agmsg-cloud 0.0.1 → 0.1.0-rc.4

package/dist/src/commands/request.js

@@ -0,0 +1,371 @@
+import { existsSync, mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { createSasCommitment } from '@agmsg-cloud/sas-core';
+import { CourierClient, CourierError } from '../api.js';
+import { recordAuthenticatedDigest } from '../authenticated-digest.js';
+import { CeremonyError, renderSasBlock, sasFromOpenedTranscript, waitForStatus } from '../ceremony.js';
+import { generateDeviceIdentity, publicKeyOf } from '../oss.js';
+import { originOf } from '../credentials.js';
+import { deviceIdentityPath } from '../paths.js';
+import { closeAttempt, consumeAttempt, readBudget, renderBudgetExhausted, renderBudgetWarning, requesterLedgerScope, } from '../ledger.js';
+import { attachRequestId, clearRecord, listResumableRequesterRecords, reserveRequesterNonce, } from '../pending.js';
+// (c, part 1) B asks to be added.
+//
+// The order below is the protocol, not a style choice:
+//
+//   1. commit to (device key, nonce) and PERSIST the nonce
+//   2. post only the commitment digest
+//   3. wait for the approver's commitment to be fixed
+//   4. only then reveal the key and the nonce
+//   5. wait for the approver to open, and derive the code locally
+//
+// Steps 3 and 4 are what stop the other side choosing its contribution after
+// learning ours. Doing 4 before 3 would leave a request whose code the server
+// could steer, and the human comparison would confirm nothing.
+//
+// The private key never leaves this machine; only the public recipient is sent,
+// and not until step 4.
+export async function cmdRequest(config, args, deps = {}) {
+    const out = deps.out ?? ((text) => void process.stdout.write(text));
+    const writeErr = deps.err ?? ((text) => void process.stderr.write(text));
+    const err = deps.err ?? ((text) => void writeErr(text));
+    const env = deps.env ?? process.env;
+    const nextStepsAreOurs = deps.nextStepsFromCaller !== true;
+    const client = new CourierClient(deps.fetchImpl ? { ...config, fetchImpl: deps.fetchImpl } : config);
+    const idPath = deviceIdentityPath(env);
+    mkdirSync(dirname(idPath), { recursive: true });
+    const pubkey = existsSync(idPath) ? await publicKeyOf(idPath) : await generateDeviceIdentity(idPath);
+    // Finish an interrupted ceremony rather than starting a second one. §4.1
+    // charges an attempt when the commitment is posted, so a crash loop that
+    // started over each time would spend the day's budget without ever completing
+    // a single comparison.
+    const resumable = listResumableRequesterRecords(config.baseUrl, env);
+    let record = resumable.find((r) => r.devicePubkey === pubkey);
+    let requestId = record?.requestId;
+    // §4.1 requires B to count durably too, scoped to its device identity and the
+    // server origin. Only a NEW ceremony costs an attempt: resuming one already
+    // paid for would charge the same guess twice and let a crash loop exhaust the
+    // budget without a single comparison.
+    const scope = requesterLedgerScope(config.baseUrl, pubkey);
+    // A record without an id may still have landed: the row can exist on the
+    // server while the response was lost. Ask, using the only handle available —
+    // the commitment. Dropping these was what left the ledger's open attempt
+    // blocking every retry with nothing able to clear it.
+    if (record && !requestId) {
+        // The list must SUCCEED before its emptiness means anything.
+        //
+        // Swallowing the error and treating it as "no live requests" turned a
+        // dropped connection into a verdict: the attempt was closed as failed and
+        // the nonce deleted, while the row on the server stayed live and became
+        // unopenable by anyone. The API failing to answer is not evidence that the
+        // row is absent.
+        let mine;
+        try {
+            mine = await client.listEnrollments();
+        }
+        catch (err) {
+            writeErr('cannot tell whether the earlier request reached the server: ' +
+                `${err instanceof Error ? err.message : String(err)}\n` +
+                '  Nothing has been changed — the attempt and its nonce are kept so a\n' +
+                '  later run can finish it. Try again when the server is reachable.\n');
+            process.exitCode = 1;
+            return;
+        }
+        const match = mine.filter((e) => e.commitment === record.commitmentHex);
+        if (match.length === 1) {
+            requestId = match[0].id;
+            attachRequestId({ serverOrigin: config.baseUrl, commitmentHex: record.commitmentHex, requestId }, env);
+        }
+        else if (match.length === 0) {
+            // Either it never arrived or it has already gone terminal. Both are over,
+            // and the attempt stays spent: this machine cannot tell whether the bytes
+            // left, and treating "I did not see a reply" as free is the retry an
+            // attacker would ask for.
