@mycadet/cli 0.0.1 → 0.12.6-dev.202610072225.d7acd73

package/src/commands/confirm.ts

@@ -0,0 +1,144 @@
+/**
+ * `cadet confirm <assistant> --request-id <id> --decision allow|deny`
+ *
+ * Resolve a pending tool confirmation on a running assistant via its
+ * runtime HTTP API. The assistant raises a `confirmation_request` event
+ * (with a `requestId`) when a tool exceeds the auto-approve risk
+ * threshold; this command answers it so the turn can proceed. Headless
+ * automation (e.g. the evals harness) uses it to approve requests that
+ * would otherwise hang waiting for an interactive user.
+ */
+
+import { extractFlag } from "../lib/arg-utils.js";
+import { AssistantClient } from "../lib/assistant-client.js";
+
+function printUsage(): void {
+  console.log(`cadet confirm - Resolve a pending tool confirmation
+
+USAGE:
+    cadet confirm [assistant] --request-id <id> [--decision allow|deny]
+
+ARGUMENTS:
+    [assistant]    Instance name (default: active assistant)
+
+OPTIONS:
+    --request-id <id>     The requestId from the confirmation_request event (required)
+    --decision <value>    allow or deny (default: allow)
+    --json                Output raw JSON response
+
+EXAMPLES:
+    cadet confirm --request-id ede263d9-cc45-4d63-86f8-a656d17b3a3a
+    cadet confirm my-assistant --request-id req-1 --decision deny
+    cadet confirm --json --request-id req-1
+`);
+}
+
+interface ParsedConfirmArgs {
+  assistantId?: string;
+  requestId: string;
+  decision: "allow" | "deny";
+  jsonOutput: boolean;
+}
+
+type ParseResult =
+  | { ok: true; value: ParsedConfirmArgs }
+  | { ok: false; error: string };
+
+/**
+ * Parse `cadet confirm` arguments. Pure: does no I/O and never exits, so the
+ * positional/flag rules can be unit-tested. Defaults the decision to `allow`,
+ * which is the common automation case (approve and continue).
+ */
+export function parseConfirmArgs(rawArgs: string[]): ParseResult {
+  const jsonOutput = rawArgs.includes("--json");
+  let args = rawArgs.filter((a) => a !== "--json");
+
+  const requestIdFlagPresent = args.includes("--request-id");
+  const [requestId, afterRequestId] = extractFlag(args, "--request-id");
+  args = afterRequestId;
+
+  const decisionFlagPresent = args.includes("--decision");
+  const [decisionRaw, afterDecision] = extractFlag(args, "--decision");
+  args = afterDecision;
+
+  // `extractFlag` strips a trailing value-less flag, which would otherwise let
+  // the next positional masquerade as the flag's value (or, for --decision,
+  // silently fall back to "allow" and approve a tool call the caller never
+  // meant to approve). Treat a flag supplied without a value as an error.
+  if (requestIdFlagPresent && requestId === undefined) {
+    return { ok: false, error: "--request-id requires a value." };
+  }
+  if (!requestId) {
+    return { ok: false, error: "--request-id is required." };
+  }
+
+  if (decisionFlagPresent && decisionRaw === undefined) {
+    return {
+      ok: false,
+      error: '--decision requires a value ("allow" or "deny").',
+    };
+  }
+  const decision = decisionRaw ?? "allow";
+  if (decision !== "allow" && decision !== "deny") {
+    return {
+      ok: false,
+      error: `--decision must be "allow" or "deny" (got "${decision}").`,
+    };
+  }
+
+  if (args.length >= 2) {
+    return { ok: false, error: "unexpected extra arguments." };
+  }
+
+  return {
+    ok: true,
+    value: { assistantId: args[0], requestId, decision, jsonOutput },
+  };
+}
+
+function exitWithUsage(error: string): never {
+  console.error(`Error: ${error}`);
+  console.error("");
+  printUsage();
+  process.exit(1);
+}
+
+export async function confirm(): Promise<void> {
+  const rawArgs = process.argv.slice(3);
+
+  if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
+    printUsage();
+    return;
+  }
+
+  const parsed = parseConfirmArgs(rawArgs);
+  if (!parsed.ok) {
+    exitWithUsage(parsed.error);
+  }
+
+  const { assistantId, requestId, decision, jsonOutput } = parsed.value;
+
+  const client = new AssistantClient({ assistantId });
+
+  const response = await client.post("/confirm", { requestId, decision });
+
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    console.error(
+      `Error: HTTP ${response.status}: ${body || response.statusText}`,
+    );
+    process.exit(1);
+  }
+
+  const result = (await response.json()) as { accepted: boolean };
+
+  if (jsonOutput) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log(
+      result.accepted
+        ? `Confirmation resolved (${decision})`
+        : `Confirmation not accepted`,
+    );
+  }
+}

package/src/commands/connect/import.ts

@@ -0,0 +1,292 @@
+/**
+ * `cadet connect import <address> [--name <localname>]`
+ *
+ * Pair this machine with an assistant running elsewhere and register it
+ * locally so `cadet client`/`message`/`events <name>` work against it. The
+ * device-code exchange, the lockfile write, and the token write live in
+ * `pairingStart`/`pairingPoll` (`@mycadet/local-mode`); this command owns the
+ * argv parsing, the polling cadence, and the output copy.
