@tonbo/cli 0.7.1 → 0.8.0

package/README.md

@@ -14,7 +14,7 @@ tonbo login [--account <name>]
 tonbo logout
 ```
 
-`login` opens the browser at `https://tonbo.dev/cli/login`, where you pick the account (your personal account unless `--account` names another) and approve a personal API key named `CLI on <hostname>`. The browser returns a one-time code to a local callback on `127.0.0.1`, and the CLI redeems it with its PKCE verifier for the key. The key acts as you with your role in that account, expires after six months and replaces the key an earlier login on the same host created; there is no refresh, so an expired or revoked key asks you to run `tonbo login` again. One login holds one account: log in again to switch accounts.
+`login` prints the login URL and opens the browser at `https://tonbo.dev/cli/login`, where you pick the account (your personal account unless `--account` names another) and approve a personal API key named `CLI on <hostname>`. The browser returns a one-time code to a local callback on `127.0.0.1`, and the CLI redeems it with its PKCE verifier for the key. The key acts as you with your role in that account, expires after six months and replaces the key an earlier login on the same host created; there is no refresh, so an expired or revoked key asks you to run `tonbo login` again. One login holds one account: log in again to switch accounts. When no browser can be opened (an SSH session, a server without a desktop), the CLI keeps waiting: open the printed URL in a browser that can reach the callback's `127.0.0.1:<port>` on that machine, through `ssh -L <port>:127.0.0.1:<port>` or the VM's port forwarding.
 
 The login and the credentials file are shared with [`yield`](../yield) through `@tonbo/cli-core`: either CLI's `login` signs both in, and either `logout` signs both out. The login is saved at `${XDG_CONFIG_HOME:-$HOME/.config}/tonbo/credentials.json` as `{version, account_id, key_id, key, expires_at}`. The CLI atomically replaces that file with owner-only permissions and refuses a symlink or a file other users can read. A file written by an earlier CLI release is not migrated; run `tonbo login`.
 
@@ -35,6 +35,7 @@ Every command other than `login` and `logout` calls one operation of the [Manage
 | `tonbo region list` | `listRegions` | `GET /v1/regions` |
 | `tonbo member list [--limit <n>] [--cursor <c>]` | `listMembers` | `GET /v1/members` |
 | `tonbo member update <member> [--role <role>] [--name <name>]` | `updateMember` | `PATCH /v1/members/{subject}` |
+| `tonbo workspace list [--limit <n>] [--cursor <c>]` | `listGitWorkspaces` | `GET /v1/git/workspaces` |
 | `tonbo agent create <name> [--role <role>] [--region <region>] [--idempotency-key <key>]` | `createAgent` | `POST /v1/agents` |
 | `tonbo api-key list [--limit <n>] [--cursor <c>]` | `listApiKeys` | `GET /v1/api-keys` |
 | `tonbo api-key create <name> [--member <member>] [--read-only] [--bucket <name>]… [--database <name>]… [--database-prefix <prefix>]… [--stream <name>]… [--stream-prefix <prefix>]… [--expires-in <period>]` | `createApiKey` | `POST /v1/api-keys` |
@@ -101,6 +102,14 @@ tonbo agent create my-agent --region us-east-1
 
 `agent create` creates an Agent identity with a role (`member` unless `--role` names another). Every Agent has a home region, chosen when it is created and never changed afterwards. Without `--region`, Tonbo uses the only region that accepts new Agents; when several do, an interactive `agent create` asks which one to use, and a non-interactive request without `--region` is refused.
 
+## Git workspaces
+
+```console
+tonbo workspace list
+```
+
+`workspace list` lists the account's git workspaces, the default first: each one's id, name, whether it is the default, its region and where gitd serves it (`<git origin>/<ws_hex>`, the prefix of every repository URL in it). Every account has a default workspace from its creation. Listing needs only a role on the account; it admits nothing, and every git token is still admitted when it is minted.