+            closeAttempt(scope, record.commitmentHex, 'failed', 'no live request for this commitment', env);
+            clearRecord({ role: 'requester', serverOrigin: config.baseUrl, key: record.commitmentHex }, env);
+            record = undefined;
+        }
+        else {
+            // One commitment, two live rows. Nothing here can choose safely.
+            writeErr('the server reports more than one live request for this commitment; ' +
+                'refusing to guess which one is yours\n');
+            process.exitCode = 1;
+            return;
+        }
+    }
+    if (!record || !requestId) {
+        // ASKED BEFORE THE ATTEMPT IS CHARGED, and that placement is the whole
+        // point. A device key that can never become a device on this account makes
+        // this ceremony unwinnable, and #194 is about such a path costing one of
+        // five. The server refuses it too — that check is the authority and stays
+        // — but it can only speak at the opening, by which time §4.1 has already
+        // spent the attempt.
+        //
+        // A REFUSAL BEFORE STARTING, NOT A REFUND AFTER. The difference matters:
+        // giving an attempt back because the server said the run did not count
+        // would let a hostile server hand out unlimited free ceremonies, which is
+        // exactly the budget an attacker wants while searching for a SAS
+        // collision. Declining to start costs the attacker nothing they cannot
+        // already do by refusing every request.
+        // The budget is READ before the lookup below, so a machine with nothing
+        // left still reaches the server for nothing. `consumeAttempt` remains the
+        // authority and re-checks under the lock — this only decides whether it is
+        // worth asking a question, and a sixth attempt must not reach the server
+        // at all, not even to read.
+        const before = readBudget(scope, env);
+        if (before.remaining === 0) {
+            writeErr(renderBudgetExhausted(before));
+            process.exitCode = 1;
+            return;
+        }
+        const blocked = await keyAlreadySpokenFor(client, pubkey);
+        if (blocked) {
+            writeErr(blocked);
+            process.exitCode = 1;
+            return;
+        }
+        const { commitmentHex: plannedCommitment, openingNonce: plannedNonce } = createSasCommitment(pubkey);
+        const charged = consumeAttempt(scope, plannedCommitment, env);
+        if (!charged.ok) {
+            if (charged.reason === 'budget_exhausted') {
+                writeErr(renderBudgetExhausted(charged.budget));
+            }
+            else {
+                writeErr('\n  An enrollment attempt from this machine is still open. Run this\n' +
+                    '  command again to resume it rather than starting a second one.\n\n');
+            }
+            process.exitCode = 1;
+            return;
+        }
+        out(renderBudgetWarning(charged.budget));
+        // Persisted BEFORE the digest is posted. A crash after the post but before
+        // this write would leave a request on the server that nothing can open.
+        record = reserveRequesterNonce({
+            serverOrigin: config.baseUrl,
+            commitmentHex: plannedCommitment,
+            nonceHex: Buffer.from(plannedNonce).toString('hex'),
+            devicePubkey: pubkey,
+        }, env);
+        const created = await client.createEnrollment({
+            commitment: record.commitmentHex,
+            label: args.label,
+        });
+        requestId = created.request_id;
+        attachRequestId({ serverOrigin: config.baseUrl, commitmentHex: record.commitmentHex, requestId }, env);
+        out(`enrollment requested: ${requestId} (expires ${created.expires_at})\n`);
+    }
+    else {
+        out(`resuming enrollment ${requestId}\n`);
+    }
+    const done = () => clearRecord({ role: 'requester', serverOrigin: config.baseUrl, key: record.commitmentHex }, env);
+    try {
+        out('waiting for an approver to commit...\n');
+        await waitForStatus(client, requestId, 'both_committed', deps.waitOptions);
+        // Safe to open now: the approver's contribution is fixed and cannot change.
+        await client.submitOpening(requestId, {
+            device_pubkey: pubkey,
+            opening_nonce: record.nonceHex,
+        });
+        out('waiting for the approver to open...\n');
+        const opened = await waitForStatus(client, requestId, 'opened', deps.waitOptions);
+        // Derived here, from the two opened nonces. Nothing displayed below came
+        // from the server as a code.
