@withbuddi/buddi 0.1.0-pre.24 → 0.1.0-pre.26

package/packages/cli/dist/connections-cmd.js

@@ -0,0 +1,657 @@
+/**
+ * `buddi connections`: Settings → Connections from the terminal
+ * (docs/connections.md, "From the terminal").
+ *
+ * The connections service and the tools it registers live in the running
+ * gateway, so every subcommand goes through it: the dashboard's own routes
+ * (`/api/connections…`), reached as the owner the way `buddi mcp` reaches them
+ * (`mcp/gateway-client.ts`: a loopback session, or a five-minute ticket off
+ * loopback), with the same CSRF pair and origin the page sends. Nothing here
+ * writes a store of its own, and nothing here prints or logs a token.
+ *
+ * `add` walks the dashboard's four screens in order: address, sign-in,
+ * review, give. A sign-in on the service's own page is a consent the gateway
+ * mints for the CLI (`cli: true`): the owner opens the link in any browser,
+ * the service sends them to the dashboard's `/connections/callback`, and this
+ * command polls the connection until it is signed in, ten minutes at most.
+ * A card that recommends the device way (GitHub) prints a code and the
+ * address to type it at; the gateway waits for the approval and this command
+ * polls the connection until its `device` says done or why not.
+ *
+ * `add <name> -- <command> <args…>` is a program on this computer: the line
+ * is printed in full, each `--secret` is asked for with the echo off (or read
+ * from stdin, one line each, when there is no terminal), and the review is
+ * the first time it runs, only to list its tools.
+ */
+import { spawn } from 'node:child_process';
+import { createInterface } from 'node:readline';
+import { looksSecret, parsePastedServer } from '@buddi/core/connection-config';
+import { GatewayError, GatewayUnavailable, NOT_RUNNING } from './mcp/gateway-client.js';
+import { confirmTty, promptHidden } from './vault-cmd.js';
+/** A sign-in on the service's own page waits this long, like the dashboard. */
+export const CONSENT_WAIT_MS = 10 * 60_000;
+export const OPEN_IN_BROWSER = 'Open it in your browser; the page sends you back to your dashboard and this command carries on.';
+function defaultIo() {
+    return {
+        out: (line) => console.log(line),
+        err: (line) => console.error(line),
+        interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+        confirm: confirmTty,
+        ask: async (question) => {
+            const rl = createInterface({ input: process.stdin, output: process.stdout });
+            try {
+                return await new Promise((resolve) => rl.question(question, resolve));
+            }
+            finally {
+                rl.close();
+            }
+        },
+        secret: promptHidden,
+        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+        now: () => Date.now(),
+        enter: (question) => {
+            const rl = createInterface({ input: process.stdin, output: process.stdout });
+            let settle = () => { };
+            const pressed = new Promise((resolve) => { settle = resolve; });
+            rl.question(question, () => { settle(true); rl.close(); });
+            rl.on('close', () => settle(false));
+            return { pressed, cancel: () => rl.close() };
+        },
+        openUrl: openInBrowser,
+        readStdin: async () => {
+            const chunks = [];
+            for await (const chunk of process.stdin)
+                chunks.push(Buffer.from(chunk));
+            return Buffer.concat(chunks).toString('utf8');
+        },
+    };
+}
+/** `open` on macOS, `xdg-open` on Linux; elsewhere nothing, and the printed address is the answer. */
+export function openInBrowser(url, platform = process.platform) {
+    const opener = platform === 'darwin' ? 'open' : platform === 'linux' ? 'xdg-open' : undefined;
+    if (!opener)
+        return;
+    try {
+        const child = spawn(opener, [url], { stdio: 'ignore', detached: true });
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch {
+        // The owner opens it.
