stim 1.17.0 → 1.17.2

package/dist/{machines-C2XiNwh9.mjs → client-SvBdgObD.mjs}

@@ -1,7 +1,7 @@
 import { t as getExecutor } from "./exec-CaErVv7t.mjs";
 import { _ as loadConfig$1, d as getConfigDir } from "./config-D0DbpZtM.mjs";
 import { w as withDirLock } from "./workspace-state-DqcCbpE7.mjs";
-import { T as CCACHE_UNAVAILABLE, a as toolchainMismatches, l as COMPILATION_CACHE_UNAVAILABLE, s as manifestDigest } from "./toolchain-CNIBTIOv.mjs";
+import { T as CCACHE_UNAVAILABLE, a as toolchainMismatches, l as COMPILATION_CACHE_UNAVAILABLE, s as manifestDigest } from "./toolchain-DNyR3NPq.mjs";
 import { createHash } from "node:crypto";
 import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, renameSync, rmSync, writeFileSync, writeSync } from "node:fs";
 import { basename, dirname, join, relative } from "node:path";
@@ -30,6 +30,28 @@ function readHostPermissions(value) {
 //#region src/offload/tailnet.ts
 const MAC_APP_TAILSCALE = "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
 const HELLO_TIMEOUT_MS = 1e4;
+function isLapsed(credential) {
+	return credential.state === "pending" && !!credential.expiresAt && Date.parse(credential.expiresAt) <= Date.now();
+}
+function markApproved(credential) {
+	const { expiresAt: _expiresAt, ...rest } = credential;
+	return {
+		...rest,
+		state: "approved"
+	};
+}
+function pendingReport(credential) {
+	return {
+		state: "pending",
+		...credential.expiresAt ? { expiresAt: credential.expiresAt } : {}
+	};
+}
+function lapsedLine(machine, credential) {
+	return `${machine} did not approve this Mac before the request lapsed at ${credential.expiresAt}.`;
+}
+function requestedLine(credential) {
+	return `Requested at ${credential.requestedAt}${credential.expiresAt ? `; the request lapses at ${credential.expiresAt}` : ""}.`;
+}
 function tailscaleStatus() {
 	for (const binary of ["tailscale", MAC_APP_TAILSCALE]) {
 		const output = getExecutor().runFileQuiet(binary, ["status", "--json"], { timeoutMs: 5e3 });
@@ -94,16 +116,280 @@ function pinnedEndpoint$1(credential, status = tailscaleStatus) {
 	return pinnedEndpoint(credential, parseMachine(credential.machine) ? status() : null);
 }
 //#endregion
+//#region src/device-host/machines.ts
+function note$1(title, detail, fix = null) {
+	return {
+		code: "device-host-machine",
+		level: "note",
+		title,
+		detail,
+		fix
+	};
+}
+const approval$1 = (machine, id) => `A person on ${machine} approves it with \`stim-server devices grant ${id} --device-host\`.`;
+function configuredMachines() {
+	const remote = loadConfig$1()?.remote;
+	if (remote !== void 0 && !isJsonObject(remote)) return null;
+	const machines = remote?.machines;
+	if (machines === void 0) return [];
+	return acceptsShape(settingDefinition("remote.machines"), machines) ? machines : null;
+}
+/** The `remote.machines` entries this Mac asked for device-host access, in setting order; null when the setting is invalid. */
+function hostingMachines() {
+	const configured = configuredMachines();
+	if (configured === null) return null;
+	try {
+		const asked = readDeviceHostMachines();
+		return configured.filter((machine) => asked.some((each) => each.machine === machine));
+	} catch {
+		return configured;
+	}
+}
+function store(machines) {
+	withDirLock(deviceHostMachinesLock(), () => {
+		const file = deviceHostMachinesFile();
+		const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+		try {
+			writeFileSync(tmp, `${JSON.stringify({
+				version: 1,
+				machines
+			}, null, 2)}\n`, { mode: 384 });
+			renameSync(tmp, file);
+		} finally {
+			rmSync(tmp, { force: true });
+		}
+	}, { ensureParent: () => mkdirSync(getConfigDir(), { recursive: true }) });
+}
+async function request(machine, peer, port, deviceName, io) {
+	const ticket = readAccessTicket();
+	const reply = await io.hello(endpoint(peer, port), {
+		request: "device-host",
+		deviceName,
+		...ticket ? { setupTicket: ticket.ticket } : {}
+	});
+	if (!("result" in reply) || reply.result?.approval?.state !== "pending" || typeof reply.result.deviceToken !== "string" || !reply.result.deviceToken || typeof reply.result.device?.id !== "string" || !reply.result.device.id || typeof reply.result.approval.expiresAt !== "string" || !reply.result.approval.expiresAt) return {
+		report: {
+			machine,
+			dnsName: peer.dnsName,
+			state: "unreachable"
+		},
+		finding: note$1(`Could not ask ${machine} for hosting access`, "The worker did not return a pending request.")
