colloq 0.2.0__py3-none-any.whl

colloq/_app/cli/colloq.mjs

@@ -0,0 +1,2517 @@
+#!/usr/bin/env node
+
+// cli/src/main.ts
+import { parseArgs } from "node:util";
+
+// cli/src/ui.ts
+var SYMBOL = { on: "\u25CF", off: "\u25CB", ok: "\u2713", bad: "\u2717", next: "\u2192" };
+var BOLD = "\x1B[1m";
+var DIM = "\x1B[2m";
+var CYAN = "\x1B[36m";
+var RED = "\x1B[31m";
+var OFF = "\x1B[0m";
+var PreconditionError = class extends Error {
+  code = 3;
+  fix;
+  why;
+  constructor(message, fix = "", why = "") {
+    super(message);
+    this.name = "PreconditionError";
+    this.fix = fix;
+    this.why = why;
+  }
+};
+var UsageError = class extends Error {
+  code = 2;
+  fix;
+  why;
+  constructor(message, fix = "", why = "") {
+    super(message);
+    this.name = "UsageError";
+    this.fix = fix;
+    this.why = why;
+  }
+};
+function visibleLength(text) {
+  return stripAnsi(text).length;
+}
+function stripAnsi(text) {
+  return text.replace(/\u001b\[[0-9;]*m/g, "");
+}
+function colorAllowed(env, isTty) {
+  if ("NO_COLOR" in env) return false;
+  return isTty;
+}
+function writer(stream) {
+  let broken = false;
+  stream.on("error", () => void (broken = true));
+  return (text) => {
+    if (broken) return;
+    try {
+      stream.write(text + "\n");
+    } catch {
+      broken = true;
+    }
+  };
+}
+function createUi(opts = {}) {
+  const color = opts.color ?? false;
+  const out = opts.out ?? writer(process.stdout);
+  const err = opts.err ?? writer(process.stderr);
+  const tty = opts.tty ?? false;
+  let jsonMode = opts.json ?? false;
+  let jsonDone = false;
+  const paint = (code, text) => color ? code + text + OFF : text;
+  const ui = {
+    get color() {
+      return color;
+    },
+    get jsonMode() {
+      return jsonMode;
+    },
+    bold: (text) => paint(BOLD, text),
+    dim: (text) => paint(DIM, text),
+    cyan: (text) => paint(CYAN, text),
+    red: (text) => paint(RED, text),
+    line(text = "") {
+      if (jsonMode) return;
+      out(text);
+    },
+    header(text) {
+      if (jsonMode) return;
+      out(ui.bold(text));
+    },
+    kv(key, value, hint) {
+      if (jsonMode) return;
+      const tail = hint ? " \xB7 " + ui.dim(hint) : "";
+      out("  " + key.padEnd(12) + value + tail);
+    },
+    hint(text) {
+      if (jsonMode) return;
+      out("      " + ui.dim(SYMBOL.next + " " + text));
+    },
+    table(rows) {
+      if (jsonMode) return;
+      if (rows.length === 0) return;
+      const indent = "  ";
+      const gap = "  ";
+      const columns = Math.max(...rows.map((row) => row.length));
+      const widths = [];
+      for (let i = 0; i < columns; i++) {
+        widths[i] = Math.max(...rows.map((row) => visibleLength(row[i] ?? "")));
+      }
+      for (const row of rows) {
+        const cells = [];
+        for (let i = 0; i < columns; i++) {
+          const cell = row[i] ?? "";
+          const pad = " ".repeat(Math.max(0, (widths[i] ?? 0) - visibleLength(cell)));
+          cells.push(cell + pad);
+        }
+        out((indent + cells.join(gap)).replace(/[ ]+$/, ""));
+      }
+    },
+    refuse(what, why, fix) {
+      if (jsonMode) {
+        ui.json({ ok: false, code: 3, error: what + (why ? ". " + why : ""), hint: fix });
+        return;
+      }
+      err(ui.red(SYMBOL.bad + " " + what));
+      if (why) err(why);
+      if (fix) err(ui.dim(SYMBOL.next + " " + fix));
+    },
+    async confirm(question) {
+      const ask2 = opts.ask;
+      if (!ask2 && !tty) {
+        throw new PreconditionError(
+          "no terminal to ask in",
+          "repeat with --yes if you agree in advance"
+        );
+      }
+      const line = SYMBOL.next + " " + question + " [y/N] ";
+      const answer = ask2 ? await ask2(line) : await readLine(line);
+      const value = answer.trim().toLowerCase();
+      return value === "y" || value === "yes";
+    },
+    json(value) {
+      jsonMode = true;
+      if (jsonDone) return;
+      jsonDone = true;
+      out(JSON.stringify(value));
+    }
+  };
+  return ui;
+}
+function countWord(count, one, many = one + "s") {
+  return count + " " + (count === 1 ? one : many);
+}
+function roomsWord(count) {
+  return countWord(count, "room");
+}
+function heading(ctx, text) {
+  if (!ctx.dryRun) ctx.ui.header(text);
+}
+function cancelled(ui) {
+  ui.line(ui.dim("cancelled"));
+  return 4;
+}
+async function readLine(question) {
+  const readline = await import("node:readline/promises");
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(question);
+  } finally {
+    rl.close();
+  }
+}
+
+// cli/src/env.ts
+import * as fs2 from "node:fs";
+
+// cli/src/launch-state.ts
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+var selfDir = path.dirname(fileURLToPath(import.meta.url));
+function expandHome(value) {
+  return value === "~" || value.startsWith("~/") ? path.join(os.homedir(), value.slice(1)) : value;
+}
+function isRepository(dir) {
+  try {
+    if (!fs.existsSync(path.join(dir, "Makefile"))) return false;
+    return /"name"\s*:\s*"colloq"/.test(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+  } catch {
+    return false;
+  }
+}
+function isWorkingTree(dir) {
+  return fs.existsSync(path.join(dir, "cli/src/launch.ts"));
+}
+function isDistribution(dir = appDir()) {
+  return fs.existsSync(path.join(dir, ".colloq-dist.json"));
+}
+function looksLikeApp(dir) {
+  if (isRepository(dir) || fs.existsSync(path.join(dir, ".colloq-dist.json"))) return true;
+  return fs.existsSync(path.join(dir, "server/dist/server.js")) && fs.existsSync(path.join(dir, "web/dist"));
+}
+var appCache;
+function appDir() {
+  if (appCache) return appCache;
+  const explicit = process.env.COLLOQ_APP_DIR;
+  if (explicit) return appCache = path.resolve(expandHome(explicit));
+  for (let dir = selfDir, step = 0; step < 12; step++) {
+    if (looksLikeApp(dir)) return appCache = dir;
+    const up = path.dirname(dir);
+    if (up === dir) break;
+    dir = up;
+  }
+  return appCache = path.resolve(selfDir, "../..");
+}
+function userStateDir() {
+  const xdg = process.env.XDG_DATA_HOME;
+  return xdg && path.isAbsolute(xdg) ? path.join(xdg, "colloq") : path.join(os.homedir(), ".colloq");
+}
+function resolveHome() {
+  const explicit = process.env.COLLOQ_HOME;
+  if (explicit) return path.resolve(expandHome(explicit));
+  const app = appDir();
+  if (isRepository(app)) return app;
+  if (isDistribution(app)) return userStateDir();
+  if (isWorkingTree(app)) return app;
+  return userStateDir();
+}
+var homeCache;
+function homeDir() {
+  if (homeCache) return homeCache;
+  const home = resolveHome();
+  fs.mkdirSync(home, { recursive: true, mode: 448 });
+  return homeCache = home;
+}
+var SESSION_FILE = ".colloq/local-session.json";
+
+// cli/src/env.ts
+function envNameOk(name) {
+  return /^[A-Za-z0-9-]+$/.test(name) && !name.startsWith("-") && !name.endsWith("-");
+}
+var SECRET_KEYS = [
+  "JUPYTER_TOKEN",
+  "SESSION_SECRET",
+  "RELAY_TOKEN",
+  "CF_TOKEN",
+  "VAST_TOKEN",
+  "OPENAI_API_KEY",
+  "OPENROUTER_API_KEY"
+];
+var SEP = "/";
+function joinPath(...parts) {
+  const segments = [];
+  let absolute = false;
+  for (const part of parts) {
+    if (part === "") continue;
+    if (part.startsWith(SEP)) {
+      segments.length = 0;
+      absolute = true;
+    }
+    for (const piece of part.split(SEP)) {
+      if (piece === "" || piece === ".") continue;
+      if (piece === "..") {
+        segments.pop();
+        continue;
+      }
+      segments.push(piece);
+    }
+  }
+  return (absolute ? SEP : "") + segments.join(SEP);
+}
+function parseEnvValue(text, key) {
+  let found = "";
+  for (const raw of text.split("\n")) {
+    if (!raw.startsWith(key + "=")) continue;
+    found = raw.slice(key.length + 1);
+  }
+  let value = found;
+  if (value.endsWith("\r")) value = value.slice(0, -1);
+  value = value.replace(/^[\s]+/, "").replace(/[\s]+$/, "");
+  if (value.length >= 2) {
+    const first = value[0];
+    const last = value[value.length - 1];
+    if (first === '"' && last === '"' || first === "'" && last === "'") {
+      value = value.slice(1, -1);
+    }
+  }
+  return value;
+}
+function createIo() {
+  return {
+    exists: (path2) => fs2.existsSync(path2),
+    readText: (path2) => {
+      try {
+        return fs2.readFileSync(path2, "utf8");
+      } catch {
+        return null;
+      }
+    },
+    mtime: (path2) => {
+      try {
+        return fs2.statSync(path2).mtimeMs;
+      } catch {
+        return null;
+      }
+    },
+    list: (path2) => {
+      try {
+        return fs2.readdirSync(path2).slice().sort();
+      } catch {
+        return [];
+      }
+    },
+    now: () => Date.now(),
+    writeText: (path2, text, mode) => {
+      const dir = path2.slice(0, path2.lastIndexOf(SEP));
+      if (dir) fs2.mkdirSync(dir, { recursive: true });
+      fs2.writeFileSync(path2, text, mode === void 0 ? void 0 : { mode });
+    }
+  };
+}
+function createEnv(opts = {}) {
+  const processEnv = opts.processEnv ?? process.env;
+  const io = opts.io ?? createIo();
+  const root = opts.root ?? appDir();
+  const home = opts.home ?? opts.root ?? homeDir();
+  const cwd = opts.cwd ?? processEnv.COLLOQ_CWD ?? root;
+  const path2 = (...parts) => joinPath(root, ...parts);
+  const statePath = (...parts) => joinPath(home, ...parts);
+  const paths = {
+    root,
+    home,
+    envFile: statePath(".env"),
+    pidFile: statePath(".colloq.pid"),
+    logFile: statePath(".colloq.log"),
+    envDir: path2("kernel/environments"),
+    /*
+     * Второй каталог окружений — и он заводится ровно там, где первый писать
+     * нельзя.
+     *
+     * Окружения, приехавшие с продуктом (base, base-gpu, cv, gpu), лежат в
+     * <app>/kernel/environments. У установленного colloq это site-packages:
+     * каталог целиком перезаписывается следующим `pip install -U`, а на многих
+     * машинах не пишется вовсе. Завести там своё окружение значит либо
+     * получить отказ прав, либо потерять файл на первом же обновлении.
+     *
+     * Поэтому своё живёт в каталоге состояния, рядом с .env и data/, — там,
+     * где его никто не перезапишет: <home>/environments.
+     *
+     * В репозитории (и в любом рабочем дереве, где home и есть корень
+     * приложения) второй каталог — это ПЕРВЫЙ, тот же самый путь. Так и
+     * задумано: там kernel/environments и пишется, и читается, и попадает в
+     * контекст `docker build`, и её же видят Makefile, launch-config.ts ·
+     * kernelInputs и панель преподавателя. Новый каталог рядом увёл бы файл
+     * из-под всех троих, и `colloq env new` в клоне заводил бы окружение,
+     * которого не видит сборка.
