@bahulam/code 0.1.1 → 0.1.3

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may accept and charge a
+      fee for acceptance of support, warranty, indemnity, or other liability
+      obligations and/or rights consistent with this License. However, in
+      accepting such obligations, You may act only on Your own behalf and on
+      Your sole responsibility, not on behalf of any other Contributor, and
+      only if You agree to indemnify, defend, and hold each Contributor
+      harmless for any liability incurred by, or claims asserted against,
+      such Contributor by reason of your accepting any such warranty or
+      additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 axplusb.tech
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,39 @@
+Bahulam Code
+Copyright 2026 axplusb.tech
+
+This product includes software developed by axplusb.tech
+(https://axplusb.tech).
+
+------------------------------------------------------------------------
+Upstream and third-party attribution
+------------------------------------------------------------------------
+
+The CLI runtime derives, in part, from the open-source open-claude-code
+project. Original work bears its own copyright and license terms; those
+files remain governed by their upstream licenses, and any modifications
+to them by axplusb.tech are additionally licensed under Apache License,
+Version 2.0 as declared in the LICENSE file at the root of this project.
+
+The Bahulam runtime bundle (@bahulam/runtime-<platform>-<arch>) ships
+with a PyArmor-obfuscated Python payload that is proprietary to
+axplusb.tech and is NOT covered by the Apache License. It is distributed
+under a separate end-user license embedded in the runtime as a signed
+license JWT. Use of the runtime requires accepting that license.
+
+Third-party npm dependencies listed in package.json are the property of
+their respective owners and are used under the terms of the licenses
+they publish. See the individual package license files under
+node_modules/*/LICENSE for the specific terms of each dependency.
+
+------------------------------------------------------------------------
+Trademarks
+------------------------------------------------------------------------
+
+"Bahulam", the Bahulam wordmark, the ∞ mark, and "Orca" are trademarks
+of axplusb.tech. The Apache License, Section 6, does not grant permission
+to use these names, marks, or logos, except as required to describe the
+origin of the software or to reproduce the content of this NOTICE file.
+
+Forks and derivative works must select a distinct name and mark; the
+Bahulam and Orca marks may not be used to name, brand, or promote any
+derivative or competing distribution without prior written permission.

package/package.json

@@ -1,16 +1,19 @@
 {
   "name": "@bahulam/code",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Bahulam Code \u2014 abundance, in your terminal. CLI-first, reliability-first, sub-agents, 65.6% SWE-bench Verified.",
   "type": "module",
   "bin": {
     "bahulam": "src/terminal/main.mjs",
-    "bahulam-code": "src/terminal/main.mjs"
+    "bahulam-code": "src/terminal/main.mjs",
+    "bahulamd": "src/terminal/main.mjs"
   },
   "files": [
     "src/",
     "pulse/",
-    "README.md"
+    "README.md",
+    "LICENSE",
+    "NOTICE"
   ],
   "scripts": {
     "start": "node src/terminal/main.mjs",
@@ -36,7 +39,7 @@
     "gemini",
     "axplusb"
   ],
-  "license": "MIT",
+  "license": "Apache-2.0",
   "author": "axplusb.tech <hello@axplusb.tech>",
   "homepage": "https://bahulam.ai/code",
   "repository": {
@@ -48,9 +51,5 @@
     "tree-sitter-wasms": "^0.1.13",
     "web-tree-sitter": "^0.26.9"
   },
-  "optionalDependencies": {
-    "@bahulam/runtime-darwin-arm64": "0.1.1",
-    "@bahulam/runtime-linux-x64": "0.1.1",
-    "@bahulam/runtime-win32-x64": "0.1.1"
-  }
+  "optionalDependencies": {}
 }

package/pulse/lib/tool-categories.ts

@@ -11,13 +11,20 @@ export type ToolCategory =
 
 export const TOOL_CATEGORIES: Record<string, ToolCategory> = {
   Read:           'file-io',
+  read_file:      'file-io',
   Write:          'file-io',
+  write_file:     'file-io',
   Edit:           'file-io',
+  edit_file:      'file-io',
   Glob:           'file-io',
+  list_files:     'file-io',
   Grep:           'file-io',
+  search_code:    'file-io',
+  search_files:   'file-io',
   NotebookEdit:   'file-io',
 