+    }
+}
+/** A stop with a sentence and an exit code; the sentence is already said. */
+class Stop extends Error {
+    code;
+    constructor(code) {
+        super('stop');
+        this.code = code;
+    }
+}
+export async function runConnections(command, deps) {
+    const io = { ...defaultIo(), ...deps.io };
+    if ('off' in deps.gateway) {
+        io.err(deps.gateway.off);
+        return 3;
+    }
+    const run = new Run(deps.gateway, io, deps.json, deps.pollMs ?? 2_000);
+    try {
+        switch (command.action) {
+            case 'list': return await run.list();
+            case 'add': return await run.add(command);
+            case 'review': return await run.review(command.name, { keep: command.keep, ...(command.slug ? { slug: command.slug } : {}) });
+            case 'give': return await run.give(command.name, command.to);
+            case 'remove': return await run.remove(command.name, command.yes);
+        }
+    }
+    catch (err) {
+        if (err instanceof Stop)
+            return err.code;
+        if (err instanceof GatewayUnavailable) {
+            io.err(NOT_RUNNING);
+            return 3;
+        }
+        if (err instanceof GatewayError) {
+            io.err(err.message);
+            return err.status === 503 ? 3 : 1;
+        }
+        throw err;
+    }
+}
+/** The tier as the review screen says it. */
+export function tierWords(tool) {
+    if (tool.tier === 'auto')
+        return 'runs on its own';
+    return tool.destructive ? 'asks every time' : 'asks you first';
+}
+const STATE_WORDS = {
+    connected: 'connected',
+    'pending-review': 'waiting for your review',
+    'needs-review': 'changed its tools; review them',
+    'needs-reconnect': 'needs you to sign in again',
+    unreachable: 'unreachable, retrying',
+};
+const plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+/** One word as a shell needs it written. */
+function quoteWord(word) {
+    if (word !== '' && /^[A-Za-z0-9_@%+=:,./-]+$/.test(word))
+        return word;
+    return `'${word.replace(/'/g, `'\\''`)}'`;
+}
+class Run {
+    gateway;
+    io;
+    json;
+    pollMs;
+    constructor(gateway, io, json, pollMs) {
+        this.gateway = gateway;
+        this.io = io;
+        this.json = json;
+        this.pollMs = pollMs;
+    }
+    #listing() {
+        return this.gateway.get('/api/connections');
+    }
+    /** A connection by its name in buddi (slug), its display name, or its id. */
+    async #find(name) {
+        const listing = await this.#listing();
+        const wanted = name.trim().toLowerCase();
+        const bySlug = listing.connections.find((c) => c.slug === wanted);
+        if (bySlug)
+            return { view: bySlug, listing };
+        const byId = listing.connections.find((c) => c.id === wanted);
+        if (byId)
+            return { view: byId, listing };
+        const byName = listing.connections.filter((c) => c.name.toLowerCase() === wanted);
+        if (byName.length === 1)
+            return { view: byName[0], listing };
+        if (byName.length > 1) {
+            this.io.err(`${byName.length} connections are called ${name}. Name one by its id: ${byName.map((c) => c.id).join(', ')}.`);
+            throw new Stop(1);
+        }
+        const known = listing.connections.map((c) => c.slug ?? c.name);
+        this.io.err(`There is no connection called ${name}.${known.length ? ` There is ${known.join(', ')}.` : ' Add one with buddi connections add.'}`);
+        throw new Stop(1);
+    }
+    #agentNames(listing, ids) {
+        return ids.map((id) => listing.agents.find((a) => a.id === id)?.name ?? id).join(', ');
+    }
+    /* ---------------------------------------------------------------- list */
+    async list() {
+        const listing = await this.#listing();
+        if (this.json) {
+            this.io.out(JSON.stringify(listing.connections.map((c) => ({
+                id: c.id, name: c.name, slug: c.slug, state: c.state, host: c.host, url: c.url,
+                signedIn: c.signedIn, tools: c.toolCount, heldTools: c.heldTools, agents: c.agents,
+            })), null, 2));
+            return 0;
+        }
+        if (listing.connections.length === 0) {
+            this.io.out('No connections yet.');
+            this.io.out(`Add one with buddi connections add <card|https://…>. The cards: ${listing.catalog.map((c) => c.id).join(', ')}.`);
+            return 0;
+        }
+        for (const c of listing.connections) {
+            const who = c.slug ?? c.name;
+            const tools = c.slug ? plural(c.toolCount, 'tool') : 'not reviewed';
+            const agents = c.agents.length > 0 ? `given to ${this.#agentNames(listing, c.agents)}` : 'given to nobody';
+            const held = c.heldTools > 0 ? `, ${c.heldTools} waiting for review` : '';
+            const state = c.state === 'unreachable' && c.unreachableSince ? `unreachable since ${c.unreachableSince}, retrying`
+                : c.state === 'pending-review' && !c.signedIn ? 'waiting for a sign-in' : STATE_WORDS[c.state];
+            this.io.out(`${who}  ${c.name} (${c.host})  ${state}  ${tools}${held}  ${agents}`);
+        }
+        return 0;
+    }
+    /* ----------------------------------------------------------------- add */
+    async add(cmd) {
+        if (cmd.program) {
+            const vars = cmd.program.env.map((e) => ({ name: e.name, value: e.value, secret: false }));
+            const asked = await this.#askSecrets(cmd.program.secrets);
+            if (asked === null)
+                return 1;
+            vars.push(...asked);
+            return this.#addProgram(cmd, cmd.address, cmd.program.command, cmd.program.args, vars);
+        }
+        // 1. Address. A pasted block is read before anything is asked of buddi.