+        const sas = sasFromOpenedTranscript(opened);
+        // The block says who decides, and says it once (#195). This printed a
+        // second copy immediately after it, so the screen read: who decides -> how
+        // to compare on a call you trust -> who decides. Repetition in the one
+        // screen where a single line has to be read is how the reader learns to
+        // skim it.
+        //
+        // The sentence was not deleted, it MOVED: what this copy carried and the
+        // block's did not — what a `no` means — is now the block's wording.
+        out(renderSasBlock(sas, 'requester'));
+        // The outcome is NOT known yet. Closing as succeeded here — which is what
+        // this did — recorded every rejected ceremony as a success, so §4.1's
+        // requirement that the requester counts failed and incomplete attempts, and
+        // warns from the second failure, did nothing on this side. Wait for the
+        // server to say which way it went.
+        const settled = await waitForStatus(client, requestId, 'consumed', deps.waitOptions);
+        // What the eight digits authenticated, kept for `fetch`.
+        //
+        // Written BEFORE the pending record is cleared, and the ordering is the
+        // point: this is the only moment where the digest and the evidence that a
+        // person compared the digits it is bound into are both in hand. Nobody
+        // compared this value — they compared eight decimal digits, and the digest
+        // is one of the inputs those digits were derived from. A crash between the
+        // two leaves a machine that has been through a ceremony and kept nothing
+        // from it, and `fetch` then refuses every bundle.
+        //
+        // The value comes from the transcript the SAS was derived over, not from a
+        // second read, so what the digits stood for and what is checked later
+        // cannot drift apart (spec 3.2.1).
+        const authenticated = opened.handoff_digest;
+        if (authenticated === null) {
+            throw new CeremonyError('server_transcript_disagrees', 'the opened transcript carries no handoff_digest');
+        }
+        recordAuthenticatedDigest({
+            serverOrigin: originOf(config.baseUrl),
+            requestId,
+            handoffDigest: authenticated,
+            secret: config.secret,
+            devicePubkey: pubkey,
+        }, env);
+        closeAttempt(scope, record.commitmentHex, 'succeeded', undefined, env);
+        // What HAPPENED is always said. What to do NEXT is said only by whoever
+        // owns the operator's next step — which is this command when someone typed
+        // it, and `sync` when `sync` is the one running it. `sync` goes straight on
+        // to fetch and pull, so telling the person to run fetch was telling them to
+        // do a thing that was already being done, in a sentence carrying a
+        // `<team>` placeholder they were expected to fill in themselves (found in
+        // the production walkthrough).
+        out(`  Added.${nextStepsAreOurs ? ' Fetch the bundle with `agmsg-cloud fetch <team>`.' : ''} (${settled.status})\n`);
+        done();
+    }
+    catch (err) {
+        if (err instanceof CeremonyError) {
+            // The record is cleared only when the ceremony is over on the SERVER too.
+            // A timeout leaves it, so the next run resumes instead of spending another
+            // attempt on a request that is still live.
+            if (err.reason === 'timed_out') {
+                // The ceremony may still be live; the next run resumes the same one and
+                // is not charged again.
+                writeErr(`enrollment did not complete: ${err.message}\n`);
+                writeErr('  Run the same command again to resume it; this costs no further attempt.\n');
+                process.exitCode = 1;
+                return;
+            }
+            done();
+            closeAttempt(scope, record.commitmentHex, 'failed', err.reason, env);
+            writeErr(renderBudgetWarning(readBudget(scope, env)));
+            writeErr(`enrollment did not complete: ${err.message}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        // The two ways this machine's key cannot become a device on this account.
+        //
+        // They arrive at the OPENING — before any comparison — because that is the
+        // first moment the server has the key at all. They used to arrive as one
+        // `already_registered` at the very end, after an approver had been
+        // interrupted and had answered (#194), and it named neither case.
+        //
+        // A machine already on this account joining a second team is NOT here: that
+        // one succeeds now, which is what #194 was about.
+        if (err instanceof CourierError &&
+            (err.code === 'device_key_in_use' || err.code === 'device_key_changed')) {
+            done();
+            closeAttempt(scope, record.commitmentHex, 'failed', err.code, env);
+            writeErr(renderBudgetWarning(readBudget(scope, env)));
+            writeErr(await renderKeyRefusal(err.code, client, pubkey));
+            process.exitCode = 1;
+            return;
+        }
+        throw err;
+    }
+}
+// WHAT IS TRUE AT THIS POINT, and no more.