+ */
+
+import {
+  checkPairedAssistantName,
+  connectImport as importLegacyBundle,
+  pairingCancel,
+  pairingPoll,
+  pairingStart,
+  resolveConfigDir,
+} from "@mycadet/local-mode";
+import { isRetryablePairingReason } from "@mycadet/service-contracts/remote-web-pairing";
+
+import { extractFlag } from "../../lib/arg-utils.js";
+import { getLockfilePaths } from "../../lib/environments/paths.js";
+import { getCurrentEnvironment } from "../../lib/environments/resolve.js";
+import { STALE_CLI_UPDATE_HINT } from "../../lib/stale-cli-hint.js";
+
+function printUsage(): void {
+  console.log(`cadet connect import - Pair with an assistant running on another machine
+
+USAGE:
+    cadet connect import <address> [options]
+
+Registers the assistant at <address> on this machine: a lockfile entry plus a
+guardian token, both under the local name below. The pairing is a device of
+its own on the host, listed and separately revocable there.
+
+<address> is either form of pairing artifact:
+
+    A pairing link from 'cadet pair' (or the host's Pair a device card). It
+    carries an approved device code, so the import completes right away.
+
+    The assistant's public https address, e.g. https://your-assistant.ts.net.
+    This machine mints its own pairing code, prints it, and polls until the
+    code is approved on the host with 'cadet pair --web-approve <code>' or
+    expires (10 minutes). Ctrl-C cancels the attempt. A temporary network
+    failure is retried until then rather than ending the attempt.
+
+ARGUMENTS:
+    <address>       A pairing link or the assistant's https address. https
+                    only; loopback, private-network, and tunnel-provider
+                    website addresses are refused.
+
+OPTIONS:
+    --name <name>   Local name to register the assistant under, slugified for
+                    the id (default: paired-<assistant host>). An existing
+                    local assistant of that name is never overwritten;
+                    re-importing the same host updates its entry.
+
+EXAMPLES:
+    cadet connect import "https://your-assistant.ts.net/assistant/pair#device_code=abc123"
+    cadet connect import https://your-assistant.ts.net
+    cadet connect import https://your-assistant.ts.net --name desk
+`);
+}
+
+/** Caps a retry backoff so a long attempt still polls on a useful cadence. */
+const MAX_RETRY_BACKOFF_SECONDS = 30;
+
+/**
+ * The single place a local registration refusal becomes output. A 409 is a
+ * name collision, so it carries the "pick another name" guidance whether it
+ * came from the pre-check below or from the import itself.
+ */
+function formatImportFailure(status: number, error: string): string {
+  return status === 409
+    ? `Error: ${error} locally. Choose a different --name to avoid overwriting it.`
+    : `Error: ${error}`;
+}
+
+/** The shared success output of both import paths. */
+function reportImported(result: {
+  assistantId: string;
+  updated: boolean;
+  accessOnly: boolean;
+}): void {
+  console.log(
+    `${result.updated ? "Updated" : "Imported"} paired assistant '${result.assistantId}'.`,
+  );
+  console.log("");
+  console.log(`  Connect with:  cadet client ${result.assistantId}`);
+  console.log("");
+  console.log(
+    result.accessOnly
+      ? "Note: the assistant issued an access-only token, so this connection will expire. Run `cadet connect import` again with a fresh pairing link when it does."