+
 ## API keys
 
 ```console
@@ -132,7 +141,7 @@ tonbo database show notes
 `database create` creates a database in `--region`, or in the default region, and prints its fields with its URL. `--expires-at` and `--expires-in` give it an expiry fixed for its life, by the same rules as `stream create`'s: once it passes, Tonbo deletes the database within a minute, as `database delete` would, and its name is free again; `database show` prints it, and without either the database never expires. A Machine's database never expires. Without `--json` it then writes the next step to stderr, opening the database by name from code:
 
 ```text
-Next: npm i @tonbo/sqlite-ursula@0.11.2
+Next: npm i --save-exact @tonbo/sqlite-ursula@0.11.2
       open("notes") from "@tonbo/sqlite-ursula/tonbo"
 ```
 
@@ -168,6 +177,8 @@ The image is `tonbo.dev/platform`, the platform image each node release ships, o
 
 `machine update` changes only what its options name. It reads the Machine and writes the change at the revision it read, or at `--revision`, so a change someone made in between is refused with `revision_mismatch` rather than overwritten. `--env` and `--unset-env` change single variables; `--port` replaces every port, naming a public port again keeps its limits, and the current default port stays the default while it is still listed unless `--default-port` names another. Ports and `--sleep-after` apply at once; image, command, shape and env at the Machine's next boot. `machine sleep` puts an awake Machine to sleep now; its next connection wakes it. `machine delete` deletes the Machine with its disk, database and logs, and its name is free for a new Machine at once.
 
+In a personal account, `machine list`, `machine show` and `machine delete` also cover your own computers, which `yield login` registers (Machines of kind `byoc`, which run nothing Tonbo operates). They are served even while Machines are not open in any region. `machine list` prints them in a second table with their system, agent harnesses, when they last reported and the state of their login key; `machine show` adds the hostname and device id, which only you see. `machine delete` forgets a computer: it disappears from the list at once and its name is free once the forget completes. Forgetting does not revoke the computer's key, so a computer whose key is still active registers again at its next start; the command says so and suggests `yield logout` on it or `tonbo api-key revoke` first. An organization lists managed Machines only.
+
 A refusal of machine-v2's `errors` prints the server's detail and then what to do next, for example `machine shapes` for `shape_unavailable` or a shorter name for `hostname_too_long`.
 
 ## Usage

package/dist/bin/tonbo.js

@@ -486,6 +486,17 @@ var managementOperations = {
     "idempotencyKey": false,
     "cli": "tonbo usage show"
   },
+  "listGitWorkspaces": {
+    "method": "GET",
+    "path": "/git/workspaces",
+    "pathParams": [],
+    "query": [
+      "cursor",
+      "limit"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo workspace list"
+  },
   "listDatabases": {
     "method": "GET",
     "path": "/databases",
@@ -1025,7 +1036,7 @@ var AuthClient = class {
         hostname: this.hostname,
         ...account ? { account } : {}
       }).toString();
-      return this.browserOpener(authorization.toString());
+      return authorization.toString();
     }, progress);
     progress({ status: "started", step: "key-redemption" });
     const redeemed = await requestJson(this.fetcher, new URL("/api/cli/login/token", this.loginOrigin).toString(), {
@@ -1046,16 +1057,17 @@ var AuthClient = class {
     progress({ status: "completed", step: "credential-store" });
     return login;
   }
-  listenForCode(expectedState, ready, progress) {
+  listenForCode(expectedState, authorizationUrl, progress) {
     return new Promise((resolve, reject) => {
       let settled = false;
       const sockets = /* @__PURE__ */ new Set();
       let authorizationStarted = false;
-      const startAuthorization = () => {
+      const startAuthorization = (browserOpened = true) => {
         if (authorizationStarted)
           return;
         authorizationStarted = true;
-        progress({ status: "completed", step: "browser" });
+        if (browserOpened)
+          progress({ status: "completed", step: "browser" });
         progress({ status: "started", step: "browser-authorization" });
       };
       const finish = (result, completedResponseSocket) => {
@@ -1119,10 +1131,20 @@ var AuthClient = class {
       server.listen(0, LOOPBACK_HOST, () => {
         const { port } = server.address();
         progress({ status: "completed", step: "callback-server" });
+        const url = authorizationUrl(`http://${LOOPBACK_HOST}:${port}/callback`);
+        progress({ status: "authorization-url", step: "browser", url });
         progress({ status: "started", step: "browser" });
-        void ready(`http://${LOOPBACK_HOST}:${port}/callback`).then(startAuthorization).catch((error) => finish({
-          error: error instanceof Error ? error : new Error("Could not open the login browser.")