+//
+// This used to say "no approver was asked", which is false: reaching the
+// opening means the requester waited for `both_committed`, so an approver had
+// already run `approve` and posted a commitment over the bundle digest. They
+// were interrupted — what did NOT happen is the comparison and the upload
+// (raised in review). The test that blessed the old wording started its
+// scripted server at `both_committed` and so never ran the order it was
+// asserting about.
+const NOTHING_COMPARED = '  No digits were shown and no bundle was sent.\n';
+/**
+ * Whether this machine's key is already spoken for by a DIFFERENT machine, or
+ * this machine already holds a different key — asked before an attempt is spent.
+ *
+ * Returns the message to print, or null to go ahead. Best effort in one
+ * direction only: a lookup that fails, or a server too old to say which row is
+ * this machine's, returns null and lets the ceremony run. The server's own
+ * refusal is the gate; this exists to keep an unwinnable run from costing one
+ * of five, and a check that cannot answer must not become a second refusal on
+ * its own.
+ *
+ * `thisMachine === undefined` is not `false`. An older server says nothing
+ * about ownership, and reading silence as "none of these are yours" would
+ * refuse every ordinary rejoin.
+ */
+async function keyAlreadySpokenFor(client, pubkey) {
+    let devices;
+    try {
+        devices = await client.listDevices();
+    }
+    catch {
+        return null;
+    }
+    if (!devices.some((d) => d.thisMachine !== undefined))
+        return null;
+    const mine = devices.find((d) => d.thisMachine === true);
+    const holdingMyKey = devices.find((d) => d.devicePubkey === pubkey);
+    // The ordinary second-team case: this machine is on the account and the key
+    // it presents is its own. It still runs the full ceremony — what that
+    // establishes is this team's bundle digest, not the registration.
+    if (holdingMyKey && holdingMyKey.thisMachine === true)
+        return null;
+    if (holdingMyKey) {
+        return (`not started: this machine's device key is already registered to a different machine on\n` +
+            `  this account. It is listed as "${holdingMyKey.label}".\n\n` +
+            '  Two things look like this, and the machine you are sitting at tells them apart:\n\n' +
+            '    the same machine, signed in again under another name\n' +
+            '      -> an owner removes the OTHER entry in the console (Machines -> Remove).\n\n' +
+            "    a different machine, using a copy of that one's identity file\n" +
+            '      -> this machine needs its own. Move ~/.agmsg-cloud/device.key aside and\n' +
+            '         run this again; a new identity is generated when none is present.\n\n' +
+            '  No enrollment was started, so this costs none of your attempts.\n');
+    }
+    if (mine) {
+        return ('not started: this machine is already listed on the account under a different device key.\n' +
+            '  That happens when the key at ~/.agmsg-cloud/device.key was replaced or lost —\n' +
+            '  the listed one cannot be recovered from here, and the account still points at it.\n\n' +
+            '  To clear it, an owner removes this machine in the console (Machines -> Remove),\n' +
+            '  and then this machine signs in again with `agmsg-cloud login`.\n\n' +
+            '  No enrollment was started, so this costs none of your attempts.\n');
+    }
+    return null;
+}
+/**
+ * Why this machine's device key was refused, and what actually clears it.
+ *
+ * Both remedies were followed to the end before being printed. Removing a
+ * machine in the console revokes its capability URL AND its device rows
+ * (`revokeCapabilityRows`) and releases the machine slot, and both unique
+ * indexes are partial on active rows — so the next sign-in registers cleanly.
+ * It is an OWNER action, which is why the wording does not tell a member to go
+ * and do it.
+ */
+async function renderKeyRefusal(code, client, pubkey) {
+    if (code === 'device_key_changed') {
+        return ('not added: this machine is already listed on the account under a different device key.\n' +
+            '  That happens when the key at ~/.agmsg-cloud/device.key was replaced or lost —\n' +
+            '  the listed one cannot be recovered from here, and the account still points at it.\n\n' +
+            '  To clear it, an owner removes this machine in the console (Machines -> Remove),\n' +
+            '  and then this machine signs in again with `agmsg-cloud login`.\n' +
+            NOTHING_COMPARED);
+    }
+    // Naming the machine that holds the key turns "something is wrong" into one
+    // decision. It discloses nothing new: `listDevices` already answers any
+    // capability of this account with every device's label and public key.