+      : "Note: this connection includes a refresh credential, so it can renew itself. Re-pair only if it's revoked or the refresh credential expires.",
+  );
+}
+
+/**
+ * DEPRECATED input path, kept for one upgrade cycle: a host still on the
+ * previous CLI release mints a base64 pairing bundle, and an upgraded second
+ * machine would otherwise reject that bundle as an invalid address. Delete
+ * this once that release is out of support; nothing mints bundles any more.
+ *
+ * Returns true when the argument was a bundle and the import is done. A 400
+ * means it did not decode as one, so the caller reports the address error it
+ * already has instead of a bundle error.
+ */
+function importLegacyPairingBundle(
+  lockfilePaths: string[],
+  configDir: string,
+  address: string,
+  name: string | undefined,
+): boolean {
+  const result = importLegacyBundle(lockfilePaths, configDir, {
+    bundle: address,
+    name,
+  });
+  if (!result.ok) {
+    if (result.status === 400) {
+      return false;
+    }
+    console.error(formatImportFailure(result.status, result.error));
+    process.exit(1);
+  }
+  console.log(
+    "Warning: base64 pairing bundles are deprecated and will stop working in a future release.",
+  );
+  console.log(
+    "Newer hosts print a pairing link instead: run `cadet pair` there and import that link.",
+  );
+  console.log("");
+  reportImported(result);
+  return true;
+}
+
+export async function connectImport(): Promise<void> {
+  const rawArgs = process.argv.slice(4);
+
+  if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
+    printUsage();
+    return;
+  }
+
+  const [nameFlag, args] = extractFlag(rawArgs, "--name");
+
+  // Any `--`-prefixed token left after known-flag extraction is an option this
+  // CLI version doesn't support. Fail loud before any network call rather than
+  // letting it fall through: an unknown flag would otherwise be read as the
+  // address and reported as an unusable one, hiding the real mistake. Neither
+  // an https address nor a pairing link starts with `--`.
+  const unknownFlag = args.find((a) => a.startsWith("--"));
+  if (unknownFlag) {
+    console.error(`Error: unknown option '${unknownFlag}'.`);
+    console.error(
+      "Run `cadet connect import --help` to see available options.",
+    );
+    console.error(
+      `If this option is from newer docs, ${STALE_CLI_UPDATE_HINT}`,
+    );
+    process.exit(1);
+  }
+
+  const address = args[0];
+  if (!address) {
+    console.error("Error: missing assistant address.");
+    printUsage();
+    process.exit(1);
+  }
+
+  const lockfilePaths = getLockfilePaths(getCurrentEnvironment());
+  const configDir = resolveConfigDir(process.env);
+
+  // Refuse a colliding --name BEFORE anything is exchanged. The device code is
+  // one-time and the gateway records a device the moment it is spent, so
+  // discovering the collision after the exchange would orphan that device and
+  // force the user to generate a fresh link. This is a pre-check, not a
+  // reservation: another process can still claim the id in between, which the
+  // real check inside the import path catches.
+  if (nameFlag) {
+    const conflict = checkPairedAssistantName(lockfilePaths, nameFlag);
+    if (conflict) {
+      console.error(formatImportFailure(conflict.status, conflict.error));
+      process.exit(1);
+    }
+  }
+
+  const started = await pairingStart(address);
+  if (!started.ok) {
+    // The address path runs first, so the normal flow never touches the
+    // deprecated bundle decoder; only an unusable address falls through to it.
+    if (
+      started.reason === "invalid-address" &&
+      importLegacyPairingBundle(lockfilePaths, configDir, address, nameFlag)
+    ) {
+      return;
+    }
+    console.error(`Error: ${started.error}`);
+    process.exit(1);
+  }
+
+  // An interrupted wait drops the pending session rather than leaving the
+  // device code exchangeable for the rest of its TTL.
