plx-cli 0.0.0-stage → 0.5.0

package/README.md

@@ -1,3 +1,61 @@
-# Temporary Holding Version
+# plx
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Parallax's command line. `plx connect` sets a computer up for [Parallax](https://github.com/ryan-stoffel/parallax) Connect with one sign-in: it installs plxd with its login service, registers the computer with Parallax Relay under your Parallax account, and every device signed in to that account can reach it, with no Tailscale, sshd, keys, or open ports ([0091](../../docs/decisions/0091-connect-over-relay.md)).
+
+It publishes as `plx-cli`, with a `plx` command, until the `plx` name on npm is Parallax's.
+
+```sh
+npx plx-cli connect
+```
+
+Every download is checked against the SHA-256 its GitHub release reports, and plx refuses one that doesn't match or has none. plxd goes in `~/.parallax-plxd` (`%USERPROFILE%\.parallax-plxd` on Windows), and its login service runs it from there. On Linux, `~/.local/bin/plxd` links to it.
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `plx connect` | Signs in, installs plxd here, registers it with the relay, and turns on `relay` and `remote`. Once it's online it shows a 6-digit code: type it on a signed-in device when that device opens this computer, and plx prints the device's name. |
+| `plx connect add <ssh destination>` | The same on another computer over SSH, with the sign-in here. |
+| `plx connect approve` | Approves a device waiting to sign in, once its code matches, or shows a new code to type on a device. |
+| `plx connect status` | Prints the account, host id, relay state, and routes. |
+| `plx connect unlink` | Turns the relay off here and keeps the registration, so the host id and webhook URLs stay. Signed-in devices keep their sessions until removed in Settings. |
+| `plx connect remove` | Signs in again and removes this computer from your account. |
+| `plx doctor` | Checks Parallax on this computer and hands what's left to your coding agent. See [Doctor](#doctor). |
+
+Until the release after this one, the Tailscale commands stay: `plx devices [--json]`, `plx add <device>`, and `plx setup` ([0056](../../docs/decisions/0056-parallax-connect.md)).
+
+Options:
+
+- `--channel stable|nightly`: which release to install (default `stable`).
+- `--no-browser`: sign in on any device and paste the code here. This is automatic over SSH and on Linux without a display.
+- `--user <user>` and `--port <port>`: the SSH user and port for `add`.
+- `--headless`: install plxd alone, without the app, for the Tailscale `add` and `setup`. `connect` always installs plxd alone.
+- `--dry-run`: print the Tailscale steps and install script without installing anything.
+- `--agent claude|codex` and `--model <model>`: the agent `doctor` hands off to, without asking, and its model.
+
+## Sign-in
+
+`plx connect` uses the Parallax app's Clerk OAuth application, with PKCE. With a browser on this computer, sign-in returns to a listener on 127.0.0.1. Otherwise plx prints a link: open it on any device, sign in, and paste the code `relay.parallax.codes/connect/code` shows. The code works only with the verifier plx holds. The token goes to plxd once, to register, and nothing keeps it.
+
+## Doctor
+
+```sh
+npx plx-cli doctor
+```
+
+It asks the running plxd for its version, health, and agents, then checks:
+
+- plxd is installed, running, answering, and running the binary on disk, not one a self-update replaced.
+- It's the newest release on its channel.
+- The project store is ok and its writes aren't queuing.
+- Each agent Parallax uses is installed and signed in.
+- git is on PATH, the disk has room, and plxd's log has no errors from the last 24 hours.
+
+For each failed check it can fix, it asks first: it starts plxd or runs an agent's own sign-in. Then it writes `context.md` (this computer's facts and the results) and `prompt.md` (the [playbook](src/doctor-playbook.md)) to `doctor/<time>/` in the data folder. It offers to open Claude Code or Codex on them, as T3 Code's `t3 triage` does. The agent asks what went wrong, reads the logs and the store, checks Parallax's source and issues, and helps you file an issue with the `via-doctor` template. It posts only after you approve the text. Without either agent, the doctor prints the two files' paths to paste into any agent.
