@2kw/ai 7.3.0-dev.1 → 7.3.0-dev.10

package/dist/bridge/run.js

@@ -0,0 +1,134 @@
+import { randomBytes } from "node:crypto";
+import chalk from "chalk";
+import { deviceConfigHash } from "../relay-protocol/pairing.js";
+import { pollHub } from "./hub.js";
+import { collectInventory } from "./inventory.js";
+import { BackboneApiError } from "../lib/errors.js";
+import { ClockSkewError, DeviceGoneError, reportInventory } from "./pairing.js";
+import { findBash } from "./shell.js";
+import { readConfig } from "./store.js";
+const REPORT_EVERY_MS = 10 * 60_000;
+const CONFIG_CHECK_MS = 2_000;
+const MIN_POLL_MS = 1_000;
+const MAX_BACKOFF_MS = 30_000;
+const OUTDATED = "This version of 2kw is too old for this server. Update with npm install -g @2kw/ai";
+function sleep(ms, signal) {
+    return new Promise((done) => {
+        const finish = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", finish);
+            done();
+        };
+        const timer = setTimeout(finish, ms);
+        signal.addEventListener("abort", finish, { once: true });
+    });
+}
+/**
+ * The foreground loop of `2kw bridge run` (#1377, plan P14). Reports the inventory at start, when
+ * bridge.toml (or the bash it names) changes, and every 10 minutes, and long-polls the hub so the
+ * computer shows as present. A 401 from either is final and rejects with {@link DeviceGoneError}:
+ * unlike the network relay, a device does not wait for its credential to come back. A 401 a wrong
+ * clock caused rejects with {@link ClockSkewError}, and a 426 from either with the update message.
+ * Resolves when `signal` aborts.
+ */
+export async function runBridge(dir, identity, key, signal) {
+    const stop = new AbortController();
+    const onAbort = () => stop.abort();
+    signal.addEventListener("abort", onAbort, { once: true });
+    let fatal;
+    // The hash of what was last sent, so an unchanged bridge.toml is not re-sent and a failed send
+    // waits for the 10-minute report instead of retrying every check.
+    let attempted;
+    let reporting;
+    const report = async () => {
+        try {
+            const inventory = await collectInventory(readConfig(dir));
+            attempted = inventory.configHash;
+            await reportInventory(identity, key, inventory);
+        }
+        catch (error) {
+            if (error instanceof DeviceGoneError || error instanceof ClockSkewError) {
+                fatal ??= error;
+                stop.abort();
+            }
+            else if (error instanceof BackboneApiError && error.status === 426) {
+                fatal ??= new Error(OUTDATED);
+                stop.abort();
+            }
+            else {
+                console.error(chalk.yellow(`Could not send this computer's folders: ${String(error)}`));
+            }
+        }
+    };
+    const trigger = () => {
+        reporting ??= report().finally(() => {
+            reporting = undefined;
+        });
+        return reporting;
+    };
+    const timers = [];
+    try {
+        await trigger();
+        timers.push(setInterval(trigger, REPORT_EVERY_MS));
+        timers.push(setInterval(() => {
+            try {
+                const config = readConfig(dir);
+                const hash = deviceConfigHash({ shell: findBash(config.shell), workspaces: config.workspaces });
+                if (hash !== attempted)
+                    void trigger();
+            }
+            catch {
+                // A half-saved bridge.toml: the next check reads it again.
+            }
+        }, CONFIG_CHECK_MS));
+        const replicaId = randomBytes(8).toString("hex");
+        let backoff = MIN_POLL_MS;
+        let toldInUse = false;
+        while (!stop.signal.aborted) {
+            const started = Date.now();
+            let status;
+            try {
+                status = await pollHub(identity, key, replicaId, stop.signal);
+            }
+            catch (error) {
+                if (error instanceof ClockSkewError) {
+                    fatal ??= error;
+                    break;
+                }
+                status = undefined;
+            }
+            if (stop.signal.aborted)
+                break;
+            if (status === 401) {
+                fatal ??= new DeviceGoneError();
+                break;
+            }
+            if (status === 426) {
+                fatal ??= new Error(OUTDATED);
+                break;
+            }
+            if (status === 409 && !toldInUse) {
+                toldInUse = true;
+                console.error(chalk.yellow("Another 2kw bridge run keeps this computer reachable, or one stopped moments ago. This one takes over when it stops."));
+            }
+            if (status === 200 || status === 204) {
+                backoff = MIN_POLL_MS;
+                // A poll that comes back at once is not held by the server; never spin on it.
+                if (Date.now() - started < MIN_POLL_MS)
+                    await sleep(MIN_POLL_MS, stop.signal);
+                continue;
+            }
+            await sleep(backoff, stop.signal);
+            backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
+        }
+    }
+    finally {
+        timers.forEach(clearInterval);
+        signal.removeEventListener("abort", onAbort);
+        stop.abort();
+        await reporting;
+    }
+    if (fatal !== undefined)
+        throw fatal;
+}
+//# sourceMappingURL=run.js.map

