            console.log(chalk.yellow(`  âš  supplied hub unreachable; using LAN-discovered hub ${discovered}`));
+            hubUrl = discovered;
+        }
+    }
+    const fed = {
+        ...(config.get('federation') ?? {}),
+        enabled: true,
+        role: 'satellite',
+        port: internal.port,
+        displayName: internal.name,
+        token: internal.token,
+        seeds: [hubUrl],
+        lan: network === 'lan',
+    };
+    config.set('federation', fed);
+    // Derive the scheduler host from the SAME hubUrl used for the mesh seed
+    // (respects an explicit --hub-url), not from ctx.hub — using auto-discovery
+    // here independently of the mesh seed meant an explicit --hub-url only
+    // repointed the mesh connection while the scheduler (enroll/heartbeat/
+    // preview-agent) silently kept talking to whatever hub auto-discovery
+    // found (e.g. a real hub reachable over Tailscale), not the one requested.
+    // Keep the scheduler private on the hub. Both LAN and Tailscale robots use
+    // the authenticated mesh proxy instead of depending on port 8080 binding,
+    // firewall rules, or a separately routable scheduler address.
+    const schedulerUrl = `${hubUrl.replace(/\/+$/, '')}/robopark`;
+    // Vision (camera/motion detection -> presence-triggered session) is the
+    // production trigger — on by default. --no-vision opts out (e.g. no camera
+    // on this box, or RoboVisionAI_PI isn't installed).
+    const visionEnabled = deviceRole !== 'motor' && opts.vision !== false;
+    const defaultVideoDevice = process.platform === 'linux' && opts.autoStart
+        ? '/dev/robopark-camera'
+        : '/dev/video0';
+    const runtimeArgs = [
+        'robot', 'up',
+        '--name', internal.name,
+        '--hub-url', hubUrl,
+        '--scheduler-url', schedulerUrl,
+        '--token', internal.token,
+        '--port', String(internal.port),
+        networkFlag,
+        '--video-device', opts.videoDevice ?? defaultVideoDevice,
+        '--audio-device', opts.audioDevice ?? 'Usb Audio Device: USB Audio',
+        '--device-role', deviceRole,
+    ];
+    if (opts.enrollmentToken)
+        runtimeArgs.push('--enrollment-token', opts.enrollmentToken);
+    if (opts.character)
+        runtimeArgs.push('--character', opts.character);
+    if (!visionEnabled)
+        runtimeArgs.push('--no-vision');
+    console.log(chalk.dim('  single robot command:'));
+    console.log('  ' + chalk.cyan(`robopark ${runtimeArgs.join(' ')}`));
+    console.log(chalk.dim(`  network: ${network} (scheduler: ${schedulerUrl})`));
+    console.log();
+    if (opts.start && !opts.autoStart && deviceRole !== 'voice_vision') {
+        const motorService = await ensureMotorService(internal.name, {
+            token: internal.token,
+            autoStart: false,
+        });
+        console.log(chalk.green(`  ✓ ${motorService}`));
+    }
+    // On Linux, registerAutoStart enables and starts the systemd service. Do not
+    // also launch a detached copy that can leave mesh healthy while preview is
+    // duplicated, blocked, or running under a different HOME.
+    if (opts.start && !(opts.autoStart && process.platform === 'linux')) {
+        const robotArgv = [process.execPath, process.argv[1], ...runtimeArgs];
+        console.log(chalk.dim('  starting unified robot runtime…'));
+        runDetached(robotArgv[0], robotArgv.slice(1));
+    }
+    if (opts.autoStart) {
+        // Enrollment is a one-time bootstrap action. Persisting it in the
+        // supervisor would erase the device identity and attempt a new enrollment
+        // on every reboot, creating duplicate robots (or failing after the token
+        // is consumed).
+        const bootRuntimeArgs = runtimeArgs.filter((arg, index) => arg !== '--enrollment-token' && runtimeArgs[index - 1] !== '--enrollment-token');
+        const robotArgv = [process.execPath, process.argv[1], ...bootRuntimeArgs, '--foreground'];
+        // Motors have an independent owner so camera/audio restarts cannot take
+        // GPIO control down or leave a second process racing for port 8001.
+        if (deviceRole !== 'voice_vision') {
+            const motorService = await ensureMotorService(internal.name, { token: internal.token });
+            console.log(chalk.green(`  ✓ ${motorService}`));
+        }
+        for (const role of ['robot', 'robot-preview-agent', 'robot-vision-agent']) {
+            unregisterAutoStart(role, internal.name);
+        }
+        const reg = await registerAutoStart({
+            role: 'robot-runtime',
+            name: internal.name,
+            command: robotArgv[0],
+            args: robotArgv.slice(1),
+        });
+        console.log(reg.ok ? chalk.green(`  ✓ ${reg.message}`) : chalk.yellow(`  ⚠ ${reg.message}`));
+    }
+}
+async function setupControl(config, opts, ctx, internal) {
+    const hubUrl = opts.hub ?? (ctx.hub ? `http://${ctx.hub.ip}:${internal.port}` : undefined);
+    const args = [
+        'mesh', 'install',
+        '--token', internal.token,
+        '--name', internal.name,
+        hubUrl ? '--seed' : '', hubUrl ?? '',
+    ].filter(Boolean);
+    console.log(chalk.dim('  control command:'));
+    console.log('  ' + chalk.cyan(`infinicode ${args.join(' ')}`));
+    console.log();
+    if (opts.start) {
+        const controlArgv = await infinicodeArgv(args);
+        console.log(chalk.dim('  registering infinicode MCP host…'));
+        const proc = spawn(controlArgv[0], controlArgv.slice(1), { stdio: 'inherit' });
+        proc.on('error', (err) => {
+            console.log(chalk.red(`  ✗ failed to start infinicode: ${err.message}`));
+        });
+        await new Promise(resolve => proc.on('close', () => resolve()));
+    }
+}