+
+## Requirements
+
+- Node 20 or newer on the computer that runs plx, unless the Parallax app runs it.
+- For `add`, SSH on the other computer: Remote Login on macOS, OpenSSH Server on Windows, or sshd on Linux. On macOS and Linux, SSH asks for the password at most once.
+- Parallax builds for macOS on Apple silicon, Windows x64 and arm64, and Linux x64 and arm64.
+- On Linux, plxd brings the bubblewrap and socat Claude Code's sandbox needs. Ubuntu 24.04 and later also need the distro's `bubblewrap` and the AppArmor profile from Claude Code's sandboxing docs. NixOS needs `programs.nix-ld.enable = true;` to run agent CLIs.

package/bin/plx.mjs

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+// @ts-check
+// plx: Parallax's command line (src/cli.mjs).
+
+import { main } from "../src/cli.mjs";
+
+main(process.argv.slice(2)).then(
+  (code) => {
+    process.exitCode = code;
+  },
+  (error) => {
+    console.log(`✗ ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+  },
+);

package/package.json

@@ -1,6 +1,30 @@
 {
   "name": "plx-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.5.0",
+  "description": "Parallax's command line: set up a computer for Parallax Connect with one sign-in.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "bin": {
+    "plx": "bin/plx.mjs"
+  },
+  "files": [
+    "bin",
+    "src"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ryan-stoffel/parallax.git",
+    "directory": "packages/plx"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "check": "tsc -p .",
+    "test": "node --test"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.5",
+    "typescript": "^7.0.2"
+  }
+}

package/src/cli.mjs

@@ -0,0 +1,205 @@
+// @ts-check
+// plx: Parallax's command line. `plx connect` sets a computer up for Parallax Connect over
+// Parallax Relay with one sign-in (0091), `plx doctor` checks Parallax on this computer, and
+// `devices`, `add`, and `setup` keep the Tailscale path (0056) for the release that migrates it.
+
+import { createInterface } from "node:readline/promises";
+import { parseArgs } from "node:util";
+
+import * as connect from "./connect.mjs";
+import { doctor } from "./doctor.mjs";
+import { readDetails } from "./install.mjs";
+import { attach, VERSION } from "./plxd.mjs";
+import { canOpenBrowser, clerkOf, codePage, openBrowser, signIn } from "./signin.mjs";
+import { add, setup } from "./tailscale-setup.mjs";
+import { listDevices, TAGGED } from "./tailscale.mjs";
+
+const HELP = `plx: Parallax's command line.
+
+Usage:
+  plx connect                        Sign in, install plxd here, and connect this computer to
+                                     your Parallax account
+  plx connect add <ssh destination>  The same on another computer over SSH, signing in here
+  plx connect approve                Approve a device waiting to sign in, or show a new code
+                                     for one to type
+  plx connect status                 Show the account, host id, relay state, and routes
+  plx connect unlink                 Turn Parallax Relay off here, keeping the registration
+  plx connect remove                 Sign in again and remove this computer from your account
+  plx doctor                         Check Parallax on this computer, fix what it can, and hand
+                                     the rest to claude or codex to look into and file an issue
+
+Tailscale (until the release after this one):
+  plx devices [--json]               List your devices on your tailnet
+  plx add <device>                   Install Parallax on a device over SSH and connect it
+  plx setup                          Install Parallax on this computer and connect it
+
+Options:
+  --channel stable|nightly   Which release to install (default: stable)
+  --no-browser               Sign in on any device and paste the code here, rather than in a
+                             browser on this computer. Automatic over SSH and without a display
+  --user <user>              The SSH user for add (default: ssh's own)
+  --port <port>              The SSH port for add
+  --headless                 Install plxd alone, without the app, for the Tailscale add and setup
+                             (Linux always gets plxd alone; connect always installs plxd alone)
+  --dry-run                  Print the Tailscale steps and install script without installing
+  --json                     Print devices as JSON
+  --agent claude|codex       The agent doctor hands off to, without asking
+  --model <model>            The model doctor's agent uses (default: the agent's own)
+  -h, --help                 Show this help
+  -v, --version              Show plx's version`;
+
+const CONNECT_COMMANDS = new Set(["add", "approve", "status", "unlink", "remove"]);
+
+/** Asks for a line on the terminal. @param {string} question */
+async function prompt(question) {
+  const lines = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await lines.question(question);
+  } finally {
+    lines.close();
+  }
+}
+
+/**
+ * What `plx connect` reaches: Clerk through the browser or a pasted code, plxd over `plxd
+ * attach`, and the terminal.
