@runtypelabs/cli 2.59.1 → 2.59.2

package/dist/chunk-NONFcXkn.js

@@ -0,0 +1,728 @@
+#!/usr/bin/env node
+import { t as isRecord } from "./chunk-QSfNYiw9.js";
+import { i as getApiUrl, r as createCliClient } from "./chunk-BW2fg46T.js";
+import { n as ensureAuth } from "./chunk-CJraEBVd.js";
+import { a as printJson, i as printDetail } from "./chunk-CcFCyqbB.js";
+import { i as createDeviceListenIdentityStore, n as assertListenForwardTarget, r as runDeviceListen } from "./chunk-Dn8eaJuu.js";
+import { Command } from "commander";
+import chalk from "chalk";
+import { constants } from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import os from "node:os";
+import { randomUUID } from "node:crypto";
+import { access, chmod, copyFile, mkdir, readFile, realpath, rename, rm, stat } from "node:fs/promises";
+// src/lib/device-provider.ts
+var DeviceProviderError = class extends Error {
+	code;
+	retryable;
+	constructor(message, code, retryable = false, options) {
+		super(message, options);
+		this.code = code;
+		this.retryable = retryable;
+		this.name = "DeviceProviderError";
+	}
+};
+// src/lib/macos-device-provider.ts
+const MAX_SIDECAR_OUTPUT_BYTES = 1048576;
+const MAX_HELPER_BYTES = 104857600;
+const DEFAULT_SIDECAR_TIMEOUT_MS = 3e4;
+function parseHello(value) {
+	if (!isRecord(value) || typeof value.providerId !== "string" || typeof value.protocolVersion !== "number" || typeof value.helperVersion !== "string" || typeof value.platform !== "string" || !Array.isArray(value.capabilities) || !value.capabilities.every((capability) => typeof capability === "string")) throw new DeviceProviderError("The native helper returned an invalid hello response", "INVALID_RESPONSE");
+	return value;
+}
+async function isExecutable(filePath) {
+	try {
+		await access(filePath, constants.X_OK);
+		return (await stat(filePath)).isFile();
+	} catch {
+		return false;
+	}
+}
+var MacOSDeviceProvider = class {
+	id = "com.runtype.device.macos";
+	platform;
+	architecture;
+	operatingSystemRelease;
+	homeDirectory;
+	workingDirectory;
+	environment;
+	sidecarTimeoutMs;
+	constructor(options = {}) {
+		this.platform = options.platform ?? process.platform;
+		this.architecture = options.architecture ?? process.arch;
+		this.operatingSystemRelease = options.operatingSystemRelease ?? os.release();
+		this.homeDirectory = options.homeDirectory ?? os.homedir();
+		this.workingDirectory = options.workingDirectory ?? process.cwd();
+		this.environment = options.environment ?? process.env;
+		this.sidecarTimeoutMs = options.sidecarTimeoutMs ?? DEFAULT_SIDECAR_TIMEOUT_MS;
+	}
+	async probe() {
+		const unsupportedReason = this.unsupportedReason();
+		if (unsupportedReason) return {
+			providerId: this.id,
+			supported: false,
+			installed: false,
+			reason: unsupportedReason
+		};
+		const binaryPath = await this.resolveBinary();
+		if (!binaryPath) return {
+			providerId: this.id,
+			supported: true,
+			installed: false,
+			reason: "The Runtype macOS device helper is not installed"
+		};
+		try {
+			const hello = parseHello(await this.invokeAt(binaryPath, "hello"));
+			this.assertCompatible(hello);
+			return {
+				providerId: this.id,
+				supported: true,
+				installed: true,
+				binaryPath,
+				helperVersion: hello.helperVersion,
+				protocolVersion: hello.protocolVersion
+			};
+		} catch (error) {
+			return {
+				providerId: this.id,
+				supported: true,
+				installed: true,
+				binaryPath,
+				reason: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	async ensureInstalled(options = {}) {
+		this.assertPlatform();
+		if (!options.helperPath) {
+			const installedPath = await this.resolveInstalledBinary();
+			if (installedPath) return this.describeInstallation(installedPath, false);