+  const cancelPairing = (): void => {
+    pairingCancel(started.handle);
+    process.exit(130);
+  };
+  process.on("SIGINT", cancelPairing);
+  process.on("SIGTERM", cancelPairing);
+
+  try {
+    if (started.userCode) {
+      console.log("Approve this pairing on the assistant's machine:");
+      console.log("");
+      console.log(`  Code: ${started.userCode}`);
+      console.log(`  Run:  cadet pair --web-approve ${started.userCode}`);
+      console.log("");
+      console.log(`Waiting for approval (expires ${started.expiresAt})...`);
+    }
+
+    // The approval wait promises to run until approval or expiry, so a
+    // transport failure backs off and polls again rather than abandoning a
+    // session local-mode is deliberately keeping alive. Minting the challenge
+    // already proved this address reachable, so a later failure is transient.
+    //
+    // A pairing link is the other case: it opens a session without any
+    // request, so nothing has proved the host is up, and there is no approval
+    // to wait for. An unreachable host is reported at once there instead of
+    // hanging for the link's full TTL.
+    const retryTransientFailures = started.userCode !== null;
+    let expiresAt = started.expiresAt;
+    let intervalSeconds = started.intervalSeconds;
+    let consecutiveFailures = 0;
+
+    for (;;) {
+      const result = await pairingPoll(lockfilePaths, configDir, {
+        handle: started.handle,
+        name: nameFlag,
+        platform: "cli",
+      });
+
+      if (!result.ok) {
+        if (
+          !retryTransientFailures ||
+          !isRetryablePairingReason(result.reason)
+        ) {
+          console.error(formatImportFailure(result.status, result.error));
+          process.exit(1);
+        }
+        const expiresAtMs = Date.parse(expiresAt);
+        if (Number.isFinite(expiresAtMs) && Date.now() >= expiresAtMs) {
+          console.error(
+            "Error: the pairing code expired before the assistant could be " +
+              "reached. Start over to get a new one.",
+          );
+          process.exit(1);
+        }
+        consecutiveFailures += 1;
+        if (consecutiveFailures === 1) {
+          console.log("");
+          console.log(
+            `Could not reach the assistant: ${result.error} ` +
+              `Still trying until the code expires (${expiresAt}).`,
+          );
+        }
+        await Bun.sleep(
+          Math.min(
+            intervalSeconds * consecutiveFailures,
+            MAX_RETRY_BACKOFF_SECONDS,
+          ) * 1000,
+        );
+        continue;
+      }
+
+      consecutiveFailures = 0;
+
+      if (result.status === "imported") {
+        reportImported(result);
+        return;
+      }
+
+      // Pending: the host has not approved the code yet. The gateway names the
+      // deadline and the cadence, and `pairingPoll` reports the attempt expired
+      // once that deadline passes.
+      expiresAt = result.expiresAt;
+      intervalSeconds = result.intervalSeconds;
+      await Bun.sleep(intervalSeconds * 1000);
+    }
+  } finally {
+    process.off("SIGINT", cancelPairing);
+    process.off("SIGTERM", cancelPairing);
+  }
+}

package/src/commands/connect.ts

@@ -0,0 +1,31 @@
+import { connectImport } from "./connect/import.js";
+
+function printUsage(): void {
+  console.log("Usage: cadet connect [beta] <subcommand>");
+  console.log("");
+  console.log("Connect to an assistant paired from another machine.");
+  console.log("");
+  console.log("Subcommands:");
+  console.log(
+    "  import    Pair with an assistant at a link or https address and register it",
+  );
+}
+
+export async function connect(): Promise<void> {
+  const args = process.argv.slice(3);
+  const subcommand = args[0];
+
+  if (subcommand === "--help" || subcommand === "-h" || !subcommand) {
+    printUsage();
+    process.exit(0);
+  }
+
+  if (subcommand === "import") {
+    await connectImport();
+    return;
+  }
+
+  console.error(`Unknown subcommand: ${subcommand}`);
+  printUsage();
+  process.exit(1);
+}

package/src/commands/debug-bundle.ts

@@ -0,0 +1,222 @@
+/**
+ * `cadet debug-bundle [name]`
+ *
+ * Send Cadet staff a debug bundle of a self-hosted assistant: the
+ * workspace, its logs, and the gateway's own database, with no credentials.
+ * Staff open it on a throwaway debug clone. The platform only hands out the
+ * upload URL while "Allow Staff Access" is on, and the bundle is deleted
+ * after seven days.