+    //
+    // Best effort — a failed lookup must not replace the reason with an error
+    // about the lookup.
+    let holder = '';
+    try {
+        const held = (await client.listDevices()).find((d) => d.devicePubkey === pubkey);
+        if (held)
+            holder = ` It is listed as "${held.label}".`;
+    }
+    catch {
+        holder = '';
+    }
+    return (`not added: this machine's device key is already registered to a different machine on\n` +
+        `  this account.${holder}\n\n` +
+        '  Two things look like this, and the machine you are sitting at tells them apart:\n\n' +
+        '    the same machine, signed in again under another name\n' +
+        '      -> an owner removes the OTHER entry in the console (Machines -> Remove).\n\n' +
+        '    a different machine, using a copy of that one\'s identity file\n' +
+        '      -> this machine needs its own. Move ~/.agmsg-cloud/device.key aside and\n' +
+        '         run this again; a new identity is generated when none is present.\n\n' +
+        NOTHING_COMPARED);
+}

package/dist/src/commands/sync.js

@@ -0,0 +1,138 @@
+import { existsSync } from 'node:fs';
+import { hostname } from 'node:os';
+import { CourierClient } from '../api.js';
+import { originOf, readCredential } from '../credentials.js';
+import { publicKeyOf } from '../oss.js';
+import { deviceIdentityPath } from '../paths.js';
+import { NEEDS, ensurePreflight, preflight } from '../preflight.js';
+import { shellArg } from '../shell-arg.js';
+import { cmdFetch } from './fetch.js';
+import { cmdPull } from './pull.js';
+import { cmdRequest } from './request.js';
+// The name login settled for this machine, if there is a credential to read it
+// from. Null rather than a throw: sync's own failure for a missing credential
+// is better than one from a name lookup, and it says something more useful.
+function credentialMachineName(config) {
+    const stored = readCredential(originOf(config.baseUrl));
+    return stored?.machineName ?? null;
+}
+export async function cmdSync(config, opts) {
+    // Checked here for everything the three steps need together, so a machine
+    // missing `remote.sh` is told before the ceremony rather than after it — the
+    // approver interrupted, the attempt spent, on a machine that could never
+    // have finished.
+    //
+    // Not the ONLY check: `fetch` and `pull` still run their own when called
+    // directly, and they still run them when called from here. That repetition
+    // is cheap and it is what keeps them correct on their own; what this adds is
+    // that the failure arrives first (raised in review).
+    ensurePreflight(preflight(config.scriptsDir, NEEDS.sync));
+    const d = opts.deps ?? {};
+    const out = d.out ?? ((text) => void process.stdout.write(text));
+    const request = d.request ?? cmdRequest;
+    const fetch = d.fetch ?? cmdFetch;
+    const pull = d.pull ?? cmdPull;
+    // The approver sees this, and they are looking for a machine they recognise.
+    // A hostname is what a person calls their laptop; a uuid is what they read
+    // aloud wrongly.
+    //
+    // Taken from the credential login settled, NOT from the hostname again. They
+    // were two independent defaults reading the same source, so a machine named
+    // at login still introduced itself to the approver as its hostname — which
+    // is how two machines came to be called mbp2024 on one approval screen. The
+    // operator has one machine; it has one name, chosen once.
+    //
+    // `--label` still overrides, for the run where someone wants to be someone
+    // else on purpose.
+    const label = opts.label ?? credentialMachineName(config) ?? hostname();
+    out(`\nJoining "${opts.team}" from this machine ("${label}").\n\n`);
+    // Said here, where it can still be acted on, because the approver cannot act
+    // on it at all: their screen shows names, and two rows reading the same one
+    // leave them guessing which request is this machine.
+    //
+    // A WARNING, NOT A REFUSAL, and the reason is who is inconvenienced by each.
+    // Refusing strands a join on a name the operator may not be able to change
+    // from here — the other machine might be one they no longer have, or a stale
+    // device only an approver can remove — and it refuses something that is
+    // probably fine, since the approver may well know which is which. Saying it
+    // costs nothing and puts the choice where the name can still be typed
+    // differently: re-run with --label.