+ * @param {boolean} noBrowser
+ * @returns {import("./connect.mjs").Deps}
+ */
+const realDeps = (noBrowser) => ({
+  signIn: () =>
+    signIn({
+      clerk: clerkOf(process.env),
+      browser: canOpenBrowser(process.env, process.platform, noBrowser),
+      codePage: codePage(process.env),
+      open: openBrowser,
+      prompt,
+    }),
+  details: readDetails,
+  install: connect.install,
+  plxd: (runner, os) => attach(runner.attach(os)),
+  prompt,
+  routes: () => connect.localRoutes(),
+  // Unref'd: a wait for a setup code to lapse never keeps plx running after it's done.
+  sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms).unref()),
+});
+
+/**
+ * Runs the command line and resolves to the exit code.
+ * @param {string[]} argv
+ * @param {(noBrowser: boolean) => import("./connect.mjs").Deps} [deps] What `connect` reaches;
+ *   tests pass fakes.
+ */
+export async function main(argv, deps = realDeps) {
+  /** @type {ReturnType<typeof parse>} */
+  let args;
+  try {
+    args = parse(argv);
+  } catch (error) {
+    return usage(error instanceof Error ? error.message : String(error));
+  }
+  const { values, positionals } = args;
+  if (values.help) return print(HELP);
+  if (values.version) return print(VERSION);
+  const channel = values.channel ?? "stable";
+  if (channel !== "stable" && channel !== "nightly") return usage(`--channel is stable or nightly, not ${channel}.`);
+  if (values.port !== undefined && !/^\d+$/.test(values.port)) return usage(`--port is a number, not ${values.port}.`);
+  /** @type {import("./tailscale-setup.mjs").Options} */
+  const options = { channel, user: values.user, port: values.port, headless: values.headless, dryRun: values["dry-run"] };
+
+  const [command, ...rest] = positionals;
+  switch (command) {
+    case undefined:
+      return print(HELP);
+    case "connect": {
+      const [sub, ...more] = rest;
+      if (sub !== undefined && !CONNECT_COMMANDS.has(sub)) return usage(`Unknown connect command: ${sub}`);
+      if (sub !== "add" && more.length > 0) return usage(`connect${sub ? ` ${sub}` : ""} takes no arguments.`);
+      const [destination] = more;
+      if (sub === "add" && (more.length !== 1 || !destination)) return usage("connect add takes one ssh destination.");
+      // ssh would read a destination starting with - as an option.
