remoteclaw 0.1.0-next.cd6ddde → 0.1.0-next.cf9ccbe

package/dist/devices-cli-BXCOsNFc.js

@@ -0,0 +1,323 @@
+import "./paths-DHuXVC00.js";
+import { L as theme } from "./utils-DPoNpP7D.js";
+import "./subsystem-BAW_f3DI.js";
+import { i as defaultRuntime } from "./ansi-DtaiOnt1.js";
+import "./agent-scope-CAQLm3LP.js";
+import { f as GATEWAY_CLIENT_MODES, p as GATEWAY_CLIENT_NAMES } from "./message-channel-CtcVHawF.js";
+import "./config-DwuBnd6D.js";
+import "./env-DyyqmxSM.js";
+import "./host-env-security-BGibnCbS.js";
+import "./shell-env-c3j5zcU9.js";
+import "./version-CVMnqdzu.js";
+import "./env-vars-a7S70ba7.js";
+import "./zod-schema-Y5SQgJLm.js";
+import { n as formatTimeAgo } from "./format-relative-zwkkXJvs.js";
+import { Ot as listDevicePairing, Pt as summarizeDeviceTokens, Tt as approveDevicePairing } from "./client-CMtdm9Ii.js";
+import { n as callGateway, t as buildGatewayConnectionDetails } from "./call-BTHzKFbN.js";
+import { r as isLoopbackHost } from "./net-DTqfFYzt.js";
+import "./logger-ASsO5Nz-.js";
+import "./ip-D4VG5EJO.js";
+import "./tailnet-Da-_9e8E.js";
+import { n as withProgress } from "./progress-BcwxtM9Q.js";
+import { t as renderTable } from "./table-DFx25vNb.js";
+
+//#region src/cli/devices-cli.ts
+const FALLBACK_NOTICE = "Direct scope access failed; using local fallback.";
+const devicesCallOpts = (cmd, defaults) => cmd.option("--url <url>", "Gateway WebSocket URL (defaults to gateway.remote.url when configured)").option("--token <token>", "Gateway token (if required)").option("--password <password>", "Gateway password (password auth)").option("--timeout <ms>", "Timeout in ms", String(defaults?.timeoutMs ?? 1e4)).option("--json", "Output JSON", false);
+const callGatewayCli = async (method, opts, params) => withProgress({
+	label: `Devices ${method}`,
+	indeterminate: true,
+	enabled: opts.json !== true
+}, async () => await callGateway({
+	url: opts.url,
+	token: opts.token,
+	password: opts.password,
+	method,
+	params,
+	timeoutMs: Number(opts.timeout ?? 1e4),
+	clientName: GATEWAY_CLIENT_NAMES.CLI,
+	mode: GATEWAY_CLIENT_MODES.CLI
+}));
+function normalizeErrorMessage(error) {
+	if (error instanceof Error) return error.message;
+	return String(error);
+}
+function shouldUseLocalPairingFallback(opts, error) {
+	if (!normalizeErrorMessage(error).toLowerCase().includes("pairing required")) return false;
+	if (typeof opts.url === "string" && opts.url.trim().length > 0) return false;
+	const connection = buildGatewayConnectionDetails();
+	if (connection.urlSource !== "local loopback") return false;
+	try {
+		return isLoopbackHost(new URL(connection.url).hostname);
+	} catch {
+		return false;
+	}
+}
+function redactLocalPairedDevice(device) {
+	const { tokens, ...rest } = device;
+	return {
+		...rest,
+		tokens: summarizeDeviceTokens(tokens)
+	};
+}
+async function listPairingWithFallback(opts) {
+	try {
+		return parseDevicePairingList(await callGatewayCli("device.pair.list", opts, {}));
+	} catch (error) {
+		if (!shouldUseLocalPairingFallback(opts, error)) throw error;
+		if (opts.json !== true) defaultRuntime.log(theme.warn(FALLBACK_NOTICE));
+		const local = await listDevicePairing();
+		return {
+			pending: local.pending,
+			paired: local.paired.map((device) => redactLocalPairedDevice(device))
+		};
+	}
+}
+async function approvePairingWithFallback(opts, requestId) {
+	try {
+		return await callGatewayCli("device.pair.approve", opts, { requestId });
+	} catch (error) {
+		if (!shouldUseLocalPairingFallback(opts, error)) throw error;
+		if (opts.json !== true) defaultRuntime.log(theme.warn(FALLBACK_NOTICE));
+		const approved = await approveDevicePairing(requestId);
+		if (!approved) return null;
+		return {
+			requestId,
+			device: redactLocalPairedDevice(approved.device)