package/dist/bridge/shell.d.ts

@@ -0,0 +1,17 @@
+/** The seams of the bash lookup: the platform, its environment, and which files exist. */
+export interface ShellLookup {
+    platform: NodeJS.Platform;
+    env: NodeJS.ProcessEnv;
+    isFile: (path: string) => boolean;
+}
+/**
+ * Finds the POSIX `bash` device commands run in (#1377, plan P15, spec D7). The `shell` from
+ * bridge.toml wins, and when it does not exist nothing else is taken. Otherwise: on Windows, Git
+ * for Windows in its usual places, then next to the `git` on PATH, then a `bash.exe` on PATH; on
+ * Linux and macOS, `bash` on PATH. The WSL launcher in System32 is never taken: it runs commands
+ * in a Linux distribution, not on this computer's files.
+ */
+export declare function findBash(override: string | undefined, lookup?: ShellLookup): string | null;
+/** The first line of `bash --version`, or null when it does not answer within 2 s. */
+export declare function bashVersion(path: string): Promise<string | null>;
+//# sourceMappingURL=shell.d.ts.map

package/dist/bridge/shell.js

@@ -0,0 +1,48 @@
+import { execFile } from "node:child_process";
+import { statSync } from "node:fs";
+import { posix, win32 } from "node:path";
+function isFile(path) {
+    try {
+        return statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+const defaultLookup = () => ({ platform: process.platform, env: process.env, isFile });
+/**
+ * Finds the POSIX `bash` device commands run in (#1377, plan P15, spec D7). The `shell` from
+ * bridge.toml wins, and when it does not exist nothing else is taken. Otherwise: on Windows, Git
+ * for Windows in its usual places, then next to the `git` on PATH, then a `bash.exe` on PATH; on
+ * Linux and macOS, `bash` on PATH. The WSL launcher in System32 is never taken: it runs commands
+ * in a Linux distribution, not on this computer's files.
+ */
+export function findBash(override, lookup = defaultLookup()) {
+    if (override !== undefined)
+        return lookup.isFile(override) ? override : null;
+    const { platform, env } = lookup;
+    const path = platform === "win32" ? win32 : posix;
+    const dirs = (env.PATH ?? env.Path ?? "").split(path.delimiter).filter((d) => d !== "");
+    const onPath = (file) => dirs.map((d) => path.join(d, file)).filter(lookup.isFile);
+    if (platform !== "win32")
+        return onPath("bash")[0] ?? null;
+    const wsl = path.join(env.SystemRoot ?? "C:\\Windows", "System32", "bash.exe").toLowerCase();
+    const candidates = [
+        env.ProgramFiles && path.join(env.ProgramFiles, "Git", "bin", "bash.exe"),
+        env["ProgramFiles(x86)"] && path.join(env["ProgramFiles(x86)"], "Git", "bin", "bash.exe"),
+        env.LOCALAPPDATA && path.join(env.LOCALAPPDATA, "Programs", "Git", "bin", "bash.exe"),
+        // git.exe sits in <root>\cmd or <root>\bin; bash.exe in <root>\bin.
+        ...onPath("git.exe").map((git) => path.join(path.dirname(path.dirname(git)), "bin", "bash.exe")),
+        ...onPath("bash.exe"),
+    ];
+    return (candidates.find((candidate) => !!candidate && candidate.toLowerCase() !== wsl && lookup.isFile(candidate)) ?? null);
+}
+/** The first line of `bash --version`, or null when it does not answer within 2 s. */
+export function bashVersion(path) {
+    return new Promise((done) => {
+        execFile(path, ["--version"], { timeout: 2_000, windowsHide: true }, (error, stdout) => {
+            done(error ? null : (stdout.split(/\r?\n/)[0]?.trim() ?? null) || null);
+        });
+    });
+}
+//# sourceMappingURL=shell.js.map