+      if (sub === "add" && !/^[^\s-]\S*$/.test(destination ?? "")) return usage(`${destination} isn't an ssh destination.`);
+      const connectDeps = deps(values["no-browser"] === true);
+      switch (sub) {
+        case undefined:
+          return connect.connect(options, connectDeps);
+        case "add":
+          return connect.add(destination ?? "", options, connectDeps);
+        case "approve":
+          return connect.approve(connectDeps);
+        case "status":
+          return connect.status(connectDeps);
+        case "unlink":
+          return connect.unlink(connectDeps);
+        default:
+          return connect.remove(connectDeps);
+      }
+    }
+    case "devices":
+      return devices(values.json === true);
+    case "add":
+      if (rest.length !== 1 || !rest[0]) return usage("add takes one device.");
+      return add(rest[0], options);
+    case "setup":
+      return setup(options);
+    case "doctor":
+      if (values.agent !== undefined && values.agent !== "claude" && values.agent !== "codex") return usage(`--agent is claude or codex, not ${values.agent}.`);
+      return doctor({ agent: values.agent, model: values.model });
+    default:
+      return usage(`Unknown command: ${command}`);
+  }
+}
+
+/** @param {string[]} argv */
+function parse(argv) {
+  return parseArgs({
+    args: argv,
+    allowPositionals: true,
+    options: {
+      channel: { type: "string" },
+      "no-browser": { type: "boolean" },
+      user: { type: "string" },
+      port: { type: "string" },
+      headless: { type: "boolean" },
+      "dry-run": { type: "boolean" },
+      json: { type: "boolean" },
+      agent: { type: "string" },
+      model: { type: "string" },
+      help: { type: "boolean", short: "h" },
+      version: { type: "boolean", short: "v" },
+    },
+  });
+}
+
+/** @param {string} text */
+function print(text) {
+  console.log(text);
+  return 0;
+}
+
+/** @param {string} message */
+function usage(message) {
+  console.error(`${message}\n\n${HELP}`);
+  return 2;
+}
+
+/** `plx devices`: a table, or `{ self, devices }` as JSON. @param {boolean} json */
+async function devices(json) {
+  const tailnet = await listDevices();
+  if (json) return print(JSON.stringify(tailnet, null, 2));
+  const rows = [
+    ["NAME", "DNS NAME", "OS", "IP", "ONLINE", "PARALLAX"],
+    ...[{ ...tailnet.self, name: `${tailnet.self.name} (this computer)` }, ...tailnet.devices].map((d) => [
+      d.name,
+      d.dnsName,
+      d.os,
+      d.ip ?? "-",
+      d.online ? "yes" : "no",
+      d.parallax ? "yes" : "no",
+    ]),
+  ];
+  const widths = rows[0]?.map((_, column) => Math.max(...rows.map((row) => row[column]?.length ?? 0))) ?? [];
+  for (const row of rows) console.log(row.map((cell, column) => cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd());
+  if (tailnet.self.tagged) console.log(`\n${TAGGED}`);
+  return 0;
+}

package/src/connect.mjs

@@ -0,0 +1,325 @@
+// @ts-check
+// `plx connect` and its subcommands (0091): set up a computer for Parallax Connect over Parallax
+// Relay with one sign-in, and manage it after. Everything plxd does here goes over `plxd attach`,
+// its trusted local connection, or over ssh for `connect add`.
+
+import https from "node:https";
+
+import { findInstaller, localOs, sshTarget, step, StepFailed } from "./install.mjs";
+import { localRunner, sshRunner } from "./run.mjs";
+import { installScript, REMOTE_PORT } from "./scripts.mjs";
+
+/** @typedef {import("./plxd.mjs").Plxd} Plxd */
+/** @typedef {import("./releases.mjs").Channel} Channel */
+/** @typedef {import("./run.mjs").Runner} Runner */
+/** @typedef {import("./releases.mjs").Os} Os */
+/** @typedef {import("./detect.mjs").Target} Target */
+
+/**
+ * What the commands reach outside this process, so tests can fake each.
+ * @typedef {object} Deps
+ * @property {() => Promise<string>} signIn Signs in and resolves to a Clerk access token.
+ * @property {(runner: Runner, os: Os) => Promise<Target>} details Finds the OS details of the
+ *   computer `runner` reaches.
+ * @property {(runner: Runner, target: Target, name: string, channel: Channel) => Promise<void>} install
+ *   Installs plxd with its login service on `target` through `runner`.
+ * @property {(runner: Runner, os: Os) => Promise<Plxd>} plxd Opens `plxd attach` through
+ *   `runner` on an `os` computer.
+ * @property {(question: string) => Promise<string>} prompt Asks the user for a line.
+ * @property {() => Promise<string[]>} routes This computer's routes, from its listener.
