feat(runner): complete Fleet enrollment and runner details (RUN-12, RUN-13)

.github/workflows/pr.yml

@@ -67,6 +67,7 @@ jobs:
           POSTHOG_API_KEY =
           OIDC_ISSUER_URL =
           OIDC_CLIENT_ID =
+          FLEET_PLATFORM_BASE_URL =
           XCEOF
 
       - name: Generate Xcode project

.github/workflows/release.yml

@@ -309,6 +309,7 @@ jobs:
           #include "Version.xcconfig"
           OIDC_ISSUER_URL = https:/$()/auth.arcbox.dev/api/auth
           OIDC_CLIENT_ID = arcbox-desktop
+          FLEET_PLATFORM_BASE_URL = https:/$()/api.arcbox.dev
           XCEOF
 
       - name: Trust SwiftPM plugins

.swiftlint.yml

@@ -4,7 +4,7 @@ included:
   - Packages
 
 excluded:
-  - Packages/ArcBoxClient/Sources/ArcBoxClient/Generated
+  - Packages/*/Sources/*/Generated
   - Packages/*/.build
   - .build
   - .claude

AGENTS.md

@@ -48,6 +48,11 @@ A bare `Bool` like `hasCompletedInitialLoad` cannot distinguish "never started"
 ### Default tab vs lazy tabs
 The default tab's view renders during startup. Other tabs render lazily when the user switches to them. This means timing bugs in `.task(id:)` only manifest on the default tab — other tabs work by accident because dependencies are already available when they appear. Always test startup behavior on the default tab specifically.
 
+### `fixedSize(horizontal: false, vertical: true)` window blowup (macOS 26)
+Any state change inside a `fixedSize(vertical: true)` subtree in a main-window view triggers a window-sizing pass that resizes the window — or, if the window can't grow, the `NavigationSplitView` content inside it — to the screen's *visible-frame height* (content slides under the title bar, bottom-pinned views disappear). Verified on macOS 26.5 with a minimal repro: inserting, removing, or even changing the text of such a label fires it; the same label without `fixedSize` does not, and still wraps correctly inside width-constrained containers.
+
+**Rule**: don't use `fixedSize(vertical: true)` on labels whose content appears/changes dynamically in the main window (error banners, status text). Text wraps without it in width-bounded layouts; use it only for genuinely static text, ideally in sheets.
+
 ## Code Style
 - Swift 6 strict concurrency (`SWIFT_DEFAULT_ACTOR_ISOLATION = MainActor`, `SWIFT_APPROACHABLE_CONCURRENCY = YES`)
 - ViewModels use `@Observable`; environment injection via custom `EnvironmentKey`

ArcBox/App/ApplicationCoordinator.swift

@@ -2,6 +2,7 @@ import AppKit
 import ArcBoxAuth
 import ArcBoxClient
 import DockerClient
+import FleetPlatformClient
 import Foundation
 import OSLog
 import Observation
@@ -18,15 +19,19 @@ final class ApplicationCoordinator: NSObject {
     let networksVM = NetworksViewModel()
     let volumesVM = VolumesViewModel()
     let systemVmBackendVM = SystemVmBackendModel()
+    // App-scoped so the Fleet Watch survives closing the main window.
+    let runnersVM = RunnersViewModel()
 
     private let eventMonitor = DockerEventMonitor()
     private let sandboxEventMonitor = SandboxEventMonitor()
     private let machineEventMonitor = MachineEventMonitor()
     private let sleepWakeManager = SleepWakeManager()
     private let deepLinkRouter = DeepLinkRouter()
+    private let fleetAgentConnection = FleetAgentConnection()
     private let updaterDelegate = UpdaterDelegate()
     private let updaterController: SPUStandardUpdaterController
     private let updaterSettings: UpdaterSettingsModel
+    private var fleetPlatformClient: FleetPlatformClient?
 
     private(set) var arcboxClient: ArcBoxClient?
     private(set) var dockerClient: DockerClient?
@@ -99,8 +104,30 @@ final class ApplicationCoordinator: NSObject {
             }
         }
 