+        let config;
+        if (cmd.config !== undefined) {
+            let read;
+            try {
+                read = parsePastedServer(cmd.config);
+            }
+            catch (err) {
+                this.io.err(err instanceof Error ? err.message : String(err));
+                return 2;
+            }
+            if (read.kind === 'program') {
+                const p = read.program;
+                // A value on the line is taken as given; a placeholder is asked for.
+                const blanks = p.env.filter((e) => e.value === '').map((e) => e.name);
+                const asked = await this.#askSecrets(blanks);
+                if (asked === null)
+                    return 1;
+                const vars = [
+                    ...p.env.filter((e) => e.value !== '').map((e) => ({ name: e.name, value: e.value, secret: e.secret })),
+                    ...asked,
+                ];
+                const name = cmd.name ?? p.name;
+                if (!name) {
+                    this.io.err('Give the program a name with --name.');
+                    return 2;
+                }
+                return this.#addProgram(cmd, name, p.command, p.args, vars);
+            }
+            config = read.config;
+            for (const dropped of config.dropped)
+                this.io.out(`buddi sends one header; ${dropped} is left out.`);
+        }
+        const listing = await this.#listing();
+        let card;
+        let url;
+        if (config)
+            url = config.url;
+        else {
+            const address = cmd.address.trim();
+            if (/^https?:\/\//i.test(address))
+                url = address;
+            else {
+                card = listing.catalog.find((c) => c.id === address.toLowerCase());
+                if (!card) {
+                    this.io.err(`There is no card called ${address}. The cards: ${listing.catalog.map((c) => c.id).join(', ')}; or give an https:// address.`);
+                    return 2;
+                }
+                url = card.url;
+            }
+        }
+        card ??= listing.catalog.find((c) => c.url === url);
+        const name = cmd.name ?? config?.name ?? card?.name;
+        const added = (await this.gateway.post('/api/connections', { url, ...(name ? { name } : {}) })).body;
+        let view = added.connection;
+        this.io.out(`Opened ${view.host}: ${view.name}.`);
+        const waits = () => this.io.out(`${view.name} waits under Settings → Connections; buddi connections remove "${view.name}" takes it away.`);
+        // 2. Sign in.
+        try {
+            if (added.signIn === 'none')
+                this.io.out(`${view.name} wants no sign-in.`);
+            else
+                view = await this.#signIn(view, added.signIn, cmd, card, config);
+        }
+        catch (err) {
+            if (err instanceof Stop || err instanceof GatewayError) {
+                if (err instanceof GatewayError)
+                    this.io.err(err.message);
+                waits();
+                throw new Stop(1);
+            }
+            throw err;
+        }
+        // 3. Review.
+        const reviewed = await this.#review(view, { keep: cmd.keep, ...(cmd.slug ? { slug: cmd.slug } : {}) });
+        if (!reviewed)
+            return 0;
+        // 4. Give.
+        return this.#give(reviewed, cmd.to, listing);
+    }
+    /**
+     * Each named secret with the echo off, or from stdin one line each when
+     * there is no terminal. Null, said, when one is missing.