   Bash:           'shell',
+  shell:          'shell',
 
   Task:           'agent',
   TaskCreate:     'agent',
@@ -58,10 +65,16 @@ export const CATEGORY_COLORS: Record<ToolCategory, string> = {
 /** Per-tool bar colors so Read / Write / Edit / … stay distinct on project cards */
 const TOOL_BAR_OVERRIDES: Record<string, string> = {
   Read:         'var(--viz-tool-read)',
+  read_file:    'var(--viz-tool-read)',
   Write:        'var(--viz-tool-write)',
+  write_file:   'var(--viz-tool-write)',
   Edit:         'var(--viz-tool-edit)',
+  edit_file:    'var(--viz-tool-edit)',
   Grep:         'var(--viz-tool-grep)',
+  search_code:  'var(--viz-tool-grep)',
+  search_files: 'var(--viz-tool-grep)',
   Glob:         'var(--viz-tool-glob)',
+  list_files:   'var(--viz-tool-glob)',
   NotebookEdit: 'var(--viz-tool-edit)',
 }
 

package/src/commands/device.mjs

@@ -0,0 +1,121 @@
+/**
+ * Device inventory and revocation.
+ *
+ *   bahulam device list             List all paired devices for this user.
+ *   bahulam device revoke <id>      Revoke a device (kill switch).
+ *                                    Revoked devices are dropped within *                                    revoking itself remotely.
+ *
+ *   bahulam device whoami           Print this device's registered id +
+ *                                    pubkey (for cross-checking with
+ *                                    `bahulam device list`).
+ */
+
+import { TarangAuth } from '../auth/tarang-auth.mjs';
+
+const GATEWAY = (process.env.BAHULAM_GATEWAY_URL || 'https://gateway.bahulam.ai').replace(/\/+$/, '').replace(/\/v1$/, '');
+const RESET = '\x1b[0m';
+const BOLD = '\x1b[1m';
+const DIM = '\x1b[2m';
+const RED = '\x1b[31m';
+const GREEN = '\x1b[32m';
+const YELLOW = '\x1b[33m';
+
+export async function runDeviceCommand(args = []) {
+  const sub = (args[0] || '').toLowerCase();
+  const auth = new TarangAuth();
+  const creds = auth.loadCredentials();
+  if (!creds.token) {
+    process.stderr.write(`${RED}Not logged in. Run ${BOLD}bahulam login${RESET}${RED} first.${RESET}\n`);
+    return 1;
+  }
+
+  if (sub === 'list')   return await _list(creds.token, auth);
+  if (sub === 'revoke') return await _revoke(creds.token, args[1], auth);
+  if (sub === 'whoami') return _whoami(auth);
+
+  process.stderr.write(`${BOLD}bahulam device${RESET} ${DIM}— list and revoke paired devices${RESET}\n\n`);
+  process.stderr.write(`  bahulam device list             List paired devices\n`);
+  process.stderr.write(`  bahulam device revoke <id>      Revoke a device (kill switch)\n`);
+  process.stderr.write(`  bahulam device whoami           Show this device's registered id\n`);
+  return 1;
+}
+
+async function _list(token, auth) {
+  try {
+    const res = await fetch(`${GATEWAY}/v1/devices`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => '');
+      process.stderr.write(`${RED}Failed to list devices (${res.status}): ${body}${RESET}\n`);