+		}
+		const sourcePath = options.helperPath ? path.resolve(options.helperPath) : await this.resolveDevelopmentSource();
+		if (!sourcePath) throw new DeviceProviderError([
+			"The Runtype macOS device helper is not installed.",
+			"For this internal-alpha build, compile it from the core repository and pass:",
+			"  runtype devices setup --helper-path apps/device-daemon-macos/.build/release/runtype-device"
+		].join("\n"), "HELPER_NOT_INSTALLED");
+		const resolvedSource = await realpath(sourcePath).catch(() => sourcePath);
+		const sourceDetails = await stat(resolvedSource).catch(() => null);
+		if (!sourceDetails?.isFile() || sourceDetails.size > MAX_HELPER_BYTES) throw new DeviceProviderError(`Device helper is not a valid executable file: ${sourcePath}`, "INVALID_HELPER");
+		await access(resolvedSource, constants.X_OK).catch((error) => {
+			throw new DeviceProviderError(`Device helper is not executable: ${sourcePath}`, "INVALID_HELPER", false, { cause: error });
+		});
+		const sourceHello = parseHello(await this.invokeAt(resolvedSource, "hello"));
+		this.assertCompatible(sourceHello);
+		const targetPath = this.stableBinaryPath;
+		if (resolvedSource !== await realpath(targetPath).catch(() => targetPath)) {
+			const targetDirectory = path.dirname(targetPath);
+			await mkdir(targetDirectory, {
+				recursive: true,
+				mode: 448
+			});
+			await chmod(targetDirectory, 448);
+			const temporaryPath = path.join(targetDirectory, `.runtype-device-${randomUUID()}.tmp`);
+			try {
+				await copyFile(resolvedSource, temporaryPath, constants.COPYFILE_EXCL);
+				await chmod(temporaryPath, 448);
+				await rename(temporaryPath, targetPath);
+			} finally {
+				await rm(temporaryPath, { force: true });
+			}
+		}
+		return this.describeInstallation(targetPath, true);
+	}
+	async invoke(method, params = {}) {
+		this.assertPlatform();
+		const binaryPath = await this.resolveBinary();
+		if (!binaryPath) throw new DeviceProviderError("The Runtype macOS device helper is not installed. Run `runtype devices setup` first.", "HELPER_NOT_INSTALLED");
+		const result = await this.invokeAt(binaryPath, method, params);
+		if (!isRecord(result)) throw new DeviceProviderError("The native helper returned a non-object result", "INVALID_RESPONSE");
+		return result;
+	}
+	async removeInstalledBinary() {
+		if (!await isExecutable(this.stableBinaryPath)) return false;
+		await rm(this.stableBinaryPath, { force: true });
+		return true;
+	}
+	get stableBinaryPath() {
+		return path.join(this.homeDirectory, ".runtype", "device", "bin", "runtype-device");
+	}
+	installedCandidates() {
+		return [
+			this.stableBinaryPath,
+			path.join(this.homeDirectory, "Applications", "Runtype Device.app", "Contents", "MacOS", "runtype-device"),
+			"/Applications/Runtype Device.app/Contents/MacOS/runtype-device"
+		];
+	}
+	developmentCandidates() {
+		return [
+			...this.environment.RUNTYPE_DEVICE_HELPER_PATH ? [path.resolve(this.environment.RUNTYPE_DEVICE_HELPER_PATH)] : [],
+			path.join(this.workingDirectory, "apps", "device-daemon-macos", ".build", "release", "runtype-device"),
+			path.join(this.workingDirectory, "apps", "device-daemon-macos", ".build", "debug", "runtype-device")
+		];
+	}
+	async firstExecutable(candidates) {
+		for (const candidate of candidates) if (await isExecutable(candidate)) return candidate;
+		return null;
+	}
+	resolveInstalledBinary() {
+		return this.firstExecutable(this.installedCandidates());
+	}
+	resolveDevelopmentSource() {
+		return this.firstExecutable(this.developmentCandidates());
+	}
+	async resolveBinary() {
+		return await this.resolveInstalledBinary() ?? await this.firstExecutable(this.developmentCandidates());
+	}
+	assertPlatform() {
