The CLI bridge

Concept

The CLI bridge

The bridge is optional. Run aarmos-bridge dev in a project folder and it opens a localhost WebSocket on 127.0.0.1:7423, pairing the PWA to that port. A green CLI paired pill appears bottom-left with a Local node connected toast.

Safety posture

  • File writes are confined to the launched workspace. Read operations are not generally workspace-confined.
  • Origin-checked handshake with a per-session token
  • Dry-run is ON by default: proposed mutations are previewed. Applying an approved batch executes them; dry-run is a session setting, not an unconditional execution barrier.
  • Shell commands are limited by configured permissions. Explicit unrestricted commands run with the local user's authority and are not confined by the file-write boundary.

Close the tab or Ctrl+C anytime — the CLI keeps listening (◇ Client disconnected. Standing by…); killing it swaps the pill to local node lost with the reconnect command.

Bridge provides local capabilities to the PWA, not the canonical governed runtime. Its pairing, preview and permission controls do not establish canonical Authority or durable pre-dispatch Attempts. Bridge application results are not themselves AVAR proof of governed execution or downstream business success.

Not the same as observation

The bridge is a development tool for a project folder: it can propose edits and commands, behind review. Watching a running runtime is a different thing — aarmos observe starts a read-only observation service on loopback port 7682, paired with a short-lived code and carrying a single read capability. See observe a local runtime.

Aarmos works standalone without the bridge. See quickstart for the concise command sequence.

The CLI is distributed to authorized workspaces only and is not publicly issued; the commands on this page are reference examples.