package/dist/bridge/store.d.ts

@@ -0,0 +1,33 @@
+import type { KeyObject } from "node:crypto";
+import { CliUsageError } from "../lib/errors.js";
+import type { Jwk } from "../relay-protocol/keys.js";
+import { type BridgeConfig, type Workspace } from "./toml.js";
+/** What a confirmed pairing hands the bridge, plus where it was paired. Never an account token. */
+export interface BridgeIdentity {
+    relayId: string;
+    organizationId: string;
+    ownerMemberId: string;
+    issuer: string;
+    jwks: {
+        keys: Jwk[];
+    };
+    baseUrl: string;
+    name: string;
+    pairedAt: string;
+}
+export declare function writeKey(dir: string, key: KeyObject): void;
+export declare function readKey(dir: string): KeyObject;
+export declare function writeIdentity(dir: string, identity: BridgeIdentity): void;
+/** identity.json is not JSON: `connect` pairs over it, every other command names the file to delete. */
+export declare class UnreadableIdentityError extends CliUsageError {
+    readonly path: string;
+    constructor(path: string);
+}
+/** null when this computer is not connected. */
+export declare function readIdentity(dir: string): BridgeIdentity | null;
+export declare function deleteIdentity(dir: string): void;
+export declare function configPath(dir: string): string;
+export declare function readConfig(dir: string): BridgeConfig;
+export declare function addWorkspace(dir: string, path: string, name?: string): Workspace;
+export declare function removeWorkspace(dir: string, name: string): void;
+//# sourceMappingURL=store.d.ts.map