+		const reason = this.unsupportedReason();
+		if (!reason) return;
+		throw new DeviceProviderError(reason, this.platform === "darwin" ? "UNSUPPORTED_OS_VERSION" : "UNSUPPORTED_PLATFORM");
+	}
+	unsupportedReason() {
+		if (this.platform !== "darwin") return `Runtype Device currently supports macOS only (detected ${this.platform}/${this.architecture})`;
+		const darwinMajor = Number.parseInt(this.operatingSystemRelease.split(".")[0] ?? "", 10);
+		if (!Number.isInteger(darwinMajor) || darwinMajor < 23) return `Runtype Device requires macOS 14 or newer (detected Darwin ${this.operatingSystemRelease})`;
+		return null;
+	}
+	assertCompatible(hello) {
+		if (hello.providerId !== this.id || hello.platform !== "macos") throw new DeviceProviderError(`Unexpected native provider identity: ${hello.providerId}/${hello.platform}`, "PROVIDER_MISMATCH");
+		if (hello.protocolVersion !== 1) throw new DeviceProviderError(`Native helper protocol ${hello.protocolVersion} is incompatible with CLI protocol 1`, "PROTOCOL_MISMATCH");
+	}
+	async describeInstallation(binaryPath, installed) {
+		const hello = parseHello(await this.invokeAt(binaryPath, "hello"));
+		this.assertCompatible(hello);
+		return {
+			providerId: this.id,
+			binaryPath,
+			helperVersion: hello.helperVersion,
+			protocolVersion: hello.protocolVersion,
+			installed
+		};
+	}
+	async invokeAt(binaryPath, method, params = {}) {
+		const id = randomUUID();
+		const request = JSON.stringify({
+			protocolVersion: 1,
+			id,
+			method,
+			params
+		});
+		const child = spawn(binaryPath, ["control"], {
+			env: this.environment,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			shell: false
+		});
+		const stdout = [];
+		const stderr = [];
+		let stdoutBytes = 0;
+		let stderrBytes = 0;
+		let outputExceeded = false;
+		let timedOut = false;
+		child.stdout.on("data", (chunk) => {
+			stdoutBytes += chunk.length;
+			if (stdoutBytes > MAX_SIDECAR_OUTPUT_BYTES) {
+				outputExceeded = true;
+				child.kill("SIGKILL");
+				return;
+			}
+			stdout.push(chunk);
+		});
+		child.stderr.on("data", (chunk) => {
+			if (stderrBytes >= MAX_SIDECAR_OUTPUT_BYTES) return;
+			stderrBytes += chunk.length;
+			stderr.push(chunk.subarray(0, MAX_SIDECAR_OUTPUT_BYTES - (stderrBytes - chunk.length)));
+		});
+		const completion = new Promise((resolve, reject) => {
+			child.once("error", reject);
+			child.once("close", (code, signal) => resolve({
+				code,
+				signal
+			}));
+		});
+		const timeout = setTimeout(() => {
+			timedOut = true;
+			child.kill("SIGKILL");
+		}, this.sidecarTimeoutMs);
+		child.stdin.on("error", () => {});
+		child.stdin.end(`${request}\n`);
+		let completionResult;
+		try {
+			completionResult = await completion;
+		} catch (error) {
+			throw new DeviceProviderError(`Unable to start the native device helper at ${binaryPath}`, "HELPER_START_FAILED", false, { cause: error });
+		} finally {
+			clearTimeout(timeout);
+		}
+		if (timedOut) throw new DeviceProviderError(`Native device helper timed out after ${this.sidecarTimeoutMs}ms`, "HELPER_TIMEOUT", true);
+		if (outputExceeded) throw new DeviceProviderError(`Native device helper output exceeded ${MAX_SIDECAR_OUTPUT_BYTES} bytes`, "OUTPUT_TOO_LARGE");
+		const output = Buffer.concat(stdout).toString("utf8").trim();
+		let response;
+		try {
+			response = JSON.parse(output);
+		} catch (error) {
+			const detail = Buffer.concat(stderr).toString("utf8").trim();
+			throw new DeviceProviderError(`Native device helper returned invalid JSON${detail ? `: ${detail}` : ""}`, "INVALID_RESPONSE", false, { cause: error });
+		}
+		if (response.protocolVersion !== 1 || response.id !== id || typeof response.ok !== "boolean") throw new DeviceProviderError("Native device helper returned a mismatched response envelope", "INVALID_RESPONSE");