+        fleetAgentConnection.start()
         Task { [weak self] in
-            await self?.authSession.loadUserInfo()
+            guard let self else { return }
+            await authSession.restoreSession()
+            initFleetPlatformClientIfNeeded()
+            runnersVM.start(
+                controlClient: fleetAgentConnection.controlClient,
+                platformClient: fleetPlatformClient,
+                authentication: authSession,
+                agentReadiness: fleetAgentConnection
+            )
+            await authSession.refreshSession()
+        }
+        Task { [weak self] in
+            guard let self else { return }
+            do {
+                _ = try await fleetAgentConnection.ensureReady()
+            } catch is CancellationError {
+                Log.fleet.info("Fleet Agent readiness probe cancelled")
+            } catch {
+                Log.fleet.info(
+                    "Fleet Agent is not ready: \(error.localizedDescription, privacy: .private)"
+                )
+            }
         }
 
         if !isOnboarding {
@@ -197,7 +224,7 @@ final class ApplicationCoordinator: NSObject {
         guard !isTerminating else { return false }
         isTerminating = true
 
-        WebAuthenticationController.shared.cancelForTermination()
+        authSession.cancelSignIn()
         statusItemController?.closePopover()
         statusItemController?.setVisible(false)
         let screen = NSApp.keyWindow?.screen ?? NSApp.mainWindow?.screen ?? NSScreen.main
@@ -224,6 +251,19 @@ final class ApplicationCoordinator: NSObject {
     }
 
     func shutdown() async {
+        let enrollmentSettled = await runnersVM.prepareForTermination()
+        if !enrollmentSettled {
+            Log.fleet.warning(
+                "Fleet enrollment did not settle before the application termination deadline"
+            )
+        }
+        let connectionClosedGracefully = await fleetAgentConnection.shutdown()
+        if !connectionClosedGracefully {
+            Log.fleet.warning(
+                "Fleet client transport required forced shutdown during application termination"
+            )
+        }
+
         startupTask?.cancel()
         await startupOrchestrator?.cancelForTermination()
         await startupTask?.value
@@ -263,11 +303,7 @@ final class ApplicationCoordinator: NSObject {
                 imagesVM: imagesVM,
                 networksVM: networksVM,
                 openMainWindow: { [weak self] in self?.showMainWindow() },
-                openSettingsWindow: { [weak self] in self?.showSettings() },
-                oauthCallbackScheme: OIDCClientConfiguration.redirectURI.scheme,
-                onOAuthCallback: { [weak self] url in
-                    Task { await self?.authSession.handleAuthorizationCallback(url) }
-                }
+                openSettingsWindow: { [weak self] in self?.showSettings() }
             ))
     }
 
@@ -449,8 +485,11 @@ final class ApplicationCoordinator: NSObject {
             .environment(volumesVM)
             .environment(sandboxEventMonitor)
             .environment(authSession)
+            .environment(runnersVM)
             .environment(\.arcboxClient, arcboxClient)
             .environment(\.dockerClient, dockerClient)
+            .environment(\.fleetControlClient, fleetAgentConnection.controlClient)
+            .environment(\.fleetPlatformClient, fleetPlatformClient)
             .environment(\.startupOrchestrator, startupOrchestrator)
             .environment(\.accessTokenProvider, authSession)
             .frame(minWidth: 900, minHeight: 600)
@@ -467,8 +506,11 @@ final class ApplicationCoordinator: NSObject {
                 .environment(authSession)
                 .environment(systemVmBackendVM)
                 .environment(updaterSettings)
+                .environment(runnersVM.fleet)
                 .environment(\.arcboxClient, arcboxClient)
                 .environment(\.dockerClient, dockerClient)
+                .environment(\.fleetControlClient, fleetAgentConnection.controlClient)
+                .environment(\.fleetPlatformClient, fleetPlatformClient)
                 .environment(\.accessTokenProvider, authSession)
         )
     }
@@ -496,14 +538,28 @@ final class ApplicationCoordinator: NSObject {
             showSettings(tab: .account)
             return
         }
-        guard authSession.status != .signingIn, !authSession.configuration.isPlaceholder else {
-            return
-        }
+        guard authSession.status != .restoring, authSession.status != .signingIn,
+            !authSession.configuration.isPlaceholder
+        else { return }
         Task {
-            await authSession.signIn(using: WebAuthenticationController.shared.authenticate)
+            await authSession.signIn()
         }
     }
 