package/dist/bridge/store.js

@@ -0,0 +1,110 @@
+import { basename, dirname, join, resolve } from "node:path";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { CliUsageError } from "../lib/errors.js";
+import { privateKeyFromPem, privateKeyToPem } from "../relay-protocol/keys.js";
+import { MAX_WORKSPACES, WORKSPACE_NAME, parseBridgeToml, stringifyBridgeToml } from "./toml.js";
+/**
+ * The bridge's three files (#1377, plan P14): `key.pem` and `identity.json`, readable by the user
+ * only, and `bridge.toml`. On Windows the mode bits are inert; the files rely on the profile
+ * directory's own permissions.
+ */
+const KEY_FILE = "key.pem";
+const IDENTITY_FILE = "identity.json";
+const CONFIG_FILE = "bridge.toml";
+function writeSecretFile(path, data) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const tmp = `${path}.tmp`;
+    // Owner-only from the first byte; the rename replaces the old file in one step.
+    writeFileSync(tmp, data, { mode: 0o600 });
+    renameSync(tmp, path);
+    chmodSync(path, 0o600);
+}
+export function writeKey(dir, key) {
+    writeSecretFile(join(dir, KEY_FILE), privateKeyToPem(key));
+}
+export function readKey(dir) {
+    return privateKeyFromPem(readFileSync(join(dir, KEY_FILE), "utf8"));
+}
+export function writeIdentity(dir, identity) {
+    writeSecretFile(join(dir, IDENTITY_FILE), JSON.stringify(identity, null, 2));
+}
+/** identity.json is not JSON: `connect` pairs over it, every other command names the file to delete. */
+export class UnreadableIdentityError extends CliUsageError {
+    path;
+    constructor(path) {
+        super(`${path} is unreadable. Delete ${path}, then run 2kw bridge connect again.`);
+        this.path = path;
+        this.name = "UnreadableIdentityError";
+    }
+}
+/** null when this computer is not connected. */
+export function readIdentity(dir) {
+    const path = join(dir, IDENTITY_FILE);
+    if (!existsSync(path))
+        return null;
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        throw new UnreadableIdentityError(path);
+    }
+}
+export function deleteIdentity(dir) {
+    rmSync(join(dir, IDENTITY_FILE), { force: true });
+}
+export function configPath(dir) {
+    return join(dir, CONFIG_FILE);
+}
+export function readConfig(dir) {
+    const path = configPath(dir);
+    if (!existsSync(path))
+        return { workspaces: [] };
+    try {
+        return parseBridgeToml(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        throw new CliUsageError(`${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function writeConfig(dir, config) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    writeFileSync(configPath(dir), stringifyBridgeToml(config));
+}
+/** The folder name, lowercased, with every character a workspace name cannot hold turned into `-`. */
+function defaultName(path) {
+    return basename(path)
+        .toLowerCase()
+        .replace(/[^a-z0-9._-]+/g, "-")
+        .replace(/^[^a-z0-9]+/, "")
+        .slice(0, 64);
+}
+export function addWorkspace(dir, path, name) {
+    const resolved = resolve(path);
+    if (!existsSync(resolved) || !statSync(resolved).isDirectory()) {
+        throw new CliUsageError(`${resolved} is not an existing folder`);
+    }
+    const workspaceName = name ?? defaultName(resolved);
+    if (!WORKSPACE_NAME.test(workspaceName)) {
+        throw new CliUsageError(`'${workspaceName}' cannot be a workspace name: use 1 to 64 lowercase letters, digits, '.', '_' or '-', ` +
+            "starting with a letter or digit (--name sets it)");
+    }
+    const config = readConfig(dir);
+    if (config.workspaces.length >= MAX_WORKSPACES) {
+        throw new CliUsageError(`This computer already offers ${MAX_WORKSPACES} workspaces, the most it can. Remove one first with 2kw bridge remove <name>.`);
+    }
+    if (config.workspaces.some((w) => w.name === workspaceName)) {
+        throw new CliUsageError(`A workspace named '${workspaceName}' already exists`);
+    }
+    const workspace = { name: workspaceName, path: resolved };
+    writeConfig(dir, { ...config, workspaces: [...config.workspaces, workspace] });
+    return workspace;
+}
+export function removeWorkspace(dir, name) {
+    const config = readConfig(dir);
+    const workspaces = config.workspaces.filter((w) => w.name !== name);
+    if (workspaces.length === config.workspaces.length) {
+        throw new CliUsageError(`No workspace named '${name}'`);
+    }
+    writeConfig(dir, { ...config, workspaces });
+}
+//# sourceMappingURL=store.js.map

package/dist/bridge/toml.d.ts

@@ -0,0 +1,16 @@
+export interface Workspace {
+    name: string;
+    path: string;
+}
+/** bridge.toml: an optional top-level `shell` and `[[workspace]]` tables with `name` and `path`. */
+export interface BridgeConfig {
+    shell?: string;
+    workspaces: Workspace[];
+}
+export declare const WORKSPACE_NAME: RegExp;
+/** The most workspaces the backend takes in one inventory. */
+export declare const MAX_WORKSPACES = 50;
+/** Throws a plain message on anything that is not a bridge.toml this bridge wrote or could have. */
+export declare function parseBridgeToml(text: string): BridgeConfig;
+export declare function stringifyBridgeToml(config: BridgeConfig): string;
+//# sourceMappingURL=toml.d.ts.map

