Aabco Tasks — Fleet Control

One-click LAN install - Machines → a LAN → Scan & grow → Install manager on selected

• The install runs in the background and this page follows it per machine: connecting, copying, installing, checking the service, reaching the Hub, then online in <LAN>. No more tunnel request timed out while it is still working.
• A machine the Hub installed is approved automatically when it reports in, and filed under the LAN it was installed from (not the network it reports). Only that machine: it must present that install's one-time token from the address it was installed at.
• A failure says why and what to do: Access is denied - use a domain admin (AABCO\…), the RPC server is unavailable - the target's firewall blocks RPC from <seed>, installed but the manager can't reach the Hub: outgoing HTTPS blocked, …
• The installer adds the manager's outgoing HTTPS rule itself and registers the service on the machine's own disk. The one-time domain policy that makes every office PC installable is in tasksio-console's LAN-DEPLOY-GPO.md.

Names instead of ids - Queues, Groups, Enrollments, Apps and their windows

• Queues, dtTasks, machines, groups and apps are shown by their names. An id is small grey text you can click to copy (the whole id is in its tooltip). A name the Hub cannot find says so - unknown queue (7d1e0c55…) - instead of a long id.
• Every tab is a list of cards, like Fleet: Queues (what waits, runs, polls, and what each queue runs, by name), Groups (the machines in it and what it sets, in words), Enrollments (who asked, when, and what the machine says it can run), Apps (what it provides and which queues need it).
• Where you used to paste an id, type the name and pick it from the list; pasting an id still works.
• Deleting, dropping, rejecting and revoking moved into the ⋯ menu of the thing they act on, with the same confirmations. Times read 3 min ago; hover for the exact time.

Fleet - one card per machine

• Each machine is a card: its status, name and version on the first line; group, LAN › machine, when it was last seen and its id on the second; the task it is running when busy.
• Open UI, Manage and Edit stay on the card; Restart and Shutdown moved into the ⋯ menu, with the same confirmations as before.
• What a machine can run is one line (⚠ 2 need setup · ✓ 1 ready); click it for the list, and a name in the list for the Capabilities window.
• A machine the Hub MCP took off its queues carries a yellow banner with ▶ Resume queues.

The settings editor (a machine's Edit, a group's Edit config) - sections, Default / Custom, role cards

• Every section folds; its header says in one line what it holds (all default, 1 custom: GitLab read token, the server roles as chips). Only a section with a Custom value opens by itself. Save stays at the bottom of the window.
• Each setting is Default or Custom instead of a bare tick box. Default says where the value comes from (From group Office: 5 seconds, or that the machine uses its own); Custom shows the input. What is saved is the same as before: a Default setting is left out of the config.
• Server roles are cards to tick, not a comma-separated list. A role the page does not know is still shown, as its own card, and kept unless you untick it.
• The shape picture settings sit under their role and fold away while the role is off - unless one of them is set, which stays visible. Copy to the master is a switch: Off = dry run.

Shape picture sync - the website's new shape pictures, copied to the master on \\aabcoserver

Pictures uploaded on the website's Shape Fixes page are saved only on the web server. A machine on the office LAN given the server role shape-bmp-sync (Edit → Server roles) now compares them with the master library and copies what is new, every 10 minutes and on Sync now in its Capabilities window, where the last run's result is shown.

• Dry run until you say otherwise: nothing is written until Copy to the master (Shape picture sync section) is On in that machine's settings. Until then each run lists what it would copy.
• Never deletes. A master file newer than the website's (or as new) is a conflict: left alone and listed. A file replaced because the website's is newer is copied to the backup folder first.
• Names: only names the website files pictures under are copied (the code as the catalogue spells it, ends upper case, .bmp); any other name is listed as skipped, with the reason.
• The share is reached as the user logged on at that machine's console - the service's own account cannot open it - so someone must stay logged on there (locked is fine).

The Hub MCP - an assistant can read the fleet, and take one machine off its queues and back

A small MCP server (tools/hub-mcp in this repo) gives an AI assistant such as Claude Code a few narrow tools over this Hub's admin API. The main use: before a gate or a replay that needs a machine's AutoCAD to itself, the assistant takes that machine off its queues, waits for its running task to end, does its run, and puts it back - instead of hoping no customer job arrives in the meantime.

• Read-only: list_workers (online, version, running task, the queues its heartbeat says it polls), get_worker, list_queues (waiting, in flight, who polls).
• Pause: pause_machine_queues sets the machine's Polled queue UUIDs override to an empty list, so it claims no new task. A task already running is not stopped (wait_until_idle waits for it), and tasks sent meanwhile wait in their queue - nothing is lost. It returns only once the machine's own heartbeat says it polls nothing.
• Resume: resume_machine_queues puts the override back exactly as it was and returns once the heartbeat polls the old queues again.
• A paused machine shows it here: a yellow "⏸ queues paused by Hub MCP" badge in the Status column, with when and why. Its ▶ Resume queues button does what the resume tool does - use it if an assistant's session ended without resuming.
• It refuses a machine that is offline, one whose queue list does not come from this Hub (it could not be given back), and an aabco-worker (there an empty list means "no restriction").
• It cannot install, restart, shut down, delete, change other settings, touch the queues themselves or press the actions below - those stay here, in a person's hands.
• The admin token is read from a file on the assistant's machine (%USERPROFILE%\.tasksio\hub-admin-token.txt) - never typed into a chat, never printed. Settings whose names read as secrets are hidden in everything it answers.

Actions on a green row - make a new API token

A requirement's ▶ button used to appear only while its check was red. An action worth taking when all is well now shows on a green row too. The first two: under a machine's indBBS_AUA read-only HTTP API role, indBBS HTTP API read token and write token, each with "Make a new … token (the old one stops working)". The row shows the token file and how old it is. The new token is proved on the machine before the run says done; every caller still holding the old one is refused until its copy is replaced - the button's confirmation lists them.