+ * @property {(ms: number) => Promise<void>} sleep
+ */
+
+/**
+ * @typedef {object} Options
+ * @property {Channel} channel
+ * @property {string} [user] The SSH user for `add`.
+ * @property {string} [port] The SSH port for `add`.
+ */
+
+/** How long setup waits for plxd to reach the relay and listen. */
+const ONLINE_TIMEOUT_MS = 60_000;
+
+/**
+ * Runs `body` with a step failure's ✗ already printed as exit 1, and any other error printed.
+ * @param {() => Promise<number | void>} body
+ * @returns {Promise<number>}
+ */
+async function exitCode(body) {
+  try {
+    return (await body()) ?? 0;
+  } catch (error) {
+    if (!(error instanceof StepFailed)) console.log(`✗ ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}
+
+/**
+ * Runs `body` with plxd open through `runner` on an `os` computer, this one by default, closing
+ * it after.
+ * @template T
+ * @param {Deps} deps
+ * @param {(plxd: Plxd) => Promise<T>} body
+ * @param {Runner} [runner]
+ * @param {Os} [os]
+ */
+async function withPlxd(deps, body, runner = localRunner(), os = localOs() ?? "linux") {
+  const plxd = await deps.plxd(runner, os);
+  try {
+    return await body(plxd);
+  } finally {
+    plxd.close();
+  }
+}
+
+/**
+ * `plx connect`: signs in, installs plxd with its login service here, and links it. Resolves to
+ * the exit code.
+ * @param {Options} options
+ * @param {Deps} deps
+ */
+export function connect(options, deps) {
+  const runner = localRunner();
+  return exitCode(async () => {
+    const os = localOs();
+    if (!os) throw new Error(`Parallax doesn't run on ${process.platform}.`);
+    const token = await step("Signing in to Parallax", async () => [`Signed in to Parallax Connect`, await deps.signIn()]);
+    const target = await step("Finding this computer's OS", async () => {
+      const target = await deps.details(runner, os);
+      return [`${target.label}: ${target.version} (${target.arch})`, target];
+    });
+    await deps.install(runner, target, "this computer", options.channel);
+    await withPlxd(
+      deps,
+      async (plxd) => {
+        await link(plxd, token, deps);
+        await approveNewDevice(plxd, deps);
+      },
+      runner,
+      os,
+    );
+  });
+}
+
+/**
+ * `plx connect add <ssh destination>`: the same setup on another computer over ssh, with the
+ * sign-in shown here. The only path that uses ssh, and only once.
+ * @param {string} destination `[user@]host`, as ssh takes it.
+ * @param {Options} options
+ * @param {Deps} deps
+ */
+export function add(destination, options, deps) {
+  const target = options.user ? `${options.user}@${destination}` : destination;
+  const runner = sshRunner(target, { port: options.port });
+  return exitCode(async () => {
+    const token = await step("Signing in to Parallax", async () => [`Signed in to Parallax Connect`, await deps.signIn()]);
+    const details = await sshTarget(runner, destination, target, "npx plx-cli connect");
+    await deps.install(runner, details, destination, options.channel);
+    await withPlxd(
+      deps,
+      async (plxd) => {
+        await link(plxd, token, deps);
+        await approveNewDevice(plxd, deps);
+      },
+      runner,
+      details.os,
+    );
+  }).finally(() => runner.close());
+}
+
+/**
+ * Installs plxd alone, with its login service, through `runner` (0072).
+ * @param {Runner} runner
+ * @param {Target} target
+ * @param {string} name
+ * @param {Channel} channel
+ */
+export async function install(runner, target, name, channel) {
+  const installer = await findInstaller(target, channel, true);
+  await step(`Installing plxd on ${name}`, async () => {
+    const script = installScript(target.os, installer, channel, true, false);
+    const { code } = await runner.script(target.os === "windows" ? "powershell" : "sh", script, false);
+    if (code !== 0) throw new Error(`The install failed on ${name} (exit ${code}).`);
+    return [`Installed plxd ${installer.version} with its login service`, undefined];
+  });
+}
+
+/**
+ * Registers the host with the relay under the token's account, turns on `relay` and `remote`,
+ * and waits until plxd is connected to the relay and listening. Prints its name as the relay
+ * lists it.
