riptide-transfer 1.3.6__tar.gz

riptide_transfer-1.3.6/PKG-INFO

@@ -0,0 +1,176 @@
+Metadata-Version: 2.4
+Name: riptide-transfer
+Version: 1.3.6
+Summary: Direct, encrypted PC-to-PC file transfer in the terminal. No cloud upload, no website in the data path.
+Author: riptide
+License: MIT
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: textual>=0.86
+Requires-Dist: cryptography>=42
+Requires-Dist: paramiko>=3.4
+
+# Riptide
+
+Riptide is a terminal program for direct, encrypted, PC to PC file transfer. Run `riptide` in a folder, connect two computers, and send files from one to the other over one encrypted TCP connection. Files go straight from sender to receiver. No server stores a copy in between.
+
+The name comes from Minecraft. Riptide is the trident enchantment that launches the player forward at high speed. With an Elytra in rain, Riptide plus Elytra is the fastest travel method in Minecraft. Riptide the program aims for the same idea for files: the shortest route, from one PC to the other.
+
+## Screenshots
+
+![Homepage](docs/screenshots/homepage.png)
+
+![Create Server page](docs/screenshots/create-server.png)
+
+![Join Server page](docs/screenshots/join-server.png)
+
+![File transfer page](docs/screenshots/transfer.png)
+
+## Features
+
+- Direct session between two PCs. One side listens, the other dials in. Both sides must be online at the same time.
+- Either side can send files after the session opens. File direction does not depend on connection direction.
+- Multiple file selection. Select files with Space, send the batch with Enter.
+- File manager with folders, live search in `Find:`, auto-highlight of the first file or folder, and `0` to deselect all.
+- File requests with approval. Type a peer path, press Enter, and nothing is sent until the peer presses Allow.
+- Saved connections. Peers, hostnames, and certificate fingerprints are saved in `~/.riptide/config.toml`. Saved devices appear on the Join Server page.
+- Automatically add firewall rule for inbound connections.
+- Live progress with speed, transferred total, remaining size, and ETA, on sender and receiver.
+- Hash verification. Each file is SHA-256 hashed before sending, written as `.part` on receipt, and renamed only if the hash matches.
+- TLS encryption for headers and file bytes, with per-machine self-signed certificates.
+- Fingerprint approval. First connection to a peer shows its certificate fingerprint for approval. A changed fingerprint later aborts the session.
+- Public address display on Create Server.
+
+Security, in brief: TLS protects files in transit. Fingerprints authenticate peers, and first connect shows a 6-digit code to compare out of band. Download requests need explicit approval. Private keys stay in `~/.riptide/` at 0600 and are never stored in `config.toml`. Files on disk are not encrypted. A push after session approval does not ask per file, but it never overwrites, duplicates are saved as (1), (2), etc., so only approve sessions for peers you trust. Full detail is in [Docs/Security](docs/security.md).
+
+## Installation
+
+Published on PyPI as `riptide-transfer`. The command stays `riptide`.
+
+Requirements: Python 3.11 or newer, Windows or Linux. For the GitHub install you also need `git`.
+
+```sh
+pip install riptide-transfer
+```
+
+Or install from GitHub:
+
+```sh
+pip install git+https://github.com/mohakps/riptide
+```
+
+Run it from the folder you want to send from or receive into:
+
+```sh
+riptide
+```
+
+Update:
+
+```sh
+pip install --upgrade riptide-transfer
+```
+
+Uninstall:
+
+```sh
+pip uninstall riptide-transfer
+```
+
+If upgrade fails, uninstall and install again.
+
+## Usage
+
+Create Server listens. Join Server dials. Create stays on top in the menu.
+
+1. Create side: run `riptide`, choose Create Server, and share the public address shown on that page or your DDNS hostname with the other person. Keep the page open.
+2. Join side: run `riptide`, choose Join Server, enter the host hostname or IP, or pick a saved device, and press Enter.