+     */
+    ownEnvDir: home === root ? path2("kernel/environments") : joinPath(home, "environments"),
+    sessionFile: statePath(SESSION_FILE),
+    backupsDir: statePath("backups"),
+    dist: path2("web/dist")
+  };
+  const readRaw = (key) => {
+    const text = io.readText(paths.envFile);
+    if (text === null) return "";
+    return parseEnvValue(text, key);
+  };
+  const env = {
+    root: () => root,
+    path: path2,
+    userPath: (value) => value.startsWith(SEP) ? value : joinPath(cwd, value),
+    read(key) {
+      if (SECRET_KEYS.includes(key)) {
+        throw new Error(
+          "the value of " + key + " is not readable: secrets live in .env, the CLI only has has()"
+        );
+      }
+      return readRaw(key);
+    },
+    has: (key) => readRaw(key) !== "",
+    port() {
+      const value = Number.parseInt(readRaw("PORT"), 10);
+      return Number.isFinite(value) && value > 0 ? value : 3e3;
+    },
+    kernelEnv: () => readRaw("KERNEL_ENV") || "base",
+    home: () => processEnv.HOME ?? processEnv.USERPROFILE ?? "",
+    publicUrl: () => readRaw("PUBLIC_URL"),
+    relay() {
+      const port = Number.parseInt(readRaw("RELAY_PORT"), 10);
+      return {
+        domain: readRaw("RELAY_DOMAIN"),
+        addr: readRaw("RELAY_ADDR"),
+        port: Number.isFinite(port) && port > 0 ? port : 7e3
+      };
+    },
+    paths,
+    io
+  };
+  return env;
+}
+
+// cli/src/session.ts
+function whole(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 1 ? value : null;
+}
+function loopback(value) {
+  if (typeof value !== "string") return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:") return null;
+    if (!["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) return null;
+    if (url.username || url.password || url.search || url.hash) return null;
+    if (url.pathname !== "/") return null;
+    return value;
+  } catch {
+    return null;
+  }
+}
+function readSession(io, file) {
+  let data;
+  try {
+    const parsed = JSON.parse(io.readText(file) ?? "null");
+    if (!parsed || typeof parsed !== "object") return null;
+    data = parsed;
+  } catch {
+    return null;
+  }
+  const pid = whole(data.pid);
+  const url = loopback(data.url);
+  const port = whole(data.port);
+  const mode = data.mode === "dev" ? "dev" : data.mode === "run" ? "run" : null;
+  if (pid === null || url === null || port === null || port > 65535 || mode === null) return null;
+  if (typeof data.runId !== "string" || !data.runId) return null;
+  const phase = ["preparing", "starting", "ready", "stopping"].includes(String(data.phase)) ? data.phase : "ready";
+  return {
+    pid,
+    serverPid: whole(data.serverPid),
+    port,
+    url,
+    runId: data.runId,
+    mode,
+    phase,
+    startedAt: whole(data.startedAt) ?? 0,
+    leaseFile: typeof data.leaseFile === "string" ? data.leaseFile : ""
+  };
+}
+
+// cli/src/commands/host.ts
+var PERIMETER = {
+  what: "student code runs in a hardened container per room, cut off from your home network",
+  fix: "the link is a door: anyone who has it runs code in a sandbox on this computer \u2014 keep it for your class; Ctrl+C closes it"
+};
+var NAME = /^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/;
+function hostNameOk(host) {
+  return NAME.test(host);
+}
+function nameOf(ctx) {
+  return (ctx.positionals[0] ?? "").trim();
+}
+function directOf(ctx) {
+  return ctx.values.direct === true;
+}
+function checkName(ctx) {
+  const host = nameOf(ctx);
+  if (directOf(ctx) && !host) {
+    throw new UsageError(
+      "direct mode needs a name",
+      "colloq host class.example.org --direct",
+      "the certificate is issued for that name, and it cannot be made up for you"
+    );
+  }
+  if (host && !hostNameOk(host)) {
+    throw new UsageError(
+      "name " + host + " will not do",
+      "colloq host class.example.org",
+      "a name holds only latin letters, digits, dots and hyphens"
+    );
+  }
+}
+function needEnv(ctx) {
+  if (ctx.io.exists(ctx.env.paths.envFile)) return;
+  throw new PreconditionError(
+    "no " + ctx.env.paths.envFile + " \u2014 PORT, RELAY_* and CF_TOKEN are read from it",
+    "colloq start creates it on the first run"
+  );
+}
+function stateEnv(ctx) {
+  return { COLLOQ_HOME: ctx.env.paths.home };
+}
+function publishCall(ctx, host, direct) {
+  const env = { ...stateEnv(ctx) };
+  if (direct) env.COLLOQ_DIRECT = "1";
+  if (host) env.COLLOQ_HOSTNAME = host;
+  return ctx.sh.script("./scripts/host.sh", [], { env });
+}
+async function publishWhen(ctx) {
+  return directOf(ctx) || await ctx.rooms() > 0;
+}
+function publishQuestion(ctx) {
+  const host = nameOf(ctx);
+  return directOf(ctx) ? "install caddy on 80 and 443 and rewrite the A record for " + host + "?" : "publish " + (host || "the class") + "?";
+}
+function headline(ctx, host, direct) {
+  if (direct) return "installing caddy on this machine: it holds 80 and 443 for " + host;
+  const domain = ctx.env.relay().domain;
+  if (host && domain && (host === domain || host.endsWith("." + domain))) {
+    return "publishing " + host + " through the relay: keep this window open";
+  }
+  if (host) return "publishing " + host + " through Cloudflare, which does not open from Russia";
+  return "publishing through a quick Cloudflare tunnel: the name is random, and it does not open from Russia";
+}
+var commands = [
+  {
+    name: "host",
+    aliases: ["public"],
+    group: "host",
+    summary: "Publish the running class and get a link",
+    usage: "colloq host [name] [--direct]",
+    args: [
+      {
+        name: "name",
+        summary: "Class address, e.g. class.example.org. Without a name: a quick tunnel"
+      }
+    ],
+    flags: [{ name: "direct", summary: "caddy on this machine itself, without the relay" }],
+    destructive: true,
+    confirm: "cli",
+    check: checkName,
+    confirmWhen: publishWhen,
+    confirmQuestion: publishQuestion,
+    delegates: "COLLOQ_HOSTNAME=<name> ./scripts/host.sh (with --direct: COLLOQ_DIRECT=1 as well)",
+    examples: ["colloq host class.example.org", "colloq host class.example.org --direct"],
+    notes: "The class must already be running: host.sh publishes, it does not bring anything up \u2014 if /api/health is silent, it dies with an instruction. Keep this window open: the tunnel is this very process, and Ctrl+C closes only the tunnel. In a local session the temporary address is taken down without restarting the server and without changing .env. A name under RELAY_DOMAIN goes to the relay; any other name goes silently to Cloudflare, which does not open from Russia. Only the relay completes a short name to RELAY_DOMAIN, and host.sh decides that. The price of --direct: caddy takes 80 and 443, /etc/caddy/Caddyfile and its unit are rewritten, and an A record points the name at this machine; after Ctrl+C the name stays live. It needs Linux, systemd, root and a public address: on macOS the script refuses by itself. host.sh publishes nothing unless the server confirms in /api/health that every room runs in a container of its own (Docker or the runtime broker). Without cloudflared on PATH, the Cloudflare transports get a pinned release downloaded once into <state>/bin and checked by sha256; COLLOQ_CLOUDFLARED=/path names your own file. For a class started here, colloq start --share does all of this in one step and prints the link for students. Two lines about the perimeter are printed under the header: every room is a hardened container cut off from your home network, and the link is still a door to code on this computer. colloq doctor says the same.",
+    async run(ctx) {
+      const host = nameOf(ctx);
+      const direct = directOf(ctx);
+      if (ctx.dryRun) return await publishCall(ctx, host, direct);
+      needEnv(ctx);
+      ctx.ui.header(headline(ctx, host, direct));
+      ctx.ui.hint(PERIMETER.what);
+      ctx.ui.hint(PERIMETER.fix);
+      return await publishCall(ctx, host, direct);
+    }
+  }
+];
+
+// shared/local-public-url-lease.ts
+function publicLeaseAddress(value) {
+  if (typeof value !== "string") return null;
+  try {
+    const url = new URL(value);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) return null;
+    return url.href.replace(/\/+$/, "");
+  } catch {
+    return null;
+  }
+}
+function parsePublicUrlLease(raw) {
+  try {
+    const lease = JSON.parse(raw ?? "");
+    if (!lease || typeof lease.runId !== "string" || !lease.runId || typeof lease.owner !== "string" || !lease.owner || !Number.isFinite(lease.expiresAt)) return null;
+    const url = publicLeaseAddress(lease.url);
+    return url ? { runId: lease.runId, owner: lease.owner, expiresAt: lease.expiresAt, url } : null;
+  } catch {
+    return null;
+  }
+}
+function leaseUrl(raw, runId, now) {
+  const lease = parsePublicUrlLease(raw);
+  return lease && lease.runId === runId && lease.expiresAt > now ? lease.url : void 0;
+}
+
+// cli/src/commands/local.ts
+async function ask(ctx, question) {
+  if (await ctx.confirm(question)) return true;
+  cancelled(ctx.ui);
+  return false;
+}
+function flag(ctx, name) {
+  const raw = ctx.values[name];
+  return typeof raw === "string" && raw !== "" ? raw : void 0;
+}
+function stateEnv2(ctx) {
+  return { COLLOQ_HOME: ctx.env.paths.home };
+}
+function copyCall(ctx, script, vars = {}, args = []) {
+  const env = stateEnv2(ctx);
+  for (const [key, item] of Object.entries(vars)) {
+    if (item !== void 0 && item !== "") env[key] = item;
+  }
+  return ctx.sh.script(script, args, { env });
+}
+function checkName2(name) {
+  if (name === void 0) return;
+  if (!envNameOk(name)) {
+    throw new UsageError(
+      'environment name "' + name + '" is not valid',
+      "letters, digits and a hyphen in the middle: --name lab"
+    );
+  }
+}
+function checkLines(lines) {
+  if (lines === void 0) return;
+  if (!/^[0-9]+$/.test(lines) || lines === "0") {
+    throw new UsageError(
+      '"' + lines + '" is not a number of lines',
+      "a whole number: colloq logs -n 200"
+    );
+  }
+}
+function localSession(ctx) {
+  return readSession(ctx.io, ctx.env.paths.sessionFile);
+}
+async function sessionAddress(ctx) {
+  const session = localSession(ctx);
+  if (session === null) return void 0;
+  const alive = await ctx.sh.capture("kill", ["-0", String(session.pid)], { timeoutMs: 4e3 });
+  const publicUrl = alive.code === 0 && session.leaseFile !== "" ? leaseUrl(ctx.io.readText(session.leaseFile), session.runId, ctx.io.now()) : void 0;
+  return { local: session.url, public: publicUrl };
+}
+function checkLaunch(ctx) {
+  const port = ctx.values.port;
+  if (typeof port === "string" && (!/^[0-9]+$/.test(port) || Number(port) < 1 || Number(port) > 65535)) {
+    throw new UsageError(
+      "the port must be a whole number from 1 to 65535",
+      "colloq run --port 3000"
+    );
+  }
+  const host = ctx.values.host;
+  if (typeof host === "string" && !hostNameOk(host)) {
+    throw new UsageError("the tunnel name is not valid", "colloq run --host class.example.org");
+  }
+  if (ctx.values.share === true && host !== void 0) {
+    throw new UsageError(
+      "--share and --host do not work together",
+      "colloq start --share for a quick link, or colloq start --host class.example.org for your own name"
+    );
+  }
+}
+function launcher(ctx) {
+  return ctx.dist ? [ctx.env.path("cli/launch.mjs")] : ["--import", "tsx", ctx.env.path("cli/src/launch.ts")];
+}
+async function launch(ctx, command) {
+  const args = [...launcher(ctx), command];
+  if (command === "run") {
+    const host = flag(ctx, "host");
+    if (host) args.push("--host", host);
+    if (ctx.values.share === true) args.push("--share");
+    if (ctx.values.detach === true) args.push("--detach");
+    const port = flag(ctx, "port");
+    if (port) args.push("--port", port);
+    if (ctx.values["no-open"] === true) args.push("--no-open");
+  }
+  if (command === "restart" && ctx.values.build === true) args.push("--build");
+  if (command !== "stop" && ctx.values.fast === true) args.push("--fast");
+  return await ctx.sh.run("node", args);
+}
+var commands2 = [
+  {
+    name: "run",
+    aliases: ["start"],
+    group: "local",
+    summary: "Start a local session in this terminal and open the browser",
+    usage: "colloq run [--share | --host <name>] [--detach] [--port <port>] [--no-open] [--fast]",
+    flags: [
+      {
+        name: "share",
+        summary: "Put the class online through a quick Cloudflare tunnel and print one link"
+      },
+      { name: "host", arg: "name", summary: "Publish the session through the tunnel it owns" },
+      { name: "detach", summary: "Leave the session in the background" },
+      { name: "port", arg: "port", summary: "Port of the local server" },
+      { name: "no-open", summary: "Do not open the browser" },
+      { name: "fast", summary: "Build without pre-compressing the frontend" }
+    ],
+    destructive: false,
+    check: checkLaunch,
+    delegates: "native: the class supervisor \u2014 cli/launch.mjs in the distribution, cli/src/launch.ts through tsx from the sources",
+    examples: ["colloq start", "colloq start --share", "colloq run --host class.example.org"],
+    notes: "colloq start is the same command under its other name, and it is the one a class is started with most of the time. Logs stay in the terminal and are appended to .colloq.log in the state directory as well; Ctrl+C ends the session, its tunnel and the kernels of this database, keeping files and data. A busy server is not restarted. --detach leaves the session in the background; colloq logs follows it, colloq stop ends it. --fast matters only when colloq runs from its sources: an installed colloq arrives built. --share opens a quick Cloudflare tunnel and prints one block: the link for students (or, with no class yet, where to create one), a warning never to share /admin/ links, and how long the link lives. The address is new on every start, and Cloudflare does not open from Russia \u2014 there, use --host with your own relay. Without cloudflared on PATH, colloq downloads a pinned release from GitHub into <state>/bin once and checks its sha256 before running it; COLLOQ_CLOUDFLARED=/path names your own file, COLLOQ_CLOUDFLARED_DOWNLOAD=0 forbids the download. --share and --host publish a class only when every room runs in a Docker container of its own; otherwise they refuse and the class stays local. They do not work together.",
+    async run(ctx) {
+      heading(ctx, "starting the local session");
+      return await launch(ctx, "run");
+    }
+  },
+  {
+    name: "stop",
+    group: "local",
+    summary: "End the local session, its tunnel and the kernels of this database",
+    usage: "colloq stop",
+    flags: [],
+    destructive: true,
+    confirm: "cli",
+    // Спрашивать «остановить сервер?», чтобы следом сказать «останавливать
+    // нечего», — значит спросить зря: вопрос есть только у идущего занятия.