-        }));
+        void Promise.resolve().then(() => this.browserOpener(url)).then(() => startAuthorization(), (error) => {
+          if (settled || authorizationStarted)
+            return;
+          progress({
+            status: "failed",
+            step: "browser",
+            reason: error instanceof Error ? error.message : String(error),
+            callbackPort: port
+          });
+          startAuthorization(false);
+        });
       });
     });
   }
@@ -1134,12 +1156,27 @@ function respond(response, outcome, finished) {
   response.writeHead(page.status, { ...page.headers, connection: "close" });
   response.end(page.body);
 }
+function browserCommand(url, platform = process.platform, env = process.env) {
+  if (platform === "darwin")
+    return ["open", [url]];
+  if (platform === "win32")
+    return ["rundll32", ["url.dll,FileProtocolHandler", url]];
+  if (!env.DISPLAY && !env.WAYLAND_DISPLAY)
+    throw new Error("there is no graphical session (DISPLAY and WAYLAND_DISPLAY are unset)");
+  return ["xdg-open", [url]];
+}
 async function openBrowser(url) {
-  if (process.platform === "darwin")
-    return void await exec("open", [url]);
-  if (process.platform === "win32")
-    return void await exec("rundll32", ["url.dll,FileProtocolHandler", url]);
-  return void await exec("xdg-open", [url]);
+  const [command, args] = browserCommand(url);
+  try {
+    await exec(command, args);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT")
+      throw new Error(`${command} is not installed`, { cause: error });
+    if (typeof code === "number")
+      throw new Error(`${command} exited with code ${code}`, { cause: error });
+    throw error;
+  }
 }
 
 // ../../packages/tonbo-cli-core/dist/src/api.js
@@ -1162,7 +1199,7 @@ var ManagementApi = class {
   page(operationId, key, { limit, cursor } = {}, query = {}) {
     return this.request(operationId, key, { query: { ...query, limit, cursor } });
   }
-  async request(operationId, key, { params = {}, query = {}, body, idempotencyKey, ifMatch }) {
+  async request(operationId, key, { params = {}, query = {}, body, idempotencyKey, ifMatch }, seen) {
     const operation = managementOperations[operationId];
     const path2 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
       const value = params[name];
@@ -1190,7 +1227,12 @@ var ManagementApi = class {
     const queryString = search.toString();
     const url = `${this.apiOrigin}${managementApiBasePath}${path2}${queryString ? `?${queryString}` : ""}`;
     try {
-      return await requestJson(this.fetcher, url, {
+      const fetcher = seen ? async (input, init) => {
+        const response = await this.fetcher(input, init);
+        seen(response);
+        return response;
+      } : this.fetcher;
+      return await requestJson(fetcher, url, {
         method: operation.method,
         headers,
         ...body === void 0 ? {} : { body: JSON.stringify(body) }
@@ -1210,6 +1252,9 @@ var ManagementApi = class {
   listMembers(key, page) {
     return this.page("listMembers", key, page);
   }
+  listGitWorkspaces(key, page) {
+    return this.page("listGitWorkspaces", key, page);
+  }
   updateMember(key, subject, change) {
     return this.call("updateMember", key, { params: { subject }, body: change });
   }
@@ -1334,13 +1379,18 @@ var ManagementApi = class {
   sleepMachine(key, name) {
     return this.call("sleepMachine", key, { params: { name } });
   }
-  /** The Machine being deleted, or null when the API answered 204: the
-   * name's create never reached its region, and only the name was released. */
+  /** The Machine being deleted or the device forgotten, with its kind; the
+   * Machine is null when the API answered 204, whose `X-Tonbo-Machine-Kind`
+   * says whether a name was released (`managed`: its create never reached its