+		};
+	}
+}
+function parseDevicePairingList(value) {
+	const obj = typeof value === "object" && value !== null ? value : {};
+	return {
+		pending: Array.isArray(obj.pending) ? obj.pending : [],
+		paired: Array.isArray(obj.paired) ? obj.paired : []
+	};
+}
+function selectLatestPendingRequest(pending) {
+	if (!pending?.length) return null;
+	return pending.reduce((latest, current) => {
+		const latestTs = typeof latest.ts === "number" ? latest.ts : 0;
+		return (typeof current.ts === "number" ? current.ts : 0) > latestTs ? current : latest;
+	});
+}
+function formatTokenSummary(tokens) {
+	if (!tokens || tokens.length === 0) return "none";
+	return tokens.map((t) => `${t.role}${t.revokedAtMs ? " (revoked)" : ""}`).toSorted((a, b) => a.localeCompare(b)).join(", ");
+}
+function resolveRequiredDeviceRole(opts) {
+	const deviceId = String(opts.device ?? "").trim();
+	const role = String(opts.role ?? "").trim();
+	if (deviceId && role) return {
+		deviceId,
+		role
+	};
+	defaultRuntime.error("--device and --role required");
+	defaultRuntime.exit(1);
+	return null;
+}
+function registerDevicesCli(program) {
+	const devices = program.command("devices").description("Device pairing and auth tokens");
+	devicesCallOpts(devices.command("list").description("List pending and paired devices").action(async (opts) => {
+		const list = await listPairingWithFallback(opts);
+		if (opts.json) {
+			defaultRuntime.log(JSON.stringify(list, null, 2));
+			return;
+		}
+		if (list.pending?.length) {
+			const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+			defaultRuntime.log(`${theme.heading("Pending")} ${theme.muted(`(${list.pending.length})`)}`);
+			defaultRuntime.log(renderTable({
+				width: tableWidth,
+				columns: [
+					{
+						key: "Request",
+						header: "Request",
+						minWidth: 10
+					},
+					{
+						key: "Device",
+						header: "Device",
+						minWidth: 16,
+						flex: true
+					},
+					{
+						key: "Role",
+						header: "Role",
+						minWidth: 8
+					},
+					{
+						key: "IP",
+						header: "IP",
+						minWidth: 12
+					},
+					{
+						key: "Age",
+						header: "Age",
+						minWidth: 8
+					},
+					{
+						key: "Flags",
+						header: "Flags",
+						minWidth: 8
+					}
+				],
+				rows: list.pending.map((req) => ({
+					Request: req.requestId,
+					Device: req.displayName || req.deviceId,
+					Role: req.role ?? "",
+					IP: req.remoteIp ?? "",
+					Age: typeof req.ts === "number" ? formatTimeAgo(Date.now() - req.ts) : "",
+					Flags: req.isRepair ? "repair" : ""
+				}))
+			}).trimEnd());
+		}
+		if (list.paired?.length) {
+			const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+			defaultRuntime.log(`${theme.heading("Paired")} ${theme.muted(`(${list.paired.length})`)}`);
+			defaultRuntime.log(renderTable({
+				width: tableWidth,
+				columns: [
+					{
+						key: "Device",
+						header: "Device",
+						minWidth: 16,
+						flex: true
+					},
+					{
+						key: "Roles",
+						header: "Roles",
+						minWidth: 12,
+						flex: true
+					},
+					{
+						key: "Scopes",
+						header: "Scopes",
+						minWidth: 12,
+						flex: true
+					},
+					{
+						key: "Tokens",
+						header: "Tokens",
+						minWidth: 12,
+						flex: true
+					},
+					{
+						key: "IP",
+						header: "IP",
+						minWidth: 12
+					}
+				],
+				rows: list.paired.map((device) => ({
+					Device: device.displayName || device.deviceId,
+					Roles: device.roles?.length ? device.roles.join(", ") : "",
+					Scopes: device.scopes?.length ? device.scopes.join(", ") : "",
+					Tokens: formatTokenSummary(device.tokens),
+					IP: device.remoteIp ?? ""
+				}))
+			}).trimEnd());
+		}
+		if (!list.pending?.length && !list.paired?.length) defaultRuntime.log(theme.muted("No device pairing entries."));