+      return 1;
+    }
+    const { devices } = await res.json();
+    if (!devices || devices.length === 0) {
+      process.stderr.write(`${DIM}No paired devices.${RESET}\n`);
+      return 0;
+    }
+    const self = auth.getRawConfig()?.pairing?.device_id || '';
+    process.stderr.write(`\n${BOLD}${devices.length} device(s)${RESET}\n`);
+    for (const d of devices) {
+      const badge = d.device_id === self ? ` ${GREEN}(this)${RESET}` : '';
+      const status = d.status === 'active' ? GREEN + 'active' + RESET : RED + 'revoked' + RESET;
+      const seen = d.last_seen_at ? `last seen ${d.last_seen_at}` : `paired ${d.created_at}`;
+      process.stderr.write(`  ${d.device_id}${badge}  ${status}  ${BOLD}${d.name}${RESET}  ${DIM}${seen}${RESET}\n`);
+    }
+    process.stderr.write('\n');
+    return 0;
+  } catch (err) {
+    process.stderr.write(`${RED}Network error: ${err.message}${RESET}\n`);
+    return 1;
+  }
+}
+
+async function _revoke(token, deviceId, auth) {
+  if (!deviceId) {
+    process.stderr.write(`Usage: ${BOLD}bahulam device revoke <device_id>${RESET}\n`);
+    process.stderr.write(`${DIM}Run ${BOLD}bahulam device list${RESET}${DIM} to see ids.${RESET}\n`);
+    return 1;
+  }
+  try {
+    const res = await fetch(`${GATEWAY}/v1/devices/revoke`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ device_id: deviceId }),
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => '');
+      process.stderr.write(`${RED}Revoke failed (${res.status}): ${body}${RESET}\n`);
+      return 1;
+    }
+    process.stderr.write(`${GREEN}✓ revoked${RESET} ${deviceId}\n`);
+    // If revoking self, clear local pairing so the daemon doesn't keep
+    // trying to reconnect with a dead key.
+    const self = auth.getRawConfig()?.pairing?.device_id;
+    if (self === deviceId) {
+      auth.saveCredentials({
+        pairing: null,
+        remote: { ...(auth.getRawConfig()?.remote || {}), enabled: false },
+      });
+      process.stderr.write(`${YELLOW}⚠ this was THIS device; local pairing + remote both cleared.${RESET}\n`);
+    }
+    process.stderr.write(`${DIM}Relay drops the revoked connection within one heartbeat.${RESET}\n\n`);
+    return 0;
+  } catch (err) {
+    process.stderr.write(`${RED}Network error: ${err.message}${RESET}\n`);
+    return 1;
+  }
+}
+
+function _whoami(auth) {
+  const p = auth.getRawConfig()?.pairing;
+  if (!p?.device_id) {
+    process.stderr.write(`${DIM}not paired.${RESET} Run ${BOLD}bahulam pair get-code${RESET}${DIM} on this device.${RESET}\n`);
+    return 0;
+  }
+  process.stderr.write(`  ${DIM}device_id:${RESET} ${p.device_id}\n`);
+  process.stderr.write(`  ${DIM}name:${RESET}      ${p.device_name}\n`);
+  process.stderr.write(`  ${DIM}pubkey:${RESET}    ${(p.pubkey_base64 || '').slice(0, 32)}…\n`);
+  process.stderr.write(`  ${DIM}paired_at:${RESET} ${p.paired_at}\n`);
+  return 0;
+}