+   * region) or a device was forgotten (`byoc`: its region held no row). */
   async deleteMachine(key, name) {
-    const answer = await this.request("deleteMachine", key, {
-      params: { name }
+    const headers = { kind: null };
+    const answer = await this.request("deleteMachine", key, { params: { name } }, (response) => {
+      headers.kind = response.headers.get("x-tonbo-machine-kind");
     });
-    return answer?.data ?? null;
+    if (answer?.data)
+      return { machine: answer.data, kind: answer.data.kind };
+    return { machine: null, kind: headers.kind === "byoc" ? "byoc" : "managed" };
   }
   /** The whole answer: the shapes and the default one. */
   listMachineShapes(key) {
@@ -1433,6 +1483,16 @@ var LOGIN_PROGRESS_MESSAGES = {
   }
 };
 function reportLoginProgress(progress, event) {
+  if (event.status === "authorization-url") {
+    progress.note(`Open this URL to approve the login: ${event.url}`);
+    return;
+  }
+  if (event.status === "failed") {
+    const port = event.callbackPort;
+    progress.fail(`Could not open a browser: ${event.reason.replace(/\.$/, "")}.`);
+    progress.note(`Open the URL above in a browser that can reach 127.0.0.1:${port} on this machine. From another computer, forward that port first: \`ssh -L ${port}:127.0.0.1:${port} <this host>\` or your VM's port forwarding both work.`);
+    return;
+  }
   const messages = LOGIN_PROGRESS_MESSAGES[event.step];
   if (event.status === "started")
     progress.start(messages.started);
@@ -1518,6 +1578,17 @@ var TerminalProgress = class {
   fail(message = this.activeMessage) {
     this.finish("!!", message);
   }
+  note(message) {
+    if (this.stream.isTTY && this.activeMessage) {
+      this.stream.write(`\r${"".padEnd(this.lastWidth)}\r${message}
+`);
+      this.lastWidth = 0;
+      this.render(`[${FRAMES[this.frame]}] ${this.activeMessage}`);
+      return;
+    }
+    this.stream.write(`${message}
+`);
+  }
   finish(marker, message) {
     if (this.timer)
       clearInterval(this.timer);
@@ -1653,6 +1724,29 @@ async function memberListCommand(deps, options = {}) {
     ) : "No members."
   );
 }
+async function workspaceListCommand(deps, options = {}) {
+  const page = await deps.api.listGitWorkspaces(await deps.auth.apiKey(), {
+    limit: options.limit,
+    cursor: options.cursor
+  });
+  printPage(
+    deps,
+    options.json,
+    page,
+    (workspaces) => workspaces.length ? table(
+      ["ID", "NAME", "DEFAULT", "REGION", "GIT ORIGIN", "STATE", "CREATED"],
+      workspaces.map((workspace) => [
+        workspace.id,
+        workspace.name ?? "",
+        workspace.default ? "yes" : "",
+        workspace.region,
+        `${workspace.git_origin}/${workspace.ws_hex}`,
+        workspace.state,
+        workspace.created_at
+      ])
+    ) : "No git workspaces."
+  );
+}
 async function resolveMemberSubject(deps, key, member) {
   if (member.startsWith("agent.")) return member;
   const subjects = /* @__PURE__ */ new Set();
@@ -2011,7 +2105,7 @@ async function databaseCreateCommand(deps, name, options = {}) {
 }
 function databaseNextStep(name) {
   return [
-    "Next: npm i @tonbo/sqlite-ursula@0.11.2",
+    "Next: npm i --save-exact @tonbo/sqlite-ursula@0.11.2",
     `      open(${JSON.stringify(name)}) from "@tonbo/sqlite-ursula/tonbo"`
   ].join("\n");
 }
@@ -2249,7 +2343,16 @@ var MACHINE_ERROR_HINTS = {
   snapshot_would_be_discarded: "Pass --discard-snapshot to apply the change at the next boot, which then starts fresh.",
   database_limit_reached: "Each Machine counts one database: delete a Machine or a database (`tonbo database list`) first.",
   idempotency_conflict: "That idempotency key belongs to another request: leave out --idempotency-key to create a new Machine.",
-  create_rate_limited: "Too many Machines were created in the last hour; try again later."