+	}));
+	devicesCallOpts(devices.command("remove").description("Remove a paired device entry").argument("<deviceId>", "Paired device id").action(async (deviceId, opts) => {
+		const trimmed = deviceId.trim();
+		if (!trimmed) {
+			defaultRuntime.error("deviceId is required");
+			defaultRuntime.exit(1);
+			return;
+		}
+		const result = await callGatewayCli("device.pair.remove", opts, { deviceId: trimmed });
+		if (opts.json) {
+			defaultRuntime.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		defaultRuntime.log(`${theme.warn("Removed")} ${theme.command(trimmed)}`);
+	}));
+	devicesCallOpts(devices.command("clear").description("Clear paired devices from the gateway table").option("--pending", "Also reject all pending pairing requests", false).option("--yes", "Confirm destructive clear", false).action(async (opts) => {
+		if (!opts.yes) {
+			defaultRuntime.error("Refusing to clear pairing table without --yes");
+			defaultRuntime.exit(1);
+			return;
+		}
+		const list = parseDevicePairingList(await callGatewayCli("device.pair.list", opts, {}));
+		const removedDeviceIds = [];
+		const rejectedRequestIds = [];
+		const paired = Array.isArray(list.paired) ? list.paired : [];
+		for (const device of paired) {
+			const deviceId = typeof device.deviceId === "string" ? device.deviceId.trim() : "";
+			if (!deviceId) continue;
+			await callGatewayCli("device.pair.remove", opts, { deviceId });
+			removedDeviceIds.push(deviceId);
+		}
+		if (opts.pending) {
+			const pending = Array.isArray(list.pending) ? list.pending : [];
+			for (const req of pending) {
+				const requestId = typeof req.requestId === "string" ? req.requestId.trim() : "";
+				if (!requestId) continue;
+				await callGatewayCli("device.pair.reject", opts, { requestId });
+				rejectedRequestIds.push(requestId);
+			}
+		}
+		if (opts.json) {
+			defaultRuntime.log(JSON.stringify({
+				removedDevices: removedDeviceIds,
+				rejectedPending: rejectedRequestIds
+			}, null, 2));
+			return;
+		}
+		defaultRuntime.log(`${theme.warn("Cleared")} ${removedDeviceIds.length} paired device${removedDeviceIds.length === 1 ? "" : "s"}`);
+		if (opts.pending) defaultRuntime.log(`${theme.warn("Rejected")} ${rejectedRequestIds.length} pending request${rejectedRequestIds.length === 1 ? "" : "s"}`);
+	}));
+	devicesCallOpts(devices.command("approve").description("Approve a pending device pairing request").argument("[requestId]", "Pending request id").option("--latest", "Approve the most recent pending request", false).action(async (requestId, opts) => {
+		let resolvedRequestId = requestId?.trim();
+		if (!resolvedRequestId || opts.latest) resolvedRequestId = selectLatestPendingRequest((await listPairingWithFallback(opts)).pending)?.requestId?.trim();
+		if (!resolvedRequestId) {
+			defaultRuntime.error("No pending device pairing requests to approve");
+			defaultRuntime.exit(1);
+			return;
+		}
+		const result = await approvePairingWithFallback(opts, resolvedRequestId);
+		if (!result) {
+			defaultRuntime.error("unknown requestId");
+			defaultRuntime.exit(1);
+			return;
+		}
+		if (opts.json) {
+			defaultRuntime.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		const deviceId = result?.device?.deviceId;
+		defaultRuntime.log(`${theme.success("Approved")} ${theme.command(deviceId ?? "ok")} ${theme.muted(`(${resolvedRequestId})`)}`);
+	}));
+	devicesCallOpts(devices.command("reject").description("Reject a pending device pairing request").argument("<requestId>", "Pending request id").action(async (requestId, opts) => {
+		const result = await callGatewayCli("device.pair.reject", opts, { requestId });
+		if (opts.json) {
+			defaultRuntime.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		const deviceId = result?.deviceId;