+		if (!response.ok) throw new DeviceProviderError(response.error?.message || "Native device operation failed", response.error?.code || "OPERATION_FAILED", response.error?.retryable === true);
+		if (completionResult.code !== 0) throw new DeviceProviderError(`Native device helper exited with status ${completionResult.code ?? completionResult.signal ?? "unknown"}`, "HELPER_EXITED");
+		return response.result;
+	}
+};
+// src/commands/devices.ts
+const defaultDependencies = {
+	ensureAuth,
+	createClient: (apiKey) => createCliClient(apiKey),
+	createProvider: () => new MacOSDeviceProvider(),
+	getApiUrl,
+	sleep: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+	setExitCode: (code) => {
+		process.exitCode = code;
+	},
+	createIdentityStore: (workspace) => createDeviceListenIdentityStore({ workspace }),
+	runListen: (options) => runDeviceListen(options)
+};
+function unwrapData(response) {
+	if (!isRecord(response) || !("data" in response)) throw new Error("Runtype API returned an invalid device response");
+	return response.data;
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function apiStatusCode(error) {
+	return isRecord(error) && typeof error.statusCode === "number" ? error.statusCode : null;
+}
+function isRecordedRevocationError(error) {
+	if (apiStatusCode(error) !== 503) return false;
+	const data = isRecord(error) && isRecord(error.data) ? error.data : null;
+	return (typeof data?.error === "string" ? data.error : errorMessage(error)).toLowerCase().includes("revocation was recorded");
+}
+function printCommandError(label, error) {
+	console.error(chalk.red(label));
+	console.error(chalk.red(errorMessage(error)));
+}
+function printDevice(device) {
+	printDetail("Runtype Device", [
+		{
+			label: "ID",
+			value: device.id
+		},
+		{
+			label: "Name",
+			value: device.name
+		},
+		{
+			label: "Platform",
+			value: device.platform
+		},
+		{
+			label: "Online",
+			value: device.status?.online
+		},
+		{
+			label: "Last seen",
+			value: device.status?.lastSeenAt
+		},
+		{
+			label: "Available tools",
+			value: device.status?.availableTools.join(", ")
+		},
+		{
+			label: "MCP URL",
+			value: device.mcpUrl
+		},
+		{
+			label: "Revoked",
+			value: device.revokedAt
+		}
+	]);
+}
+function localDeviceId(status) {
+	return typeof status.deviceId === "string" && status.deviceId.length > 0 ? status.deviceId : null;
+}
+async function authenticatedClient(dependencies) {
+	const apiKey = await dependencies.ensureAuth({ exitOnFailure: false });
+	if (!apiKey) {
+		dependencies.setExitCode(1);
+		return null;
+	}
+	return dependencies.createClient(apiKey);
+}
+async function waitForDevice(client, deviceId, dependencies) {
+	let latest = null;
+	for (let attempt = 0; attempt < 8; attempt += 1) {
+		try {
+			latest = unwrapData(await client.get(`/devices/${encodeURIComponent(deviceId)}`));
+			if (latest.status?.online) return latest;
+		} catch {}
+		if (attempt < 7) await dependencies.sleep(750);
+	}
+	return latest;
+}
+async function runTail(logPath, lines) {
+	const child = spawn("/usr/bin/tail", [
+		"-n",
+		String(lines),
+		"-f",
+		logPath
+	], {
+		stdio: "inherit",
+		shell: false
+	});
+	return new Promise((resolve, reject) => {
+		child.once("error", reject);
+		child.once("close", (code) => resolve(code ?? 1));
+	});
+}
+function createDevicesCommand(overrides = {}) {
+	const dependencies = {
+		...defaultDependencies,
+		...overrides
+	};
+	const command = new Command("devices").description("Manage local computers connected to Runtype agents");
