Step 15: CLI wiring, prune, and sgardd daemon.

Local prune: garden.Prune() removes orphaned blobs. 2 tests.

CLI commands: sgard push, sgard pull (with SSH auth via --ssh-key
or ssh-agent), sgard prune (local by default, remote with --remote).

Server daemon: cmd/sgardd with --listen, --repo, --authorized-keys
flags. Runs gRPC server with optional SSH key auth interceptor.

Root command gains --remote and --ssh-key persistent flags with
resolveRemote() (flag > env > repo/remote file).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/sgard/main.go

@@ -4,11 +4,16 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/spf13/cobra"
 )
 
-var repoFlag string
+var (
+	repoFlag   string
+	remoteFlag string
+	sshKeyFlag string
+)
 
 var rootCmd = &cobra.Command{
 	Use:   "sgard",
@@ -23,8 +28,29 @@ func defaultRepo() string {
 	return filepath.Join(home, ".sgard")
 }
 
+// resolveRemote returns the remote address from flag, env, or repo config file.
+func resolveRemote() (string, error) {
+	if remoteFlag != "" {
+		return remoteFlag, nil
+	}
+	if env := os.Getenv("SGARD_REMOTE"); env != "" {
+		return env, nil
+	}
+	// Try <repo>/remote file.
+	data, err := os.ReadFile(filepath.Join(repoFlag, "remote"))
+	if err == nil {
+		addr := strings.TrimSpace(string(data))
+		if addr != "" {
+			return addr, nil
+		}
+	}
+	return "", fmt.Errorf("no remote configured; use --remote, SGARD_REMOTE, or create %s/remote", repoFlag)
+}
+
 func main() {
 	rootCmd.PersistentFlags().StringVar(&repoFlag, "repo", defaultRepo(), "path to sgard repository")
+	rootCmd.PersistentFlags().StringVar(&remoteFlag, "remote", "", "gRPC server address (host:port)")
+	rootCmd.PersistentFlags().StringVar(&sshKeyFlag, "ssh-key", "", "path to SSH private key")
 
 	if err := rootCmd.Execute(); err != nil {
 		fmt.Fprintln(os.Stderr, err)

cmd/sgard/prune.go

@@ -0,0 +1,71 @@
+package main
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/kisom/sgard/client"
+	"github.com/kisom/sgard/garden"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+var pruneCmd = &cobra.Command{
+	Use:   "prune",
+	Short: "Remove orphaned blobs not referenced by the manifest",
+	Long:  "Remove orphaned blobs locally, or on the remote server with --remote.",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		addr, _ := resolveRemote()
+
+		if addr != "" {
+			return pruneRemote(addr)
+		}
+		return pruneLocal()
+	},
+}
+
+func pruneLocal() error {
+	g, err := garden.Open(repoFlag)
+	if err != nil {
+		return err
+	}
+
+	removed, err := g.Prune()
+	if err != nil {
+		return err
+	}
+
+	fmt.Printf("Pruned %d orphaned blob(s).\n", removed)
+	return nil
+}
+
+func pruneRemote(addr string) error {
+	signer, err := client.LoadSigner(sshKeyFlag)
+	if err != nil {
+		return err
+	}
+
+	creds := client.NewSSHCredentials(signer)
+	conn, err := grpc.NewClient(addr,
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.WithPerRPCCredentials(creds),
+	)
+	if err != nil {
+		return fmt.Errorf("connecting to %s: %w", addr, err)
+	}
+	defer func() { _ = conn.Close() }()
+
+	c := client.New(conn)
+	removed, err := c.Prune(context.Background())
+	if err != nil {
+		return err
+	}
+
+	fmt.Printf("Pruned %d orphaned blob(s) on remote.\n", removed)
+	return nil
+}
+
+func init() {
+	rootCmd.AddCommand(pruneCmd)
+}