+	};
+	const credential = {
+		machine,
+		nodeId: peer.nodeId,
+		dnsName: peer.dnsName,
+		deviceId: reply.result.device.id,
+		deviceToken: reply.result.deviceToken,
+		state: "pending",
+		requestedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		expiresAt: reply.result.approval.expiresAt,
+		...ticket ? { ticketHash: ticket.ticketHash } : {}
+	};
+	return {
+		report: {
+			machine,
+			dnsName: peer.dnsName,
+			state: "pending",
+			deviceId: credential.deviceId,
+			requestedAt: credential.requestedAt,
+			expiresAt: credential.expiresAt
+		},
+		finding: note$1(`Asked ${machine} for hosting access`, `The request lapses at ${reply.result.approval.expiresAt}.`, approval$1(machine, credential.deviceId)),
+		credential
+	};
+}
+/** Reports the device-host approval of each remote Mac, separate from its build approval. Only --fix asks or forgets credentials; every token stays pinned. */
+async function inspectDeviceHostMachines({ fix }, io = realIo, entries = configuredMachines()) {
+	if (entries === null) return {
+		findings: [note$1("Invalid remote.machines setting", "Use a remote object with machines as an array of tailnet names. Existing hosting credentials and pinned nodes are preserved.", "Run `stim guide settings` and correct the setting before running doctor again.")],
+		machines: []
+	};
+	const unavailable = (state, finding) => ({
+		findings: [finding],
+		machines: entries.map((machine) => ({
+			machine,
+			state
+		}))
+	});
+	const unreadable = () => unavailable("credentials-unavailable", note$1("Hosting credentials are unreadable", `Stim preserves ${deviceHostMachinesFile()} and its pinned nodes.`, "Restore the existing file from a trusted backup or restore read access before running doctor again."));
+	if (!entries.length) {
+		if (!fix) return {
+			findings: [],
+			machines: []
+		};
+		try {
+			if (!readDeviceHostMachines().length) return {
+				findings: [],
+				machines: []
+			};
+		} catch {
+			return unreadable();
+		}
+	}
+	const claim = tryAcquireClaim({
+		root: deviceHostMachinesClaims(),
+		mode: "exclusive",
+		label: "device-host approval"
+	});
+	if (!claim.acquired) {
+		releaseClaim(claim.pending);
+		return unavailable("busy", note$1("Device-host approval is in use", "Another doctor run holds the hosting credential claim. Run doctor again after it finishes."));
+	}
+	try {
+		let credentials;
+		try {
+			credentials = readDeviceHostMachines();
+		} catch {
+			return unreadable();
+		}
+		if (fix) {
+			const kept = credentials.filter((each) => entries.includes(each.machine));
+			if (kept.length !== credentials.length) {
+				store(kept);
+				credentials = kept;
+			}
+		}
+		if (!entries.length) return {
+			findings: [],
+			machines: []
+		};
+		const status = io.status();
+		if (!isJsonObject(status)) return unavailable("tailscale-off", note$1("Remote Macs are unreachable", "remote.machines names remote Macs, but Tailscale is not running."));
+		const self = isJsonObject(status.Self) ? status.Self : {};
+		const deviceName = (typeof self.HostName === "string" && self.HostName ? self.HostName : hostname()).replace(/[\p{Cc}\p{Cf}]/gu, "").trim().slice(0, 64) || "Mac";
+		const inspected = {
+			findings: [],
+			machines: []
+		};
+		const namedNodes = /* @__PURE__ */ new Set();
+		for (const machine of new Set(entries)) {
+			const parsed = parseMachine$1(machine);
+			if (!parsed) {
+				inspected.machines.push({
+					machine,
+					state: "invalid"
+				});
+				inspected.findings.push(note$1(`Remote Mac ${machine} is not a tailnet name`, "Expected `name` or `name:port`."));
+				continue;
+			}
+			const current = io.status();
+			if (!isJsonObject(current)) {
+				inspected.machines.push({
+					machine,
+					state: "tailscale-off"
+				});
+				inspected.findings.push(note$1(`Remote Mac ${machine} is unreachable`, "Tailscale stopped before this connection."));
+				continue;
+			}
+			const peer = findPeer$1(current, parsed.name);
+			if (peer === "missing" || peer === "ambiguous") {
+				inspected.machines.push({
+					machine,
+					state: "not-on-tailnet"
+				});
+				inspected.findings.push(note$1(`Remote Mac ${machine} is not on this tailnet`, peer === "missing" ? "No peer has that name." : "Several peers match that name."));
+				continue;
+			}
+			const nodeRoute = `${peer.nodeId}:${parsed.port}`;
+			if (namedNodes.has(nodeRoute)) {
+				inspected.machines.push({
+					machine,
+					dnsName: peer.dnsName,
+					state: "invalid"
+				});
+				inspected.findings.push(note$1(`Remote Mac ${machine} repeats a named node`, "Name each tailnet node and serve port only once in remote.machines."));
+				continue;
+			}
+			namedNodes.add(nodeRoute);
+			const credential = credentials.find((each) => each.machine === machine);
+			const known = {
+				machine,
+				dnsName: peer.dnsName,
+				...credential ? {
+					deviceId: credential.deviceId,
+					requestedAt: credential.requestedAt
+				} : {}
+			};
+			if (credential && credential.nodeId !== peer.nodeId) {
+				inspected.machines.push({
+					...known,
+					state: "node-changed"
+				});
+				inspected.findings.push(note$1(`Remote Mac ${machine} is a different tailnet node`, "Stim refuses to connect or send the saved token.", `If that Mac was replaced, remove ${machine} from remote.machines, run \`stim doctor --fix\`, then add it back and run \`stim doctor --fix\` again to request approval on the new node.`));
+				continue;
+			}
+			let ask = !credential && fix;
+			if (credential) {
+				const reply = await io.hello(endpoint(peer, parsed.port), { deviceToken: credential.deviceToken });
+				if ("result" in reply && reply.result?.device?.id === credential.deviceId && Array.isArray(reply.result.capabilities) && reply.result.capabilities.includes("device-host")) {
+					if (credential.state !== "approved") {
+						credentials = credentials.map((each) => each.machine === machine ? markApproved(each) : each);
+						store(credentials);
+					}
+					const host = readHostPermissions(reply.result.host);
+					if (host && (host.screenRecording === false || host.accessibility === false)) {