+     */
+    async #askSecrets(names) {
+        if (names.length === 0)
+            return [];
+        let values;
+        if (this.io.interactive) {
+            values = [];
+            for (const name of names)
+                values.push((await this.io.secret(`${name} (not shown): `)).trim());
+        }
+        else {
+            values = (await this.io.readStdin()).split(/\r?\n/).map((line) => line.trim());
+        }
+        const out = [];
+        for (const [i, name] of names.entries()) {
+            const value = values[i] ?? '';
+            if (value === '') {
+                this.io.err(this.io.interactive
+                    ? `No value was given for ${name}, so nothing was added.`
+                    : `No value for ${name} on stdin (one line per --secret, in order), so nothing was added.`);
+                return null;
+            }
+            out.push({ name, value, secret: true });
+        }
+        return out;
+    }
+    /** A program on this computer: recorded, reviewed (its first run), given. */
+    async #addProgram(cmd, name, command, args, vars) {
+        const line = [command, ...args].map(quoteWord).join(' ');
+        this.io.out(`${cmd.name ?? name} runs on this computer as you:`);
+        this.io.out(`  ${line}`);
+        for (const v of vars)
+            this.io.out(`  ${v.name}=${v.secret ? '(secret, kept in the vault)' : v.value}`);
+        const plainSecrets = vars.filter((v) => !v.secret && looksSecret(v.name)).map((v) => v.name);
+        if (plainSecrets.length > 0)
+            this.io.out(`${plainSecrets.join(', ')} ${plainSecrets.length === 1 ? 'looks' : 'look'} like a secret; --secret keeps one in the vault instead.`);
+        const added = (await this.gateway.post('/api/connections', {
+            transport: 'stdio', name: cmd.name ?? name, command, args, env: vars,
+        })).body;
+        const view = added.connection;
+        this.io.out(`Starting ${view.name} to read its tools. The first start can take a minute or two while it downloads.`);
+        let reviewed;
+        try {
+            reviewed = await this.#review(view, { keep: cmd.keep, ...(cmd.slug ? { slug: cmd.slug } : {}) });
+        }
+        catch (err) {
+            if (err instanceof GatewayError) {
+                this.io.err(err.message);
+                const fresh = await this.gateway.get(`/api/connections/${view.id}`).catch(() => undefined);
+                if (fresh?.stderr?.length) {
+                    this.io.err('Its last lines:');
+                    for (const l of fresh.stderr)
+                        this.io.err(`  ${l}`);
+                }
+                this.io.out(`${view.name} waits under Settings → Connections; buddi connections remove "${view.name}" takes it away.`);
+                return 1;
+            }
+            throw err;
+        }
+        if (!reviewed)
+            return 0;
+        const listing = await this.#listing();
+        return this.#give(reviewed, cmd.to, listing);
+    }
+    async #signIn(view, signIn, cmd, card, config) {
+        const header = config?.header;
+        const forced = cmd.token || cmd.tokenStdin || header !== undefined;
+        if (!forced && !cmd.clientId && card?.auth?.recommended === 'device' && card.auth.device) {
+            return this.#device(view, card);
+        }
+        const wantsToken = forced || (!cmd.clientId && card?.auth?.recommended === 'token');
+        if (wantsToken)
+            return this.#token(view, cmd, card, header);
+        if (signIn === 'manual' && !cmd.clientId) {
+            this.io.err(`${view.name} does not let buddi register itself. Run again with --client-id <id> (an app you create in its developer settings, with the redirect address ${this.gateway.baseUrl}/connections/callback), or with --token.`);
+            throw new Stop(1);
+        }
+        return this.#consent(view, cmd.clientId);
+    }
+    async #token(view, cmd, card, header) {
+        let token = header?.value ?? '';
+        if (token === '') {
+            if (card?.auth?.recommended === 'token' && !cmd.token && !cmd.tokenStdin) {
+                this.io.out(`${card.name} recommends a token.${card.auth.tokenPage ? ` Make one at ${card.auth.tokenPage}` : ''}`);
+                if (card.auth.tokenHint)
+                    this.io.out(card.auth.tokenHint);
+            }
+            if (!cmd.tokenStdin && !this.io.interactive) {
+                this.io.err('There is no terminal to type the token in. Pipe it with --token-stdin.');
+                throw new Stop(1);
+            }
+            token = (await this.io.secret(`Token for ${view.name} (not shown): `)).trim();
+            if (token === '') {
+                this.io.err('No token was given, so nothing was signed in.');
+                throw new Stop(1);
+            }
+        }
+        const done = await this.gateway.post(`/api/connections/${view.id}/token`, {
+            token,
+            ...(header ? { header: header.name, prefix: header.prefix } : {}),
+        });
+        this.io.out(`${view.name} accepted the token; buddi keeps it as one of your secrets.`);
+        return done.body.connection;
+    }
+    /**
+     * A code typed on the service's site: the gateway asks for it and waits for
+     * the approval; this prints it with the address, opens the address on
+     * Enter, and polls the connection until its `device` says done or why not.