+    /// Create the authenticated Platform REST client without starting network work.
+    private func initFleetPlatformClientIfNeeded() {
+        guard fleetPlatformClient == nil else { return }
+
+        let configuration = FleetPlatformConfiguration.current
+        Log.fleet.info(
+            "Creating FleetPlatformClient for \(configuration.baseURL.absoluteString, privacy: .public)"
+        )
+        fleetPlatformClient = FleetPlatformClient(
+            configuration: configuration,
+            accessTokenProvider: authSession
+        )
+    }
+
     private func activate() {
         NSApp.unhide(nil)
         NSApp.activate(ignoringOtherApps: true)

ArcBox/App/DeepLinkRouter.swift

@@ -14,11 +14,6 @@ final class DeepLinkRouter {
         let networksVM: NetworksViewModel
         let openMainWindow: () -> Void
         let openSettingsWindow: () -> Void
-        /// URL scheme of the OAuth redirect (e.g. `com.arcboxlabs.desktop`).
-        /// Callbacks with this scheme are forwarded to `onOAuthCallback` rather
-        /// than parsed as `arcbox://` deep links.
-        let oauthCallbackScheme: String?
-        let onOAuthCallback: (URL) -> Void
     }
 
     private var target: Target?
@@ -40,14 +35,6 @@ final class DeepLinkRouter {
     }
 
     private func dispatch(_ url: URL) {
-        guard let target else { return }
-        if let scheme = target.oauthCallbackScheme,
-            url.scheme?.caseInsensitiveCompare(scheme) == .orderedSame
-        {
-            Log.deepLink.info("Handling OAuth redirect callback")
-            target.onOAuthCallback(url)
-            return
-        }
         guard let link = DeepLink(url) else {
             Log.deepLink.warning("Ignoring unrecognized deep link: \(url.absoluteString, privacy: .private)")
             return
@@ -81,7 +68,7 @@ final class DeepLinkRouter {
         case .volumes: target.volumesVM.selectedID = id
         case .images: target.imagesVM.selectedID = id
         case .networks: target.networksVM.selectedID = id
-        case .activity, .pods, .services, .machines, .sandboxes:
+        case .activity, .pods, .services, .machines, .sandboxes, .runner:
             Log.deepLink.info("Item selection unsupported for \(item.rawValue, privacy: .public)")
         }
     }

ArcBox/App/EnvironmentValues+Clients.swift

@@ -1,6 +1,8 @@
 import ArcBoxAuth
 import ArcBoxClient
 import DockerClient
+import FleetControlClient
+import FleetPlatformClient
 import SwiftUI
 
 private struct ArcBoxClientKey: EnvironmentKey {
@@ -15,6 +17,14 @@ private struct DockerClientKey: EnvironmentKey {
     static let defaultValue: DockerClient? = nil
 }
 
+private struct FleetControlClientKey: EnvironmentKey {
+    static let defaultValue: FleetControlClient? = nil
+}
+
+private struct FleetPlatformClientKey: EnvironmentKey {
+    static let defaultValue: FleetPlatformClient? = nil
+}
+
 private struct StartupOrchestratorKey: EnvironmentKey {
     static let defaultValue: StartupOrchestrator? = nil
 }
@@ -30,6 +40,16 @@ extension EnvironmentValues {
         set { self[DockerClientKey.self] = newValue }
     }
 
+    var fleetControlClient: FleetControlClient? {
+        get { self[FleetControlClientKey.self] }
+        set { self[FleetControlClientKey.self] = newValue }
+    }
+
+    var fleetPlatformClient: FleetPlatformClient? {
+        get { self[FleetPlatformClientKey.self] }
+        set { self[FleetPlatformClientKey.self] = newValue }
+    }
+
     var startupOrchestrator: StartupOrchestrator? {
         get { self[StartupOrchestratorKey.self] }
         set { self[StartupOrchestratorKey.self] = newValue }

ArcBox/Components/EmptyStateView.swift

@@ -27,10 +27,11 @@ struct EmptyStateView<Content: View>: View {
                 Image(systemName: icon)
                     .font(.system(size: 26))
                     .foregroundStyle(AppColors.textMuted)
+                    .accessibilityHidden(true)
             }
 
             Text(title)
-                .font(.system(size: 13))
+                .font(.headline)
                 .foregroundStyle(AppColors.textSecondary)
 
             content

ArcBox/Components/StatusBadge.swift

@@ -11,7 +11,7 @@ struct StatusBadge: View {
                 .fill(color)
                 .frame(width: AppMetrics.statusDot, height: AppMetrics.statusDot)
             Text(label)
-                .font(.system(size: 13))
+                .font(.callout)
                 .foregroundStyle(color)
         }
         .accessibilityElement(children: .combine)