+						const panes = [...host.screenRecording === false ? ["Screen & System Audio Recording (Screen Recording on macOS 14)"] : [], ...host.accessibility === false ? ["Device Control and Data Access (Accessibility on macOS 26 and earlier)"] : []];
+						const detail = [...host.screenRecording === false ? ["Viewing hosted macOS apps needs Screen Recording."] : [], ...host.accessibility === false ? ["Controlling them needs the control permission."] : []];
+						inspected.findings.push(note$1(`Remote Mac ${machine} needs ${panes.join(" and ")} for ${host.name}`, detail.join(" "), `On ${machine}, approve ${host.name} in System Settings > Privacy & Security, or run \`stim-server service install\` there again to show the requests.`));
+					}
+					inspected.machines.push({
+						...known,
+						state: "approved",
+						...host ? { host } : {}
+					});
+					continue;
+				}
+				const pending = "error" in reply && reply.error?.code === "approval-pending";
+				const revoked = "error" in reply && reply.error?.code === "unauthorized";
+				const ticket = fix && pending && credential.state !== "approved" ? readAccessTicket() : void 0;
+				ask = fix && (revoked || !!ticket && credential.ticketHash !== ticket.ticketHash);
+				if (pending && !ask) {
+					inspected.machines.push({
+						...known,
+						...pendingReport(credential)
+					});
+					inspected.findings.push(note$1(`Remote Mac ${machine} has not approved this Mac for device hosting yet`, requestedLine(credential), approval$1(machine, credential.deviceId)));
+					continue;
+				}
+				if (!ask) {
+					const lapsed = revoked && isLapsed(credential);
+					inspected.machines.push({
+						...known,
+						state: lapsed ? "lapsed" : revoked ? "revoked" : "unreachable"
+					});
+					inspected.findings.push(note$1(lapsed ? `Hosting request to ${machine} lapsed` : `Remote Mac ${machine} ${revoked ? "no longer accepts this Mac for device hosting" : "did not confirm hosting access"}`, lapsed ? `${lapsedLine(machine, credential)} The saved token and pinned node are preserved.` : "The saved token and pinned node are preserved.", revoked ? "Run `stim doctor --fix` to ask again." : `Check stim-server and its tailnet serve route on ${machine}, then run doctor again.`));
+					continue;
+				}
+			}
+			if (ask) {
+				const result = await request(machine, peer, parsed.port, deviceName, io);
+				if (result.credential) {
+					credentials = [...credentials.filter((each) => each.machine !== machine), result.credential];
+					store(credentials);
+				}
+				inspected.machines.push(result.report);
+				inspected.findings.push(result.finding);
+			} else {
+				inspected.machines.push({
+					...known,
+					state: "not-asked"
+				});
+				inspected.findings.push(note$1(`Remote Mac ${machine} has not approved this Mac for device hosting`, "This Mac has not asked for hosting access.", "Run `stim doctor --fix` to ask."));
+			}
+		}
+		return inspected;
+	} finally {
+		releaseClaim(claim.acquired);
+	}
+}
+//#endregion
 //#region src/offload/build-machines.ts
-/** The build machines named in `offload.machines` that this Mac asked for build access, in that order. */
-function pairedMachines(entries = configuredMachines$1()) {
+/** The `remote.machines` entries that this Mac asked for build access, in that order. */
+function pairedMachines(entries = configuredMachines() ?? []) {
 	const credentials = readBuildMachines();
 	return entries.flatMap((entry) => credentials.filter((each) => each.machine === entry));
 }
-function configuredMachines$1() {
-	const machines = loadConfig$1()?.offload?.machines;
-	return Array.isArray(machines) ? machines.filter((entry) => typeof entry === "string") : [];
-}
 function updateCredentials(change) {
 	const dir = getConfigDir();
 	withDirLock(buildMachinesLock(), () => {
@@ -121,7 +407,7 @@ function updateCredentials(change) {
 		}
 	}, { ensureParent: () => mkdirSync(dir, { recursive: true }) });
 }
-function note$1(title, detail, fix = null) {
+function note(title, detail, fix = null) {
 	return {
 		code: "build-machine",
 		level: "note",
@@ -130,7 +416,7 @@ function note$1(title, detail, fix = null) {
 		fix
 	};
 }
-const approval$1 = (entry, deviceId) => `A person on ${entry} approves it with \`stim-server devices grant ${deviceId} --build\`.`;
+const approval = (entry, deviceId) => `A person on ${entry} approves it with \`stim-server devices grant ${deviceId} --build\`.`;
 const PROBLEM_TITLES = {
 	unreachable: "does not answer a build offer",
 	checkout: "cannot build an app outside a git checkout",
@@ -155,7 +441,7 @@ function problemFix(code, entry) {
 		case "unreachable": return `Check that stim-server runs on ${entry} and that its tailscale serve route answers, then run \`stim doctor\` again. To keep it running there, run \`stim-server service install --serve\` on ${entry}.`;
 		case "checkout": return "Offload syncs the files git lists; run Stim from a git checkout of the app.";
 		case "stim-build": return `Update stim-server on ${entry} to the same Stim build as this Mac: there, run \`stim-server service update --release <version>\` for this Mac's release, or \`--from <dir>\` with the packed packages of this Mac's checkout.`;
-		case "arch": return "Use a build machine with the same CPU architecture as this Mac.";
+		case "arch": return "Use a remote Mac with the same CPU architecture as this Mac.";
 		case "xcode":
 		case "simulator-sdk":
 		case "macos-sdk": return `Install and select the same Xcode on ${entry} and this Mac (\`xcode-select -p\` on each).`;
@@ -167,8 +453,8 @@ function problemFix(code, entry) {
 		case "ndk":
 		case "build-tools":
 		case "compile-sdk": return `Install the missing package with sdkmanager in the Android SDK stim-server on ${entry} uses (its ANDROID_HOME, else ~/Library/Android/sdk).`;
-		case "disk": return `Free space on ${entry}'s worker root (offload.workerRoot there).`;
-		case "busy": return `Builds stay on this Mac until ${entry} has capacity. On ${entry}, offload.maxLoadPerCore sets the load it accepts and concurrency.maxBuilds how many of its own builds it runs; it takes one offloaded build at a time.`;