+	command.command("setup").description("Install, pair, and start Runtype Device on this Mac").option("--name <name>", "Device name shown in Runtype").option("--helper-path <path>", "Install a locally built native helper (internal alpha)").option("--json", "Output as JSON").action(async (options) => {
+		const provider = dependencies.createProvider();
+		let pairedDeviceId = null;
+		try {
+			const installation = await provider.ensureInstalled({ helperPath: options.helperPath });
+			const existingDeviceId = localDeviceId(await provider.invoke("status"));
+			if (existingDeviceId) throw new DeviceProviderError(`This Mac is already paired as ${existingDeviceId}. Run \`runtype devices status\` instead.`, "ALREADY_PAIRED");
+			const client = await authenticatedClient(dependencies);
+			if (!client) return;
+			const pairParams = {
+				pairingUri: unwrapData(await client.post("/devices/pairing-sessions", {})).pairingUri,
+				apiUrl: dependencies.getApiUrl()
+			};
+			if (options.name) pairParams.name = options.name;
+			const paired = await provider.invoke("pair", pairParams);
+			pairedDeviceId = paired.deviceId;
+			const service = await provider.invoke("install");
+			const local = await provider.invoke("status");
+			const device = await waitForDevice(client, paired.deviceId, dependencies);
+			const result = {
+				deviceId: paired.deviceId,
+				name: paired.name,
+				online: device?.status?.online ?? false,
+				mcpUrl: device?.mcpUrl ?? null,
+				installation,
+				service,
+				local
+			};
+			if (options.json) {
+				printJson(result);
+				return;
+			}
+			console.log(chalk.green(`Paired and started ${paired.name}`));
+			console.log(`  Device ID: ${chalk.green(paired.deviceId)}`);
+			console.log(`  Relay: ${device?.status?.online ? chalk.green("online") : chalk.yellow("connecting")}`);
+			if (device?.mcpUrl) console.log(`  MCP URL: ${device.mcpUrl}`);
+			if (local.messagesDatabaseReadable !== true) console.log(chalk.yellow(`\nGrant Full Disk Access to ${String(local.executablePath)} to enable iMessage reads.`));
+			console.log(chalk.gray("iMessage sending remains disabled by local policy."));
+		} catch (error) {
+			printCommandError("Failed to set up Runtype Device", error);
+			if (pairedDeviceId) console.error(chalk.yellow(`Pairing completed as ${pairedDeviceId}, but startup did not finish. Run \`runtype devices install\` after correcting the error.`));
+			dependencies.setExitCode(1);
+		}
+	});
+	command.command("install").description("Install or restart the local Runtype Device background service").option("--helper-path <path>", "Install a locally built native helper (internal alpha)").option("--json", "Output as JSON").action(async (options) => {
+		const provider = dependencies.createProvider();
+		try {
+			const installation = await provider.ensureInstalled({ helperPath: options.helperPath });
+			const service = await provider.invoke("install");
+			if (options.json) printJson({
+				installation,
+				service
+			});
+			else {
+				console.log(chalk.green("Runtype Device is installed and running"));
+				console.log(`  Helper: ${installation.binaryPath}`);
+				if (typeof service.logPath === "string") console.log(`  Logs: ${service.logPath}`);
+			}
+		} catch (error) {
+			printCommandError("Failed to install Runtype Device", error);
+			dependencies.setExitCode(1);
+		}
+	});
+	command.command("listen").description("Forward this Runtype workspace's calls to a localhost agent. Does not publish a URL. Does not bind that port.").option("--forward-to <url>", "Loopback HTTP URL of the local agent").option("--name <name>", "Device name shown in Runtype").option("--json", "Output the connected session as JSON").action(async (options) => {
+		let forwardTo;
+		try {
+			forwardTo = assertListenForwardTarget(options.forwardTo);
+		} catch (error) {
