c3bridge CLI

c3bridge is the per-host bridge daemon. Install it via npm install -g @naarang/ccc; set it up once with an enrollment bundle, run it as a service, and touch it afterwards mostly for pairing and diagnostics.

Commands

`c3bridge init --bundle <path>`

Import an enrollment bundle minted on the hub with c3sync hub control enroll-bridge. Stores credentials and identity in the selected secret backend, installs the hub CA, and writes the config. The bundle is a single-use secret — delete it after import.

`c3bridge run`

Run the bridge in the foreground (Ctrl+C to stop). Useful for first-run testing and debugging; for normal operation use the service.

`c3bridge pair [--minutes <1-10>]`

Print a one-time pairing QR for a phone to scan. The offer expires after --minutes (default 5). Multiple outstanding offers are fine; expired ones are pruned automatically.

`c3bridge devices`

List paired phones: device ID, name, pairing date, and whether the phone registered for push.

`c3bridge revoke <device-id>`

Remove one phone's pair state (keys and push token) from this bridge. Errors if the device isn't paired. This is per-machine revocation — for a lost phone, also revoke its hub credential (see ceremonies).

`c3bridge doctor`

Print the config (secrets redacted) and probe every Herdr session socket, reporting ready or unavailable per session. First stop for anything odd.

`c3bridge service install | uninstall | status`

Manage the bridge as a native OS service: a systemd user unit (c3bridge.service) on Linux, a LaunchAgent (app.getc3.bridge) on macOS, a scheduled task ("C3 Bridge") on Windows. install starts it and enables start-at-boot with restart-on-failure.

Environment variables

Variable	Effect
`C3BRIDGE_HOME`	Override the state directory (default `~/.c3bridge`).
`C3BRIDGE_SECRET_BACKEND`	`keyring` (default — OS credential store) or `file` (encrypted mode-0600 files, for protected headless hosts). Choose explicitly before `init` on servers without a keyring.
`C3BRIDGE_ALLOW_FILE_KEY`	Legacy escape hatch: `1` permits recovery when a keyring fails. Prefer `C3BRIDGE_SECRET_BACKEND=file` for deliberate headless setups.
`HERDR_CONFIG_DIR`	Where to find Herdr's sockets, if Herdr runs with a non-default config dir.

Files

Everything lives under ~/.c3bridge, user-only permissions:

File	Contents
`config.json`	Non-secret config: host ID, display name, hub URL, key fingerprints.
`state.enc.json`	Encrypted pair state (per-phone keys, counters, push tokens).
`hub-ca.crt`	The pinned hub CA certificate.
`state.lock`	Concurrency lock.

The bridge finds Herdr at its default sockets (~/.config/herdr/herdr.sock and per-session sockets; named pipes on Windows).

Logs contain event codes only — never prompts, terminal content, filenames, subjects, or tokens.

Exit behavior

Failed commands print a generic pointer to c3bridge doctor rather than raw errors (a deliberate no-secrets-in-logs policy) and exit non-zero.