+3. Approve the connection when asked, on either side.
+4. Send: select files with Space in the file manager, press Enter. Request: type a peer path in Download From Peer, press Enter, and wait for the peer to Allow it.
+5. Files arrive in the folder where the receiving side ran `riptide`.
+
+If you are behind CGNAT, swap roles. Let the other side Create, and you Join. Full usage, shortcuts, and setup steps are in [Docs/Usage](docs/usage.md). Learn more about CGNAT or who should create server in [Docs/Architecture](docs/architecture.md).
+
+### Shortcuts
+
+| Key | Action |
+| --- | --- |
+| Up / Down | Move in a list |
+| Space | Open a folder, or select a file |
+| Enter | Send selected files, or Allow a pending connection |
+| Backspace | Erase Find text, go up a folder when Find is empty, or Deny a pending connection |
+| 0 | Deselect all files |
+| Tab | Cycle between file list and download input |
+| Esc | Back, or leave the session |
+
+## Advantages
+
+- One direct transfer, at bottleneck speed. No server in the middle to slow, throttle, or queue it.
+- About half the time of a cloud transfer for large files. Cloud transfer is upload plus download. Direct transfer is one transfer.
+- No account, storage quota, or file size limit from Riptide. Disk space is the limit.
+- No third party holds a copy, so privacy does not depend on a provider policy.
+- LAN speed when both PCs are on the same LAN, using a private LAN address.
+
+Full details in [Docs/Advantages](docs/advantages.md).
+
+## Limitations
+
+- First setup on the Create side: port forward 50000 on the router, once, and DDNS if the public IP changes often. The PC firewall rule for port 50000 is checked and added automatically when you click Create Server, on Windows and Linux. If Riptide is not run as admin, or sudo needs a password, it asks once on that click: UAC on Windows, pkexec on Linux. If you cancel, or it cannot add the rule, the Create page shows the exact manual command. Only rules that explicitly mention port 50000 are checked and opened. Any-port rules are ignored.
+- No direct connection between two CGNAT devices on IPv4, unless both have global IPv6. There is no relay fallback.
+- Folders cannot be sent yet. Zip a folder first, or select its files one by one.
+- No resume for an interrupted file. It restarts from the start.
+- One file at a time, in batch order. No parallel streams.
+- Both sides must be online together. No offline queue.
+- You must exchange the host address outside Riptide, by message or DDNS hostname.
+- Terminal only, Windows and Linux primarily. macOS is not specifically tested.
+
+Full detail, with workarounds where they exist, is in [Docs/Limitations](docs/limitations.md).
+
+## Project structure
+
+```
+riptide/
+├── src/riptide/
+│   ├── app.py
+│   ├── theme.py
+│   ├── screens/
+│   │   ├── menu.py
+│   │   ├── create.py
+│   │   ├── join.py
+│   │   └── session_screen.py
+│   └── core/
+│       ├── session.py
+│       ├── identity.py
+│       ├── nat.py
+│       ├── config.py
+│       ├── file_select.py
+│       ├── firewall.py
+│       ├── focus.py
+│       └── transfer.py
+├── tests/
+├── REMOVED.md
+└── README.md
+```
+
+For detail structure, read [Docs/Project structure](docs/project-structure.md).
+
+## How this was built
+
+- Meta Muse: primary assistant for panning, implementation, testing, and documentation.
+- Gemini 3.8 Flash: TUI Design
+
+Human decisions, testing on real machines, and final choices about names, ports, and behaviour are the author's. AI-generated code was tested, not trusted blindly. The test suite and headless Textual pilots are part of the workflow, and live two-machine testing is what proves a transfer.
+
+## Future Scope
+
+- Support for transferring folders
+- Support for MacOS
+
+## Docs
+
+- [Architecture](docs/architecture.md)
+- [Security](docs/security.md)
+- [Advantages](docs/advantages.md)
+- [Limitations](docs/limitations.md)
+- [Troubleshooting](docs/troubleshooting.md)
+- [Sources and references](docs/sources-references.md)