+		case "disk": return `Free space on ${entry}'s worker root (server.workerRoot there).`;
+		case "busy": return `Builds stay on this Mac until ${entry} has capacity. On ${entry}, server.maxLoadPerCore sets the load it accepts and concurrency.maxBuilds how many of its own builds it runs; it takes one offloaded build at a time.`;
 	}
 }
 const TRANSIENT = /* @__PURE__ */ new Set(["unreachable", "busy"]);
@@ -176,7 +462,7 @@ function offloadFindings(entry, problems) {
 	return problems.map((problem) => ({
 		code: `build-machine-${problem.code}`,
 		level: TRANSIENT.has(problem.code) ? "note" : "cost",
-		title: `Build machine ${entry} ${PROBLEM_TITLES[problem.code]}`,
+		title: `Remote Mac ${entry} ${PROBLEM_TITLES[problem.code]}`,
 		detail: `Builds fall back to this Mac: ${problem.reason}.`,
 		fix: problemFix(problem.code, entry)
 	}));
@@ -196,7 +482,7 @@ async function requestAccess(entry, peer, port, deviceName, io) {
 				state: "unreachable",
 				dnsName: peer.dnsName
 			},
-			finding: note$1(`Could not ask ${entry} for build access`, reason)
+			finding: note(`Could not ask ${entry} for build access`, reason)
 		};
 	}
 	const credential = {
@@ -207,6 +493,7 @@ async function requestAccess(entry, peer, port, deviceName, io) {
 		deviceToken: reply.result.deviceToken,
 		state: "pending",
 		requestedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		expiresAt: reply.result.approval.expiresAt,
 		...ticket ? { ticketHash: ticket.ticketHash } : {}
 	};
 	updateCredentials((credentials) => [...credentials.filter((each) => each.machine !== entry), credential]);
@@ -216,9 +503,10 @@ async function requestAccess(entry, peer, port, deviceName, io) {
 			state: "pending",
 			dnsName: peer.dnsName,
 			deviceId: credential.deviceId,
-			requestedAt: credential.requestedAt
+			requestedAt: credential.requestedAt,
+			expiresAt: credential.expiresAt
 		},
-		finding: note$1(`Asked ${entry} for build access`, `The request lapses at ${reply.result.approval.expiresAt}.`, approval$1(entry, credential.deviceId))
+		finding: note(`Asked ${entry} for build access`, `The request lapses at ${reply.result.approval.expiresAt}.`, approval(entry, credential.deviceId))
 	};
 }
 async function inspectMachine(entry, status, deviceName, fix, io, check) {
@@ -228,7 +516,7 @@ async function inspectMachine(entry, status, deviceName, fix, io, check) {
 			machine: entry,
 			state: "invalid"
 		},
-		finding: note$1(`Build machine ${entry} is not a tailnet name`, "Expected `name` or `name:port`.")
+		finding: note(`Remote Mac ${entry} is not a tailnet name`, "Expected `name` or `name:port`.")
 	};
 	const peer = findPeer$1(status, parsed.name);
 	if (peer === "missing" || peer === "ambiguous") {
@@ -238,7 +526,7 @@ async function inspectMachine(entry, status, deviceName, fix, io, check) {
 				machine: entry,
 				state: "not-on-tailnet"
 			},
-			finding: note$1(`Build machine ${entry} is not on this tailnet`, detail)
+			finding: note(`Remote Mac ${entry} is not on this tailnet`, detail)
 		};
 	}
 	const credential = readBuildMachines().find((each) => each.machine === entry);
@@ -253,7 +541,7 @@ async function inspectMachine(entry, status, deviceName, fix, io, check) {
 			deviceId: credential.deviceId,
 			requestedAt: credential.requestedAt
 		},
-		finding: note$1(`Build machine ${entry} is a different tailnet node`, `This Mac paired with node ${credential.nodeId}, but ${peer.dnsName} is now node ${peer.nodeId}. Stim does not connect to it.`, `If that Mac was replaced, remove ${entry} from offload.machines, run \`stim doctor --fix\` to forget the old pairing, then add it back and run \`stim doctor --fix\` again.`)
+		finding: note(`Remote Mac ${entry} is a different tailnet node`, `This Mac paired with node ${credential.nodeId}, but ${peer.dnsName} is now node ${peer.nodeId}. Stim does not connect to it.`, `If that Mac was replaced, remove ${entry} from remote.machines, run \`stim doctor --fix\` to forget the old pairing, then add it back and run \`stim doctor --fix\` again.`)
 	};
 	if (!credential) {
 		if (fix) return requestAccess(entry, peer, parsed.port, deviceName, io);
@@ -262,7 +550,7 @@ async function inspectMachine(entry, status, deviceName, fix, io, check) {
 				...known,
 				state: "not-asked"
 			},
-			finding: note$1(`Build machine ${entry} has not approved this Mac`, "This Mac has not asked it for build access.", "Run `stim doctor --fix` to ask.")
+			finding: note(`Remote Mac ${entry} has not approved this Mac for builds`, "This Mac has not asked it for build access.", "Run `stim doctor --fix` to ask.")
 		};
 	}
 	const paired = {
@@ -274,10 +562,7 @@ async function inspectMachine(entry, status, deviceName, fix, io, check) {
 	if ("result" in reply && reply.result.capabilities.includes("build")) {
 		const permissions = readHostPermissions(reply.result.host);
 		const host = permissions ? { host: permissions } : {};
-		if (credential.state !== "approved") updateCredentials((credentials) => credentials.map((each) => each.machine === entry ? {
-			...each,
-			state: "approved"
-		} : each));
+		if (credential.state !== "approved") updateCredentials((credentials) => credentials.map((each) => each.machine === entry ? markApproved(each) : each));
 		if (!check) return {
 			report: {
 				...paired,
@@ -310,19 +595,26 @@ async function inspectMachine(entry, status, deviceName, fix, io, check) {
 		return {
 			report: {
 				...paired,
-				state: "pending"
+				...pendingReport(credential)
 			},
-			finding: note$1(`Build machine ${entry} has not approved this Mac yet`, `Requested at ${credential.requestedAt}.`, approval$1(entry, credential.deviceId))
+			finding: note(`Remote Mac ${entry} has not approved this Mac for builds yet`, requestedLine(credential), approval(entry, credential.deviceId))
 		};
 	}
 	if ("error" in reply && reply.error.code === "unauthorized") {
 		if (fix) return requestAccess(entry, peer, parsed.port, deviceName, io);
+		if (isLapsed(credential)) return {
+			report: {
+				...paired,
+				state: "lapsed"
+			},
+			finding: note(`Build request to ${entry} lapsed`, lapsedLine(entry, credential), "Run `stim doctor --fix` to ask again.")