+    confirmWhen: async (ctx) => localSession(ctx) !== null,
+    confirmQuestion: "stop the server?",
+    delegates: "native: the same supervisor with the stop command",
+    examples: ["colloq stop", "colloq stop --yes"],
+    notes: "From the session receipt (.colloq/local-session.json in the state directory) the supervisor ends the processes it owns and the kernels of its own database. Files and the database are kept. Without a receipt no class is running and there is nothing to stop: every colloq start leaves one.",
+    async run(ctx) {
+      if (localSession(ctx) !== null) {
+        heading(ctx, "stopping the server");
+        return await launch(ctx, "stop");
+      }
+      ctx.ui.line("no class is running \u2014 nothing to stop");
+      ctx.ui.hint("start one: colloq start");
+      return 0;
+    }
+  },
+  {
+    name: "restart",
+    group: "local",
+    summary: "Restart the local session with the same port, data and tunnel",
+    usage: "colloq restart [--build] [--fast]",
+    flags: [
+      { name: "build", summary: "Rebuild the frontend before restarting" },
+      { name: "fast", summary: "With --build, build without compression" }
+    ],
+    destructive: true,
+    confirm: "self",
+    delegates: "native: the same supervisor with the restart command",
+    examples: ["colloq restart", "colloq restart --build"],
+    notes: "The supervisor reads the session receipt, ends the session and starts it again with the same port, data and flags. Without a receipt no class is running, and the command says so in words. --build and --fast matter only when colloq runs from its sources: an installed colloq arrives built and has nothing to rebuild.",
+    async run(ctx) {
+      if (localSession(ctx) === null) {
+        ctx.ui.refuse(
+          "no class is running \u2014 nothing to restart",
+          "there is no session receipt at " + ctx.env.paths.sessionFile,
+          "start one: colloq start"
+        );
+        return 3;
+      }
+      if (!ctx.dryRun && !await ask(ctx, "restart the local session?")) return 4;
+      heading(ctx, "restarting the local session");
+      return await launch(ctx, "restart");
+    }
+  },
+  {
+    name: "logs",
+    aliases: ["log"],
+    group: "local",
+    summary: "Watch the log of the class on this machine",
+    usage: "colloq logs [-f|--no-follow] [-n <lines>]",
+    flags: [
+      { name: "follow", short: "f", summary: "Follow (on by default)" },
+      { name: "no-follow", summary: "Show the tail and exit" },
+      { name: "lines", short: "n", arg: "lines", summary: "How many lines of the tail" }
+    ],
+    destructive: false,
+    delegates: "tail .colloq.log in the state directory",
+    examples: ["colloq logs", "colloq logs -n 200 --no-follow"],
+    notes: ".colloq.log is written by every colloq start, in the terminal and with --detach alike. It is appended to and never truncated \u2014 the history of past weeks is evidence, and tail only reads. The log holds /admin/t/<token> links: the CLI cuts nothing out of the stream and retells nothing, and it never prints the token itself either.",
+    async run(ctx) {
+      if (ctx.values.follow === true && ctx.values["no-follow"] === true) {
+        throw new UsageError(
+          "-f and --no-follow do not work together",
+          "follow with -f, show the tail and exit with --no-follow"
+        );
+      }
+      const follow = ctx.values["no-follow"] !== true;
+      const lines = flag(ctx, "lines");
+      checkLines(lines);
+      const log = ctx.env.paths.logFile;
+      if (!ctx.dryRun && !ctx.io.exists(log)) {
+        ctx.ui.refuse(
+          "no log at " + log,
+          "no class has been started on this machine yet \u2014 every colloq start writes its log there",
+          "colloq start --detach \u2014 the class goes to the background, and colloq logs follows it"
+        );
+        return 3;
+      }
+      heading(ctx, "the log of the class");
+      const args = [];
+      if (follow) args.push("-f");
+      if (lines !== void 0) args.push("-n", lines);
+      args.push(log);
+      return await ctx.sh.run("tail", args);
+    }
+  },
+  {
+    name: "link",
+    group: "local",
+    summary: "Show the class address and where to find the sign-in to the panel",
+    usage: "colloq link",
+    flags: [],
+    destructive: false,
+    delegates: "native: reads the session receipt, the temporary address and .env",
+    examples: ["colloq link", "colloq link --dry-run"],
+    notes: "The setup token is never printed \u2014 not from data/setup-token, not from the log: the /admin/t/<token> link is the key to the whole instance.",
+    async run(ctx) {
+      if (ctx.dryRun) {
+        return ctx.sh.dry(
+          "native: link (reads the session receipt, the temporary address and .env)"
+        );
+      }
+      const session = await sessionAddress(ctx);
+      if (!session && !ctx.io.exists(ctx.env.paths.envFile)) {
+        ctx.ui.refuse(
+          "no .env",
+          "the class address comes from there",
+          "the first run creates it: colloq run"
+        );
+        return 3;
+      }
+      const url = session ? session.public ?? session.local : ctx.env.publicUrl();
+      const inside = session !== void 0 && session.public === void 0 || url === "" || /^https?:\/\/(127\.0\.0\.1|localhost|0\.0\.0\.0)([:/]|$)/.test(url);
+      ctx.ui.header("Class");
+      if (session) ctx.ui.kv("local", session.local);
+      if (inside) {
+        ctx.ui.kv("address", "not published", url === "" ? void 0 : url);
+        ctx.ui.hint("colloq host <name> \u2014 publish it and get a link for the room");
+      } else {
+        ctx.ui.kv("address", ctx.ui.cyan(url));
+      }
+      const domain = ctx.env.relay().domain;
+      if (domain !== "") ctx.ui.kv("domain", domain);
+      ctx.ui.kv("sign-in", "printed once at startup");
+      ctx.ui.hint(
+        "it is in " + ctx.env.paths.logFile + "; on the machine \u2014 in " + joinPath(ctx.env.paths.home, "data/setup-token") + ". The CLI never prints the token itself"
+      );
+      return 0;
+    }
+  },
+  {
+    name: "backup",
+    group: "local",
+    summary: "Take a backup: a local one of this machine or a portable k3s one",
+    usage: "colloq backup [--legacy] [--mode <live|consistent>] [--resume] [--name <environment>] [--out <path>] [--release <path>]",
+    flags: [
+      { name: "legacy", summary: "A local pair of .db and -files.tar.gz (the default)" },
+      { name: "mode", arg: "mode", summary: "Portable: live (the default) or consistent" },
+      { name: "resume", summary: "Portable: start the writers again after consistent" },
+      {
+        name: "name",
+        arg: "environment",
+        summary: "Portable backup of an environment: into backups/<environment>/"
+      },
+      { name: "out", arg: "path", summary: "Portable: where to put the archive" },
+      { name: "release", arg: "path", summary: "Portable: which release counts as installed" }
+    ],
+    destructive: true,
+    confirm: "self",
+    delegates: "./scripts/backup-local.sh \xB7 with a portable flag \u2014 MODE=\u2026 ./scripts/backup.sh; COLLOQ_HOME names the state directory",
+    examples: ["colloq backup", "colloq backup --mode consistent --resume"],
+    notes: 'Without flags it is a local backup: the database and the class files of this machine. The portable one is for a machine with k3s on it, and --mode, --resume, --out, --release or --name lead into it. The question is asked only with --mode consistent: it stops app, the broker and every room and deliberately leaves them down \u2014 only --resume brings them back, and a backup that fails leaves the writers down as well. backup.sh restarts itself under scripts/state-lock.py, refuses while .restore-in-progress is there and refuses without an installed release. The local backup (scripts/backup-local.sh) does a VACUUM INTO (sqlite3 required) and an archive with workspace, data/session-secret, data/setup-token and its own environment lists, both files 0600; exit code 1 from tar means "the file changed while it was read", that is a class in progress, and it is allowed. Everything counts from the state directory: backups of this machine live in its backups/, backups of environments in backups/<environment>/.',
+    async run(ctx) {
+      const given = flag(ctx, "mode");
+      const mode = given ?? "live";
+      const resume = ctx.values.resume === true;
+      const name = flag(ctx, "name");
+      const out = flag(ctx, "out");
+      const release = flag(ctx, "release");
+      const portable = given !== void 0 || resume || name !== void 0 || out !== void 0 || release !== void 0;
+      const legacy = ctx.values.legacy === true || !portable;
+      if (legacy) {
+        const extra = [
+          ["--mode", given !== void 0],
+          ["--resume", resume],
+          ["--out", out !== void 0],
+          ["--release", release !== void 0],
+          ["--name", name !== void 0]
+        ];
+        const used = extra.filter(([, on2]) => on2).map(([option]) => option);
+        if (used.length > 0) {
+          throw new UsageError(
+            used.join(" and ") + " does not work with --legacy",
+            "a local backup is always the same pair in backups/: colloq backup --legacy"
+          );
+        }
+        heading(ctx, "taking a local backup: the database and the files");
+        return await copyCall(ctx, "./scripts/backup-local.sh");
+      }
+      if (mode !== "live" && mode !== "consistent") {
+        throw new UsageError(
+          'there is no "' + mode + '" mode',
+          "there is --mode live and there is --mode consistent"
+        );
+      }
+      if (resume && mode !== "consistent") {
+        throw new UsageError(
+          "--resume only makes sense with --mode consistent",
+          "live stops nobody, there is nothing to bring back"
+        );
+      }
+      checkName2(name);
+      if (mode === "consistent") {
+        const tail = resume ? "" : " without --resume they stay down";
+        if (!await ask(ctx, "stop every writer?" + tail)) return 4;
+      }
+      heading(ctx, mode === "consistent" ? "taking a consistent backup" : "taking a backup on the fly");
+      return await copyCall(ctx, "./scripts/backup.sh", {
+        MODE: mode,
+        RESUME: resume ? "1" : void 0,
+        NAME: name,
+        OUT: out === void 0 ? void 0 : ctx.env.userPath(out),
+        RELEASE: release === void 0 ? void 0 : ctx.env.userPath(release)
+      });
+    }
+  },
+  {
+    name: "restore",
+    group: "local",
+    summary: "Restore a backup: a local one of this machine or a portable k3s one",
+    usage: "colloq restore --archive <file> --release <file> [--replace] [--recover] [--name <environment>] | colloq restore --legacy --db <file> [--files <archive>] [--name <environment>] [--replace]",
+    flags: [
+      { name: "archive", arg: "file", summary: "The portable backup, a .tar.gz" },
+      { name: "release", arg: "file", summary: "release.json of the same generation" },
+      { name: "legacy", summary: "A local pair of .db and -files.tar.gz" },
+      { name: "db", arg: "file", summary: "The database from a local backup" },
+      { name: "files", arg: "archive", summary: "Class files from a local backup" },
+      {
+        name: "name",
+        arg: "environment",
+        summary: "Backup of an environment: from backups/<environment>/"
+      },
+      {
+        name: "replace",
+        summary: "Restore over the current database (--yes does not grant this)"
+      },
+      { name: "recover", summary: "Finish an interrupted restore" }
+    ],
+    destructive: true,
+    confirm: "self",
+    delegates: "./scripts/restore.sh <db> [<files>] \xB7 ./scripts/restore.sh --archive \u2026 --release \u2026; COLLOQ_HOME names the state directory",
+    examples: [
+      "colloq restore --legacy --db backups/colloq-20260914.db --files backups/colloq-20260914-files.tar.gz",
+      "colloq restore --archive backups/{env}/colloq-20260914.tar.gz --release release.json"
+    ],
+    notes: "The portable path asks nothing on its own \u2014 we ask; the local one asks for itself (scripts/restore.sh), and we do not ask a second time. The two worlds must not be mixed: restore.sh rejects an old pair laid on top as soon as a k3s release is installed. The local path refuses if the colloq service is active, the compose app is running, .colloq.pid is alive, or somebody answers on localhost:<PORT>. WAL and SHM travel with their own database, the old database is set aside as data/colloq.db.replaced-<stamp>, and the files from the archive go over workspace/ without a backup of their own. Relative paths count from the directory the command was called from.",
+    async run(ctx) {
+      const legacy = ctx.values.legacy === true;
+      const archive = flag(ctx, "archive");
+      const release = flag(ctx, "release");
+      const db = flag(ctx, "db");
+      const files = flag(ctx, "files");
+      const name = flag(ctx, "name");
+      const recover = ctx.values.recover === true;
+      const replace = ctx.values.replace === true;
+      checkName2(name);
+      const missing2 = (path2, what) => {
+        ctx.ui.refuse(
+          "no file " + path2,
+          what,
+          "see what has been taken: ls backups" + (name === void 0 ? "" : "/" + name)
+        );
+        return 3;
+      };
+      if (legacy || db !== void 0 || files !== void 0) {
+        const wrong = [
+          ["--archive", archive !== void 0],
+          ["--release", release !== void 0],
+          ["--recover", recover]
+        ];
+        const used = wrong.filter(([, given]) => given).map(([option]) => option);
+        if (used.length > 0) {
+          throw new UsageError(
+            "an old-format backup and a portable one are different worlds: drop " + used.join(" and "),
+            "k3s: colloq restore --archive \u2026 --release \u2026"
+          );
+        }
+        if (db === void 0) {
+          throw new UsageError(
+            "no --db <file>",
+            "Usage: colloq restore --legacy --db backups/colloq-\u2026.db [--files backups/colloq-\u2026-files.tar.gz]"
+          );
+        }
+        const dbPath = ctx.env.userPath(db);
+        const filesPath = files === void 0 ? void 0 : ctx.env.userPath(files);
+        if (!ctx.dryRun) {
+          if (!ctx.io.exists(dbPath)) return missing2(dbPath, "there is nothing to restore");
+          if (filesPath !== void 0 && !ctx.io.exists(filesPath)) {
+            return missing2(filesPath, "the archive holds the class files and the instance keys");
+          }
+        }
+        heading(ctx, "restoring an old-format backup");
+        return await copyCall(
+          ctx,
+          "./scripts/restore.sh",
+          { NAME: name, REPLACE: replace ? "1" : void 0 },
+          filesPath === void 0 ? [dbPath] : [dbPath, filesPath]
+        );
+      }
+      if (archive === void 0 || release === void 0) {
+        const what = archive === void 0 ? "--archive <file>" : "--release <file>";
+        throw new UsageError(
+          "no " + what,
+          "a portable backup needs both: colloq restore --archive backup.tar.gz --release release.json"
+        );
+      }
+      const archivePath = ctx.env.userPath(archive);
+      const releasePath = ctx.env.userPath(release);
+      if (!ctx.dryRun) {
+        if (!ctx.io.exists(archivePath)) return missing2(archivePath, "there is nothing to restore");
+        if (!ctx.io.exists(releasePath)) {
+          return missing2(
+            releasePath,
+            "without release.json the generation of the backup cannot be checked"
+          );
+        }
+        if (!await ask(
+          ctx,
+          "restore over this machine? the cluster will be stopped and the writers will stay down"
+        )) {
+          return 4;
+        }
+      }
+      heading(ctx, "restoring a portable backup");
+      return await copyCall(ctx, "./scripts/restore.sh", { NAME: name }, [
+        "--archive",
+        archivePath,
+        "--release",
+        releasePath,
+        ...replace ? ["--replace"] : [],
+        ...recover ? ["--recover"] : []
+      ]);
+    }
+  }
+];
+
+// cli/src/launch-config.ts
+import { createHash, randomBytes } from "node:crypto";
+function localClassEnv(dist) {
+  return `# Settings for this machine. colloq wrote this file on its first start:
+# edit it and restart with colloq restart. The full list of everything that
+# can be configured is in .env.example next to the application.