+ *
+ * Steps: the daemon is checked for the debug profile, the platform mints
+ * the upload URL, the daemon exports with the debug profile, and this
+ * command waits for the job so the result is real.
+ */
+import { isManagedCloud } from "../lib/managed-cloud.js";
+import {
+  formatAssistantReference,
+  resolveTargetAssistant,
+} from "../lib/assistant-config.js";
+import { parseAssistantTargetArg } from "../lib/assistant-target-args.js";
+import { loadGuardianToken, leaseGuardianToken } from "../lib/guardian-token";
+import { pollJobUntilDone } from "../lib/job-polling.js";
+import {
+  MigrationInProgressError,
+  localRuntimeExportToGcs,
+  localRuntimeIdentity,
+  localRuntimePollJobStatus,
+} from "../lib/local-runtime-client.js";
+import { loopbackSafeFetch } from "../lib/loopback-fetch.js";
+import {
+  authHeaders,
+  authHeadersForKnownOrganization,
+  getPlatformUrl,
+  readPlatformToken,
+} from "../lib/platform-client.js";
+import { compareVersions } from "../lib/version-compat.js";
+
+// Matches the daemon's own upload deadline (EXPORT_TO_GCS_PUT_TIMEOUT_MS in
+// assistant/src/runtime/routes/migration-routes.ts), so a slow but healthy
+// export is never reported as failed while it is still uploading.
+const EXPORT_TIMEOUT_MS = 60 * 60 * 1000;
+// The daemon release that added `profile: "debug"`. An older daemon strips
+// the field and exports a normal teleport bundle, which carries the owner's
+// credentials. That must never reach the staff bucket.
+export const DEBUG_PROFILE_MIN_VERSION = "0.12.3";
+// Renew a cached guardian token that is about to lapse instead of starting
+// a long export on it.
+const TOKEN_EXPIRY_MARGIN_MS = 60 * 1000;
+
+function printHelp(): void {
+  console.log(`Usage: cadet debug-bundle [name]
+
+Send Cadet staff a debug bundle of a self-hosted assistant so they can
+inspect a copy of it. The bundle holds the assistant's workspace, its
+logs, and the gateway's own database. It never holds credentials.
+
+Arguments:
+  name    Assistant ID or unique display name. Defaults to the active
+          assistant (see 'cadet use'). Multi-word names need no quotes.
+
+Requirements:
+  - 'Allow Staff Access' is on for the assistant (Settings > Privacy).
+  - You are logged in ('cadet login'), which also registers the
+    assistant with the platform.
+  - The assistant runs version ${DEBUG_PROFILE_MIN_VERSION} or newer.
+  - The assistant is self-hosted. Cadet-hosted assistants need no bundle;
+    staff clone them directly.
+
+Side effects:
+  - Uploads the bundle to Cadet's debug-bundle storage, where it is
+    deleted after 7 days. Nothing on this machine changes.
+  - Records a 'debug bundle exported' entry in your account's audit history.
+  - Waits for the upload to finish (up to 60 minutes for a large workspace).
+
+Examples:
+  cadet debug-bundle
+  cadet debug-bundle my-assistant
+  cadet debug-bundle Support Bot
+`);
+}
+
+export async function debugBundle(): Promise<void> {
+  const args = process.argv.slice(3);
+  if (args.includes("--help") || args.includes("-h")) {
+    printHelp();
+    return;
+  }
+
+  const entry = resolveTargetAssistant(parseAssistantTargetArg(args));
+  const reference = formatAssistantReference(entry);
+  if (isManagedCloud(entry.cloud)) {
+    console.error(
+      `${reference} is hosted by Cadet, so staff can clone it directly. No bundle is needed.`,
+    );
+    process.exit(1);
+  }
+
+  const platformToken = readPlatformToken();
+  if (!platformToken) {
+    console.error("Not logged in. Run 'cadet login' first.");
+    process.exit(1);
+  }
+  const platformAssistantId = entry.platformAssistantId?.trim();
+  if (!platformAssistantId) {
+    console.error(
+      `${reference} is not registered with the platform yet. Run 'cadet login' and retry.`,
+    );
+    process.exit(1);
+  }
+  const platformUrl = entry.platformBaseUrl?.trim() || getPlatformUrl();
+  const organizationId = entry.platformOrganizationId?.trim();
+
+  // Step 1: a guardian token for the daemon, and a check that the daemon
+  // knows the debug profile. This comes before the platform call so a
+  // daemon that would export credentials is refused before any URL exists.