riptide_transfer-1.3.6/README.md

@@ -0,0 +1,164 @@
+# Riptide
+
+Riptide is a terminal program for direct, encrypted, PC to PC file transfer. Run `riptide` in a folder, connect two computers, and send files from one to the other over one encrypted TCP connection. Files go straight from sender to receiver. No server stores a copy in between.
+
+The name comes from Minecraft. Riptide is the trident enchantment that launches the player forward at high speed. With an Elytra in rain, Riptide plus Elytra is the fastest travel method in Minecraft. Riptide the program aims for the same idea for files: the shortest route, from one PC to the other.
+
+## Screenshots
+
+![Homepage](docs/screenshots/homepage.png)
+
+![Create Server page](docs/screenshots/create-server.png)
+
+![Join Server page](docs/screenshots/join-server.png)
+
+![File transfer page](docs/screenshots/transfer.png)
+
+## Features
+
+- Direct session between two PCs. One side listens, the other dials in. Both sides must be online at the same time.
+- Either side can send files after the session opens. File direction does not depend on connection direction.
+- Multiple file selection. Select files with Space, send the batch with Enter.
+- File manager with folders, live search in `Find:`, auto-highlight of the first file or folder, and `0` to deselect all.
+- File requests with approval. Type a peer path, press Enter, and nothing is sent until the peer presses Allow.
+- Saved connections. Peers, hostnames, and certificate fingerprints are saved in `~/.riptide/config.toml`. Saved devices appear on the Join Server page.
+- Automatically add firewall rule for inbound connections.
+- Live progress with speed, transferred total, remaining size, and ETA, on sender and receiver.
+- Hash verification. Each file is SHA-256 hashed before sending, written as `.part` on receipt, and renamed only if the hash matches.
+- TLS encryption for headers and file bytes, with per-machine self-signed certificates.
+- Fingerprint approval. First connection to a peer shows its certificate fingerprint for approval. A changed fingerprint later aborts the session.
+- Public address display on Create Server.
+
+Security, in brief: TLS protects files in transit. Fingerprints authenticate peers, and first connect shows a 6-digit code to compare out of band. Download requests need explicit approval. Private keys stay in `~/.riptide/` at 0600 and are never stored in `config.toml`. Files on disk are not encrypted. A push after session approval does not ask per file, but it never overwrites, duplicates are saved as (1), (2), etc., so only approve sessions for peers you trust. Full detail is in [Docs/Security](docs/security.md).
+
+## Installation
+
+Published on PyPI as `riptide-transfer`. The command stays `riptide`.
+
+Requirements: Python 3.11 or newer, Windows or Linux. For the GitHub install you also need `git`.
+
+```sh
+pip install riptide-transfer
+```
+
+Or install from GitHub:
+
+```sh
+pip install git+https://github.com/mohakps/riptide
+```
+
+Run it from the folder you want to send from or receive into:
+
+```sh
+riptide
+```
+
+Update:
+
+```sh
+pip install --upgrade riptide-transfer
+```
+
+Uninstall:
+
+```sh
+pip uninstall riptide-transfer
+```
+
+If upgrade fails, uninstall and install again.
+
+## Usage
+
+Create Server listens. Join Server dials. Create stays on top in the menu.
+
+1. Create side: run `riptide`, choose Create Server, and share the public address shown on that page or your DDNS hostname with the other person. Keep the page open.
+2. Join side: run `riptide`, choose Join Server, enter the host hostname or IP, or pick a saved device, and press Enter.
+3. Approve the connection when asked, on either side.
+4. Send: select files with Space in the file manager, press Enter. Request: type a peer path in Download From Peer, press Enter, and wait for the peer to Allow it.
+5. Files arrive in the folder where the receiving side ran `riptide`.
+
+If you are behind CGNAT, swap roles. Let the other side Create, and you Join. Full usage, shortcuts, and setup steps are in [Docs/Usage](docs/usage.md). Learn more about CGNAT or who should create server in [Docs/Architecture](docs/architecture.md).
+
+### Shortcuts
+
+| Key | Action |
+| --- | --- |
+| Up / Down | Move in a list |
+| Space | Open a folder, or select a file |
+| Enter | Send selected files, or Allow a pending connection |
+| Backspace | Erase Find text, go up a folder when Find is empty, or Deny a pending connection |
+| 0 | Deselect all files |
+| Tab | Cycle between file list and download input |
+| Esc | Back, or leave the session |
+
+## Advantages
+
+- One direct transfer, at bottleneck speed. No server in the middle to slow, throttle, or queue it.
+- About half the time of a cloud transfer for large files. Cloud transfer is upload plus download. Direct transfer is one transfer.
+- No account, storage quota, or file size limit from Riptide. Disk space is the limit.
+- No third party holds a copy, so privacy does not depend on a provider policy.
+- LAN speed when both PCs are on the same LAN, using a private LAN address.
+
+Full details in [Docs/Advantages](docs/advantages.md).
+
+## Limitations
+
+- First setup on the Create side: port forward 50000 on the router, once, and DDNS if the public IP changes often. The PC firewall rule for port 50000 is checked and added automatically when you click Create Server, on Windows and Linux. If Riptide is not run as admin, or sudo needs a password, it asks once on that click: UAC on Windows, pkexec on Linux. If you cancel, or it cannot add the rule, the Create page shows the exact manual command. Only rules that explicitly mention port 50000 are checked and opened. Any-port rules are ignored.
+- No direct connection between two CGNAT devices on IPv4, unless both have global IPv6. There is no relay fallback.
+- Folders cannot be sent yet. Zip a folder first, or select its files one by one.
+- No resume for an interrupted file. It restarts from the start.
+- One file at a time, in batch order. No parallel streams.
+- Both sides must be online together. No offline queue.
+- You must exchange the host address outside Riptide, by message or DDNS hostname.
+- Terminal only, Windows and Linux primarily. macOS is not specifically tested.
+
+Full detail, with workarounds where they exist, is in [Docs/Limitations](docs/limitations.md).
+
+## Project structure
+
+```
+riptide/
+├── src/riptide/
+│   ├── app.py
+│   ├── theme.py
+│   ├── screens/
+│   │   ├── menu.py
+│   │   ├── create.py
+│   │   ├── join.py
+│   │   └── session_screen.py
+│   └── core/
+│       ├── session.py
+│       ├── identity.py
+│       ├── nat.py
+│       ├── config.py
+│       ├── file_select.py
+│       ├── firewall.py
+│       ├── focus.py
+│       └── transfer.py
+├── tests/
+├── REMOVED.md
+└── README.md
+```
+
+For detail structure, read [Docs/Project structure](docs/project-structure.md).
+
+## How this was built
+
+- Meta Muse: primary assistant for panning, implementation, testing, and documentation.
+- Gemini 3.8 Flash: TUI Design
+
+Human decisions, testing on real machines, and final choices about names, ports, and behaviour are the author's. AI-generated code was tested, not trusted blindly. The test suite and headless Textual pilots are part of the workflow, and live two-machine testing is what proves a transfer.
+
+## Future Scope
+
+- Support for transferring folders
+- Support for MacOS
+
+## Docs
+
+- [Architecture](docs/architecture.md)
+- [Security](docs/security.md)
+- [Advantages](docs/advantages.md)
+- [Limitations](docs/limitations.md)
+- [Troubleshooting](docs/troubleshooting.md)
+- [Sources and references](docs/sources-references.md)