+		defaultRuntime.log(`${theme.warn("Rejected")} ${theme.command(deviceId ?? "ok")}`);
+	}));
+	devicesCallOpts(devices.command("rotate").description("Rotate a device token for a role").requiredOption("--device <id>", "Device id").requiredOption("--role <role>", "Role name").option("--scope <scope...>", "Scopes to attach to the token (repeatable)").action(async (opts) => {
+		const required = resolveRequiredDeviceRole(opts);
+		if (!required) return;
+		const result = await callGatewayCli("device.token.rotate", opts, {
+			deviceId: required.deviceId,
+			role: required.role,
+			scopes: Array.isArray(opts.scope) ? opts.scope : void 0
+		});
+		defaultRuntime.log(JSON.stringify(result, null, 2));
+	}));
+	devicesCallOpts(devices.command("revoke").description("Revoke a device token for a role").requiredOption("--device <id>", "Device id").requiredOption("--role <role>", "Role name").action(async (opts) => {
+		const required = resolveRequiredDeviceRole(opts);
+		if (!required) return;
+		const result = await callGatewayCli("device.token.revoke", opts, {
+			deviceId: required.deviceId,
+			role: required.role
+		});
+		defaultRuntime.log(JSON.stringify(result, null, 2));
+	}));
+}
+
+//#endregion
+export { registerDevicesCli };

package/dist/devices-cli-CHGdYfrz.js

@@ -0,0 +1,319 @@
+import { Ct as theme, _ as defaultRuntime } from "./entry.js";
+import "./config-BTH7fB_v.js";
+import "./host-env-security-axRnIi8d.js";
+import "./shell-env-DBS5su07.js";
+import "./version-3QUZW8EP.js";
+import "./env-vars-CD2_baIP.js";
+import "./agent-scope-BA1HP4K6.js";
+import "./zod-schema-CvFqwpNE.js";
+import { f as GATEWAY_CLIENT_MODES, p as GATEWAY_CLIENT_NAMES } from "./message-channel-tuc9CdEw.js";
+import { Ot as listDevicePairing, Pt as summarizeDeviceTokens, Tt as approveDevicePairing } from "./client-B6h7bgbF.js";
+import { n as callGateway, t as buildGatewayConnectionDetails } from "./call-D_NchaCs.js";
+import { r as isLoopbackHost } from "./net-DSkFMHJ8.js";
+import "./logger-CPvz-aPM.js";
+import "./ip-MwCwRA7c.js";
+import "./tailnet-xt92Yaop.js";
+import { n as formatTimeAgo } from "./format-relative-Czf5fUjn.js";
+import { n as withProgress } from "./progress-DRLmcFiG.js";
+import { t as renderTable } from "./table-On3hkCqi.js";
+
+//#region src/cli/devices-cli.ts
+const FALLBACK_NOTICE = "Direct scope access failed; using local fallback.";
+const devicesCallOpts = (cmd, defaults) => cmd.option("--url <url>", "Gateway WebSocket URL (defaults to gateway.remote.url when configured)").option("--token <token>", "Gateway token (if required)").option("--password <password>", "Gateway password (password auth)").option("--timeout <ms>", "Timeout in ms", String(defaults?.timeoutMs ?? 1e4)).option("--json", "Output JSON", false);
+const callGatewayCli = async (method, opts, params) => withProgress({
+	label: `Devices ${method}`,
+	indeterminate: true,
+	enabled: opts.json !== true
+}, async () => await callGateway({
+	url: opts.url,
+	token: opts.token,
+	password: opts.password,
+	method,
+	params,
+	timeoutMs: Number(opts.timeout ?? 1e4),
+	clientName: GATEWAY_CLIENT_NAMES.CLI,
+	mode: GATEWAY_CLIENT_MODES.CLI
+}));
+function normalizeErrorMessage(error) {
+	if (error instanceof Error) return error.message;
+	return String(error);
+}
+function shouldUseLocalPairingFallback(opts, error) {
+	if (!normalizeErrorMessage(error).toLowerCase().includes("pairing required")) return false;
+	if (typeof opts.url === "string" && opts.url.trim().length > 0) return false;
+	const connection = buildGatewayConnectionDetails();
+	if (connection.urlSource !== "local loopback") return false;
+	try {
+		return isLoopbackHost(new URL(connection.url).hostname);
+	} catch {