+ * @param {Plxd} plxd
+ * @param {string} token
+ * @param {Deps} deps
+ */
+async function link(plxd, token, deps) {
+  await step("Registering this computer with Parallax Relay", async () => {
+    await plxd.call("relay/register", { token });
+    await plxd.call("host/settings/set", { relay: true, remote: true });
+    return ["Registered, with Reach from anywhere on", undefined];
+  });
+  await step("Waiting for it to come online", async () => {
+    for (let waited = 0; ; waited += 1000) {
+      const status = await plxd.call("remote/sessions");
+      if (status.relay?.connected && status.listening) break;
+      if (waited >= ONLINE_TIMEOUT_MS) {
+        const why = status.relay?.problem ?? status.problem ?? "it didn't connect in time";
+        throw new Error(`It isn't online: ${why}`);
+      }
+      await deps.sleep(1000);
+    }
+    const listed = await plxd.call("relay/hosts", { token }).catch(() => undefined);
+    const self = listed?.hosts?.find((/** @type {{ thisComputer: boolean }} */ host) => host.thisComputer);
+    return [`${self?.name ?? "This computer"} is online on Parallax Connect`, undefined];
+  });
+}
+
+/**
+ * Shows a setup code for a signed-in device to type, a new one each time one lapses, and waits
+ * until a device pairs with it. Prints the device's name.
+ * @param {Plxd} plxd
+ * @param {Deps} deps
+ */
+async function approveNewDevice(plxd, deps) {
+  console.log("\nOn a device signed in to Parallax, open this computer and type its code there.");
+  for (;;) {
+    const { code, expiresAt } = await plxd.call("access/setupCode");
+    console.log(`\n  ${code}\n\nWaiting for a device (Ctrl-C to stop; plx connect approve shows a new code later).`);
+    let state = await plxd.call("access/get");
+    const lapses = deps.sleep(Math.max(0, Date.parse(expiresAt) - Date.now())).then(() => undefined);
+    while (!state.setupApproved) {
+      const changed = await Promise.race([plxd.call("access/get", { after: state.version }), lapses]);
+      if (!changed) break;
+      state = changed;
+    }
+    if (state.setupApproved) {
+      console.log(`✓ Approved ${state.setupApproved}. It can reach this computer now, and so can your other devices.`);
+      return;
+    }
+    console.log("The code lapsed. Here's a new one.");
+  }
+}
+
+/**
+ * `plx connect approve`: approves a new device's waiting request after its code shows, with
+ * Enter, or denies it with `n`. With none waiting, shows a code to type on a device, as setup
+ * ends.
+ * @param {Deps} deps
+ */
+export function approve(deps) {
+  return exitCode(() =>
+    withPlxd(deps, async (plxd) => {
+      let state = await plxd.call("access/get");
+      if (!state.pending) return approveNewDevice(plxd, deps);
+      if (!state.pending.code) console.log(`${state.pending.name} asked to sign in. Waiting for it to show its code…`);
+      while (state.pending && !state.pending.code) state = await plxd.call("access/get", { after: state.version });
+      const pending = state.pending;
+      if (!pending) throw new Error("The request went away before it showed a code.");
+      console.log(`${pending.name} asks to sign in to this computer, with the code ${pending.code}.`);
+      const answer = (await deps.prompt("Approve it if that device shows the same code. Enter approves, n denies: ")).trim().toLowerCase();
+      if (answer === "n" || answer === "no") {
+        await plxd.call("access/deny", { request: pending.id });
+        console.log(`✓ Denied ${pending.name}.`);
+      } else {
+        await plxd.call("access/approve", { request: pending.id });
+        console.log(`✓ Approved ${pending.name}.`);
+      }
+    }),
+  );
+}
+
+/**
+ * `plx connect unlink`: turns `relay` off and keeps the registration, so the host id and webhook
+ * URLs stay. New account sign-ins stop; sessions already issued stay until revoked in Settings.