riptide_transfer-1.3.6/pyproject.toml

@@ -0,0 +1,26 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "riptide-transfer"
+version = "1.3.6"
+description = "Direct, encrypted PC-to-PC file transfer in the terminal. No cloud upload, no website in the data path."
+readme = "README.md"
+requires-python = ">=3.11"
+license = {text = "MIT"}
+authors = [{name = "riptide"}]
+dependencies = [
+    "textual>=0.86",
+    "cryptography>=42",
+    "paramiko>=3.4",
+]
+
+[project.scripts]
+riptide = "riptide.app:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

riptide_transfer-1.3.6/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

riptide_transfer-1.3.6/src/riptide/__init__.py

@@ -0,0 +1,28 @@
+"""Riptide: direct, encrypted PC-to-PC file transfer in the terminal."""
+
+from pathlib import Path
+import tomllib
+
+
+def _load_version() -> str:
+    pyproject_path = Path(__file__).resolve().parents[2] / "pyproject.toml"
+    if pyproject_path.exists():
+        try:
+            data = tomllib.loads(pyproject_path.read_text(encoding="utf-8"))
+            return str(data.get("project", {}).get("version", "0.0.0"))
+        except Exception:
+            pass
+    try:
+        from importlib.metadata import version
+        for dist_name in ("riptide-transfer", "riptide"):
+            try:
+                return version(dist_name)
+            except Exception:
+                continue
+    except Exception:
+        pass
+    return "0.0.0"
+
+
+__version__ = _load_version()
+__all__ = ["__version__"]

