Team Setup manifests

Explains the team setup manifest — what it runs and the shape it takes — as it runs on every team computer. The editor lives on Organisation → Team setup.

What a manifest is

{ "manifestId": "<slug>", "entries": [{ "id": "<slug>", "setup": "<script>", "check": "<script> | null" }] }

An entry's id is unique and slug-shaped, at most 64 characters; a manifest holds at most 50 entries; setup is at most 32 KiB and check is at most 4 KiB or null. A manifest is edited as a form or as JSON on Organisation → Team setup (/organisation/setup; no source screen — sheet idiom Sm-46).

How entries run

Entries run one at a time, in the order the manifest lists them. A computer runs the manifest at start and again every 24 hours while it stays up. An entry whose check exits 0 skips its setup; after a setup runs, check runs again to confirm it. Each entry's setup has a 30-minute timeout and its check a 5-minute one. A failure never blocks the computer and is retried on the next refresh. A change to the approved manifest reaches every running computer within a day on its own, and a restart or a recreate applies it immediately; every entry re-applies after a recreation.

Do not put secret values in setup scripts

A manifest is plain text applied across the whole fleet, so the editor carries its own note: Don't put secret values in setup scripts. Save them as team secrets and read them as environment variables. The scan behind it refuses a secret or a url_with_credentials finding and names the path where it found one. Save the value as a Team Secret instead, or authenticate interactively, inside the computer's own browser.

Team Secrets

Team secrets, below the editor, holds write-only values the setup scripts read as environment variables: a secret named NPM_TOKEN is $NPM_TOKEN in every entry's setup and check. A saved value is never shown again — the page lists names and sizes only — and a script's output shows it as [secret NPM_TOKEN]. A team holds at most 100 secrets, each at most 32 KB and together at most 96 KB. A name is capital letters, digits and underscores starting with a letter; a name the computer sets itself (PATH, HOME, the proxy variables, BASH_*, LD_*, LC_* and similar) is refused. Saving and removing one is audited (org.setup_secret_set, org.setup_secret_removed) by name, never by value.

Approval

In an organisation with one administrator, that administrator's Save and apply approves the manifest as it is saved. With two or more administrators, a change is proposed by one and approved by a different one. The approved version is the one computers pull. Every proposal and decision is audited (org.setup_manifest_proposed, org.setup_manifest_decided).

Member groups

Applies to, above the editor, picks the organisation's manifest or a member group's. A group's manifest runs on the computers of that group's members, after the organisation's entries, and on no other computer; an entry whose id the organisation's manifest already uses runs as <id>-2. Each scope has its own approved manifest and its own proposal.

Where results appear

Results show per computer, on Organisation → Computers and on the member's own Settings → Computer (Sm-49); each run writes one audit row (computer.setup_ran). A computer created before this release shows Team setup: not yet available on this computer until its next Update on Settings → Updates (Sm-52). There is no fleet-wide results view.

The guest and sudo

The computer runs Debian 13 (trixie). Its browser is Google Chrome stable, or Chromium on an arm64 home host, which has no Linux build of Chrome. git, gh, Go, jq, curl, ffmpeg, LibreOffice, Node and Python with pip are already installed, so a setup script does not need to install them. A setup script runs as the computer's own user, with sudo for any command — setup scripts keep it even when Allow sudo on bot computers is off.