+ * @param {Deps} deps
+ */
+export function unlink(deps) {
+  return exitCode(() =>
+    withPlxd(deps, async (plxd) => {
+      await plxd.call("host/settings/set", { relay: false });
+      console.log("✓ This computer is off Parallax Relay. It stays registered, so plx connect brings it back with the same id.");
+      console.log("  Devices already signed in keep their sessions until you remove them in Settings.");
+    }),
+  );
+}
+
+/**
+ * `plx connect remove`: signs in again, since nothing kept the token, removes this host from the
+ * account on the relay, and turns `relay` off so plxd stops reconnecting.
+ * @param {Deps} deps
+ */
+export function remove(deps) {
+  return exitCode(() =>
+    withPlxd(deps, async (plxd) => {
+      const token = await step("Signing in to Parallax", async () => [`Signed in`, await deps.signIn()]);
+      await step("Removing this computer from your account", async () => {
+        const { hostId } = await plxd.call("relay/id");
+        await plxd.call("relay/remove", { token, hostId });
+        await plxd.call("host/settings/set", { relay: false });
+        return [`Removed ${hostId} from Parallax Relay`, undefined];
+      });
+    }),
+  );
+}
+
+/**
+ * `plx connect status`: the account, host id, relay state, and routes.
+ * @param {Deps} deps
+ */
+export function status(deps) {
+  return exitCode(() =>
+    withPlxd(deps, async (plxd) => {
+      const [{ hostId }, access, settings, sessions] = await Promise.all([
+        plxd.call("relay/id"),
+        plxd.call("access/get"),
+        plxd.call("host/settings/get"),
+        plxd.call("remote/sessions"),
+      ]);
+      const relay = !settings.relay
+        ? "off"
+        : sessions.relay?.connected
+          ? "on, connected"
+          : `on, not connected${sessions.relay?.problem ? `: ${sessions.relay.problem}` : ""}`;
+      const remote = !settings.remote ? "off" : sessions.listening ? "on, listening" : `on, not listening${sessions.problem ? `: ${sessions.problem}` : ""}`;
+      const routes = sessions.listening ? await deps.routes().catch(() => []) : [];
+      const rows = [
+        ["Account", access.account ?? "not signed in (run plx connect)"],
+        ["Host id", hostId],
+        ["Relay", relay],
+        ["Reach from anywhere", remote],
+        ["Routes", routes.length ? routes.join(", ") : "none"],
+        ["Approved devices", String(access.approvedClients.length)],
+      ];
+      const width = Math.max(...rows.map(([label]) => label?.length ?? 0));
+      for (const [label, value] of rows) console.log(`${(label ?? "").padEnd(width)}  ${value}`);
+      if (access.pending) console.log(`\n${access.pending.name} is waiting for approval. Run plx connect approve.`);
+    }),
+  );
+}
+
+/**
+ * This computer's routes, best first, as its remote listener's public descriptor reports them
+ * (0065). The listener's certificate is self-signed and this only reads the routes, so it isn't
+ * checked.
+ * @param {number} [port]
+ * @returns {Promise<string[]>}
+ */
+export function localRoutes(port = REMOTE_PORT) {
+  return new Promise((resolve, reject) => {
+    const req = https.get({ host: "127.0.0.1", port, path: "/.well-known/parallax", rejectUnauthorized: false, timeout: 5000 }, (res) => {
+      let body = "";
+      res.setEncoding("utf8");
+      res.on("data", (chunk) => (body += chunk));
+      res.on("end", () => {
+        try {
+          const routes = JSON.parse(body).routes;
+          resolve(Array.isArray(routes) ? routes.filter((route) => typeof route === "string") : []);
+        } catch (error) {
+          reject(error);
+        }
+      });
+    });
+    req.once("timeout", () => req.destroy(new Error("The listener didn't answer.")));
+    req.once("error", reject);
+  });
+}