riptide_transfer-1.3.6/src/riptide/__main__.py

@@ -0,0 +1,4 @@
+from .app import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

riptide_transfer-1.3.6/src/riptide/app.py

@@ -0,0 +1,45 @@
+"""Riptide Textual app. Entry point: riptide = riptide.app:main"""
+from __future__ import annotations
+
+import argparse
+import sys
+
+from textual.app import App
+
+from . import __version__
+from .theme import CSS
+
+
+class RiptideApp(App):
+    CSS = CSS
+    TITLE = "riptide"
+
+    def render(self):
+        from textual.renderables.blank import Blank
+        return Blank("transparent")
+
+    def on_mount(self) -> None:
+        self.styles.background = "transparent"
+        from .screens.menu import MenuScreen
+
+        self.push_screen(MenuScreen())
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="riptide",
+        description="Direct, encrypted PC-to-PC file transfer in the terminal.",
+    )
+    parser.add_argument("--version", action="version", version=f"riptide {__version__}")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser()
+    parser.parse_args(argv)
+    app = RiptideApp()
+    app.run()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

riptide_transfer-1.3.6/src/riptide/core/__init__.py

@@ -0,0 +1 @@
+"""Core, non-UI logic for riptide."""

riptide_transfer-1.3.6/src/riptide/core/config.py

@@ -0,0 +1,176 @@
+"""Saved connections and settings.
+
+Location is always Path.home() / ".riptide" / "config.toml", on every OS.
+Private keys and certificates are never stored here. A peer is identified
+by host + TLS certificate fingerprint, approved in the UI on first connect.
+
+Since v1.1, the host side also keeps trusted clients, separate from
+dial-out peers. A trusted client is identified by fingerprint, with
+the device name as a display label only. The dial-out peer list is
+keyed by host, for filling the Join address, while the trusted
+client list is keyed by fingerprint, for host-side authentication.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from pathlib import Path
+
+try:
+    import tomllib
+except ModuleNotFoundError:  # Python < 3.11, not supported by pyproject
+    import tomli as tomllib  # type: ignore
+
+# Session port. Kept in code/config only, except for the
+# Create/Join header and waiting text.
+# 50000 is in the dynamic/private range (49152-65535), so it is not
+# IANA-reserved, but it is the de facto default for IBM DB2, Jenkins
+# agents, and SAP NetWeaver Java, so a machine running one of those
+# will already have it in use and Riptide will fail to bind.
+DEFAULT_SESSION_PORT = 50000
+
+
+def config_dir(home: Path | None = None) -> Path:
+    return (home or Path.home()) / ".riptide"
+
+
+def config_path(home: Path | None = None) -> Path:
+    return config_dir(home) / "config.toml"
+
+
+@dataclass
+class Peer:
+    name: str
+    host: str = ""
+    fingerprint: str = ""
+
+
+@dataclass
+class Config:
+    peers: list[Peer] = field(default_factory=list)
+    trusted_clients: list[Peer] = field(default_factory=list)
+    session_port: int = DEFAULT_SESSION_PORT
+    firewall_port_open: bool | None = None
+    def peer_for(self, host: str) -> Peer | None:
+        for peer in self.peers:
+            if peer.host == host:
+                return peer
+        return None
+    def trusted_client_for_fingerprint(self, fingerprint: str) -> Peer | None:
+        for peer in self.trusted_clients:
+            if peer.fingerprint and peer.fingerprint == fingerprint:
+                return peer
+        return None
+    def trusted_client_for_device(self, device: str) -> Peer | None:
+        for peer in self.trusted_clients:
+            if peer.name and peer.name == device:
+                return peer
+        return None
+
+
+def _escape(value: str) -> str:
+    return value.replace("\\", "\\\\").replace('"', '\\"')
+
+
+def _contains_private_key(text: str) -> bool:
+    return "PRIVATE KEY" in text or "-----BEGIN" in text
+
+
+def load_config(home: Path | None = None) -> Config:
+    path = config_path(home)
+    if not path.exists():
+        return Config()