+  let accessToken = await daemonAccessToken(entry, reference, false);
+  const { version } = await localRuntimeIdentity(entry, accessToken);
+  const comparison = compareVersions(version, DEBUG_PROFILE_MIN_VERSION);
+  if (comparison === null || comparison < 0) {
+    console.error(
+      `${reference} runs version ${version || "unknown"}, which cannot build a debug bundle. Update it to ${DEBUG_PROFILE_MIN_VERSION} or newer ('cadet upgrade') and retry.`,
+    );
+    process.exit(1);
+  }
+
+  // Step 2: the platform mints the upload URL, and refuses unless the
+  // owner's staff access grant is active.
+  const headers = organizationId
+    ? authHeadersForKnownOrganization(platformToken, organizationId)
+    : await authHeaders(platformToken, platformUrl);
+  const urlResponse = await loopbackSafeFetch(
+    `${platformUrl}/v1/assistants/${encodeURIComponent(platformAssistantId)}/debug-bundle-upload-url/`,
+    { method: "POST", headers },
+  );
+  if (urlResponse.status === 403) {
+    console.error(
+      "Staff access is off for this assistant. Turn on 'Allow Staff Access' in Settings > Privacy, then retry.",
+    );
+    process.exit(1);
+  }
+  if (!urlResponse.ok) {
+    const detail = await urlResponse.text().catch(() => "");
+    console.error(
+      `Error: Could not get an upload URL (${urlResponse.status}): ${detail || urlResponse.statusText}`,
+    );
+    process.exit(1);
+  }
+  const { url: uploadUrl } = (await urlResponse.json()) as { url: string };
+
+  // Step 3: the daemon builds and uploads the bundle.
+  let jobId: string;
+  try {
+    ({ jobId } = await localRuntimeExportToGcs(entry, accessToken, {
+      uploadUrl,
+      description: "debug bundle for Cadet staff",
+      profile: "debug",
+    }));
+  } catch (err) {
+    if (err instanceof MigrationInProgressError) {
+      console.error(
+        `Error: Another export is already in progress (job ${err.existingJobId}). Wait for it to finish, then retry.`,
+      );
+      process.exit(1);
+    }
+    throw err;
+  }
+  console.log(`Export started (job ${jobId})...`);
+
+  // Step 4: wait for the upload so the owner sees a real result. A large
+  // export can outlive the guardian token, so a 401 mid-poll re-leases one.
+  const terminal = await pollJobUntilDone({
+    label: "debug bundle export",
+    poll: () => localRuntimePollJobStatus(entry, accessToken, jobId),
+    timeoutMs: EXPORT_TIMEOUT_MS,
+    refreshOn401: async () => {
+      accessToken = await daemonAccessToken(entry, reference, true);
+    },
+  });
+  if (terminal.status === "failed") {
+    console.error(`Error: Export failed: ${terminal.error}`);
+    process.exit(1);
+  }
+  console.log(
+    "Debug bundle sent to Cadet. Staff can open it for the next 7 days.",
+  );
+}
+
+async function daemonAccessToken(
+  entry: {
+    assistantId: string;
+    runtimeUrl: string;
+    guardianBootstrapSecret?: string;
+  },
+  reference: string,
+  forceRefresh: boolean,
+): Promise<string> {
+  if (!forceRefresh) {
+    const cached = loadGuardianToken(entry.assistantId);
+    if (
+      cached &&
+      new Date(cached.accessTokenExpiresAt).getTime() - Date.now() >
+        TOKEN_EXPIRY_MARGIN_MS
+    ) {
+      return cached.accessToken;
+    }
+  }
+  try {
+    return (
+      await leaseGuardianToken(
+        entry.runtimeUrl,
+        entry.assistantId,
+        entry.guardianBootstrapSecret,
+      )
+    ).accessToken;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("ECONNREFUSED") || msg.includes("fetch failed")) {
+      console.error(`Error: Could not connect to ${reference}. Is it running?`);
+      process.exit(1);
+    }
+    throw err;
+  }
+}