+     */
+    async #device(view, card) {
+        let started;
+        try {
+            started = (await this.gateway.post(`/api/connections/${view.id}/device`, {})).body;
+        }
+        catch (err) {
+            if (err instanceof GatewayError) {
+                this.io.err(`${err.message} Run again with --token to sign in with a token instead.`);
+                throw new Stop(1);
+            }
+            throw err;
+        }
+        this.io.out(`Sign in to ${card.name} with this code:`);
+        this.io.out('');
+        this.io.out(`  ${started.userCode}`);
+        this.io.out('');
+        this.io.out(`Type it at ${started.verificationUri} and say yes there.`);
+        const enter = this.io.interactive ? this.io.enter('Press Enter to open it in your browser, or open it yourself. ') : undefined;
+        void enter?.pressed.then((pressed) => { if (pressed)
+            this.io.openUrl(started.verificationUri); });
+        try {
+            const until = Math.max(Date.parse(started.expiresAt) || 0, this.io.now()) + 30_000;
+            while (this.io.now() < until) {
+                await this.io.sleep(this.pollMs);
+                const fresh = await this.gateway.get(`/api/connections/${view.id}`).catch((err) => {
+                    if (err instanceof GatewayUnavailable)
+                        throw err;
+                    return undefined;
+                });
+                if (fresh?.device?.state === 'done') {
+                    if (enter)
+                        this.io.out('');
+                    this.io.out(`Signed in to ${fresh.name}.`);
+                    return fresh;
+                }
+                if (fresh?.device?.state === 'failed') {
+                    if (enter)
+                        this.io.out('');
+                    this.io.err(fresh.device.reason ?? 'The sign-in did not finish. Start it again.');
+                    throw new Stop(1);
+                }
+            }
+            this.io.err('The code expired before it was approved. Start it again.');
+            throw new Stop(1);
+        }
+        finally {
+            enter?.cancel();
+        }
+    }
+    async #consent(view, clientId) {
+        let started;
+        try {
+            started = (await this.gateway.post(`/api/connections/${view.id}/consent`, { cli: true, ...(clientId ? { clientId } : {}) })).body;
+        }
+        catch (err) {
+            if (err instanceof GatewayError && err.body?.code === 'client-id') {
+                this.io.err(`${err.message} Run again with --client-id <id> or --token. The redirect address is ${this.gateway.baseUrl}/connections/callback.`);
+                throw new Stop(1);
+            }
+            throw err;
+        }
+        if (clientId)
+            this.io.out(`The app's redirect address must be ${started.redirectUri}.`);
+        this.io.out(`Sign in to ${view.name} here:`);
+        this.io.out(`  ${started.authorizeUrl}`);
+        this.io.out(OPEN_IN_BROWSER);
+        const until = this.io.now() + CONSENT_WAIT_MS;
+        while (this.io.now() < until) {
+            await this.io.sleep(this.pollMs);
+            const fresh = await this.gateway.get(`/api/connections/${view.id}`).catch((err) => {
+                if (err instanceof GatewayUnavailable)
+                    throw err;
+                return undefined;
+            });
+            if (fresh?.signedIn && fresh.authKind === 'oauth') {
+                this.io.out(`Signed in to ${fresh.name}.`);
+                return fresh;
+            }
+        }
+        this.io.err('The sign-in did not come back within ten minutes. Start it again.');
+        throw new Stop(1);
+    }
+    /* -------------------------------------------------------------- review */
+    #printReview(review, slug) {
+        const name = review.connection.name;
+        if (review.program) {
+            this.io.out(`${name} runs on this computer as you: ${review.program.line}`);
+            this.io.out(`It brings ${plural(review.tools.length, 'tool')}. buddi starts it when an agent needs one and stops it after ten quiet minutes.`);