+
+# The address of the class on this machine. From outside it is visible
+# only through colloq host.
+PORT=3000
+BIND_ADDR=127.0.0.1
+UI_LANGUAGE=${dist ? "en" : "ru"}
+
+# The kernels of a class are Docker containers on this computer, one per room.
+# Each room container is hardened: no privileges, a process limit, the internet
+# yes, your local network and this computer no. COLLOQ_ROOM_NETWORK=open lifts
+# the network block for a machine you fully trust.
+KERNEL_BACKEND=docker
+KERNEL_ENV=base
+# Memory and processors of one room. 4g is enough for an ordinary class; for a
+# class that trains networks set 8g-16g, if the machine has that much.
+KERNEL_MEM=4g
+KERNEL_CPUS=2
+KERNEL_SHM=1g
+
+# Signs the sign-in links of teachers and students. Left empty, the key is
+# created in data/ on its own and survives a restart; a value written here
+# wins over it.
+SESSION_SECRET=
+# Not a shared Jupyter: every room has a token of its own. This line is here
+# so the log does not keep the token from .env.example, which everyone knows.
+JUPYTER_TOKEN=${randomBytes(24).toString("hex")}
+
+# File uploads and the disk space one class may take.
+MAX_UPLOAD_MB=50
+MAX_SESSION_MB=1024
+
+# The Oracle. Without a key the class still runs, but the model cannot be asked.
+AI_PROVIDER=openai
+OPENAI_API_KEY=
+OPENAI_BASE_URL=https://api.openai.com/v1
+OPENAI_MODEL=gpt-4o-mini
+`;
+}
+
+// shared/admin.ts
+var PYTHON_VERSIONS = ["3.10", "3.11", "3.12", "3.13"];
+
+// cli/src/commands/env.ts
+var CHAIN_LIMIT = 8;
+var FROM = /^[ \t]*#[ \t]*colloq:[ \t]*from[ \t]+([^\s]+)[ \t]*$/m;
+var PYTHON = /^[ \t]*#[ \t]*colloq:[ \t]*python[ \t]+(3\.[0-9]+)[ \t]*$/m;
+var NAME2 = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+var NOT_A_PACKAGE = /^[ \t]*(#|-|$)/;
+var NOT_A_LINE = /^[ \t]*(#|$)/;
+function envDirs(ctx) {
+  return { app: ctx.env.paths.envDir, own: ctx.env.paths.ownEnvDir };
+}
+function envFileIn(io, dirs, name) {
+  const own = joinPath(dirs.own, name + ".txt");
+  return io.exists(own) ? own : joinPath(dirs.app, name + ".txt");
+}
+function listEnvNames(io, dirs) {
+  const names = /* @__PURE__ */ new Set();
+  for (const dir of [dirs.app, dirs.own]) {
+    for (const file of io.list(dir)) {
+      if (file.endsWith(".txt")) names.add(file.slice(0, -".txt".length));
+    }
+  }
+  return [...names].sort();
+}
+function envFile(ctx, name) {
+  return envFileIn(ctx.io, envDirs(ctx), name);
+}
+function ownFile(ctx, name) {
+  return joinPath(ctx.env.paths.ownEnvDir, name + ".txt");
+}
+function isOwn(ctx, name) {
+  const dirs = envDirs(ctx);
+  if (dirs.own === dirs.app) return false;
+  return ctx.io.exists(ownFile(ctx, name));
+}
+function short(ctx, path2) {
+  const root = ctx.env.root() + "/";
+  if (path2.startsWith(root)) return path2.slice(root.length);
+  const home = ctx.env.home();
+  if (home && path2.startsWith(home + "/")) return "~" + path2.slice(home.length);
+  return path2;
+}
+function places(ctx) {
+  const dirs = envDirs(ctx);
+  const app = short(ctx, dirs.app) + "/";
+  return dirs.own === dirs.app ? app : app + " and " + short(ctx, dirs.own) + "/";
+}
+function textOf(ctx, path2) {
+  const text = ctx.io.readText(path2);
+  return text === null ? null : text.replace(/\r/g, "");
+}
+function wantName(ctx, usage) {
+  const name = (ctx.positionals[0] ?? "").trim();
+  if (!name) throw new UsageError("no environment given", "Usage: " + usage);
+  checkName3(name);
+  return name;
+}
+function checkName3(name) {
+  if (NAME2.test(name)) return;
+  throw new UsageError(
+    '"' + name + '" cannot be an environment name: lowercase latin letters, digits and a hyphen',
+    "colloq env list: which ones already exist"
+  );
+}
+function needFile(ctx, name, fix) {
+  if (ctx.io.exists(envFile(ctx, name))) return;
+  throw new PreconditionError(
+    "no " + short(ctx, envFile(ctx, name)) + ': environment "' + name + '" has not been created',
+    fix
+  );
+}
+var PYTHONS = PYTHON_VERSIONS;
+function wantPython(ctx) {
+  const value = (ctx.values.python ?? "").trim();
+  if (!value) return void 0;
+  if (!PYTHONS.includes(value)) {
+    throw new UsageError(
+      "Python " + value + " is not one of those the kernel builds on",
+      "available: " + PYTHONS.join(" ")
+    );
+  }
+  return value;
+}
+function defaultPython(ctx) {
+  const text = textOf(ctx, ctx.env.path("kernel/Dockerfile")) ?? "";
+  return /^ARG PARENT=python:([0-9]+\.[0-9]+)-/m.exec(text)?.[1] ?? "3.11";
+}
+function chainOf(io, dirs, name) {
+  const names = [];
+  let current = name;
+  while (current) {
+    const file = envFileIn(io, dirs, current);
+    if (names.includes(current)) {
+      return { names, trouble: "environments reference each other in a circle: " + current };
+    }
+    if (!NAME2.test(current)) {
+      return {
+        names,
+        trouble: '"' + current + '" cannot be an environment name: neither a file nor an image tag'
+      };
+    }
+    const text = io.readText(file);
+    if (text === null) {
+      return {
+        names,
+        trouble: names.length === 0 ? 'environment "' + current + '" has not been created' : 'environment "' + current + '" is named as a parent, and it does not exist'
+      };
+    }
+    names.unshift(current);
+    if (names.length > CHAIN_LIMIT) {
+      return { names, trouble: "the environment chain is longer than eight links" };
+    }
+    current = FROM.exec(text.replace(/\r/g, ""))?.[1];
+  }
+  return { names };
+}
+function pythonOf(ctx, name, fallback) {
+  const root = chainOf(ctx.io, envDirs(ctx), name).names[0];
+  if (root === void 0) return fallback;
+  const text = textOf(ctx, envFile(ctx, root));
+  return (text === null ? void 0 : PYTHON.exec(text)?.[1]) ?? fallback;
+}
+function needChain(ctx, name, fix) {
+  const chain = chainOf(ctx.io, envDirs(ctx), name);
+  if (chain.trouble) throw new PreconditionError(chain.trouble, fix);
+  return chain;
+}
+function packagesOf(text) {
+  return text.split("\n").filter((line) => !NOT_A_PACKAGE.test(line)).length;
+}
+function meaningful(text) {
+  return text.split("\n").filter((line) => !NOT_A_LINE.test(line));
+}
+function starter(name, python, fallback) {
+  const lines = [];
+  if (python && python !== fallback) lines.push("# colloq: python " + python, "#");
+  lines.push(
+    '# Environment "' + name + '". It is installed on top of the base from',
+    "# kernel/requirements.txt, so numpy/pandas/matplotlib/scikit-learn need no line here.",
+    "#",
+    "# One package per line, as in an ordinary requirements.txt:",
+    "#",
+    "#   transformers>=4.44",
+    "#   datasets>=2.20",
+    ""
+  );
+  return lines.join("\n");
+}
+function writeKernelEnv(ctx, name) {
+  const existing = ctx.io.readText(ctx.env.paths.envFile);
+  const text = existing ?? localClassEnv(ctx.dist);
+  const kept = text.split("\n").filter((line) => !/^KERNEL_ENV=/.test(line));
+  while (kept.length > 0 && (kept[kept.length - 1] ?? "").trim() === "") kept.pop();
+  kept.push("KERNEL_ENV=" + name, "");
+  ctx.io.writeText(ctx.env.paths.envFile, kept.join("\n"), existing === null ? 384 : void 0);
+}
+function renderList(ctx) {
+  const current = ctx.env.kernelEnv();
+  const fallback = defaultPython(ctx);
+  const names = listEnvNames(ctx.io, envDirs(ctx));
+  ctx.ui.line(ctx.ui.bold("Environments") + " " + ctx.ui.dim("(" + places(ctx) + ")"));
+  ctx.ui.line();
+  if (names.length === 0) {
+    ctx.ui.line("  " + ctx.ui.dim("no environment files: create one with colloq env new <name>"));
+    return;
+  }
+  const width = Math.max(14, ...names.map((name) => name.length));
+  for (const name of names) {
+    const text = textOf(ctx, envFile(ctx, name)) ?? "";
+    const tail = "Python " + pythonOf(ctx, name, fallback) + " \xB7 " + countWord(packagesOf(text), "package") + " on top of the base" + (isOwn(ctx, name) ? " \xB7 your own" : "");
+    ctx.ui.line(
+      "  " + (name === current ? "*" : " ") + " " + name.padEnd(width) + " " + ctx.ui.dim(tail)
+    );
+  }
+  ctx.ui.line();
+  ctx.ui.line(ctx.ui.dim("* \u2014 the default for new classes. Change it: colloq env use <name>"));
+}
+function renderShow(ctx, name) {
+  const file = envFile(ctx, name);
+  const python = pythonOf(ctx, name, defaultPython(ctx));
+  ctx.ui.line(ctx.ui.bold(name) + " " + ctx.ui.dim("\u2014 " + short(ctx, file) + " \xB7 Python " + python));
+  ctx.ui.line();
+  const own = meaningful(textOf(ctx, file) ?? "");
+  if (own.length > 0) ctx.ui.table(own.map((line) => [line]));
+  else ctx.ui.line("  " + ctx.ui.dim("nothing on top of the base"));
+  ctx.ui.line();
+  ctx.ui.line(ctx.ui.dim("Base (always there):"));
+  ctx.ui.table(
+    meaningful(textOf(ctx, ctx.env.path("kernel/requirements.txt")) ?? "").map((line) => [line])
+  );
+}
+var commands3 = [
+  {
+    name: "env list",
+    aliases: ["env", "env ls"],
+    group: "env",
+    summary: "Which environments exist",
+    usage: "colloq env list [--json]",
+    flags: [
+      { name: "json", summary: "Machine-readable: name, Python, packages on top of the base" }
+    ],
+    destructive: false,
+    delegates: "native: reads both environment directories and KERNEL_ENV from .env",
+    examples: ["colloq env list", "colloq env list --json"],
+    notes: 'The star marks the default for new classes: KERNEL_ENV from .env, otherwise base. The Python version comes from the root of the "# colloq: from" chain, which is at most eight links long. "your own" is an environment you created yourself: it lives next to .env and survives an update of the package.',
+    async run(ctx) {
+      const intent = "native: env list (reads " + places(ctx) + " and KERNEL_ENV from .env)";
+      if (ctx.dryRun) {
+        if (!ctx.json) return ctx.sh.dry(intent);
+        ctx.ui.json({ ok: true, dryRun: true, command: intent });
+        return 0;
+      }
+      if (!ctx.json) {
+        renderList(ctx);
+        return 0;
+      }
+      const current = ctx.env.kernelEnv();
+      const fallback = defaultPython(ctx);
+      const dirs = envDirs(ctx);
+      ctx.ui.json({
+        ok: true,
+        current,
+        dir: short(ctx, dirs.app),
+        ownDir: short(ctx, dirs.own),
+        environments: listEnvNames(ctx.io, dirs).map((name) => ({