+  create_rate_limited: "Too many Machines were created in the last hour; try again later.",
+  image_pulling: "The Machine's image is still being pulled; the request was not run. Try again shortly; `tonbo machine show` reports the image's state.",
+  image_failed: "The Machine's image could not be pulled; `tonbo machine show` says why. Fix the image, then name it again with `tonbo machine update --image`.",
+  machine_kind_mismatch: "That Machine is one of your computers: `tonbo machine show` and `tonbo machine delete` serve it, and nothing else does."
+};
+var MACHINE_IMAGE_FAILURE_HINTS = {
+  image_unavailable: "The registry no longer serves that image publicly, or served other bytes for it: publish it again, or use another image",
+  image_platform_unsupported: "Machines run linux/arm64: publish the image for that platform (for example `docker buildx build --platform linux/arm64`)",
+  image_too_large: "Make the image smaller (fewer or smaller layers)",
+  image_unsupported: "Rebuild the image without the entry the message names"
 };
 function explainMachineError(error) {
   if (!(error instanceof HttpError) || error.code === null) return error;
@@ -2280,8 +2383,27 @@ function machineState(machine) {
   return machine.failure ? `${machine.state}: ${machine.failure.code}: ${machine.failure.message}` : machine.state;
 }
 function imageText(machine) {
-  const { reference, digest } = machine.image;
-  return `${reference} (${digest ?? "platform image"})`;
+  const { reference, repository, digest, state } = machine.image;
+  if (digest === null) return `${reference} (platform image)`;
+  const pulled = repository === null ? digest : `${repository}@${digest}`;
+  const pulling = state === "resolved" && (machine.state === "creating" || machine.state === "active");
+  return `${reference} (${pulled}, ${pulling ? "pulling" : state})`;
+}
+function imageNextStep(machine, hint) {
+  if (machine.state === "deleting") return null;
+  if (machine.state === "failed")
+    return `${hint}. A failed Machine does not change: delete it with \`tonbo machine delete\` and create another that names the fixed image.`;
+  return `${hint}, then name it again with \`tonbo machine update --image\`.`;
+}
+function imageFailureFields(machine) {
+  const { failure } = machine.image;
+  if (!failure) return [];
+  const hint = MACHINE_IMAGE_FAILURE_HINTS[failure.code];
+  const next = hint ? imageNextStep(machine, hint) : null;
+  return [
+    ["Image failure", `${failure.code}: ${failure.message}`],
+    ...next ? [["Next step", next]] : []
+  ];
 }
 function machineFields(machine) {
   return fields([
@@ -2292,6 +2414,7 @@ function machineFields(machine) {
     ["Power", machine.status.power],
     ["Shape", machine.shape],
     ["Image", imageText(machine)],
+    ...imageFailureFields(machine),
     ["Command", machine.command ? machine.command.join(" ") : "the image's own"],
     ["Ports", machinePortsText(machine)],
     ["HTTPS", machine.hostnames.https],
@@ -2306,6 +2429,32 @@ function machineFields(machine) {
     ["Updated", machine.updated_at]
   ]);
 }
+function keyStateText(machine) {
+  const state = machine.byoc.key_state;
+  if (state === "active") return state;
+  return `${state}: this computer is signed out; \`yield login\` on it signs it in again`;
+}
+function deviceFields(machine) {
+  const { byoc } = machine;
+  return fields([
+    ["Name", machine.name],
+    ["ID", machine.id],
+    ["Kind", "byoc (one of your computers)"],
+    ["Region", machine.region],
+    ...byoc.hostname === void 0 ? [] : [["Hostname", byoc.hostname]],
+    ...byoc.device_id === void 0 ? [] : [["Device ID", byoc.device_id]],
+    ["System", `${byoc.os}/${byoc.arch}`],
+    ["Client", `${byoc.client} ${byoc.client_version}`],
+    ["Harnesses", byoc.harnesses.join(", ") || "none"],
+    ["Last seen", byoc.last_seen],
+    ["Key", keyStateText(machine)],
+    ["Created", machine.created_at],
+    ["Updated", machine.updated_at]
+  ]);
+}
+function anyMachineFields(machine) {
+  return machine.kind === "byoc" ? deviceFields(machine) : machineFields(machine);
+}
 function parsePorts(specs, current) {
   const accesses = machinePortAccess;
   return specs.map((spec) => {
@@ -2350,23 +2499,41 @@ async function machineListCommand(deps, options = {}) {
       limit: options.limit,
       cursor: options.cursor
     });
-    printPage(
-      deps,
-      options.json,
-      page,
-      (machines) => machines.length ? table(
-        ["NAME", "REGION", "STATE", "POWER", "SHAPE", "IMAGE", "HTTPS"],
-        machines.map((machine) => [
-          machine.name,
-          machine.region,
-          machine.state,
-          machine.status.power,
-          machine.shape,
-          machine.image.reference,
-          machine.hostnames.https
-        ])
-      ) : "No Machines."