+		};
 		return {
 			report: {
 				...paired,
 				state: "revoked"
 			},
-			finding: note$1(`Build machine ${entry} no longer accepts this Mac`, `${reply.error.message} It was revoked, or the request lapsed before approval.`, "Run `stim doctor --fix` to ask again.")
+			finding: note(`Remote Mac ${entry} no longer accepts this Mac for builds`, `${reply.error.message} It was revoked or denied.`, "Run `stim doctor --fix` to ask again.")
 		};
 	}
 	const reason = "failed" in reply ? reply.failed : "error" in reply ? reply.error.message : "unexpected reply";
@@ -331,17 +623,21 @@ async function inspectMachine(entry, status, deviceName, fix, io, check) {
 			...paired,
 			state: "unreachable"
 		},
-		finding: note$1(`Could not reach build machine ${entry}`, reason, `Check that stim-server runs on ${entry}. To keep it running there, run \`stim-server service install --serve\` on ${entry}.`)
+		finding: note(`Could not reach remote Mac ${entry}`, reason, `Check that stim-server runs on ${entry}. To keep it running there, run \`stim-server service install --serve\` on ${entry}.`)
 	};
 }
 /**
-* Doctor findings and a report for each `offload.machines` entry. The worker's node is pinned when access is
+* Doctor findings and a report for each `remote.machines` entry. The worker's node is pinned when access is
 * requested; a later connection goes only to the current MagicDNS name of that same node, checked before the token
 * is sent. With `fix`, requests access from a named machine this Mac holds no pairing for, requests again when the
 * pinned node forgot this Mac or, with `STIM_ACCESS_TICKET` set, when a pending request carries another ticket, and forgets pairings of machines no longer named. With `check`, each approved
 * machine is asked for one build offer and reports every reason it would not take this project's build.
 */
-async function inspectBuildMachines({ fix, check = null }, io = realIo, entries = configuredMachines$1()) {
+async function inspectBuildMachines({ fix, check = null }, io = realIo, entries = configuredMachines()) {
+	if (entries === null) return {
+		findings: [note("Invalid remote.machines setting", "Use a remote object with machines as an array of tailnet names. Existing credentials and pinned nodes are preserved.", "Run `stim guide settings` and correct the setting before running doctor again.")],
+		machines: []
+	};
 	const unnamed = (each) => !entries.includes(each.machine);
 	if (fix && readBuildMachines().some(unnamed)) updateCredentials((credentials) => credentials.filter((each) => !unnamed(each)));
 	if (entries.length === 0) return {
@@ -350,7 +646,7 @@ async function inspectBuildMachines({ fix, check = null }, io = realIo, entries
 	};
 	const status = io.status();
 	if (!isJsonObject(status)) return {
-		findings: [note$1("Build machines are unreachable", "offload.machines names build machines, but Tailscale is not running.")],
+		findings: [note("Remote Macs are unreachable", "remote.machines names remote Macs, but Tailscale is not running.")],
 		machines: entries.map((machine) => ({
 			machine,
 			state: "tailscale-off"
@@ -374,14 +670,14 @@ async function inspectBuildMachines({ fix, check = null }, io = realIo, entries
 //#region src/offload/selection.ts
 var OffloadRefusal = class extends Error {
 	code = "STIM_OFFLOAD_REFUSED";
-	remedy = "Run stim doctor --fix to ask for build access if not paired. On the worker, a person finds the id with stim-server devices and approves it with stim-server devices grant <id> --build. Check stim settings get offload.machines, or rerun with --build-machine auto or --build-machine local.";
+	remedy = "Run stim doctor --fix to ask for build access if not paired. On the worker, a person finds the id with stim-server devices and approves it with stim-server devices grant <id> --build. Check stim settings get remote.machines, or rerun with --remote-build auto or --remote-build local.";
 	constructor(machine, reason) {
 		super(reason.startsWith(`${machine}: `) ? reason : `${machine}: ${reason}`);
 	}
 };
 function resolveBuildMachine(flag, env, setting) {
 	const selected = flag ?? (env?.trim() || void 0) ?? setting ?? "auto";
-	if (typeof selected !== "string" || !selected.trim() || !parseMachine(selected)) throw Object.assign(/* @__PURE__ */ new Error("--build-machine / offload.machine must be auto, local, or a tailnet machine name."), { code: "STIM_BAD_ARG" });
+	if (typeof selected !== "string" || !selected.trim() || !parseMachine(selected)) throw Object.assign(/* @__PURE__ */ new Error("--remote-build / remote.build must be auto, local, or a tailnet machine name."), { code: "STIM_BAD_ARG" });
 	const trimmed = selected.trim();
 	const reserved = trimmed.toLowerCase();
 	return reserved === "auto" || reserved === "local" ? reserved : trimmed;
@@ -404,16 +700,16 @@ function requireConfiguredMachine(selected, machines) {
 		const candidate = parseMachine(entry);
 		return candidate?.name === parsed.name && candidate.port === parsed.port;
 	});
-	if (!match) throw new OffloadRefusal(selected, `not listed in offload.machines (configured: ${entries.join(", ") || "none"})`);
+	if (!match) throw new OffloadRefusal(selected, `not listed in remote.machines (configured: ${entries.join(", ") || "none"})`);
 	return match;
 }
 function resolveBuildPlacement(flag) {
-	const offload = loadConfig$1()?.offload;
+	const remote = loadConfig$1()?.remote;
 	let selected = "auto";
 	try {
-		selected = resolveBuildMachine(flag, process.env.STIM_OFFLOAD_MACHINE, offload?.machine);
-		selected = requireConfiguredMachine(selected, offload?.machines);
-		if (namedBuildMachine(selected) && pairedMachines([selected]).length === 0) throw new OffloadRefusal(selected, "no build machine is paired");
+		selected = resolveBuildMachine(flag, process.env.STIM_REMOTE_BUILD, remote?.build);
+		selected = requireConfiguredMachine(selected, remote?.machines);
+		if (namedBuildMachine(selected) && pairedMachines([selected]).length === 0) throw new OffloadRefusal(selected, "no remote Mac is paired");
 		return { selected };
 	} catch (error) {
 		return {
@@ -421,7 +717,7 @@ function resolveBuildPlacement(flag) {
 			failure: {
 				code: error.code,
 				message: error.message,
-				remedy: error instanceof OffloadRefusal ? error.remedy : "Pass --build-machine auto, local, or an entry from stim settings get offload.machines."