+			printCommandError("Cannot forward to that URL", error);
+			dependencies.setExitCode(1);
+			return;
+		}
+		const client = await authenticatedClient(dependencies);
+		if (!client) return;
+		try {
+			const workspace = await client.get("/auth/me");
+			if (typeof workspace.userId !== "string" || !workspace.userId || workspace.orgId !== null && typeof workspace.orgId !== "string") throw new Error("Cannot verify the authenticated workspace");
+			await dependencies.runListen({
+				client,
+				apiUrl: dependencies.getApiUrl(),
+				forwardTo,
+				name: options.name,
+				json: Boolean(options.json),
+				identityStore: dependencies.createIdentityStore(workspace),
+				sleep: dependencies.sleep,
+				setExitCode: dependencies.setExitCode
+			});
+		} catch (error) {
+			printCommandError("Failed to listen for workspace calls", error);
+			dependencies.setExitCode(1);
+		}
+	});
+	command.command("list").description("List paired devices and relay status").option("--json", "Output as JSON").action(async (options) => {
+		try {
+			const client = await authenticatedClient(dependencies);
+			if (!client) return;
+			const devices = unwrapData(await client.get("/devices"));
+			if (options.json) {
+				printJson({ data: devices });
+				return;
+			}
+			if (devices.length === 0) {
+				console.log(chalk.gray("No paired devices"));
+				return;
+			}
+			console.log(chalk.cyan("Runtype Devices:"));
+			for (const device of devices) {
+				const state = device.revokedAt ? "revoked" : device.status?.online ? "online" : "offline";
+				console.log(`  ${chalk.green(device.id)}  ${device.name}  ${state}`);
+			}
+		} catch (error) {
+			printCommandError("Failed to list Runtype devices", error);
+			dependencies.setExitCode(1);
+		}
+	});
+	command.command("status [id]").description("Show local status, or cloud relay status for a device ID").option("--json", "Output as JSON").action(async (id, options) => {
+		try {
+			if (id) {
+				const client = await authenticatedClient(dependencies);
+				if (!client) return;
+				const device = unwrapData(await client.get(`/devices/${encodeURIComponent(id)}`));
+				if (options.json) printJson(device);
+				else printDevice(device);
+				return;
+			}
+			const local = await dependencies.createProvider().invoke("status");
+			if (options.json) printJson(local);
+			else printDetail("Local Runtype Device", [
+				{
+					label: "Device ID",
+					value: local.deviceId ?? "not paired"
+				},
+				{
+					label: "API URL",
+					value: local.apiUrl
+				},
+				{
+					label: "Helper version",
+					value: local.helperVersion
+				},
+				{
+					label: "Service installed",
+					value: local.serviceInstalled
+				},
+				{
+					label: "Service running",
+					value: local.serviceRunning
+				},
+				{
+					label: "Messages readable",
+					value: local.messagesDatabaseReadable
+				},
+				{
+					label: "Sending enabled",
+					value: local.allowSend
+				},
+				{
+					label: "Executable",
+					value: local.executablePath
+				},
+				{
+					label: "Logs",
+					value: local.logPath
+				}
+			]);
+		} catch (error) {
+			printCommandError("Failed to read Runtype Device status", error);
+			dependencies.setExitCode(1);
+		}
+	});
+	command.command("doctor").description("Check native helper, background service, and Messages permissions").option("--json", "Output as JSON").action(async (options) => {
+		const provider = dependencies.createProvider();
+		try {
+			const probe = await provider.probe();
+			const local = probe.installed && !probe.reason ? await provider.invoke("doctor") : null;
+			const healthy = probe.supported && probe.installed && local?.serviceRunning === true && local.messagesDatabaseReadable === true;
+			const result = {
+				healthy,
+				probe,