package/src/commands/pair.mjs

@@ -0,0 +1,190 @@
+/**
+ * Device pairing — pair this laptop with a phone or another device
+ * for remote session monitoring.
+ *
+ * Two directions:
+ *
+ *   bahulam pair get-code [name]      Generate a fresh 6-digit code. *
+ * Two directions:
+ *
+ *   bahulam pair get-code [name]      Ask the gateway for a fresh 6-digit
+ *                                     code + expiry, print it. Give this
+ *                                     to a NEW device (phone, other laptop)
+ *                                     that will run `bahulam pair` with it.
+ *
+ *   bahulam pair <code>               Register THIS device by claiming the
+ *                                     code. Generates a per-device Ed25519
+ *                                     keypair, POSTs to /v1/devices/pair,
+ *                                     stashes the returned device_id +
+ *                                     peer pubkeys in ~/.bahulam/config.json.
+ *
+ * Storage (config.json.pairing):
+ *   { device_id, device_name, private_key, public_key, paired_at,
+ *     peer_pubkeys: { device_id: pubkey_base64, ... } }
+ *
+ * The private key never leaves the device. Key format is PEM (Node's
+ * default for generateKeyPair) so we don't need any conversion library.
+ */
+
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import { generateKeyPairSync, createPrivateKey, createPublicKey } from 'node:crypto';
+import { promisify } from 'node:util';
+import { TarangAuth } from '../auth/tarang-auth.mjs';
+
+const GATEWAY = (process.env.BAHULAM_GATEWAY_URL || 'https://gateway.bahulam.ai').replace(/\/+$/, '').replace(/\/v1$/, '');
+const RESET = '\x1b[0m';
+const BOLD = '\x1b[1m';
+const DIM = '\x1b[2m';
+const RED = '\x1b[31m';
+const GREEN = '\x1b[32m';
+const YELLOW = '\x1b[33m';
+const CYAN = '\x1b[36m';
+
+export async function runPairCommand(args = []) {
+  const auth = new TarangAuth();
+  const creds = auth.loadCredentials();
+  if (!creds.token) {
+    process.stderr.write(`${RED}Not logged in. Run ${BOLD}bahulam login${RESET}${RED} first.${RESET}\n`);
+    return 1;
+  }
+
+  const sub = (args[0] || '').toLowerCase();
+  if (sub === 'get-code') {
+    return await _getCode(creds.token, args[1]);
+  }
+  if (sub === 'status') {
+    return _status(auth);
+  }
+  if (/^\d{6}$/.test(sub)) {
+    return await _claimCode(creds.token, sub, args[1] || _defaultDeviceName(), auth);
+  }
+  _usage();
+  return 1;
+}
+
+function _usage() {
+  process.stderr.write(`${BOLD}bahulam pair${RESET} ${DIM}— pair a device for remote monitoring${RESET}\n\n`);
+  process.stderr.write(`  bahulam pair get-code [name]     Get a 6-digit code (share with new device)\n`);
+  process.stderr.write(`  bahulam pair <code> [name]       Register THIS device using a 6-digit code\n`);
+  process.stderr.write(`  bahulam pair status              Show current pairing state\n`);
+}
+
+async function _getCode(token, deviceName) {
+  const name = deviceName || _defaultDeviceName();
+  try {
+    const res = await fetch(`${GATEWAY}/v1/devices/code`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ device_name: name }),
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => '');
+      process.stderr.write(`${RED}Failed to get code (${res.status}): ${body}${RESET}\n`);
+      return 1;
+    }
+    const { code, expires_at } = await res.json();
+    process.stderr.write(`\n  ${CYAN}${BOLD}${code}${RESET}\n\n`);
+    process.stderr.write(`  ${DIM}Enter this code on the other device with:${RESET}\n`);
+    process.stderr.write(`    ${BOLD}bahulam pair ${code}${RESET}\n`);
+    process.stderr.write(`  ${DIM}Or at ${GATEWAY.replace('gateway.', 'pair.')} (until ${expires_at})${RESET}\n\n`);
+    return 0;
+  } catch (err) {
+    process.stderr.write(`${RED}Network error: ${err.message}${RESET}\n`);