+				remedy: error instanceof OffloadRefusal ? error.remedy : "Pass --remote-build auto, local, or an entry from stim settings get remote.machines."
 			}
 		};
 	}
@@ -450,7 +746,7 @@ const CHUNK_BYTES = 61440;
 const MAX_BUFFERED = 8388608;
 const DIGEST_BYTES = 32;
 function offloadMode(env = process.env) {
-	const raw = env.STIM_OFFLOAD_MODE || loadConfig$1()?.offload?.mode;
+	const raw = env.STIM_REMOTE_BUILD_MODE || loadConfig$1()?.remote?.buildMode;
 	return OFFLOAD_MODES.includes(raw) ? raw : "auto";
 }
 function buildPlacementCandidates(selected) {
@@ -478,30 +774,30 @@ function placementLoad(choice) {
 	})} there`;
 }
 /**
-* Whether a build may go to a build machine at all, before any machine is asked. `auto` keeps the build here while
-* this Mac has a free `concurrency.maxBuilds` slot and its load per core is under `offload.maxLoadPerCore`.
+* Whether a build may go to a remote Mac at all, before any machine is asked. `auto` keeps the build here while
+* this Mac has a free `concurrency.maxBuilds` slot and its load per core is under `server.maxLoadPerCore`.
 * A named selection ignores local capacity and mode, and refuses an unsupported build or missing pairing.
 */
 function offloadPlacement({ mode, machines, here, unsupported, selected = "auto" }) {
 	if (namedBuildMachine(selected)) {
-		if (unsupported) throw new OffloadRefusal(selected, `${unsupported}, so a named build machine cannot take it`);
-		if (machines === 0) throw new OffloadRefusal(selected, "no build machine is paired");
+		if (unsupported) throw new OffloadRefusal(selected, `${unsupported}, so a named remote Mac cannot take it`);
+		if (machines === 0) throw new OffloadRefusal(selected, "no remote Mac is paired");
 		return {
 			offload: true,
-			reason: `selected with --build-machine ${selected}`
+			reason: `selected with --remote-build ${selected}`
 		};
 	}
 	if (selected === "local") return {
 		offload: false,
-		reason: "--build-machine local"
+		reason: "--remote-build local"
 	};
 	if (mode === "off") return {
 		offload: false,
-		reason: "offload.mode is off"
+		reason: "remote.buildMode is off"
 	};
 	if (machines === 0) return {
 		offload: false,
-		reason: "no build machine is paired"
+		reason: "no remote Mac is paired"
 	};
 	if (unsupported) return {
 		offload: false,
@@ -509,7 +805,7 @@ function offloadPlacement({ mode, machines, here, unsupported, selected = "auto"
 	};
 	if (mode === "force") return {
 		offload: true,
-		reason: "offload.mode is force"
+		reason: "remote.buildMode is force"
 	};
 	const busy = saturation(here);
 	return busy ? {
@@ -797,7 +1093,7 @@ var BuildConnection = class BuildConnection {
 function replyError(reply) {
 	return "error" in reply ? `${reply.error.code}: ${reply.error.message}` : null;
 }
-/** The repository on the build machine: one area per git common dir, shared by all its worktrees. */
+/** The repository on the remote Mac: one area per git common dir, shared by all its worktrees. */
 function repoIdentity(projectRoot) {
 	const run = getExecutor().runFile;
 	const repoRoot = realpathSync(run("git", [
@@ -937,7 +1233,7 @@ async function chooseBuildMachine({ projectRoot, target, mode, here, note, machi
 	asked.forEach((each, at) => {
 		if (!order.includes(at) && "connection" in each) each.connection.close();
 	});
-	if (order.length === 0) return reasons.length ? reasons.join("; ") : "no build machine is paired";
+	if (order.length === 0) return reasons.length ? reasons.join("; ") : "no remote Mac is paired";
 	for (const reason of reasons) note(reason);
 	const [first, ...rest] = order.map((at) => {
 		const pick = asked[at];
@@ -1366,261 +1662,4 @@ function offloadCheck(projectRoot, targets) {
 	};
 }
 //#endregion
-//#region src/device-host/machines.ts
-function note(title, detail, fix = null) {
-	return {
-		code: "device-host-machine",
-		level: "note",
-		title,
-		detail,
-		fix
-	};
-}
-const approval = (machine, id) => `A person on ${machine} approves it with \`stim-server devices grant ${id} --device-host\`.`;
-function configuredMachines() {
-	const hosting = loadConfig$1()?.hosting;
-	if (hosting !== void 0 && !isJsonObject(hosting)) return null;
-	const machines = hosting?.machines;
-	if (machines === void 0) return [];
-	return acceptsShape(settingDefinition("hosting.machines"), machines) ? machines : null;
-}
-function store(machines) {
-	withDirLock(deviceHostMachinesLock(), () => {
-		const file = deviceHostMachinesFile();
-		const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
-		try {
-			writeFileSync(tmp, `${JSON.stringify({
-				version: 1,
-				machines
-			}, null, 2)}\n`, { mode: 384 });
-			renameSync(tmp, file);
-		} finally {
-			rmSync(tmp, { force: true });
-		}
-	}, { ensureParent: () => mkdirSync(getConfigDir(), { recursive: true }) });
-}
-async function request(machine, peer, port, deviceName, io) {
-	const ticket = readAccessTicket();
-	const reply = await io.hello(endpoint(peer, port), {
-		request: "device-host",
-		deviceName,
-		...ticket ? { setupTicket: ticket.ticket } : {}
-	});
-	if (!("result" in reply) || reply.result?.approval?.state !== "pending" || typeof reply.result.deviceToken !== "string" || !reply.result.deviceToken || typeof reply.result.device?.id !== "string" || !reply.result.device.id || typeof reply.result.approval.expiresAt !== "string" || !reply.result.approval.expiresAt) return {
-		report: {
-			machine,
-			dnsName: peer.dnsName,
-			state: "unreachable"
-		},
-		finding: note(`Could not ask ${machine} for hosting access`, "The worker did not return a pending request.")