+          name,
+          python: pythonOf(ctx, name, fallback),
+          packages: packagesOf(textOf(ctx, envFile(ctx, name)) ?? ""),
+          current: name === current,
+          own: isOwn(ctx, name),
+          file: short(ctx, envFile(ctx, name))
+        }))
+      });
+      return 0;
+    }
+  },
+  {
+    name: "env show",
+    group: "env",
+    summary: "What is in an environment and which Python it runs on",
+    usage: "colloq env show [name]",
+    args: [{ name: "name", summary: "Environment; without a name, the current one" }],
+    flags: [],
+    destructive: false,
+    delegates: "native: reads <environment>.txt and kernel/requirements.txt",
+    examples: ["colloq env show", "colloq env show {env}"],
+    notes: "Without a name it shows the current one: what stands in KERNEL_ENV. When there is no such file it refuses. The base packages are listed separately: they are in every environment, and there is no need to repeat them in your own list.",
+    async run(ctx) {
+      const asked = (ctx.positionals[0] ?? "").trim() || ctx.env.kernelEnv();
+      checkName3(asked);
+      needFile(ctx, asked, "colloq env list");
+      needChain(ctx, asked, "colloq env show " + asked + ': fix the "# colloq: from" line');
+      if (ctx.dryRun) {
+        return ctx.sh.dry(
+          "native: env show " + asked + " (reads " + short(ctx, envFile(ctx, asked)) + " and kernel/requirements.txt)"
+        );
+      }
+      renderShow(ctx, asked);
+      return 0;
+    }
+  },
+  {
+    name: "env new",
+    group: "env",
+    summary: "Create an environment",
+    usage: "colloq env new <name> [--python <version>]",
+    args: [
+      {
+        name: "name",
+        summary: "What to call it: lowercase latin letters, digits, hyphen",
+        required: true
+      }
+    ],
+    flags: [
+      {
+        name: "python",
+        arg: "version",
+        summary: "Which Python to build on; otherwise the default"
+      }
+    ],
+    destructive: false,
+    delegates: "native: creates <name>.txt with a header in your own environment directory",
+    examples: ["colloq env new cv", "colloq env new cv --python 3.12"],
+    notes: 'Creates an empty file with a header and does not overwrite an existing one. It is always written into your own directory, next to .env, and not where the package is installed: otherwise the environment would be gone on the first update. A name already taken by a bundled environment is allowed: your file overrides the bundled one. The version comes from PYTHON_VERSIONS in shared/admin.ts, and the "# colloq: python X.Y" line is written only when the version differs from ARG PARENT in kernel/Dockerfile.',
+    async run(ctx) {
+      const name = wantName(ctx, "colloq env new <name>");
+      const python = wantPython(ctx);
+      const file = ownFile(ctx, name);
+      if (ctx.io.exists(file)) {
+        throw new PreconditionError(
+          short(ctx, file) + " already exists",
+          "colloq env show " + name + ": what is in it now"
+        );
+      }
+      const shadows = ctx.io.exists(joinPath(ctx.env.paths.envDir, name + ".txt"));
+      if (ctx.dryRun) {
+        return ctx.sh.dry(
+          "native: env new " + name + " (creates " + short(ctx, file) + ", Python " + (python ?? defaultPython(ctx)) + ")"
+        );
+      }
+      ctx.io.writeText(file, starter(name, python, defaultPython(ctx)));
+      ctx.ui.line(ctx.ui.bold("created") + " " + short(ctx, file));
+      if (shadows) {
+        ctx.ui.line(ctx.ui.dim("overrides the bundled environment with the same name"));
+      }
+      ctx.ui.line(
+        ctx.ui.dim(
+          "Python " + pythonOf(ctx, name, defaultPython(ctx)) + " \xB7 write the packages in, then: colloq env use " + name
+        )
+      );
+      return 0;
+    }
+  },
+  {
+    name: "env use",
+    aliases: ["env switch"],
+    group: "env",
+    summary: "Make an environment the default for new classes",
+    usage: "colloq env use <name>",
+    args: [{ name: "name", summary: "An environment from colloq env list", required: true }],
+    flags: [],
+    destructive: true,
+    confirm: "cli",
+    // Проверка до вопроса: окружения нет или цепочка негодная — отказ, а не
+    // вопрос перед отказом. Негодную цепочку не соберёт и запуск, и узнать об
+    // этом сейчас дешевле, чем на colloq start перед парой.
+    check(ctx) {
+      const name = wantName(ctx, "colloq env use <name>");
+      needFile(ctx, name, "colloq env new " + name);
+      needChain(ctx, name, 'fix the "# colloq: from" line in the chain');
+    },
+    // Вопрос обещает ровно то, что команда сделает, — одну строку в .env.
+    // Сборки здесь нет, значит нет и обещания долгого ожидания: о минутах
+    // сборки на colloq start команда говорит уже после записи.
+    confirmQuestion: (ctx) => "make environment " + wantName(ctx, "colloq env use <name>") + " the default for new classes?",
+    delegates: "native: KERNEL_ENV in .env",
+    examples: ["colloq env use cv", "colloq env use {env} --yes"],
+    notes: "The KERNEL_ENV= line is written into the existing .env instead of a fresh file put on top of it: under sudo the file would stay root:0600, and the next start would bring an instance up with the defaults. Classes that are already open stay on their own environment. The image is not built here: colloq start builds it before the class, together with the rest of the preparation, and the first time that can take minutes.",
+    async run(ctx) {
+      const name = wantName(ctx, "colloq env use <name>");
+      if (ctx.dryRun) {
+        return ctx.sh.dry(
+          "native: env use " + name + " (KERNEL_ENV=" + name + " in " + short(ctx, ctx.env.paths.envFile) + ")"
+        );
+      }
+      writeKernelEnv(ctx, name);
+      ctx.ui.line(ctx.ui.bold("Default environment for new classes: " + name));
+      ctx.ui.line(
+        ctx.ui.dim("the image is built on your next colloq start: this can take minutes")
+      );
+      return 0;
+    }
+  }
+];
+
+// cli/src/commands/tools.ts
+function on(ctx, name) {
+  return ctx.values[name] === true;
+}
+function missing() {
+  return Promise.resolve({ code: 127, stdout: "", stderr: "" });
+}
+var REINSTALL = "reinstall colloq: pip install --force-reinstall colloq";
+var KERNEL_IMAGE_FIX = "colloq start \u2014 the image is built before the class";
+function parseEtime(value) {
+  const raw = value.trim();
+  if (!/^(\d+-)?(\d+:)?\d+:\d+$/.test(raw)) return null;
+  let days = 0;
+  let rest = raw;
+  const dash = raw.indexOf("-");
+  if (dash >= 0) {
+    days = Number(raw.slice(0, dash));
+    rest = raw.slice(dash + 1);
+  }
+  const parts = rest.split(":").map((piece) => Number(piece));
+  const hours = parts.length === 3 ? parts[0] ?? 0 : 0;
+  const minutes = parts.length === 3 ? parts[1] ?? 0 : parts[0] ?? 0;
+  const seconds = parts.length === 3 ? parts[2] ?? 0 : parts[1] ?? 0;
+  return days * 86400 + hours * 3600 + minutes * 60 + seconds;
+}
+function humanDuration(seconds) {
+  const total = Math.max(0, Math.round(seconds));
+  if (total < 60) return total + "s";
+  const minutes = Math.floor(total / 60);
+  if (minutes < 60) return minutes + "m";
+  const hours = Math.floor(minutes / 60);
+  const restMinutes = minutes % 60;
+  if (hours < 24) return restMinutes ? hours + "h " + restMinutes + "m" : hours + "h";
+  const days = Math.floor(hours / 24);
+  const restHours = hours % 24;
+  return restHours ? days + "d " + restHours + "h" : days + "d";
+}
+function humanAge(milliseconds) {
+  return humanDuration(milliseconds / 1e3) + " ago";
+}
+function two(value) {
+  return String(value).padStart(2, "0");
+}
+function clock(milliseconds) {
+  const date = new Date(milliseconds);
+  return two(date.getHours()) + ":" + two(date.getMinutes());
+}
+function day(milliseconds) {
+  const date = new Date(milliseconds);
+  return two(date.getDate()) + "." + two(date.getMonth() + 1);
+}
+function hostOf(url) {
+  const value = url.trim();
+  if (value === "") return "";
+  const match = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]+)/i.exec(value);
+  const authority = match ? match[1] ?? "" : value;
+  const host = authority.split("@").pop() ?? "";
+  return host.replace(/:\d+$/, "").toLowerCase();
+}
+function outsideOf(url) {
+  const host = hostOf(url);
+  return host !== "" && !["127.0.0.1", "localhost", "[::1]"].includes(host);
+}
+function sessionAddress2(ctx, session) {
+  if (session.leaseFile === "") return session.url;
+  return leaseUrl(ctx.io.readText(session.leaseFile), session.runId, ctx.io.now()) ?? session.url;
+}
+function newestFile(ctx, dir, keep) {
+  let best = null;
+  for (const name of ctx.io.list(dir)) {
+    if (!keep(name)) continue;
+    const at = ctx.io.mtime(joinPath(dir, name));
+    if (at === null) continue;
+    if (!best || at > best.at) best = { name, at };
+  }
+  return best;
+}
+function rowPrinter(ctx, labels) {
+  const width = Math.max(12, ...labels.map((label) => label.length + 4));
+  return (label, value) => ctx.ui.line("  " + label.padEnd(width) + value);
+}
+var PS_FORMAT = '{{.Label "colloq.kind"}}|{{.Label "com.docker.compose.service"}}|{{.State}}|{{.Label "colloq.session"}}';
+async function statusFacts(ctx) {
+  const { env, io, sh } = ctx;
+  const kernelEnv = env.kernelEnv();
+  const relayDomain = env.relay().domain;
+  const session = readSession(io, env.paths.sessionFile);
+  const sessionUrl = session === null ? "" : sessionAddress2(ctx, session);
+  const envUrl = env.publicUrl();
+  const pidText = (io.readText(env.paths.pidFile) ?? "").trim();
+  const filePid = /^\d+$/.test(pidText) ? Number(pidText) : null;
+  const pid = session === null ? filePid : session.serverPid ?? session.pid;
+  const outside = outsideOf(sessionUrl) || outsideOf(envUrl);
+  const [docker, image, etime, frpc, cloudflared] = await Promise.all([
+    sh.capture("docker", ["ps", "--format", PS_FORMAT], { timeoutMs: 700 }),
+    sh.capture(
+      "docker",
+      ["image", "inspect", "colloq-kernel:" + kernelEnv, "--format", "{{.Created}}"],
+      { timeoutMs: 700 }
+    ),
+    // Живость pid и время работы — одной строкой ps, она есть и на macOS, и на Linux.