package/dist/bridge/toml.js

@@ -0,0 +1,39 @@
+import { parse, stringify } from "smol-toml";
+export const WORKSPACE_NAME = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+/** The most workspaces the backend takes in one inventory. */
+export const MAX_WORKSPACES = 50;
+/** Throws a plain message on anything that is not a bridge.toml this bridge wrote or could have. */
+export function parseBridgeToml(text) {
+    const raw = parse(text);
+    const shell = raw.shell;
+    if (shell !== undefined && typeof shell !== "string") {
+        throw new Error("shell must be a path");
+    }
+    const tables = raw.workspace ?? [];
+    if (!Array.isArray(tables)) {
+        throw new Error("workspace must be a list of [[workspace]] tables");
+    }
+    if (tables.length > MAX_WORKSPACES) {
+        throw new Error(`at most ${MAX_WORKSPACES} [[workspace]] tables`);
+    }
+    const names = new Set();
+    const workspaces = tables.map((table) => {
+        const { name, path } = (table ?? {});
+        if (typeof name !== "string" || !WORKSPACE_NAME.test(name) || typeof path !== "string" || path === "") {
+            throw new Error("every [[workspace]] needs a valid name and a path");
+        }
+        if (names.has(name))
+            throw new Error(`the workspace name '${name}' is used twice`);
+        names.add(name);
+        return { name, path };
+    });
+    return shell === undefined ? { workspaces } : { shell, workspaces };
+}
+export function stringifyBridgeToml(config) {
+    const doc = {};
+    if (config.shell !== undefined)
+        doc.shell = config.shell;
+    doc.workspace = config.workspaces.map(({ name, path }) => ({ name, path }));
+    return `${stringify(doc)}\n`;
+}
+//# sourceMappingURL=toml.js.map

package/dist/commands/bridge.d.ts

@@ -0,0 +1,7 @@
+import { Command } from "commander";
+/**
+ * `2kw bridge`: lets chat run the commands you approve on this computer (#1377, spec §2.1, plan P14).
+ * S1 pairs, registers and stays present; commands arrive with #1378.
+ */
+export declare function makeBridgeCommand(): Command;
+//# sourceMappingURL=bridge.d.ts.map