-	};
-	const credential = {
-		machine,
-		nodeId: peer.nodeId,
-		dnsName: peer.dnsName,
-		deviceId: reply.result.device.id,
-		deviceToken: reply.result.deviceToken,
-		state: "pending",
-		requestedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		...ticket ? { ticketHash: ticket.ticketHash } : {}
-	};
-	return {
-		report: {
-			machine,
-			dnsName: peer.dnsName,
-			state: "pending",
-			deviceId: credential.deviceId,
-			requestedAt: credential.requestedAt
-		},
-		finding: note(`Asked ${machine} for hosting access`, `The request lapses at ${reply.result.approval.expiresAt}.`, approval(machine, credential.deviceId)),
-		credential
-	};
-}
-/** Reports separately approved hosting machines. Only --fix asks or forgets credentials; every token stays pinned. */
-async function inspectDeviceHostMachines({ fix }, io = realIo, entries = configuredMachines()) {
-	if (entries === null) return {
-		findings: [note("Invalid hosting.machines setting", "Use a hosting object with machines as an array of tailnet names. Existing hosting credentials and pinned nodes are preserved.", "Run `stim guide settings` and correct the setting before running doctor again.")],
-		machines: []
-	};
-	const unavailable = (state, finding) => ({
-		findings: [finding],
-		machines: entries.map((machine) => ({
-			machine,
-			state
-		}))
-	});
-	const unreadable = () => unavailable("credentials-unavailable", note("Hosting credentials are unreadable", `Stim preserves ${deviceHostMachinesFile()} and its pinned nodes.`, "Restore the existing file from a trusted backup or restore read access before running doctor again."));
-	if (!entries.length) {
-		if (!fix) return {
-			findings: [],
-			machines: []
-		};
-		try {
-			if (!readDeviceHostMachines().length) return {
-				findings: [],
-				machines: []
-			};
-		} catch {
-			return unreadable();
-		}
-	}
-	const claim = tryAcquireClaim({
-		root: deviceHostMachinesClaims(),
-		mode: "exclusive",
-		label: "hosting machine approval"
-	});
-	if (!claim.acquired) {
-		releaseClaim(claim.pending);
-		return unavailable("busy", note("Hosting machine approval is in use", "Another doctor run holds the hosting credential claim. Run doctor again after it finishes."));
-	}
-	try {
-		let credentials;
-		try {
-			credentials = readDeviceHostMachines();
-		} catch {
-			return unreadable();
-		}
-		if (fix) {
-			const kept = credentials.filter((each) => entries.includes(each.machine));
-			if (kept.length !== credentials.length) {
-				store(kept);
-				credentials = kept;
-			}
-		}
-		if (!entries.length) return {
-			findings: [],
-			machines: []
-		};
-		const status = io.status();
-		if (!isJsonObject(status)) return unavailable("tailscale-off", note("Hosting machines are unreachable", "hosting.machines names hosting machines, but Tailscale is not running."));
-		const self = isJsonObject(status.Self) ? status.Self : {};
-		const deviceName = (typeof self.HostName === "string" && self.HostName ? self.HostName : hostname()).replace(/[\p{Cc}\p{Cf}]/gu, "").trim().slice(0, 64) || "Mac";
-		const inspected = {
-			findings: [],
-			machines: []
-		};
-		const namedNodes = /* @__PURE__ */ new Set();
-		for (const machine of new Set(entries)) {
-			const parsed = parseMachine$1(machine);
-			if (!parsed) {
-				inspected.machines.push({
-					machine,
-					state: "invalid"
-				});
-				inspected.findings.push(note(`Hosting machine ${machine} is not a tailnet name`, "Expected `name` or `name:port`."));
-				continue;
-			}
-			const current = io.status();
-			if (!isJsonObject(current)) {
-				inspected.machines.push({
-					machine,
-					state: "tailscale-off"
-				});
-				inspected.findings.push(note(`Hosting machine ${machine} is unreachable`, "Tailscale stopped before this connection."));
-				continue;
-			}
-			const peer = findPeer$1(current, parsed.name);
-			if (peer === "missing" || peer === "ambiguous") {
-				inspected.machines.push({
-					machine,
-					state: "not-on-tailnet"
-				});
-				inspected.findings.push(note(`Hosting machine ${machine} is not on this tailnet`, peer === "missing" ? "No peer has that name." : "Several peers match that name."));
-				continue;
-			}
-			const nodeRoute = `${peer.nodeId}:${parsed.port}`;
-			if (namedNodes.has(nodeRoute)) {
-				inspected.machines.push({
-					machine,
-					dnsName: peer.dnsName,
-					state: "invalid"
-				});
-				inspected.findings.push(note(`Hosting machine ${machine} repeats a named node`, "Name each tailnet node and serve port only once in hosting.machines."));
-				continue;
-			}
-			namedNodes.add(nodeRoute);
-			const credential = credentials.find((each) => each.machine === machine);
-			const known = {
-				machine,
-				dnsName: peer.dnsName,
-				...credential ? {
-					deviceId: credential.deviceId,
-					requestedAt: credential.requestedAt
-				} : {}
-			};
-			if (credential && credential.nodeId !== peer.nodeId) {