+    pid === null ? missing() : sh.capture("ps", ["-p", String(pid), "-o", "etime="], {
+      timeoutMs: 300
+    }),
+    outside ? sh.capture("pgrep", ["-x", "frpc"], { timeoutMs: 300 }) : missing(),
+    outside ? sh.capture("pgrep", ["-x", "cloudflared"], { timeoutMs: 300 }) : missing()
+  ]);
+  const seen = /* @__PURE__ */ new Set();
+  let appRunning = false;
+  for (const line of docker.stdout.split("\n")) {
+    const [kind, compose, state, session2] = line.split("|");
+    if ((kind ?? "") === "room-kernel") seen.add((session2 ?? "").trim() || line);
+    if ((compose ?? "") === "app" && (state ?? "").toLowerCase().includes("running")) {
+      appRunning = true;
+    }
+  }
+  const rooms = seen.size;
+  const dockerNote = docker.code === 0 ? "" : docker.code === 124 ? "docker did not answer in 0.7s" : docker.code === 127 ? "docker not found" : "docker is not answering";
+  const uptimeSec = etime.code === 0 ? parseEtime(etime.stdout) : null;
+  const alive = etime.code === 0 && uptimeSec !== null;
+  const live = alive ? session : null;
+  const port = live ? live.port : env.port();
+  const publicUrl = live ? sessionUrl : envUrl;
+  const host = hostOf(publicUrl);
+  const published = outsideOf(publicUrl);
+  const form = live ? live.mode === "dev" ? "npm run dev" : "colloq run" : appRunning ? "container" : alive ? "make run" : rooms > 0 ? "another form" : "";
+  const startedAt = uptimeSec === null ? null : ctx.io.now() - uptimeSec * 1e3;
+  const distAt = newestDist(ctx);
+  const stale = distAt !== null && startedAt !== null && distAt > startedAt;
+  const transport = !published ? "" : relayDomain !== "" && (host === relayDomain || host.endsWith("." + relayDomain)) ? "relay" : "Cloudflare";
+  const frpcPid = firstPid(frpc);
+  const cloudflaredPid = firstPid(cloudflared);
+  const tunnelPid = transport === "relay" ? frpcPid : cloudflaredPid;
+  const tunnel = transport === "relay" ? "frpc" : "cloudflared";
+  const imageAt = image.code === 0 ? dateValue(image.stdout) : null;
+  const envName = host === "" || !published ? "" : host.split(".")[0] ?? "";
+  const backupDir = envName !== "" && io.exists(joinPath(env.paths.backupsDir, envName)) ? joinPath(env.paths.backupsDir, envName) : env.paths.backupsDir;
+  const backup = newestFile(ctx, backupDir, (name) => /\.(db|tar\.gz|tgz|zip)$/.test(name));
+  return {
+    envName,
+    port,
+    kernelEnv,
+    publicUrl,
+    relayDomain,
+    form,
+    /*
+     * Под подписью «сервер» стоит номер СЕРВЕРА, и только он: тем же номером
+     * называет слушателя порта doctor, а до этой правки два экрана звали один
+     * и тот же сервер по-разному — status номером супервизора, doctor номером
+     * его ребёнка. Пока сервер занятия не поднялся, номера нет вовсе, и строка
+     * обойдётся портом и временем: выдать вместо него супервизора значило бы
+     * вернуть ту же путаницу. Номер из .colloq.pid печатается, только если ps
+     * подтвердил, что он жив: рядом с «container» мёртвый номер от прошлого
+     * `make run` выдавал бы себя за сервер контейнера.
+     */
+    pid: live ? live.serverPid : alive ? pid : null,
+    uptimeSec,
+    startedAt,
+    distAt,
+    stale,
+    transport,
+    tunnel,
+    tunnelPid,
+    rooms,
+    image: "colloq-kernel:" + kernelEnv,
+    imageAt,
+    dockerNote,
+    backupPath: backup ? joinPath(backupDir, backup.name) : "",
+    backupAt: backup ? backup.at : null
+  };
+}
+function newestDist(ctx) {
+  const dist = ctx.env.paths.dist;
+  if (!ctx.io.exists(dist)) return null;
+  let best = null;
+  for (const dir of [dist, joinPath(dist, "assets")]) {
+    for (const name of ctx.io.list(dir)) {
+      const at = ctx.io.mtime(joinPath(dir, name));
+      if (at === null) continue;
+      if (best === null || at > best) best = at;
+    }
+  }
+  return best;
+}
+function firstPid(result) {
+  if (result.code !== 0) return null;
+  const line = result.stdout.split("\n").find((item) => /^\d+$/.test(item.trim()));
+  return line ? Number(line.trim()) : null;
+}
+function dateValue(value) {
+  const at = Date.parse(value.trim());
+  return Number.isFinite(at) ? at : null;
+}
+function renderStatus(ctx, facts) {
+  const { ui } = ctx;
+  const empty = facts.form === "" && facts.rooms === 0 && facts.publicUrl === "" && facts.pid === null;
+  if (empty) {
+    ui.line("nothing is running \xB7 " + ui.cyan("colloq run"));
+    return;
+  }
+  ui.header("Colloq \xB7 " + (facts.envName || "local"));
+  serverLine(ctx, facts);
+  if (facts.distAt === null) {
+    ui.kv(SYMBOL.off + " client", "the frontend is not built");
+    ui.hint(REINSTALL);
+  } else if (facts.stale) {
+    ui.kv(
+      SYMBOL.on + " client",
+      "web/dist built " + clock(facts.distAt) + " \u2014 newer than the server (started " + clock(facts.startedAt ?? 0) + ")"
+    );
+    ui.hint("colloq restart");
+  } else {
+    ui.kv(SYMBOL.on + " client", "web/dist built " + clock(facts.distAt));
+  }
+  publicLine(ctx, facts);
+  if (facts.transport !== "" && facts.publicUrl !== "") ui.kv("  link", ui.cyan(facts.publicUrl));
+  if (facts.dockerNote !== "") ui.kv(SYMBOL.off + " kernels", facts.dockerNote);
+  else if (facts.imageAt === null) {
+    ui.kv(
+      SYMBOL.off + " kernels",
+      "no " + facts.image + " image \xB7 rooms with a kernel: " + facts.rooms
+    );
+    ui.hint(KERNEL_IMAGE_FIX);
+  } else {
+    ui.kv(
+      SYMBOL.on + " kernels",
+      facts.image + ", built " + day(facts.imageAt) + " \xB7 rooms with a kernel: " + facts.rooms
+    );
+  }
+  ui.kv("  env", facts.kernelEnv, "change: colloq env use <name>");
+  backupLine(ctx, facts);
+}
+function serverLine(ctx, facts, hint = true) {
+  const { ui } = ctx;
+  if (facts.form === "") {
+    ui.kv(SYMBOL.off + " server", "not running \xB7 port " + facts.port);
+    if (hint) ui.hint("colloq run");
+    return;
+  }
+  const parts = [];
+  if (facts.pid !== null) parts.push("pid " + facts.pid);
+  parts.push("port " + facts.port);
+  if (facts.uptimeSec !== null) parts.push(humanDuration(facts.uptimeSec));
+  parts.push(facts.form);
+  ui.kv(SYMBOL.on + " server", parts.join(" \xB7 "));
+}
+function publicLine(ctx, facts) {
+  const { ui } = ctx;
+  const host = hostOf(facts.publicUrl);
+  if (facts.transport === "") {
+    ui.kv(
+      SYMBOL.off + " outside",
+      "not published \xB7 " + (facts.publicUrl || "this machine") + " only"
+    );
+    ui.hint("colloq host <name>");
+    return;
+  }
+  const tail = facts.tunnelPid === null ? " \u2014 no tunnel process" : " (" + facts.tunnel + " pid " + facts.tunnelPid + ")";
+  ui.kv(SYMBOL.on + " outside", host + " \xB7 " + facts.transport + tail);
+}
+function publicLineShort(ctx, facts) {
+  const host = hostOf(facts.publicUrl);
+  if (facts.transport === "") {
+    ctx.ui.kv(SYMBOL.off + " outside", "not published \xB7 colloq host <name>");
+    return;
+  }
+  const tail = facts.tunnelPid === null ? " \u2014 no tunnel process" : " (" + facts.tunnel + " pid " + facts.tunnelPid + ")";
+  ctx.ui.kv(SYMBOL.on + " outside", host + " \xB7 " + facts.transport + tail);
+}
+function backupLine(ctx, facts) {
+  const { ui } = ctx;
+  if (facts.backupAt === null) {
+    ui.kv(SYMBOL.off + " backup", "no backups");
+    ui.hint("colloq backup");
+    return;
+  }
+  const name = facts.backupPath.split("/").pop() ?? facts.backupPath;
+  ui.kv(SYMBOL.on + " backup", name + " \xB7 " + humanAge(ctx.io.now() - facts.backupAt));
+}
+var PROGRAMS = ["frpc", "cloudflared"];
+async function doctorChecks(ctx) {
+  const { env, io, sh } = ctx;
+  const kernelEnv = env.kernelEnv();
+  const relay = env.relay();
+  const pidText = (io.readText(env.paths.pidFile) ?? "").trim();
+  const session = readSession(io, env.paths.sessionFile);
+  const port = session?.port ?? env.port();
+  const [programs, info, image, listen, disk] = await Promise.all([
+    // Одна оболочка на обе программы: отдельные вызовы стоили бы вдвое дольше.
+    sh.capture(
+      "sh",
+      [
+        "-c",
+        PROGRAMS.map((name) => "command -v " + name + " >/dev/null 2>&1 && echo " + name).join(
+          "; "
+        )
+      ],
+      {
+        timeoutMs: 3e3
+      }
+    ),
+    sh.capture("docker", ["info", "--format", "{{.ServerVersion}} {{.Name}} {{.MemTotal}}"], {
+      timeoutMs: 3e3
+    }),
+    sh.capture(
+      "docker",
+      ["image", "inspect", "colloq-kernel:" + kernelEnv, "--format", "{{.Created}}"],
+      { timeoutMs: 3e3 }
+    ),
+    // Только LISTEN: чужой CLOSE_WAIT однажды уже дал ложное «порт занят».
+    sh.capture("lsof", ["-nP", "-iTCP:" + port, "-sTCP:LISTEN"], { timeoutMs: 2e3 }),
+    /*
+     * Место меряем на томе каталога СОСТОЯНИЯ, а не приложения. Растёт всё
+     * там: <home>/data, <home>/workspace, <home>/backups, <home>/.colloq.log —
+     * и подсказка ниже сама зовёт чистить backups/. У поставленного через pip
+     * colloq каталоги разные, и легко на разных томах: осмотр показывал
+     * свободное место под site-packages, а кончалось оно у данных.
+     */
+    sh.capture("df", ["-k", env.paths.home], { timeoutMs: 2e3 })
+  ]);
+  const found = new Set(programs.stdout.split("\n").map((line) => line.trim()));
+  const checks = [];
+  const add = (check) => void checks.push(check);
+  const major = Number.parseInt((process.version ?? "v0").slice(1), 10);
+  add({
+    id: "node",
+    label: "node",
+    ok: Number.isFinite(major) && major >= 22,
+    optional: false,
+    value: process.version ?? "unknown",
+    hint: "Node \u2265 22 is required: brew install node"
+  });
+  const daemon = info.code === 0 ? info.stdout.trim().split(/\s+/) : [];
+  const memTotal = daemon.length ? Number(daemon[daemon.length - 1]) : 0;
+  const daemonName = daemon.length >= 2 ? daemon.slice(1, -1).join(" ") : "";
+  const enoughMemory = memTotal >= 4 * 1024 ** 3;
+  add({
+    id: "docker",
+    label: "docker",
+    ok: info.code === 0 && enoughMemory,
+    optional: false,
+    value: info.code !== 0 ? "the daemon is not answering" : daemonName + ", " + (memTotal / 1024 ** 3).toFixed(0) + " GB" + (enoughMemory ? "" : " \u2014 not enough for a room kernel"),
+    hint: info.code !== 0 ? "start Docker Desktop or colima start" : "raise docker memory: under 4 GB the room kernel is killed by OOM"
+  });
+  const listener = listen.code === 0 ? listenerOf(listen.stdout) : null;
+  const ourPids = /* @__PURE__ */ new Set();
+  if (session !== null) {
+    ourPids.add(session.pid);
+    if (session.serverPid !== null) ourPids.add(session.serverPid);
+  }
+  if (/^\d+$/.test(pidText)) ourPids.add(Number(pidText));
+  const ours = listener !== null && ourPids.has(listener.pid);
+  add({
+    id: "port",
+    label: "port " + port,
+    ok: listen.code === 127 ? false : listener === null || ours,
+    optional: listen.code === 127,
+    value: listen.code === 127 ? "no lsof \u2014 the port cannot be checked" : listener === null ? "free" : ours ? "our server is listening, pid " + listener.pid : "taken: " + listener.name + " pid " + listener.pid + " \u2014 a second Colloq",
+    hint: "colloq stop \xB7 colloq status (never pkill by name)"
+  });
+  add({
+    id: "kernel-image",
+    label: "kernel image",
+    ok: image.code === 0,
+    optional: false,
+    value: image.code === 0 ? "colloq-kernel:" + kernelEnv : "no colloq-kernel:" + kernelEnv + " image",
+    hint: KERNEL_IMAGE_FIX
+  });
+  const ownEnvFile = joinPath(env.paths.ownEnvDir, kernelEnv + ".txt");
+  const appEnvFile = joinPath(env.paths.envDir, kernelEnv + ".txt");
+  const envFileAt = io.exists(ownEnvFile) ? ownEnvFile : io.exists(appEnvFile) ? appEnvFile : "";
+  add({
+    id: "kernel-env-file",
+    label: "environment",
+    ok: envFileAt !== "",
+    optional: false,
+    value: envFileAt === "" ? "no " + kernelEnv + ".txt list in either environment directory" : kernelEnv + ".txt in place" + (envFileAt === ownEnvFile ? " \xB7 your own" : ""),
+    hint: "colloq env list \xB7 colloq env new <name>"
+  });
+  const distNames = io.list(env.paths.dist);
+  const assets = io.list(joinPath(env.paths.dist, "assets"));
+  const plain = assets.filter((name) => /\.(js|css|html|json|svg)$/.test(name));
+  const squeezed = plain.filter((name) => assets.includes(name + ".br"));
+  const hasDist = distNames.length > 0;
+  const share = plain.length === 0 ? 1 : squeezed.length / plain.length;
+  add({
+    id: "web-dist",
+    label: "web/dist",
+    ok: hasDist && share >= 0.8,
+    optional: hasDist,
+    value: !hasDist ? "the frontend is not built" : share >= 0.8 ? "built, pre-compressed: " + squeezed.length + " of " + plain.length : "the frontend is not pre-compressed \u2014 11.6ms and 25 KB per student per file",