package/dist/commands/bridge.js

@@ -0,0 +1,228 @@
+import chalk from "chalk";
+import { Command } from "commander";
+import { LABEL, collectInventory, deviceName, deviceOs } from "../bridge/inventory.js";
+import { DeviceGoneError, awaitConfirmation, disconnectDevice, redeem, reportInventory } from "../bridge/pairing.js";
+import { bridgeDir } from "../bridge/paths.js";
+import { runBridge } from "../bridge/run.js";
+import { findBash } from "../bridge/shell.js";
+import { addWorkspace, configPath, deleteIdentity, readConfig, readIdentity, readKey, removeWorkspace, UnreadableIdentityError, writeIdentity, writeKey, } from "../bridge/store.js";
+import { getClient, runAction } from "../lib/client.js";
+import { DEFAULT_BASE_URL, getActiveContext, isJsonOutput } from "../lib/config.js";
+import { CliUsageError } from "../lib/errors.js";
+import { formatList, formatSuccess } from "../lib/output.js";
+import { generatePrivateKey } from "../relay-protocol/keys.js";
+/** Account endpoints take a browser sign-in; said where `--help` shows it, as in connectors.ts. */
+const SESSION_ONLY = "Signed-in accounts only: run 2kw auth login and sign in through the browser";
+/** The backend to pair with: `--base-url`, then AI_2KW_BASE_URL, the active context, the default. No credential needed. */
+function baseUrlOf(command) {
+    let root = command;
+    while (root.parent)
+        root = root.parent;
+    const url = root.opts().baseUrl ?? process.env.AI_2KW_BASE_URL ?? getActiveContext()?.baseUrl;
+    return (url ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+}
+/** Plain http only to this computer: the pairing answer carries the keys the bridge trusts. */
+function requireHttps(baseUrl) {
+    const { protocol, hostname } = new URL(baseUrl);
+    if (protocol === "https:" || (protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(hostname))) {
+        return baseUrl;
+    }
+    throw new CliUsageError(`${baseUrl} is not an https address. The bridge connects only over https, or over http to this computer (localhost).`);
+}
+function checkLabel(value, what) {
+    if (!LABEL.test(value)) {
+        throw new CliUsageError(`${what} must be 1 to 64 characters on one line, without control or invisible characters`);
+    }
+    return value;
+}
+/** Loads the key and identity of a connected computer, or says how to connect one. */
+function connected(dir) {
+    const identity = readIdentity(dir);
+    if (identity === null) {
+        throw new CliUsageError("This computer is not connected. Run 2kw bridge connect <code> with the code from chat.");
+    }
+    return { identity, key: readKey(dir) };
+}
+/**
+ * `2kw bridge`: lets chat run the commands you approve on this computer (#1377, spec §2.1, plan P14).
+ * S1 pairs, registers and stays present; commands arrive with #1378.
+ */
+export function makeBridgeCommand() {
+    const cmd = new Command("bridge").description("Connect this computer to chat, so commands you approve in a conversation can run here");
+    cmd
+        .command("connect")
+        .description("Connect this computer with the code shown in chat under Devices")
+        .argument("<code>", "Pairing code from chat (bbp_…)")
+        .option("--name <name>", "Name chat shows for this computer; the computer name when omitted")
+        .action(async (code, opts, command) => {
+        await runAction(command, async () => {
+            const dir = bridgeDir();
+            let existing;
+            try {
+                existing = readIdentity(dir);
+            }
+            catch (error) {
+                if (!(error instanceof UnreadableIdentityError))
+                    throw error;
+                console.error(chalk.yellow(`${error.path} is unreadable; this pairing replaces it once you confirm.`));
+                existing = null;
+            }
+            if (existing !== null) {
+                throw new CliUsageError(`This computer is already connected as '${existing.name}'. Run 2kw bridge disconnect first.`);
+            }
+            const baseUrl = requireHttps(baseUrlOf(command));
+            const name = checkLabel(opts.name ?? deviceName(), "--name");
+            const key = generatePrivateKey();
+            const redeemed = await redeem(baseUrl, key, code.trim(), name, deviceOs());
+            console.log(`Check that chat shows these six words for '${name}':\n`);
+            console.log(`    ${chalk.bold(redeemed.fingerprint.join(" "))}\n`);
+            console.log("If they match, confirm in chat. If they do not, do not confirm. Waiting…");
+            const confirmed = await awaitConfirmation(baseUrl, key, redeemed);
+            if (confirmed === null) {
+                throw new Error("The code expired before it was confirmed. Create a new one in chat and run this again.");
+            }
+            const identity = { ...confirmed, baseUrl, name, pairedAt: new Date().toISOString() };
+            writeKey(dir, key);
+            writeIdentity(dir, identity);
+            try {
+                await reportInventory(identity, key, await collectInventory(readConfig(dir)));
+            }
+            catch (error) {
+                // Paired all the same; `2kw bridge run` reports again when it starts.
+                console.error(chalk.yellow(`Could not send this computer's folders yet: ${String(error)}`));
+            }
+            formatSuccess(`Connected as '${name}'. Add folders with 2kw bridge add <path>, then keep 2kw bridge run open.`, command);
+        });
+    });
+    cmd
+        .command("add")
+        .description("Make a folder on this computer available as a workspace")
+        .argument("<path>", "An existing folder")
+        .option("--name <name>", "Workspace name; the folder name when omitted")
+        .action(async (path, opts, command) => {