+    try:
+        data = tomllib.loads(path.read_text(encoding="utf-8"))
+    except Exception:
+        return Config()
+    peers = []
+    for item in data.get("peer", []) if isinstance(data.get("peer", []), list) else []:
+        if not isinstance(item, dict):
+            continue
+        peers.append(Peer(
+            name=str(item.get("name", "")),
+            host=str(item.get("host", "")),
+            fingerprint=str(item.get("fingerprint", "")),
+        ))
+    trusted_clients = []
+    for item in data.get("trusted_client", []) if isinstance(data.get("trusted_client", []), list) else []:
+        if not isinstance(item, dict):
+            continue
+        trusted_clients.append(Peer(
+            name=str(item.get("name", "")),
+            host=str(item.get("host", "")),
+            fingerprint=str(item.get("fingerprint", "")),
+        ))
+    session_port = data.get("session_port", DEFAULT_SESSION_PORT)
+    try:
+        session_port = int(session_port)
+    except Exception:
+        session_port = DEFAULT_SESSION_PORT
+    firewall_val = data.get("firewall_port_open")
+    firewall_port_open = bool(firewall_val) if firewall_val is not None else None
+    return Config(peers=peers, trusted_clients=trusted_clients, session_port=session_port, firewall_port_open=firewall_port_open)
+
+
+def save_config(config: Config, home: Path | None = None) -> Path:
+    for peer in list(config.peers) + list(config.trusted_clients):
+        for value in (peer.name, peer.host, peer.fingerprint):
+            if _contains_private_key(value):
+                raise ValueError("refusing to store a private key in config")
+    directory = config_dir(home)
+    directory.mkdir(parents=True, exist_ok=True)
+    lines = [f"session_port = {int(config.session_port)}"]
+    if config.firewall_port_open is not None:
+        lines.append(f"firewall_port_open = {'true' if config.firewall_port_open else 'false'}")
+    lines.append("")
+    for peer in config.peers:
+        lines.append("[[peer]]")
+        lines.append(f'name = "{_escape(peer.name)}"')
+        lines.append(f'host = "{_escape(peer.host)}"')
+        lines.append(f'fingerprint = "{_escape(peer.fingerprint)}"')
+        lines.append("")
+    for peer in config.trusted_clients:
+        lines.append("[[trusted_client]]")
+        lines.append(f'name = "{_escape(peer.name)}"')
+        lines.append(f'host = "{_escape(peer.host)}"')
+        lines.append(f'fingerprint = "{_escape(peer.fingerprint)}"')
+        lines.append("")
+    path = config_path(home)
+    path.write_text("\n".join(lines), encoding="utf-8")
+    return path
+
+
+def add_peer(config: Config, peer: Peer, home: Path | None = None) -> Config:
+    existing = config.peer_for(peer.host) if peer.host else None
+    if existing is not None:
+        existing.name = peer.name or existing.name
+        existing.fingerprint = peer.fingerprint or existing.fingerprint
+    else:
+        config.peers.append(peer)
+    save_config(config, home=home)
+    return config
+
+
+def add_trusted_client(config: Config, peer: Peer, home: Path | None = None) -> Config:
+    """Save a host-side trusted client, keyed by fingerprint.
+
+    If the fingerprint is already trusted, update its label.
+    If the device label is already trusted with a different
+    fingerprint, replace that fingerprint, which is the explicit
+    Replace flow after a changed-fingerprint warning. Otherwise
+    append a new trusted client.
+    """
+    if peer.fingerprint:
+        existing = config.trusted_client_for_fingerprint(peer.fingerprint)
+        if existing is not None:
+            existing.name = peer.name or existing.name
+            save_config(config, home=home)
+            return config
+    if peer.name:
+        by_device = config.trusted_client_for_device(peer.name)
+        if by_device is not None:
+            by_device.fingerprint = peer.fingerprint
+            save_config(config, home=home)
+            return config
+    config.trusted_clients.append(peer)
+    save_config(config, home=home)
+    return config