+				local
+			};
+			if (options.json) printJson(result);
+			else {
+				console.log(healthy ? chalk.green("Runtype Device is healthy") : chalk.yellow("Runtype Device needs attention"));
+				console.log(`  Platform supported: ${probe.supported ? "yes" : "no"}`);
+				console.log(`  Helper installed: ${probe.installed ? "yes" : "no"}`);
+				if (probe.reason) console.log(`  Helper: ${probe.reason}`);
+				if (local) {
+					console.log(`  Service running: ${local.serviceRunning === true ? "yes" : "no"}`);
+					console.log(`  Messages readable: ${local.messagesDatabaseReadable === true ? "yes" : "no"}`);
+					if (local.messagesDatabaseReadable !== true) console.log(chalk.yellow(`  Grant Full Disk Access to ${String(local.executablePath)}`));
+				}
+			}
+			if (!healthy) dependencies.setExitCode(1);
+		} catch (error) {
+			printCommandError("Runtype Device diagnostics failed", error);
+			dependencies.setExitCode(1);
+		}
+	});
+	command.command("policy <mode>").description("Set local iMessage send policy (allow-send or deny-send)").option("--json", "Output as JSON").action(async (mode, options) => {
+		if (mode !== "allow-send" && mode !== "deny-send") {
+			console.error(chalk.red("Policy must be allow-send or deny-send"));
+			dependencies.setExitCode(1);
+			return;
+		}
+		const provider = dependencies.createProvider();
+		let policyUpdated = false;
+		try {
+			const policy = await provider.invoke("policy", { allowSend: mode === "allow-send" });
+			policyUpdated = true;
+			const service = (await provider.invoke("status")).serviceInstalled === true ? await provider.invoke("install") : null;
+			const result = {
+				...policy,
+				capabilitiesRepublished: service !== null,
+				service
+			};
+			if (options.json) printJson(result);
+			else {
+				console.log(chalk.green(`Local iMessage sending is ${mode === "allow-send" ? "enabled" : "disabled"}`));
+				if (service) console.log(chalk.gray("Restarted the device service to publish capabilities."));
+				else console.log(chalk.yellow("The device service is not installed; run `runtype devices install` to publish this policy."));
+			}
+		} catch (error) {
+			printCommandError(policyUpdated ? "Local policy was updated, but the device service could not publish it" : "Failed to update local device policy", error);
+			dependencies.setExitCode(1);
+		}
+	});
+	command.command("mcp-url <id>").description("Print the managed MCP endpoint for a paired device").option("--json", "Output as JSON").action(async (id, options) => {
+		try {
+			const client = await authenticatedClient(dependencies);
+			if (!client) return;
+			const device = unwrapData(await client.get(`/devices/${encodeURIComponent(id)}`));
+			if (options.json) printJson({
+				deviceId: id,
+				mcpUrl: device.mcpUrl ?? null
+			});
+			else if (device.mcpUrl) console.log(device.mcpUrl);
+			else throw new Error("The API did not return an MCP URL for this device");
+		} catch (error) {
+			printCommandError("Failed to get device MCP URL", error);
+			dependencies.setExitCode(1);
+		}
+	});
+	command.command("revoke <id>").description("Revoke a paired device in Runtype").option("--yes", "Confirm irreversible device revocation").option("--json", "Output as JSON").action(async (id, options) => {
+		if (!options.yes) {
+			console.error(chalk.red("Pass --yes to confirm irreversible device revocation"));
+			dependencies.setExitCode(1);
+			return;
+		}
+		try {
+			const client = await authenticatedClient(dependencies);
+			if (!client) return;
+			const device = unwrapData(await client.post(`/devices/${encodeURIComponent(id)}/revoke`, {}));
+			if (options.json) printJson(device);
+			else {
+				console.log(chalk.green(`Revoked ${device.name} (${device.id})`));