-    );
+    printPage(deps, options.json, page, (machines) => {
+      const managed = machines.filter((machine) => machine.kind !== "byoc");
+      const devices = machines.filter((machine) => machine.kind === "byoc");
+      const tables = [];
+      if (managed.length)
+        tables.push(
+          table(
+            ["NAME", "REGION", "STATE", "POWER", "SHAPE", "IMAGE", "HTTPS"],
+            managed.map((machine) => [
+              machine.name,
+              machine.region,
+              machine.state,
+              machine.status.power,
+              machine.shape,
+              machine.image.reference,
+              machine.hostnames.https
+            ])
+          )
+        );
+      if (devices.length)
+        tables.push(
+          table(
+            ["COMPUTER", "REGION", "SYSTEM", "HARNESSES", "LAST SEEN", "KEY"],
+            devices.map((machine) => [
+              machine.name,
+              machine.region,
+              `${machine.byoc.os}/${machine.byoc.arch}`,
+              machine.byoc.harnesses.join(",") || "none",
+              machine.byoc.last_seen,
+              machine.byoc.key_state
+            ])
+          )
+        );
+      return tables.length ? tables.join("\n\n") : "No Machines.";
+    });
     if (page.unavailable_regions.length)
       deps.notice(
         `Could not read the Machines in ${page.unavailable_regions.join(", ")}; they are missing from this list.`
@@ -2413,7 +2580,7 @@ async function machineCreateCommand(deps, name, command, options = {}) {
 async function machineShowCommand(deps, name, options = {}) {
   await machineCommand(async () => {
     const machine = await deps.api.getMachine(await deps.auth.apiKey(), name);
-    print(deps, options.json, machine, machineFields(machine));
+    print(deps, options.json, machine, anyMachineFields(machine));
   });
 }
 async function machineUpdateCommand(deps, name, command, options = {}) {
@@ -2423,7 +2590,12 @@ async function machineUpdateCommand(deps, name, command, options = {}) {
     if (options.clearPorts && (options.port?.length || options.defaultPort !== void 0))
       throw new Error("Give --port or --clear-ports, not both.");
     const key = await deps.auth.apiKey();
-    const current = await deps.api.getMachine(key, name);
+    const read = await deps.api.getMachine(key, name);
+    if (read.kind === "byoc")
+      throw new Error(
+        `${name} is one of your computers; only \`tonbo machine show\` and \`tonbo machine delete\` serve it.`
+      );
+    const current = read;
     const change = {
       image: options.image,
       shape: options.shape,
@@ -2478,24 +2650,42 @@ async function machineSleepCommand(deps, name, options = {}) {
 }
 async function machineDeleteCommand(deps, name, options = {}) {
   await machineCommand(async () => {
+    const key = await deps.auth.apiKey();
     await confirm(
       deps,
       options.yes,
       `delete Machine ${name}`,
-      () => Promise.resolve(
-        `Delete Machine ${name} with its disk, database and logs? This cannot be undone. Type the Machine's name to confirm:`
-      ),
+      () => deleteQuestion(deps, key, name),
       name
     );
-    const machine = await deps.api.deleteMachine(await deps.auth.apiKey(), name);
-    print(
-      deps,
-      options.json,
-      machine,
-      machine ? `Machine ${machine.name} is being deleted; its name is free for a new Machine.` : `Released the name ${name}; no Machine had been created under it.`
-    );
+    const { machine, kind } = await deps.api.deleteMachine(key, name);
+    print(deps, options.json, machine, deletedText(name, machine, kind));
+    if (machine?.kind === "byoc" && machine.byoc.key_state === "active")
+      deps.notice(
+        `Its key is still active, so ${name} registers again at its next start. Run \`yield logout\` on it, or revoke its key with \`tonbo api-key revoke\`, then forget it again.`
+      );
   });
 }