cmd/sgard/pull.go

@@ -0,0 +1,60 @@
+package main
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/kisom/sgard/client"
+	"github.com/kisom/sgard/garden"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+var pullCmd = &cobra.Command{
+	Use:   "pull",
+	Short: "Pull checkpoint from remote server",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		addr, err := resolveRemote()
+		if err != nil {
+			return err
+		}
+
+		g, err := garden.Open(repoFlag)
+		if err != nil {
+			return err
+		}
+
+		signer, err := client.LoadSigner(sshKeyFlag)
+		if err != nil {
+			return err
+		}
+
+		creds := client.NewSSHCredentials(signer)
+		conn, err := grpc.NewClient(addr,
+			grpc.WithTransportCredentials(insecure.NewCredentials()),
+			grpc.WithPerRPCCredentials(creds),
+		)
+		if err != nil {
+			return fmt.Errorf("connecting to %s: %w", addr, err)
+		}
+		defer func() { _ = conn.Close() }()
+
+		c := client.New(conn)
+		pulled, err := c.Pull(context.Background(), g)
+		if err != nil {
+			return err
+		}
+
+		if pulled == 0 {
+			fmt.Println("Already up to date.")
+		} else {
+			fmt.Printf("Pulled %d blob(s).\n", pulled)
+		}
+		return nil
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(pullCmd)
+}

cmd/sgard/push.go

@@ -0,0 +1,61 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/kisom/sgard/client"
+	"github.com/kisom/sgard/garden"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+var pushCmd = &cobra.Command{
+	Use:   "push",
+	Short: "Push local checkpoint to remote server",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		addr, err := resolveRemote()
+		if err != nil {
+			return err
+		}
+
+		g, err := garden.Open(repoFlag)
+		if err != nil {
+			return err
+		}
+
+		signer, err := client.LoadSigner(sshKeyFlag)
+		if err != nil {
+			return err
+		}
+
+		creds := client.NewSSHCredentials(signer)
+		conn, err := grpc.NewClient(addr,
+			grpc.WithTransportCredentials(insecure.NewCredentials()),
+			grpc.WithPerRPCCredentials(creds),
+		)
+		if err != nil {
+			return fmt.Errorf("connecting to %s: %w", addr, err)
+		}
+		defer func() { _ = conn.Close() }()
+
+		c := client.New(conn)
+		pushed, err := c.Push(context.Background(), g)
+		if errors.Is(err, client.ErrServerNewer) {
+			fmt.Println("Server is newer; run sgard pull instead.")
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+
+		fmt.Printf("Pushed %d blob(s).\n", pushed)
+		return nil
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(pushCmd)
+}

cmd/sgardd/main.go

@@ -0,0 +1,77 @@
+package main
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+
+	"github.com/kisom/sgard/garden"
+	"github.com/kisom/sgard/server"
+	"github.com/kisom/sgard/sgardpb"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc"
+)
+
+var (
+	listenAddr     string
+	repoPath       string
+	authKeysPath   string
+)
+
+var rootCmd = &cobra.Command{
+	Use:   "sgardd",
+	Short: "sgard gRPC sync daemon",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		g, err := garden.Open(repoPath)
+		if err != nil {
+			return fmt.Errorf("opening repo: %w", err)
+		}
+
+		var opts []grpc.ServerOption
+
+		if authKeysPath != "" {
+			auth, err := server.NewAuthInterceptor(authKeysPath)
+			if err != nil {
+				return fmt.Errorf("loading authorized keys: %w", err)
+			}
+			opts = append(opts,
+				grpc.UnaryInterceptor(auth.UnaryInterceptor()),
+				grpc.StreamInterceptor(auth.StreamInterceptor()),
+			)
+			fmt.Printf("Auth enabled: %s\n", authKeysPath)
+		} else {
+			fmt.Println("WARNING: no --authorized-keys specified, running without authentication")
+		}
+
+		srv := grpc.NewServer(opts...)
+		sgardpb.RegisterGardenSyncServer(srv, server.New(g))
+
+		lis, err := net.Listen("tcp", listenAddr)
+		if err != nil {
+			return fmt.Errorf("listening on %s: %w", listenAddr, err)
+		}
+
+		fmt.Printf("sgardd serving on %s (repo: %s)\n", listenAddr, repoPath)
+		return srv.Serve(lis)
+	},
+}
+
+func defaultRepo() string {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return ".sgard"
+	}
+	return filepath.Join(home, ".sgard")
+}
+
+func main() {
+	rootCmd.Flags().StringVar(&listenAddr, "listen", ":9473", "gRPC listen address")
+	rootCmd.Flags().StringVar(&repoPath, "repo", defaultRepo(), "path to sgard repository")
+	rootCmd.Flags().StringVar(&authKeysPath, "authorized-keys", "", "path to authorized SSH public keys file")
+
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}