ArcBox/Info.plist

@@ -33,6 +33,8 @@
 	<string>$(OIDC_CLIENT_ID)</string>
 	<key>OIDCIssuerURL</key>
 	<string>$(OIDC_ISSUER_URL)</string>
+	<key>FleetPlatformBaseURL</key>
+	<string>$(FLEET_PLATFORM_BASE_URL)</string>
 	<key>ArcBoxProfile</key>
 	<string>$(ARCBOX_PROFILE)</string>
 	<key>PostHogAPIKey</key>

ArcBox/Logging.swift

@@ -12,6 +12,7 @@ nonisolated enum Log {
     static let network = Logger(subsystem: subsystem, category: "network")
     static let sandbox = Logger(subsystem: subsystem, category: "sandbox")
     static let machine = Logger(subsystem: subsystem, category: "machine")
+    static let fleet = Logger(subsystem: subsystem, category: "fleet")
     static let pods = Logger(subsystem: subsystem, category: "pods")
     static let services = Logger(subsystem: subsystem, category: "services")
     static let context = Logger(subsystem: subsystem, category: "context")

ArcBox/Models/FleetRunnerImageReadiness.swift

@@ -0,0 +1,9 @@
+/// macOS runner image readiness presented on the runner page.
+enum FleetRunnerImageReadiness: Equatable {
+    case hidden
+    case pending(reference: String)
+    case preparing(FleetImagePreparationProgress)
+    case restartRequired
+    case completed(reference: String)
+    case failed(String)
+}

ArcBox/Models/NavItem.swift

@@ -9,6 +9,7 @@ enum NavItem: String, CaseIterable, Identifiable {
     case services
     case machines
     case sandboxes
+    case runner
 
     var id: String { rawValue }
 
@@ -23,6 +24,7 @@ enum NavItem: String, CaseIterable, Identifiable {
         case .services: "Services"
         case .machines: "Machines"
         case .sandboxes: "Sandboxes"
+        case .runner: "This Mac"
         }
     }
 
@@ -37,6 +39,7 @@ enum NavItem: String, CaseIterable, Identifiable {
         case .services: "gearshape.2"
         case .machines: "desktopcomputer"
         case .sandboxes: "server.rack"
+        case .runner: "hammer"
         }
     }
 
@@ -47,6 +50,7 @@ enum NavItem: String, CaseIterable, Identifiable {
         case kubernetes = "KUBERNETES"
         case linux = "LINUX"
         case sandbox = "SANDBOX"
+        case runners = "RUNNERS"
 
         var id: String { rawValue }
 
@@ -57,6 +61,7 @@ enum NavItem: String, CaseIterable, Identifiable {
             case .kubernetes: [.pods, .services]
             case .linux: [.machines]
             case .sandbox: [.sandboxes]
+            case .runners: [.runner]
             }
         }
     }

ArcBox/Models/RunnerHostCapability.swift

@@ -0,0 +1,18 @@
+import Darwin
+import Foundation
+
+/// Local hardware facts available before this Mac enrolls in a Fleet.
+enum RunnerHostCapability {
+    static let chipName: String = {
+        var size = 0
+        guard sysctlbyname("machdep.cpu.brand_string", nil, &size, nil, 0) == 0, size > 0 else {
+            return "Apple Silicon"
+        }
+        var brand = [CChar](repeating: 0, count: size)
+        guard sysctlbyname("machdep.cpu.brand_string", &brand, &size, nil, 0) == 0 else {
+            return "Apple Silicon"
+        }
+        let bytes = brand.prefix(while: { $0 != 0 }).map { UInt8(bitPattern: $0) }
+        return String(bytes: bytes, encoding: .utf8) ?? "Apple Silicon"
+    }()
+}

ArcBox/Models/RunnerHostDetailTab.swift

@@ -0,0 +1,8 @@
+enum RunnerHostDetailTab: String, CaseIterable, Identifiable {
+    case overview = "Overview"
+    case capacity = "Capacity"
+    case settings = "Settings"
+    case identity = "Identity"
+
+    var id: Self { self }
+}