+    hint: REINSTALL
+  });
+  const wantRelay = relay.domain !== "";
+  add({
+    id: "frpc",
+    label: "frpc",
+    ok: found.has("frpc"),
+    optional: !wantRelay,
+    value: found.has("frpc") ? "present" : wantRelay ? "missing \u2014 no way out under *." + relay.domain : "the relay is not set up",
+    hint: "brew install frpc"
+  });
+  add({
+    id: "cloudflared",
+    label: "cloudflared",
+    ok: found.has("cloudflared"),
+    optional: true,
+    value: found.has("cloudflared") ? "present" : "missing \u2014 the quick tunnel will not start (not needed for *.colloq.ru)",
+    hint: "brew install cloudflared"
+  });
+  const oracle = env.has("OPENAI_API_KEY") || env.has("OPENROUTER_API_KEY");
+  add({
+    id: "oracle",
+    label: "Oracle",
+    ok: oracle,
+    optional: true,
+    value: oracle ? "key present" : "no key \u2014 suggestions are off",
+    hint: "OPENAI_API_KEY or OPENROUTER_API_KEY in .env"
+  });
+  const freeGb = freeSpaceGb(disk);
+  add({
+    id: "disk",
+    label: "disk space",
+    ok: freeGb !== null && freeGb >= 15,
+    optional: freeGb === null || freeGb >= 5,
+    value: freeGb === null ? "df did not answer" : freeGb < 5 ? freeGb.toFixed(1) + " GB \u2014 an image build and a backup will not fit" : freeGb < 15 ? freeGb.toFixed(1) + " GB \u2014 barely enough for an image and a backup" : freeGb.toFixed(0) + " GB",
+    hint: "clear old backups out of " + env.paths.backupsDir
+  });
+  const roomNetworkOpen = env.read("COLLOQ_ROOM_NETWORK").trim().toLowerCase() === "open";
+  add({
+    id: "room-network",
+    label: "room network",
+    ok: !roomNetworkOpen,
+    optional: true,
+    value: roomNetworkOpen ? "open (COLLOQ_ROOM_NETWORK=open): rooms reach your LAN, router and this computer" : "local addresses blocked: LAN, router, this computer, cloud metadata",
+    hint: "remove COLLOQ_ROOM_NETWORK=open from .env, then colloq restart"
+  });
+  add({
+    id: "perimeter",
+    label: "perimeter",
+    ok: false,
+    optional: true,
+    value: PERIMETER.what,
+    hint: PERIMETER.fix
+  });
+  return checks;
+}
+function listenerOf(stdout) {
+  for (const line of stdout.split("\n")) {
+    const parts = line.trim().split(/\s+/);
+    if (parts.length < 2) continue;
+    if (parts[0] === "COMMAND") continue;
+    if (!/^\d+$/.test(parts[1] ?? "")) continue;
+    return { name: parts[0] ?? "", pid: Number(parts[1]) };
+  }
+  return null;
+}
+function freeSpaceGb(result) {
+  if (result.code !== 0) return null;
+  const lines = result.stdout.split("\n").filter((line) => line.trim() !== "");
+  const last = lines[lines.length - 1] ?? "";
+  const parts = last.trim().split(/\s+/);
+  const kb = Number(parts[3]);
+  return Number.isFinite(kb) ? kb / 1024 / 1024 : null;
+}
+var commands4 = [
+  {
+    name: "status",
+    aliases: ["st"],
+    group: "tools",
+    summary: "Show what is on this machine right now: one screen, no network",
+    usage: "colloq status [--short] [--json]",
+    flags: [
+      { name: "short", summary: "Two lines: the server and the outside" },
+      { name: "json", summary: "Machine-readable" }
+    ],
+    destructive: false,
+    delegates: "native: .colloq/local-session.json, .env, .colloq.pid, ps, docker ps, web/dist, backups/",
+    examples: ["colloq status", "colloq status --short"],
+    notes: 'Reading only, and no network at all. The port, the address and the server pid come from the receipt of the class that is running, and only when there is no receipt \u2014 from .env: `colloq run --port 4100` writes nothing into .env. Under the "server" label stands the pid of the server, not of the supervisor: the same one doctor names as the listener on the port. Docker is asked once, with a ceiling of 0.7s \u2014 no answer means one line about docker, and the screen prints on.',
+    async run(ctx) {
+      if (ctx.dryRun) {
+        return ctx.sh.dry("native: status (reads the class receipt, .env, .colloq.pid, docker ps)");
+      }
+      const facts = await statusFacts(ctx);
+      if (ctx.json) {
+        ctx.ui.json({
+          ok: true,
+          server: {
+            form: facts.form,
+            pid: facts.pid,
+            port: facts.port,
+            uptimeSec: facts.uptimeSec
+          },
+          client: {
+            builtAt: facts.distAt === null ? null : new Date(facts.distAt).toISOString(),
+            stale: facts.stale
+          },
+          public: {
+            url: facts.publicUrl,
+            transport: facts.transport,
+            tunnelPid: facts.tunnelPid
+          },
+          kernel: {
+            image: facts.image,
+            builtAt: facts.imageAt === null ? null : new Date(facts.imageAt).toISOString(),
+            env: facts.kernelEnv,
+            rooms: facts.rooms
+          },
+          backup: {
+            path: facts.backupPath,
+            ageSec: facts.backupAt === null ? null : Math.round((ctx.io.now() - facts.backupAt) / 1e3)
+          }
+        });
+        return 0;
+      }
+      if (on(ctx, "short")) {
+        serverLine(ctx, facts, false);
+        publicLineShort(ctx, facts);
+        return 0;
+      }
+      renderStatus(ctx, facts);
+      return 0;
+    }
+  },
+  {
+    name: "doctor",
+    group: "tools",
+    summary: "Check that everything is in place before a class",
+    usage: "colloq doctor [--json]",
+    flags: [{ name: "json", summary: "Machine-readable" }],
+    destructive: false,
+    delegates: "native: programs, docker, the port, the kernel image, files, disk space",
+    examples: ["colloq doctor", "colloq doctor --json"],
+    notes: '\u2717 \u2014 broken, fix it; \u25CB \u2014 a capability is switched off, and that is not an error. Out of .env only the port and the kernel environment are printed; keys are only "present / missing". The port that gets checked is the one the class runs on (from the receipt), and its listener counts as ours by the pids of the server and of the supervisor. No network at all. Code 3 if there is at least one \u2717. The last line is about the perimeter: it checks nothing and does not change the code, it says how a local class differs from a server installation.',
+    async run(ctx) {
+      if (ctx.dryRun) {
+        return ctx.sh.dry(
+          "native: doctor (programs, docker, the port, the kernel image, files, disk space)"
+        );
+      }
+      const checks = await doctorChecks(ctx);
+      const broken = checks.filter((check) => !check.ok && !check.optional);
+      if (ctx.json) {
+        ctx.ui.json(
+          checks.map((check) => ({
+            id: check.id,
+            ok: check.ok,
+            optional: check.optional,
+            value: check.value,
+            hint: check.ok ? "" : check.hint
+          }))
+        );
+        return broken.length ? 3 : 0;
+      }
+      const row = rowPrinter(
+        ctx,
+        checks.map((check) => check.label)
+      );
+      for (const check of checks) {
+        const symbol = check.ok ? SYMBOL.ok : check.optional ? SYMBOL.off : SYMBOL.bad;
+        row(symbol + " " + check.label, check.value);
+        if (!check.ok) ctx.ui.hint(check.hint);
+      }
+      return broken.length ? 3 : 0;
+    }
+  }
+];
+
+// cli/src/registry.ts
+var GROUPS = [
+  { name: "local", title: "Locally" },
+  { name: "host", title: "Class online" },
+  { name: "env", title: "Kernel environments" },
+  { name: "tools", title: "Tools" }
+];
+var registry = [...commands2, ...commands, ...commands3, ...commands4];
+
+// cli/src/sh.ts
+import { constants } from "node:os";
+var TCP_PROBE = [
+  "const net = require('net')",
+  "const [addr, port] = process.argv.slice(1)",
+  "const socket = net.connect({ host: addr, port: Number(port) })",
+  "const done = (code) => { socket.destroy(); process.exit(code) }",
+  "socket.setTimeout(2000)",
+  "socket.on('connect', () => done(0))",
+  "socket.on('timeout', () => done(1))",
+  "socket.on('error', () => done(1))"
+].join("; ");
+function exitFromSignal(signal) {
+  const number = constants.signals[signal];
+  return 128 + (typeof number === "number" ? number : 2);
+}
+function quote(value) {
+  if (value === "") return "''";
+  if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) return value;
+  return "'" + value.replace(/'/g, "'\\''") + "'";
+}
+function commandLine(cmd, args, env) {
+  const head = env ? Object.entries(env).map(([key, value]) => key + "=" + quote(value)).join(" ") : "";
+  const body = [cmd, ...args].map(quote).join(" ");
+  return head ? head + " " + body : body;
+}
+function createSh(opts) {
+  const { root, ui } = opts;
+  const dryRun = opts.dryRun ?? false;
+  const runner = opts.runner ?? null;
+  const real = {
+    async run(cmd, args, runOpts) {
+      const { spawn } = await import("node:child_process");
+      return await new Promise((resolve) => {
+        const child = spawn(cmd, args, {
+          cwd: runOpts.cwd ?? root,
+          env: { ...process.env, ...runOpts.env ?? {} },
+          stdio: "inherit"
+        });
+        const forward = (signal) => () => {
+          try {
+            child.kill(signal);
+          } catch {
+          }
+        };
+        const onInt = forward("SIGINT");
+        const onTerm = forward("SIGTERM");
+        const onHangup = forward("SIGHUP");
+        process.on("SIGINT", onInt);
+        process.on("SIGTERM", onTerm);
+        process.on("SIGHUP", onHangup);
+        const done = (code) => {
+          process.off("SIGINT", onInt);
+          process.off("SIGTERM", onTerm);
+          process.off("SIGHUP", onHangup);
+          resolve(code);
+        };
+        child.on("error", () => done(127));
+        child.on("close", (code, signal) => done(signal ? exitFromSignal(signal) : code ?? 0));
+      });
+    },
+    async capture(cmd, args, captureOpts) {
+      const { spawn } = await import("node:child_process");
+      return await new Promise((resolve) => {
+        const child = spawn(cmd, args, {
+          cwd: captureOpts.cwd ?? root,
+          env: { ...process.env, ...captureOpts.env ?? {} },
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+        let stdout = "";
+        let stderr = "";
+        let timer = null;
+        let expired = false;
+        child.stdout?.on("data", (chunk) => stdout += chunk.toString());
+        child.stderr?.on("data", (chunk) => stderr += chunk.toString());
+        child.stdin?.end();
+        if (captureOpts.timeoutMs) {
+          timer = setTimeout(() => {
+            expired = true;
+            try {
+              child.kill("SIGKILL");
+            } catch {
+            }
+          }, captureOpts.timeoutMs);
+        }
+        const done = (code) => {
+          if (timer) clearTimeout(timer);
+          resolve({ code, stdout, stderr });
+        };
+        child.on("error", () => done(127));
+        child.on("close", (code, signal) => {
+          if (expired) return done(124);
+          done(signal ? exitFromSignal(signal) : code ?? 0);
+        });
+      });
+    }
+  };
+  const sh = {
+    get dryRun() {
+      return dryRun;
+    },
+    dry(line) {
+      ui.line(line);
+      return 0;
+    },
+    async run(cmd, args, runOpts = {}) {
+      if (dryRun) {
+        ui.line(commandLine(cmd, args, runOpts.env));
+        return 0;
+      }
+      return await (runner ?? real).run(cmd, args, runOpts);
+    },
+    async capture(cmd, args, captureOpts = {}) {
+      return await (runner ?? real).capture(cmd, args, captureOpts);
+    },
+    async script(path2, args = [], runOpts = {}) {
+      return await sh.run(path2, args, runOpts);
+    }
+  };
+  return sh;
+}
+
+// cli/src/main.ts
+var GLOBAL_FLAGS = /* @__PURE__ */ new Set([
+  "--help",
+  "-h",
+  "--dry-run",
+  "--yes",
+  "-y",
+  "--json",
+  "--no-color",
+  "--version",
+  "-V"
+]);
+async function cli(argv, deps = {}) {
+  const processEnv = deps.processEnv ?? process.env;
+  const commands5 = deps.commands ?? registry;
+  const io = deps.io ?? createIo();
+  const tty = deps.tty ?? Boolean(process.stdout.isTTY && process.stdin.isTTY);
+  const globals = {
+    help: false,
+    dryRun: false,
+    yes: false,
+    json: false,
+    noColor: false,
+    version: false
+  };
+  const tokens = [];
+  let raw = false;
+  for (const token of argv) {
+    if (raw) {
+      tokens.push(token);
+      continue;
+    }
+    if (token === "--") {
+      raw = true;
+      tokens.push(token);
+      continue;
+    }
+    if (!GLOBAL_FLAGS.has(token)) {
+      tokens.push(token);
+      continue;
+    }
+    if (token === "--help" || token === "-h") globals.help = true;
+    else if (token === "--dry-run") globals.dryRun = true;