+        }
+        else {
+            this.io.out(`${name} brings ${plural(review.tools.length, 'tool')}. buddi talks to ${review.host} for them, and nowhere else.`);
+        }
+        if (review.annotatedNothing)
+            this.io.out(`${name} says nothing about what its tools do, so every one of them asks you first.`);
+        const changes = review.changes;
+        if (changes && changes.added.length + changes.changed.length + changes.removed.length > 0) {
+            this.io.out(`${name} changed its tools since your last review. Until you keep this list, the new and changed ones wait.`);
+            if (changes.removed.length > 0)
+                this.io.out(`  Gone: ${changes.removed.join(', ')}`);
+        }
+        const width = Math.max(0, ...review.tools.map((t) => t.fullName.length));
+        for (const tool of review.tools) {
+            const fullName = review.slugEditable ? tool.fullName.replace(/^mcp\.[^.]+\./, `mcp.${slug}.`) : tool.fullName;
+            const mark = tool.change === 'added' ? '  (new)' : tool.change === 'changed' ? '  (changed)' : '';
+            const extra = Math.max(0, fullName.length - tool.fullName.length);
+            this.io.out(`  ${fullName.padEnd(width + extra)}  ${tierWords(tool)}${mark}`);
+            const description = tool.description.replace(/\s+/g, ' ').trim();
+            if (description)
+                this.io.out(`      ${description.length > 160 ? `${description.slice(0, 157)}…` : description}`);
+            if (tool.problem)
+                this.io.out(`      Not usable: ${tool.problem}`);
+        }
+    }
+    /** Read the review, print it, and keep it when the owner says so. The kept view, or null. */
+    async #review(view, opts) {
+        const review = await this.gateway.get(`/api/connections/${view.id}/review`);
+        const slug = review.slugEditable ? (opts.slug?.trim().toLowerCase() || review.slug) : review.slug;
+        if (opts.slug && !review.slugEditable && opts.slug.trim().toLowerCase() !== review.slug) {
+            this.io.out(`${view.name} is already called ${review.slug}; only the first review names it.`);
+        }
+        if (this.json)
+            this.io.out(JSON.stringify({ ...review, slug }, null, 2));
+        else
+            this.#printReview(review, slug);
+        let keep = opts.keep;
+        if (!keep && !this.json && this.io.interactive)
+            keep = await this.io.confirm(`Keep these tools as mcp.${slug}.*?`);
+        if (!keep) {
+            if (!this.json)
+                this.io.out(`Nothing was kept. Run buddi connections review ${review.slugEditable ? `"${view.name}"` : slug} --keep when you have read them.`);
+            return null;
+        }
+        try {
+            const kept = (await this.gateway.post(`/api/connections/${view.id}/review`, {
+                hash: review.hash, ...(review.slugEditable ? { slug } : {}),
+            })).body;
+            if (!this.json)
+                this.io.out(`Kept. ${kept.name}'s tools are called mcp.${kept.slug}.<tool>.`);
+            return kept;
+        }
+        catch (err) {
+            if (err instanceof GatewayError) {
+                this.io.err(err.message);
+                throw new Stop(1);
+            }
+            throw err;
+        }
+    }
+    async review(name, opts) {
+        const { view } = await this.#find(name);
+        await this.#review(view, opts);
+        return 0;
+    }
+    /* ---------------------------------------------------------------- give */
+    /** Agent ids, handles or names to ids; a sentence and a stop for one it does not know. */
+    #agentIds(listing, words) {
+        const ids = [];
+        const unknown = [];
+        for (const word of words) {
+            const w = word.toLowerCase().replace(/^@/, '');
+            const hit = listing.agents.find((a) => a.id === w || a.handle.toLowerCase().replace(/^@/, '') === w || a.name.toLowerCase() === w);
+            if (hit) {
+                if (!ids.includes(hit.id))
+                    ids.push(hit.id);
+            }
+            else