+    return 1;
+  }
+}
+
+async function _claimCode(token, code, name, auth) {
+  // Generate a per-device Ed25519 keypair. Node's built-in — no npm dep.
+  const { publicKey, privateKey } = generateKeyPairSync('ed25519', {
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+  });
+  const pubkeyBase64 = _pemPubkeyToBase64Raw(publicKey);
+
+  try {
+    const res = await fetch(`${GATEWAY}/v1/devices/pair`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        code,
+        device_pubkey: pubkeyBase64,
+        device_name: name,
+      }),
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => '');
+      process.stderr.write(`${RED}Pairing failed (${res.status}): ${body}${RESET}\n`);
+      process.stderr.write(`${DIM}The code may be invalid, expired, or already claimed.${RESET}\n`);
+      return 1;
+    }
+    const { device_id, peer_pubkeys } = await res.json();
+
+    auth.saveCredentials({
+      pairing: {
+        device_id,
+        device_name: name,
+        private_key: privateKey,
+        public_key: publicKey,
+        pubkey_base64: pubkeyBase64,
+        paired_at: new Date().toISOString(),
+        peer_pubkeys: peer_pubkeys || {},
+      },
+    });
+
+    process.stderr.write(`\n${GREEN}✓ device paired${RESET}\n`);
+    process.stderr.write(`  ${DIM}id:${RESET}    ${device_id}\n`);
+    process.stderr.write(`  ${DIM}name:${RESET}  ${name}\n`);
+    const peers = Object.keys(peer_pubkeys || {});
+    process.stderr.write(`  ${DIM}peers:${RESET} ${peers.length}${peers.length ? ` (${peers.join(', ')})` : ''}\n`);
+    process.stderr.write(`\n  ${DIM}Next: ${BOLD}bahulam remote enable${RESET}${DIM} to connect this device to the relay.${RESET}\n\n`);
+    return 0;
+  } catch (err) {
+    process.stderr.write(`${RED}Network error: ${err.message}${RESET}\n`);
+    return 1;
+  }
+}
+
+function _status(auth) {
+  const config = auth.getRawConfig();
+  const p = config.pairing;
+  if (!p || !p.device_id) {
+    process.stderr.write(`${DIM}not paired. Run ${BOLD}bahulam pair get-code${RESET}${DIM} on this device or ${BOLD}bahulam pair <code>${RESET}${DIM} with a code from another.${RESET}\n`);
+    return 0;
+  }
+  process.stderr.write(`\n${BOLD}pairing${RESET}\n`);
+  process.stderr.write(`  ${DIM}id:${RESET}    ${p.device_id}\n`);
+  process.stderr.write(`  ${DIM}name:${RESET}  ${p.device_name}\n`);
+  process.stderr.write(`  ${DIM}since:${RESET} ${p.paired_at}\n`);
+  const peers = Object.keys(p.peer_pubkeys || {});
+  process.stderr.write(`  ${DIM}peers:${RESET} ${peers.length}${peers.length ? ` (${peers.join(', ')})` : ''}\n\n`);
+  return 0;
+}
+
+// ── helpers ──────────────────────────────────────────────────────────
+
+function _defaultDeviceName() {
+  const user = process.env.USER || process.env.USERNAME || 'user';
+  const host = (process.env.HOSTNAME || os.hostname() || 'host').split('.')[0];
+  return `${user}@${host}`;
+}
+
+// Convert a Node-exported Ed25519 PEM pubkey to the raw 32-byte base64
+// form the gateway stores. Node ships it wrapped in an SPKI DER; we
+// strip the SPKI header prefix to get the raw pubkey bytes.
+// SPKI Ed25519 header: 30 2a 30 05 06 03 2b 65 70 03 21 00 (12 bytes),
+// followed by the 32-byte raw pubkey.
+function _pemPubkeyToBase64Raw(pemStr) {
+  const derBase64 = pemStr
+    .replace(/-----BEGIN PUBLIC KEY-----/, '')
+    .replace(/-----END PUBLIC KEY-----/, '')
+    .replace(/\s+/g, '');
+  const der = Buffer.from(derBase64, 'base64');
+  // Strip the 12-byte SPKI Ed25519 header. If length isn't 44 (12+32),
+  // fall back to sending the full DER base64 — the gateway just stores
+  // it opaquely — the raw-vs-SPKI decision is a future
+  // (session key wrap) concern anyway.
+  if (der.length === 44) return der.slice(12).toString('base64');
+  return derBase64;
+}