+async function deleteQuestion(deps, key, name) {
+  let kind = null;
+  try {
+    kind = (await deps.api.getMachine(key, name)).kind;
+  } catch (error) {
+    if (!(error instanceof HttpError && error.status === 404)) throw error;
+  }
+  if (kind === "byoc")
+    return `Forget your computer ${name}? It disappears from your Machines; its key is not revoked. Type its name to confirm:`;
+  if (kind === "managed")
+    return `Delete Machine ${name} with its disk, database and logs? This cannot be undone. Type the Machine's name to confirm:`;
+  return `Delete Machine ${name}? Type its name to confirm:`;
+}
+function deletedText(name, machine, kind) {
+  if (kind === "byoc")
+    return `Forgot your computer ${machine?.name ?? name}; its name is free once the forget completes.`;
+  if (machine)
+    return `Machine ${machine.name} is being deleted; its name is free for a new Machine.`;
+  return `Released the name ${name}; no Machine had been created under it.`;
+}
 async function machineShapesCommand(deps, options = {}) {
   await machineCommand(async () => {
     const shapes = await deps.api.listMachineShapes(await deps.auth.apiKey());
@@ -2635,6 +2825,12 @@ function createProgram(dependencies = createDependencies) {
     program.command("region").description("regions new resources can be created in").command("list").description("list the regions"),
     "listRegions"
   ).action(async (options) => regionListCommand(dependencies(), options));
+  operationOptions(
+    program.command("workspace").description("the account's git workspaces").command("list").description("list the git workspaces, the default first"),
+    "listGitWorkspaces"
+  ).action(
+    async (options) => workspaceListCommand(dependencies(), options)
+  );
   const member = program.command("member").description("the people and Agents of the account");
   operationOptions(
     member.command("list").description("list the members and their roles"),
@@ -2859,7 +3055,7 @@ function createProgram(dependencies = createDependencies) {
   );
   const machine = program.command("machine").description("the account's Machines");
   operationOptions(
-    machine.command("list").description("list the Machines in every region"),
+    machine.command("list").description("list the Machines in every region, and your computers in a personal account"),
     "listMachines"
   ).action(
     async (options) => machineListCommand(dependencies(), options)
@@ -2885,7 +3081,7 @@ function createProgram(dependencies = createDependencies) {
     async (name, command, options) => machineCreateCommand(dependencies(), name, command, options)
   );
   operationOptions(
-    machine.command("show <name>").description("show a Machine, its hostnames and its state"),
+    machine.command("show <name>").description("show a Machine, its hostnames and its state, or one of your computers"),
     "getMachine"
   ).action(
     async (name, options) => machineShowCommand(dependencies(), name, options)
@@ -2912,7 +3108,9 @@ function createProgram(dependencies = createDependencies) {
     async (name, options) => machineSleepCommand(dependencies(), name, options)
   );
   operationOptions(
-    machine.command("delete <name>").description("delete a Machine with its disk, database and logs").option("--yes", "delete without asking; required when stdin is not a terminal"),
+    machine.command("delete <name>").description(
+      "delete a Machine with its disk, database and logs, or forget one of your computers"
+    ).option("--yes", "delete without asking; required when stdin is not a terminal"),
     "deleteMachine"
   ).action(
     async (name, options) => machineDeleteCommand(dependencies(), name, options)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tonbo/cli",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "description": "The Tonbo CLI: sign in and manage account resources from the command line.",
   "homepage": "https://tonbo.dev",
   "bugs": {