+        await runAction(command, async () => {
+            const workspace = addWorkspace(bridgeDir(), path, opts.name);
+            formatSuccess(`Added workspace '${workspace.name}' (${workspace.path}).`, command);
+        });
+    });
+    cmd
+        .command("remove")
+        .description("Stop offering a workspace; the folder itself is untouched")
+        .argument("<name>", "Workspace name, from 2kw bridge list")
+        .action(async (name, _opts, command) => {
+        await runAction(command, async () => {
+            removeWorkspace(bridgeDir(), name);
+            formatSuccess(`Removed workspace '${name}'.`, command);
+        });
+    });
+    cmd
+        .command("list")
+        .description("Show whether this computer is connected, its shell and its workspaces")
+        .action(async (_opts, command) => {
+        await runAction(command, async () => {
+            const dir = bridgeDir();
+            const identity = readIdentity(dir);
+            const config = readConfig(dir);
+            const shell = findBash(config.shell);
+            if (isJsonOutput(command)) {
+                console.log(JSON.stringify({ connected: identity !== null, name: identity?.name, deviceId: identity?.relayId, shell, workspaces: config.workspaces }, null, 2));
+                return;
+            }
+            console.log(identity === null
+                ? "Not connected. Run 2kw bridge connect <code> with the code from chat."
+                : `Connected as '${identity.name}' to ${identity.baseUrl} (device ${identity.relayId}).`);
+            if (shell !== null) {
+                console.log(`Shell: ${shell}`);
+            }
+            else if (config.shell !== undefined) {
+                console.log(chalk.yellow(`The shell set in ${configPath(dir)} does not exist: ${config.shell}`));
+            }
+            else {
+                console.log(chalk.yellow(process.platform === "win32"
+                    ? "No bash found: install Git for Windows, or set shell = \"<path to bash.exe>\" in " + configPath(dir)
+                    : "No bash found on PATH: install bash, or set shell = \"<path>\" in " + configPath(dir)));
+            }
+            if (config.workspaces.length === 0) {
+                console.log("No workspaces. Add one with 2kw bridge add <path>.");
+            }
+            else {
+                formatList(config.workspaces, command, ["name", "path"]);
+            }
+        });
+    });
+    cmd
+        .command("run")
+        .description("Keep this computer reachable from chat while this command runs (Ctrl+C stops)")
+        .action(async (_opts, command) => {
+        await runAction(command, async () => {
+            const dir = bridgeDir();
+            const { identity, key } = connected(dir);
+            requireHttps(identity.baseUrl);
+            const stop = new AbortController();
+            const onSignal = () => stop.abort();
+            process.once("SIGINT", onSignal);
+            process.once("SIGTERM", onSignal);
+            console.log(`'${identity.name}' is reachable from chat while this runs. Press Ctrl+C to stop.`);
+            try {
+                await runBridge(dir, identity, key, stop.signal);
+            }
+            catch (error) {
+                // Revoked: these files can never authenticate again.
+                if (error instanceof DeviceGoneError)
+                    deleteIdentity(dir);
+                throw error;
+            }
+            finally {
+                process.off("SIGINT", onSignal);
+                process.off("SIGTERM", onSignal);
+            }
+        });
+    });
+    cmd
+        .command("disconnect")
+        .description("Disconnect this computer; chat can no longer reach it")
+        .action(async (_opts, command) => {
+        await runAction(command, async () => {
+            const dir = bridgeDir();
+            const { identity, key } = connected(dir);
+            try {
+                await disconnectDevice(identity, key);
+            }
+            catch (error) {
+                // Already revoked elsewhere: forgetting it here is all that is left to do.
+                if (!(error instanceof DeviceGoneError))
+                    throw error;
+            }
+            deleteIdentity(dir);
+            formatSuccess(`Disconnected '${identity.name}'.`, command);
+        });
+    });
+    cmd
+        .command("devices")
+        .description(`List the computers connected to your account. ${SESSION_ONLY}`)
+        .option("--all", "Every computer in the organization, without its folders (admins only)")
+        .action(async (opts, command) => {
+        await runAction(command, async () => {
+            const client = getClient(command);
+            const { data } = await client.GET("/v1/local-bridge/devices", {
+                params: { query: opts.all ? { all: true } : {} },
+            });
+            formatList(data, command, opts.all
+                ? ["id", "name", "ownerMemberId", "os", "status", "lastSeenAt"]
+                : ["id", "name", "os", "status", "lastSeenAt", "workspaces"]);
+        });
+    });
+    cmd
+        .command("revoke")
+        .description(`Disconnect one of your computers; an admin can disconnect any. ${SESSION_ONLY}`)
+        .argument("<deviceId>", "Device ID, from 2kw bridge devices")
+        .action(async (deviceId, _opts, command) => {
+        await runAction(command, async () => {
+            const client = getClient(command);
+            await client.DELETE("/v1/local-bridge/devices/{id}", { params: { path: { id: deviceId } } });
+            formatSuccess(`Device ${deviceId} disconnected.`, command);
+        });
+    });
+    return cmd;
+}
+//# sourceMappingURL=bridge.js.map