+                unknown.push(word);
+        }
+        if (unknown.length > 0) {
+            this.io.err(`No such agent: ${unknown.join(', ')}. The agents: ${listing.agents.map((a) => a.handle || a.id).join(', ')}.`);
+            throw new Stop(2);
+        }
+        return ids;
+    }
+    async #give(view, to, listing) {
+        const grant = `mcp.${view.slug}.*`;
+        let ids;
+        if (to !== undefined)
+            ids = this.#agentIds(listing, to);
+        else if (!this.io.interactive) {
+            this.io.out(`It waits for an agent: buddi connections give ${view.slug} --to <agent>.`);
+            return 0;
+        }
+        else {
+            if (listing.agents.length === 0) {
+                this.io.out('There is no agent to give it to yet.');
+                return 0;
+            }
+            this.io.out(`Give ${grant} to which agents?`);
+            listing.agents.forEach((a, i) => this.io.out(`  ${i + 1}. ${a.name}${a.handle ? ` (${a.handle})` : ''}${a.frontDesk ? ', your front desk' : ''}`));
+            const front = listing.agents.findIndex((a) => a.frontDesk);
+            const fallback = front >= 0 ? String(front + 1) : '';
+            const answer = (await this.io.ask(`Numbers or handles, comma-separated; nobody to keep it waiting${fallback ? ` [${fallback}]` : ''}: `)).trim() || fallback;
+            if (answer === '' || answer.toLowerCase() === 'nobody')
+                ids = [];
+            else {
+                const words = answer.split(',').map((w) => w.trim()).filter(Boolean).map((w) => {
+                    const n = Number(w);
+                    return Number.isInteger(n) && n >= 1 && n <= listing.agents.length ? listing.agents[n - 1].id : w;
+                });
+                ids = this.#agentIds(listing, words);
+            }
+        }
+        if (ids.length === 0) {
+            this.io.out(`Given to nobody: ${view.name} waits under Settings → Connections.`);
+            return 0;
+        }
+        return this.#grant(view, ids, listing);
+    }
+    async #grant(view, ids, listing) {
+        const { body } = await this.gateway.post(`/api/connections/${view.id}/grant`, { agents: ids });
+        if (body.granted.length > 0)
+            this.io.out(`Gave mcp.${view.slug}.* to ${this.#agentNames(listing, body.granted)}.`);
+        for (const f of body.failed)
+            this.io.err(`${this.#agentNames(listing, [f.agent])}: ${f.message}`);
+        return body.failed.length > 0 ? 1 : 0;
+    }
+    async give(name, to) {
+        const { view, listing } = await this.#find(name);
+        if (!view.slug || view.state === 'pending-review') {
+            this.io.err(`Review ${view.name}'s tools before giving them to an agent: buddi connections review "${view.name}".`);
+            return 1;
+        }
+        const ids = this.#agentIds(listing, to);
+        if (ids.length === 0) {
+            this.io.out('Given to nobody; nothing changed.');
+            return 0;
+        }
+        return this.#grant(view, ids, listing);
+    }
+    /* -------------------------------------------------------------- remove */
+    async remove(name, yes) {
+        const { view, listing } = await this.#find(name);
+        const who = view.agents.length > 0 ? ` ${this.#agentNames(listing, view.agents)} lose its tools.` : '';
+        if (!yes) {
+            if (!this.io.interactive) {
+                this.io.err(`Run it again with --yes to disconnect ${view.name}.`);
+                return 1;
+            }
+            if (!(await this.io.confirm(`Disconnect ${view.name}? Its sign-in is deleted.${who}`))) {
+                this.io.out('Nothing was disconnected.');
+                return 0;
+            }
+        }
+        const { body } = await this.gateway.delete(`/api/connections/${view.id}`);
+        const touched = body.touched.length > 0 ? ` Its tools were taken from ${this.#agentNames(listing, body.touched)}.` : '';
+        this.io.out(`Disconnected ${body.name ?? view.name}; its sign-in is deleted.${touched}`);
+        return 0;
+    }
+}
+//# sourceMappingURL=connections-cmd.js.map