+		return false;
+	}
+}
+function redactLocalPairedDevice(device) {
+	const { tokens, ...rest } = device;
+	return {
+		...rest,
+		tokens: summarizeDeviceTokens(tokens)
+	};
+}
+async function listPairingWithFallback(opts) {
+	try {
+		return parseDevicePairingList(await callGatewayCli("device.pair.list", opts, {}));
+	} catch (error) {
+		if (!shouldUseLocalPairingFallback(opts, error)) throw error;
+		if (opts.json !== true) defaultRuntime.log(theme.warn(FALLBACK_NOTICE));
+		const local = await listDevicePairing();
+		return {
+			pending: local.pending,
+			paired: local.paired.map((device) => redactLocalPairedDevice(device))
+		};
+	}
+}
+async function approvePairingWithFallback(opts, requestId) {
+	try {
+		return await callGatewayCli("device.pair.approve", opts, { requestId });
+	} catch (error) {
+		if (!shouldUseLocalPairingFallback(opts, error)) throw error;
+		if (opts.json !== true) defaultRuntime.log(theme.warn(FALLBACK_NOTICE));
+		const approved = await approveDevicePairing(requestId);
+		if (!approved) return null;
+		return {
+			requestId,
+			device: redactLocalPairedDevice(approved.device)
+		};
+	}
+}
+function parseDevicePairingList(value) {
+	const obj = typeof value === "object" && value !== null ? value : {};
+	return {
+		pending: Array.isArray(obj.pending) ? obj.pending : [],
+		paired: Array.isArray(obj.paired) ? obj.paired : []
+	};
+}
+function selectLatestPendingRequest(pending) {
+	if (!pending?.length) return null;
+	return pending.reduce((latest, current) => {
+		const latestTs = typeof latest.ts === "number" ? latest.ts : 0;
+		return (typeof current.ts === "number" ? current.ts : 0) > latestTs ? current : latest;
+	});
+}
+function formatTokenSummary(tokens) {
+	if (!tokens || tokens.length === 0) return "none";
+	return tokens.map((t) => `${t.role}${t.revokedAtMs ? " (revoked)" : ""}`).toSorted((a, b) => a.localeCompare(b)).join(", ");
+}
+function resolveRequiredDeviceRole(opts) {
+	const deviceId = String(opts.device ?? "").trim();
+	const role = String(opts.role ?? "").trim();
+	if (deviceId && role) return {
+		deviceId,
+		role
+	};
+	defaultRuntime.error("--device and --role required");
+	defaultRuntime.exit(1);
+	return null;
+}
+function registerDevicesCli(program) {
+	const devices = program.command("devices").description("Device pairing and auth tokens");
+	devicesCallOpts(devices.command("list").description("List pending and paired devices").action(async (opts) => {
+		const list = await listPairingWithFallback(opts);
+		if (opts.json) {
+			defaultRuntime.log(JSON.stringify(list, null, 2));
+			return;
+		}
+		if (list.pending?.length) {
+			const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+			defaultRuntime.log(`${theme.heading("Pending")} ${theme.muted(`(${list.pending.length})`)}`);
+			defaultRuntime.log(renderTable({
+				width: tableWidth,
+				columns: [
+					{
+						key: "Request",
+						header: "Request",
+						minWidth: 10
+					},
+					{
+						key: "Device",
+						header: "Device",
+						minWidth: 16,
+						flex: true
+					},
+					{
+						key: "Role",
+						header: "Role",
+						minWidth: 8
+					},
+					{
+						key: "IP",
+						header: "IP",
+						minWidth: 12
+					},
+					{
+						key: "Age",
+						header: "Age",
+						minWidth: 8
+					},
+					{
+						key: "Flags",
+						header: "Flags",
+						minWidth: 8
+					}
+				],
+				rows: list.pending.map((req) => ({
+					Request: req.requestId,
+					Device: req.displayName || req.deviceId,
+					Role: req.role ?? "",
+					IP: req.remoteIp ?? "",
+					Age: typeof req.ts === "number" ? formatTimeAgo(Date.now() - req.ts) : "",
+					Flags: req.isRepair ? "repair" : ""
+				}))
+			}).trimEnd());
+		}
+		if (list.paired?.length) {
+			const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