-				inspected.machines.push({
-					...known,
-					state: "node-changed"
-				});
-				inspected.findings.push(note(`Hosting machine ${machine} is a different tailnet node`, "Stim refuses to connect or send the saved token.", `If that Mac was replaced, remove ${machine} from hosting.machines, run \`stim doctor --fix\`, then add it back and run \`stim doctor --fix\` again to request approval on the new node.`));
-				continue;
-			}
-			let ask = !credential && fix;
-			if (credential) {
-				const reply = await io.hello(endpoint(peer, parsed.port), { deviceToken: credential.deviceToken });
-				if ("result" in reply && reply.result?.device?.id === credential.deviceId && Array.isArray(reply.result.capabilities) && reply.result.capabilities.includes("device-host")) {
-					if (credential.state !== "approved") {
-						credentials = credentials.map((each) => each.machine === machine ? {
-							...each,
-							state: "approved"
-						} : each);
-						store(credentials);
-					}
-					const host = readHostPermissions(reply.result.host);
-					if (host && (host.screenRecording === false || host.accessibility === false)) {
-						const panes = [...host.screenRecording === false ? ["Screen & System Audio Recording (Screen Recording on macOS 14)"] : [], ...host.accessibility === false ? ["Device Control and Data Access (Accessibility on macOS 26 and earlier)"] : []];
-						const detail = [...host.screenRecording === false ? ["Viewing hosted macOS apps needs Screen Recording."] : [], ...host.accessibility === false ? ["Controlling them needs the control permission."] : []];
-						inspected.findings.push(note(`Hosting machine ${machine} needs ${panes.join(" and ")} for ${host.name}`, detail.join(" "), `On ${machine}, approve ${host.name} in System Settings > Privacy & Security, or run \`stim-server service install\` there again to show the requests.`));
-					}
-					inspected.machines.push({
-						...known,
-						state: "approved",
-						...host ? { host } : {}
-					});
-					continue;
-				}
-				const pending = "error" in reply && reply.error?.code === "approval-pending";
-				const revoked = "error" in reply && reply.error?.code === "unauthorized";
-				const ticket = fix && pending && credential.state !== "approved" ? readAccessTicket() : void 0;
-				ask = fix && (revoked || !!ticket && credential.ticketHash !== ticket.ticketHash);
-				if (pending && !ask) {
-					inspected.machines.push({
-						...known,
-						state: "pending"
-					});
-					inspected.findings.push(note(`Hosting machine ${machine} has not approved this Mac yet`, `Requested at ${credential.requestedAt}.`, approval(machine, credential.deviceId)));
-					continue;
-				}
-				if (!ask) {
-					inspected.machines.push({
-						...known,
-						state: revoked ? "revoked" : "unreachable"
-					});
-					inspected.findings.push(note(`Hosting machine ${machine} ${revoked ? "no longer accepts this Mac" : "did not confirm hosting access"}`, "The saved token and pinned node are preserved.", revoked ? "Run `stim doctor --fix` to ask again." : `Check stim-server and its tailnet serve route on ${machine}, then run doctor again.`));
-					continue;
-				}
-			}
-			if (ask) {
-				const result = await request(machine, peer, parsed.port, deviceName, io);
-				if (result.credential) {
-					credentials = [...credentials.filter((each) => each.machine !== machine), result.credential];
-					store(credentials);
-				}
-				inspected.machines.push(result.report);
-				inspected.findings.push(result.finding);
-			} else {
-				inspected.machines.push({
-					...known,
-					state: "not-asked"
-				});
-				inspected.findings.push(note(`Hosting machine ${machine} has not approved this Mac`, "This Mac has not asked for hosting access.", "Run `stim doctor --fix` to ask."));
-			}
-		}
-		return inspected;
-	} finally {
-		releaseClaim(claim.acquired);
-	}
-}
-//#endregion
-export { resolveBuildPlacement as _, chooseBuildMachine as a, pinnedEndpoint$1 as b, offloadCheck as c, remotePhaseText as d, simulatorRuntime as f, resolveBuildMachine as g, parseBuildMachineOption as h, buildPlacementCandidates as i, offloadPlacement as l, namedBuildMachine as m, inspectDeviceHostMachines as n, closeOffload as o, OffloadRefusal as p, BuildConnection as r, offloadBuild as s, configuredMachines as t, placementLoad as u, inspectBuildMachines as v, realIo as x, parseMachine$1 as y };
+export { realIo as S, configuredMachines as _, offloadBuild as a, parseMachine$1 as b, placementLoad as c, OffloadRefusal as d, namedBuildMachine as f, inspectBuildMachines as g, resolveBuildPlacement as h, closeOffload as i, remotePhaseText as l, resolveBuildMachine as m, buildPlacementCandidates as n, offloadCheck as o, parseBuildMachineOption as p, chooseBuildMachine as r, offloadPlacement as s, BuildConnection as t, simulatorRuntime as u, hostingMachines as v, pinnedEndpoint$1 as x, inspectDeviceHostMachines as y };