+    else if (token === "--yes" || token === "-y") globals.yes = true;
+    else if (token === "--json") globals.json = true;
+    else if (token === "--no-color") globals.noColor = true;
+    else globals.version = true;
+  }
+  const color = globals.noColor ? false : colorAllowed(processEnv, Boolean(process.stdout.isTTY));
+  const ui = createUi({
+    color,
+    json: globals.json,
+    out: deps.out,
+    err: deps.err,
+    tty,
+    ask: deps.ask
+  });
+  const env = createEnv({ io, root: deps.root, home: deps.home, cwd: deps.cwd, processEnv });
+  const sh = createSh({
+    root: env.root(),
+    ui,
+    dryRun: globals.dryRun,
+    runner: deps.runner ?? null
+  });
+  let roomsCache = null;
+  const ctx = {
+    positionals: [],
+    values: {},
+    dryRun: globals.dryRun,
+    yes: globals.yes,
+    json: globals.json,
+    sh,
+    ui,
+    env,
+    io,
+    dist: deps.dist ?? isDistribution(),
+    rooms() {
+      roomsCache ??= countRooms();
+      return roomsCache;
+    },
+    async confirm(question) {
+      if (globals.yes || globals.dryRun) return true;
+      return await ui.confirm(await withRooms(question));
+    }
+  };
+  async function countRooms() {
+    const result = await sh.capture(
+      "docker",
+      ["ps", "--filter", "label=colloq.kind=room-kernel", "--format", '{{.Label "colloq.session"}}'],
+      { timeoutMs: 4e3 }
+    );
+    if (result.code !== 0) return 0;
+    const rooms = new Set(result.stdout.split("\n").map((line) => line.trim()).filter(Boolean));
+    return rooms.size;
+  }
+  async function withRooms(question) {
+    const count = await ctx.rooms();
+    return count > 0 ? question + " " + roomsPhrase(count) : question;
+  }
+  try {
+    if (globals.version) {
+      ui.line(version(io, env.path("cli/package.json")));
+      return 0;
+    }
+    if (tokens.length === 0) {
+      if (globals.help) renderHelp(ui, commands5, env.kernelEnv());
+      else renderIntro(ui);
+      return 0;
+    }
+    return await dispatch(tokens);
+  } catch (error) {
+    return fail(error);
+  }
+  function fail(error) {
+    if (error instanceof UsageError) return report(2, error.message, error.fix, error.why);
+    if (error instanceof PreconditionError) return report(3, error.message, error.fix, error.why);
+    const message = error instanceof Error ? error.message : String(error);
+    return report(1, message, "colloq help");
+  }
+  function report(code, what, fix, why = "") {
+    if (globals.json) {
+      ui.json({ ok: false, code, error: what + (why ? ". " + why : ""), hint: fix });
+      return code;
+    }
+    ui.refuse(what, why, fix);
+    return code;
+  }
+  async function dispatch(input) {
+    const head = input.filter((token) => !token.startsWith("-"));
+    const first = head[0] ?? "";
+    if (first === "help") {
+      const wanted = head[1];
+      if (wanted) {
+        const target = find(commands5, wanted) ?? find(commands5, head.slice(1, 3).join(" "));
+        if (!target) return unknown(wanted);
+        renderCommandHelp(ui, target, env);
+        return 0;
+      }
+      renderHelp(ui, commands5, env.kernelEnv());
+      return 0;
+    }
+    const two2 = head.length > 1 ? first + " " + head[1] : "";
+    const found = (two2 ? find(commands5, two2) : void 0) ?? find(commands5, first);
+    if (!found) {
+      const twin = first.includes("-") ? find(commands5, first.replaceAll("-", " ")) : void 0;
+      if (twin) return await dispatch(respell(input, first, twin.name));
+      if (globals.help) {
+        renderHelp(ui, commands5, env.kernelEnv());
+        return 2;
+      }
+      return unknown(first);
+    }
+    const matchedTwo = Boolean(two2) && (found.name === two2 || (found.aliases ?? []).includes(two2));
+    const used = matchedTwo ? 2 : 1;
+    const tail = dropCommandTokens(input, used);
+    if (globals.help) {
+      renderCommandHelp(ui, found, env);
+      return 0;
+    }
+    if (globals.json && !found.flags.some((flag2) => flag2.name === "json")) {
+      const where = commands5.filter((command) => command.flags.some((flag2) => flag2.name === "json")).map((command) => command.name);
+      throw new UsageError(
+        "command " + found.name + " has no --json",
+        where.length ? "--json works with " + where.join(", ") : "no command has a machine-readable view"
+      );
+    }
+    const options = {};
+    for (const flag2 of found.flags) {
+      options[flag2.name] = {
+        type: flag2.arg ? "string" : "boolean",
+        ...flag2.short ? { short: flag2.short } : {},
+        ...flag2.multiple ? { multiple: true } : {}
+      };
+    }
+    let parsed;
+    try {
+      parsed = parseArgs({ args: tail, options, strict: true, allowPositionals: true });
+    } catch (error) {
+      throw parseTrouble(error, found);
+    }
+    ctx.positionals = parsed.positionals;
+    ctx.values = parsed.values;
+    const declared = found.args ?? [];
+    for (let i = 0; i < declared.length; i++) {
+      const arg = declared[i];
+      if (!arg?.required) continue;
+      if ((parsed.positionals[i] ?? "").trim() !== "") continue;
+      throw new UsageError("missing required argument <" + arg.name + ">", "Usage: " + found.usage);
+    }
+    if (parsed.positionals.length > declared.length) {
+      throw new UsageError(
+        "extra argument: " + (parsed.positionals[declared.length] ?? ""),
+        "Usage: " + found.usage
+      );
+    }
+    if (found.check) await found.check(ctx);
+    if (found.destructive && found.confirm === "cli" && !globals.yes && !globals.dryRun) {
+      const needed = found.confirmWhen ? await found.confirmWhen(ctx) : true;
+      if (needed) {
+        const asked = typeof found.confirmQuestion === "function" ? await found.confirmQuestion(ctx) : found.confirmQuestion ?? "continue?";
+        const question = found.rooms === false ? asked : await withRooms(asked);
+        if (!await ui.confirm(question)) return cancelled(ui);
+      }
+    }
+    return await found.run(ctx);
+  }
+  function unknown(name) {
+    const inGroup = commands5.filter((command) => command.name.startsWith(name + " ")).map((command) => command.name);
+    if (inGroup.length > 0) {
+      return report(
+        2,
+        name + " is a group of commands, not a command",
+        "colloq " + inGroup.join(" \xB7 colloq "),
+        "the group needs a second word"
+      );
+    }
+    const near = nearest(commands5, name);
+    return report(
+      2,
+      "no command " + name,
+      near ? "did you mean colloq " + near + "?" : "colloq help \u2014 the list of commands"
+    );
+  }
+}
+function dropCommandTokens(input, count) {
+  const out = [];
+  let dropped = 0;
+  for (const token of input) {
+    if (dropped < count && !token.startsWith("-")) {
+      dropped++;
+      continue;
+    }
+    out.push(token);
+  }
+  return out;
+}
+function respell(input, from, to) {
+  const out = [];
+  let done = false;
+  for (const token of input) {
+    if (!done && token === from) {
+      out.push(...to.split(" "));
+      done = true;
+      continue;
+    }
+    out.push(token);
+  }
+  return out;
+}
+function parseTrouble(error, command) {
+  const message = error instanceof Error ? error.message : String(error);
+  const fix = "colloq " + command.name + " --help";
+  if (error.code === "ERR_PARSE_ARGS_UNKNOWN_OPTION") {
+    const flag2 = /'(-[^']+)'/.exec(message)?.[1] ?? "";
+    const near = nearestWord(
+      command.flags.map((item) => "--" + item.name),
+      flag2
+    );
+    return new UsageError(
+      "command " + command.name + " has no flag " + flag2,
+      near ? "did you mean " + near + "? \xB7 " + fix : fix
+    );
+  }
+  return new UsageError(message, fix);
+}
+function find(commands5, name) {
+  if (!name) return void 0;
+  return commands5.find((command) => command.name === name || (command.aliases ?? []).includes(name));
+}
+function nearest(commands5, name) {
+  let best;
+  let bestDistance = 4;
+  for (const command of commands5) {
+    for (const candidate of [command.name, ...command.aliases ?? []]) {
+      const distance = levenshtein(name, candidate);
+      if (distance < bestDistance) {
+        bestDistance = distance;
+        best = command.name;
+      }
+    }
+  }
+  return best;
+}
+function nearestWord(words, name) {
+  let best;
+  let bestDistance = 4;
+  for (const word of words) {
+    const distance = levenshtein(name, word);
+    if (distance < bestDistance) {
+      bestDistance = distance;
+      best = word;
+    }
+  }
+  return best;
+}
+function levenshtein(a, b) {
+  const rows = a.length + 1;
+  const cols = b.length + 1;
+  let previous = Array.from({ length: cols }, (_, i) => i);
+  for (let i = 1; i < rows; i++) {
+    const current = [i];
+    for (let j = 1; j < cols; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      current[j] = Math.min(
+        (current[j - 1] ?? 0) + 1,
+        (previous[j] ?? 0) + 1,
+        (previous[j - 1] ?? 0) + cost
+      );
+    }
+    previous = current;
+  }
+  return previous[cols - 1] ?? Math.max(a.length, b.length);
+}
+function roomsPhrase(count) {
+  return roomsWord(count) + (count === 1 ? " is running" : " are running");
+}
+function version(io, packagePath) {
+  const text = io.readText(packagePath);
+  const match = text ? /"version"\s*:\s*"([^"]+)"/.exec(text) : null;
+  return match?.[1] ?? "0.0.0";
+}
+function renderIntro(ui) {
+  ui.line(ui.bold("colloq") + " \u2014 a class on this computer: notebooks, a Python kernel and a board");
+  ui.line();
+  ui.table([
+    [ui.cyan("colloq start"), "start the class and open the browser"],
+    [ui.cyan("colloq host <name>"), "publish it and give the room a link"],
+    [ui.cyan("colloq stop"), "end the class"]
+  ]);
+  ui.line();
+  ui.line(ui.dim("More: colloq help \xB7 one command: colloq <command> --help"));
+}
+function renderHelp(ui, commands5, kernelEnv) {
+  for (const group of GROUPS) {
+    const inGroup = commands5.filter((command) => command.group === group.name);
+    if (inGroup.length === 0) continue;
+    ui.header(group.title);
+    for (const command of inGroup) {
+      ui.line("  " + ui.cyan(command.name.padEnd(18)) + command.summary);
+    }
+    ui.line();
+  }
+  ui.line(ui.dim("Most used: colloq start \xB7 colloq host <name> \xB7 colloq status \xB7 colloq stop"));
+  ui.line(ui.dim("Everywhere: --dry-run \u2014 show what would run and do nothing \xB7 --yes \u2014 do not ask"));
+  ui.line(ui.dim("Kernel environment now: " + kernelEnv));
+  ui.line(ui.dim("In detail: colloq <command> --help"));
+}
+function renderCommandHelp(ui, command, env) {
+  const domain = env.relay().domain || "class.example.org";
+  const kernel = env.kernelEnv() || "base";
+  const fill = (text) => text.replaceAll("{domain}", domain).replaceAll("{env}", kernel);
+  ui.line(command.summary);
+  ui.line("Usage: " + ui.cyan(command.usage));
+  if (command.args?.length) {
+    ui.line();
+    ui.header("Arguments");
+    ui.table(
+      command.args.map((arg) => [
+        arg.required ? "<" + arg.name + ">" : "[" + arg.name + "]",
+        arg.summary
+      ])
+    );
+  }
+  ui.line();
+  ui.header("Flags");
+  ui.table([
+    ...command.flags.map((flag2) => [
+      (flag2.short ? "-" + flag2.short + ", " : "") + "--" + flag2.name + (flag2.arg ? " <" + flag2.arg + ">" : ""),
+      flag2.summary
+    ]),
+    // Общие флаги дописываются здесь, а не в usage каждой команды: иначе одни
+    // группы их перечисляют, другие нет, и help читается как пять разных.
+    ...globalFlagRows(command)
+  ]);
+  const examples = (command.examples?.length ? command.examples : [command.usage]).map(fill);
+  const shown = examples.length >= 2 ? examples.slice(0, 2) : [examples[0] ?? "", fill(command.usage) + " --dry-run"];
+  ui.line();
+  ui.header("Examples");
+  ui.table(shown.map((example) => [ui.cyan(example)]));
+  if (command.notes) {
+    ui.line();
+    ui.line(ui.dim(command.notes));
+  }
+  ui.line();
+  ui.line(ui.dim("delegates: " + command.delegates));
+}
+function globalFlagRows(command) {
+  const rows = [["--dry-run", "Show what would run and do nothing"]];
+  if (command.destructive) rows.push(["-y, --yes", "Agree in advance, no question will be asked"]);
+  rows.push(["--no-color", "No colour: the same output without a single escape"]);
+  rows.push(["-h, --help", "This page"]);
+  return rows;
+}
+var entry = process.argv[1] ?? "";
+if (entry.endsWith("/cli/src/main.ts") || entry.endsWith("/cli/src/main.js")) {
+  const code = await cli(process.argv.slice(2));
+  process.exitCode = code;
+}
+
+// cli/src/bin.ts
+process.exitCode = await cli(process.argv.slice(2));