+			defaultRuntime.log(`${theme.heading("Paired")} ${theme.muted(`(${list.paired.length})`)}`);
+			defaultRuntime.log(renderTable({
+				width: tableWidth,
+				columns: [
+					{
+						key: "Device",
+						header: "Device",
+						minWidth: 16,
+						flex: true
+					},
+					{
+						key: "Roles",
+						header: "Roles",
+						minWidth: 12,
+						flex: true
+					},
+					{
+						key: "Scopes",
+						header: "Scopes",
+						minWidth: 12,
+						flex: true
+					},
+					{
+						key: "Tokens",
+						header: "Tokens",
+						minWidth: 12,
+						flex: true
+					},
+					{
+						key: "IP",
+						header: "IP",
+						minWidth: 12
+					}
+				],
+				rows: list.paired.map((device) => ({
+					Device: device.displayName || device.deviceId,
+					Roles: device.roles?.length ? device.roles.join(", ") : "",
+					Scopes: device.scopes?.length ? device.scopes.join(", ") : "",
+					Tokens: formatTokenSummary(device.tokens),
+					IP: device.remoteIp ?? ""
+				}))
+			}).trimEnd());
+		}
+		if (!list.pending?.length && !list.paired?.length) defaultRuntime.log(theme.muted("No device pairing entries."));
+	}));
+	devicesCallOpts(devices.command("remove").description("Remove a paired device entry").argument("<deviceId>", "Paired device id").action(async (deviceId, opts) => {
+		const trimmed = deviceId.trim();
+		if (!trimmed) {
+			defaultRuntime.error("deviceId is required");
+			defaultRuntime.exit(1);
+			return;
+		}
+		const result = await callGatewayCli("device.pair.remove", opts, { deviceId: trimmed });
+		if (opts.json) {
+			defaultRuntime.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		defaultRuntime.log(`${theme.warn("Removed")} ${theme.command(trimmed)}`);
+	}));
+	devicesCallOpts(devices.command("clear").description("Clear paired devices from the gateway table").option("--pending", "Also reject all pending pairing requests", false).option("--yes", "Confirm destructive clear", false).action(async (opts) => {
+		if (!opts.yes) {
+			defaultRuntime.error("Refusing to clear pairing table without --yes");
+			defaultRuntime.exit(1);
+			return;
+		}
+		const list = parseDevicePairingList(await callGatewayCli("device.pair.list", opts, {}));
+		const removedDeviceIds = [];
+		const rejectedRequestIds = [];
+		const paired = Array.isArray(list.paired) ? list.paired : [];
+		for (const device of paired) {
+			const deviceId = typeof device.deviceId === "string" ? device.deviceId.trim() : "";
+			if (!deviceId) continue;
+			await callGatewayCli("device.pair.remove", opts, { deviceId });
+			removedDeviceIds.push(deviceId);
+		}
+		if (opts.pending) {
+			const pending = Array.isArray(list.pending) ? list.pending : [];
+			for (const req of pending) {
+				const requestId = typeof req.requestId === "string" ? req.requestId.trim() : "";
+				if (!requestId) continue;
+				await callGatewayCli("device.pair.reject", opts, { requestId });
+				rejectedRequestIds.push(requestId);
+			}
+		}
+		if (opts.json) {
+			defaultRuntime.log(JSON.stringify({
+				removedDevices: removedDeviceIds,
+				rejectedPending: rejectedRequestIds
+			}, null, 2));
+			return;
+		}
+		defaultRuntime.log(`${theme.warn("Cleared")} ${removedDeviceIds.length} paired device${removedDeviceIds.length === 1 ? "" : "s"}`);
+		if (opts.pending) defaultRuntime.log(`${theme.warn("Rejected")} ${rejectedRequestIds.length} pending request${rejectedRequestIds.length === 1 ? "" : "s"}`);
+	}));
+	devicesCallOpts(devices.command("approve").description("Approve a pending device pairing request").argument("[requestId]", "Pending request id").option("--latest", "Approve the most recent pending request", false).action(async (requestId, opts) => {
+		let resolvedRequestId = requestId?.trim();