+				console.log(chalk.gray("If this is the local Mac, run `runtype devices reset --yes`."));
+			}
+		} catch (error) {
+			if (isRecordedRevocationError(error)) {
+				const result = {
+					deviceId: id,
+					revoked: true,
+					relayDisconnectConfirmed: false,
+					message: errorMessage(error)
+				};
+				if (options.json) printJson(result);
+				else {
+					console.error(chalk.yellow(`Revocation was recorded for ${id}, but relay disconnection was not confirmed.`));
+					console.error(chalk.yellow("Retry this command, and reset the local Mac if applicable."));
+				}
+				dependencies.setExitCode(1);
+				return;
+			}
+			printCommandError("Failed to revoke Runtype device", error);
+			dependencies.setExitCode(1);
+		}
+	});
+	command.command("logs").description("Read local Runtype Device logs").option("-n, --lines <count>", "Number of lines", "100").option("-f, --follow", "Follow the log file").action(async (options) => {
+		try {
+			const lines = Number.parseInt(options.lines, 10);
+			if (!Number.isInteger(lines) || lines < 1 || lines > 1e4) throw new Error("--lines must be an integer between 1 and 10000");
+			const status = await dependencies.createProvider().invoke("status");
+			if (typeof status.logPath !== "string") throw new Error("The helper did not return a log path");
+			if (options.follow) {
+				const code = await runTail(status.logPath, lines);
+				if (code !== 0) dependencies.setExitCode(code);
+				return;
+			}
+			const entries = (await readFile(status.logPath, "utf8").catch((error) => {
+				if ((isRecord(error) ? error.code : void 0) === "ENOENT") return "";
+				throw error;
+			})).split(/\r?\n/u);
+			if (entries.at(-1) === "") entries.pop();
+			const selected = entries.slice(-lines).join("\n");
+			if (selected) console.log(selected);
+			else console.log(chalk.gray("No local device logs yet"));
+		} catch (error) {
+			printCommandError("Failed to read Runtype Device logs", error);
+			dependencies.setExitCode(1);
+		}
+	});
+	command.command("uninstall").description("Stop the local background service while preserving pairing state").option("--remove-binary", "Also remove the CLI-managed helper binary").option("--json", "Output as JSON").action(async (options) => {
+		const provider = dependencies.createProvider();
+		try {
+			const service = await provider.invoke("uninstall");
+			const removedBinary = options.removeBinary ? await provider.removeInstalledBinary() : false;
+			if (options.json) printJson({
+				service,
+				removedBinary
+			});
+			else console.log(chalk.green("Stopped and uninstalled the local Runtype Device service"));
+		} catch (error) {
+			printCommandError("Failed to uninstall Runtype Device", error);
+			dependencies.setExitCode(1);
+		}
+	});
+	command.command("reset").description("Clear local pairing state and rotate the native signing identity").option("--yes", "Confirm destructive local reset").option("--json", "Output as JSON").action(async (options) => {
+		if (!options.yes) {
+			console.error(chalk.red("Pass --yes to confirm destructive local reset"));
+			dependencies.setExitCode(1);
+			return;
+		}
+		try {
+			const result = await dependencies.createProvider().invoke("reset", { rotateIdentity: true });
+			if (options.json) printJson(result);
+			else {
+				console.log(chalk.green("Cleared local device state and rotated the signing identity"));
+				console.log(chalk.gray("Revoke the old device in Runtype if it has not already been revoked."));
+			}
+		} catch (error) {
+			printCommandError("Failed to reset local Runtype Device state", error);
+			dependencies.setExitCode(1);
+		}
+	});
+	return command;
+}
+const devicesCommand = createDevicesCommand();
+export { devicesCommand };
+