+    //
+    // Best effort. A machine that cannot list devices is still allowed to ask to
+    // join; failing the join over a failed courtesy check would be the refusal
+    // this deliberately is not.
+    try {
+        const existing = await new CourierClient(config).listDevices();
+        // THIS MACHINE'S OWN ROW IS NOT A CLASH WITH ITSELF.
+        //
+        // The comparison was on label alone, so a machine already on the account —
+        // joining a second team — always matched itself and was warned that "this
+        // account already has a machine called <its own name>". That is the line
+        // read during the production walkthrough (#194), and acting on it means
+        // renaming a machine to avoid a collision with nothing.
+        //
+        // Identity is the device key, not the name. Absent before the first join,
+        // which is exactly when there is no own row to exclude.
+        const idPath = deviceIdentityPath();
+        const mine = existsSync(idPath) ? await publicKeyOf(idPath) : null;
+        const clash = existing.filter((d) => d.label === label && d.devicePubkey !== mine);
+        if (clash.length > 0) {
+            out(`  NOTE: this account already has ${clash.length === 1 ? 'a machine' : `${clash.length} machines`} called "${label}".\n`);
+            out('  The approver sees names, so identical ones are indistinguishable on their screen.\n');
+            out(`  To be told apart, run: agmsg-cloud sync ${shellArg(opts.team)} --label <a-different-name>\n\n`);
+        }
+    }
+    catch {
+        // Not fatal, and not reported: a failure here says nothing about whether
+        // this machine may join, and a scary line about an unrelated call would
+        // compete with the instructions below.
+    }
+    out('  On a machine that already has the team, run:\n\n');
+    // The real command, with the team quoted for a shell. A placeholder makes
+    // the reader do the substitution, and the whole point of this arc is to stop
+    // carrying values by hand between machines — an instruction that ends in
+    // `<team>` hands the work straight back (raised in review).
+    out(`      agmsg-cloud approve ${shellArg(opts.team)}\n\n`);
+    out('  Compare the eight digits on both screens before answering there.\n\n');
+    // Everything the ceremony guarantees happens inside here: the commitment is
+    // pinned before anything opens, nothing is sealed or uploaded until the
+    // digits match, and this side refuses a transcript it cannot verify.
+    // This command owns what the operator is told to do next, because it is the
+    // one that knows there is nothing to do: fetch and pull follow immediately
+    // below. The decision is made HERE, once, rather than inferred inside each
+    // step (raised in review).
+    await request(config, { label }, { nextStepsFromCaller: true });
+    // PULL BEFORE FETCH, and the old order was the wrong way round.
+    //
+    // The comment that used to sit below said the messages "needed the key that
+    // arrived above". They do not. History arrives SEALED — that is what the
+    // age-v1 awaiting-unlock state is — and the key opens it rather than
+    // fetching it. The dependency runs the other way, and only pull satisfies
+    // it: `remote.sh unlock`, which fetch calls, refuses a team that is not on
+    // this machine, and pull is the only thing that writes one
+    // (_remote_write_pulled_team) or the age-v1 binding unlock insists on.
+    //
+    // Measured against a clean store rather than read: with no local team,
+    //
+    //   remote.sh unlock <team> --authenticated-bundle-stdin
+    //   -> agmsg: team not found: <team>
+    //
+    // On a real second machine the old order therefore failed AFTER the ceremony
+    // had run, an attempt had been spent and an approver had been interrupted.
+    // It stayed hidden because the second machine in testing pointed at the first
+    // machine's install, where the team was already present — so the second
+    // machine's path had never actually been walked.
+    await pull(config, opts.teamId === undefined
+        ? { team: opts.team, nextStepsFromCaller: true }
+        : { team: opts.team, teamId: opts.teamId, nextStepsFromCaller: true });
+    // And now the key, which opens what arrived above. Only reachable once the
+    // server says the ceremony was approved — `request` waits for that, and
+    // throws otherwise. The bundle is checked against the snapshot those digits
+    // authenticated, by machine.
+    await fetch(config, { team: opts.team });
+    // The last thing said, because "what now" is the question the screen leaves
+    // otherwise — and here the answer is that there is no next command. Saying
+    // so is the point: someone who has just run five steps and watched a code
+    // comparison has every reason to expect a sixth.
+    out(`\n"${opts.team}" is on this machine, unlocked and syncing. Nothing further to run.\n`);
+}