+		if (!resolvedRequestId || opts.latest) resolvedRequestId = selectLatestPendingRequest((await listPairingWithFallback(opts)).pending)?.requestId?.trim();
+		if (!resolvedRequestId) {
+			defaultRuntime.error("No pending device pairing requests to approve");
+			defaultRuntime.exit(1);
+			return;
+		}
+		const result = await approvePairingWithFallback(opts, resolvedRequestId);
+		if (!result) {
+			defaultRuntime.error("unknown requestId");
+			defaultRuntime.exit(1);
+			return;
+		}
+		if (opts.json) {
+			defaultRuntime.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		const deviceId = result?.device?.deviceId;
+		defaultRuntime.log(`${theme.success("Approved")} ${theme.command(deviceId ?? "ok")} ${theme.muted(`(${resolvedRequestId})`)}`);
+	}));
+	devicesCallOpts(devices.command("reject").description("Reject a pending device pairing request").argument("<requestId>", "Pending request id").action(async (requestId, opts) => {
+		const result = await callGatewayCli("device.pair.reject", opts, { requestId });
+		if (opts.json) {
+			defaultRuntime.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		const deviceId = result?.deviceId;
+		defaultRuntime.log(`${theme.warn("Rejected")} ${theme.command(deviceId ?? "ok")}`);
+	}));
+	devicesCallOpts(devices.command("rotate").description("Rotate a device token for a role").requiredOption("--device <id>", "Device id").requiredOption("--role <role>", "Role name").option("--scope <scope...>", "Scopes to attach to the token (repeatable)").action(async (opts) => {
+		const required = resolveRequiredDeviceRole(opts);
+		if (!required) return;
+		const result = await callGatewayCli("device.token.rotate", opts, {
+			deviceId: required.deviceId,
+			role: required.role,
+			scopes: Array.isArray(opts.scope) ? opts.scope : void 0
+		});
+		defaultRuntime.log(JSON.stringify(result, null, 2));
+	}));
+	devicesCallOpts(devices.command("revoke").description("Revoke a device token for a role").requiredOption("--device <id>", "Device id").requiredOption("--role <role>", "Role name").action(async (opts) => {
+		const required = resolveRequiredDeviceRole(opts);
+		if (!required) return;
+		const result = await callGatewayCli("device.token.revoke", opts, {
+			deviceId: required.deviceId,
+			role: required.role
+		});
+		defaultRuntime.log(JSON.stringify(result, null, 2));
+	}));
+}
+
+//#endregion
+export { registerDevicesCli };

package/dist/diagnostics-BzzhTQzK.js

@@ -0,0 +1,35 @@
+import { s as resolveGatewayLogPaths } from "./service-C8a0SXHD.js";
+import fsp from "node:fs/promises";
+
+//#region src/daemon/diagnostics.ts
+const GATEWAY_LOG_ERROR_PATTERNS = [
+	/refusing to bind gateway/i,
+	/gateway auth mode/i,
+	/gateway start blocked/i,
+	/failed to bind gateway socket/i,
+	/tailscale .* requires/i
+];
+async function readLastLogLine(filePath) {
+	try {
+		const lines = (await fsp.readFile(filePath, "utf8")).split(/\r?\n/).map((line) => line.trim());
+		for (let i = lines.length - 1; i >= 0; i -= 1) if (lines[i]) return lines[i];
+		return null;
+	} catch {
+		return null;
+	}
+}
+async function readLastGatewayErrorLine(env) {
+	const { stdoutPath, stderrPath } = resolveGatewayLogPaths(env);
+	const stderrRaw = await fsp.readFile(stderrPath, "utf8").catch(() => "");
+	const stdoutRaw = await fsp.readFile(stdoutPath, "utf8").catch(() => "");
+	const lines = [...stderrRaw.split(/\r?\n/), ...stdoutRaw.split(/\r?\n/)].map((line) => line.trim());
+	for (let i = lines.length - 1; i >= 0; i -= 1) {
+		const line = lines[i];
+		if (!line) continue;
+		if (GATEWAY_LOG_ERROR_PATTERNS.some((pattern) => pattern.test(line))) return line;
+	}
+	return await readLastLogLine(stderrPath) ?? await readLastLogLine(stdoutPath);
+}
+
+//#endregion
+export { readLastGatewayErrorLine as t };