@aglit-ai/cli 0.1.1 → 0.1.2

package/README.md

@@ -7,15 +7,23 @@ After the CLI and a compatible signed desktop release have been published:
 
 ```sh
 pnpm add -g @aglit-ai/cli
-aglit install
-aglit init
+aglit
+aglit start --headed
+aglit start --headless
 aglit status
 aglit disable
 aglit enable
 aglit uninstall
 ```
 
-`init` opens Aglit's Google login in the browser, asks for a computer name,
+Run `aglit` in an interactive terminal to open the guided setup. `aglit init`
+also runs this flow and installs the signed runtime if it is missing. Setup asks
+for a computer name and whether to keep the app in the background or open its
+Desktop window. **Headless is the default**, including login startup. Headed
+mode is an explicit choice; it shows the same app and profile. `aglit start
+--headless` hides its window without disabling its connection.
+
+Setup opens Aglit's Google login in the browser,
 detects existing Codex/Claude logins, and uses a configured authenticated provider
 or the sole available provider. Multiple usable providers prompt for a choice.
 Provider login detection is not an inference acceptance check. Original provider
@@ -25,11 +33,23 @@ accounts remain owned by the user; uninstall does not delete their original logi
 aglit init --name "Office Mac" --provider codex
 aglit providers
 aglit teams
+aglit pipelines
+aglit pipelines --open
 aglit init --name "Office Mac" --provider auto --team TEAM_ID
 aglit invite USER_EMAIL --team TEAM_ID
 ```
 
-For unattended setup, provide `--name` and an explicit `--provider` when detection
+The terminal shows the current account's team memberships and authorized
+pipeline devices. `aglit pipelines --open` opens the existing encrypted pipeline
+viewer for pipeline contents and controls. A device listed in the catalog is not
+proof that its pipelines are connected. Team selection remains invitation
+context; it does not share the newly registered computer.
+
+For unattended setup, use `aglit init --json --name "Office Mac" --provider codex
+--account YOUR_EMAIL --headless`. `--account` checks the actual signed-in
+account before configuration or remote access is enabled; it never selects or
+impersonates an account. JSON mode and redirected input skip interactive prompts.
+Provide an explicit `--provider` when detection
 cannot select a single provider. Initial account login and OS consent still need
 the user. On macOS, Screen Recording and Accessibility must be granted before
 `init` enables access. The native tray offers status, enable/disable, Console and

package/bin/aglit.cjs

@@ -4,24 +4,30 @@ const fs = require('node:fs');
 const path = require('node:path');
 const os = require('node:os');
 const { parseArgs } = require('node:util');
-const { createInterface } = require('node:readline/promises');
 const installation = require('../src/installation.cjs');
+const { createUi, teamsFromRoles } = require('../src/ui.cjs');
 const delay = ms => new Promise(resolve => setTimeout(resolve, ms));
 const help = `Aglit Computer Use
 
-  aglit install
-  aglit init [--name "Computer name"] [--provider codex|claude|auto] [--team TEAM_ID] [--invite EMAIL]
+  aglit                         Interactive setup
+  aglit init                    Install and register this computer
+    [--name "Computer name"] [--provider codex|claude|auto]
+    [--account EMAIL] [--headed | --headless] [--team TEAM_ID] [--invite EMAIL]
+  aglit install                 Install the signed Desktop runtime
+  aglit start [--headed | --headless]
   aglit status [--json]
   aglit enable | disable
   aglit teams
+  aglit pipelines [--open]
   aglit providers
   aglit invite EMAIL --team TEAM_ID
   aglit uninstall
 
-Uninstall revokes remote access and purges this installation, including login,
-settings, owned bundled plugins/helpers and local data. Mini Computer and VMs
-are separate. Team invitations require backend authorization; pending invites
-grant no access. A team selector never grants access to a personal computer.
+Aglit runs in the background by default. --headed opens the Desktop window.
+Use --json with install, init, start or status for non-interactive JSON output.
+Uninstall revokes access and purges only this installation. Mini Computer,
+VMs, shared browser profiles and original provider logins remain separate.
+Team selection does not grant access to this personal computer.
 `;
 
 async function finishUninstall(receipt) {
@@ -31,108 +37,161 @@ async function finishUninstall(receipt) {
     try { process.kill(receipt.pid, 0); } catch (error) {
       if (error.code !== 'ESRCH') throw error;
       installation.purge();
-      process.stdout.write(JSON.stringify({ uninstalled: true, purged: true }) + '\n'); return;
+      return { uninstalled: true, purged: true };
     }
   }
   throw Error('Runtime has not exited; local files preserved. Retry aglit uninstall after it quits.');
 }
 
 async function main() {
-  const { values, positionals } = parseArgs({ options: { name: { type: 'string' }, provider: { type: 'string' }, team: { type: 'string' }, invite: { type: 'string' }, json: { type: 'boolean' }, help: { type: 'boolean', short: 'h' } }, allowPositionals: true, strict: true });
-  if (values.help || !positionals.length) { process.stdout.write(help); return; }
-  const [command, email] = positionals;
-  const options = { install: [], init: ['name', 'provider', 'team', 'invite'], status: ['json'], enable: [], disable: [], teams: [], providers: [], invite: ['team'], uninstall: [] };
+  const { values, positionals } = parseArgs({ options: {
+    name: { type: 'string' }, provider: { type: 'string' }, account: { type: 'string' },
+    team: { type: 'string' }, invite: { type: 'string' }, headed: { type: 'boolean' },
+    headless: { type: 'boolean' }, open: { type: 'boolean' }, json: { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
+  }, allowPositionals: true, strict: true });
+  const interactive = Boolean(process.stdin.isTTY && process.stderr.isTTY && !values.json && !process.env.CI);
+  if (values.help || !positionals.length && !interactive) { process.stdout.write(help); return; }
+  const [command = 'init', email] = positionals;
+  const options = {
+    install: ['json'], init: ['name', 'provider', 'account', 'team', 'invite', 'headed', 'headless', 'json'],
+    start: ['headed', 'headless', 'json'], status: ['json'], enable: [], disable: [], teams: ['json'], pipelines: ['open', 'json'], providers: ['json'], invite: ['team'], uninstall: [],
+  };
   if (!Object.hasOwn(options, command) || Object.keys(values).some(key => !options[command].includes(key)) || positionals.length > (command === 'invite' ? 2 : 1)) throw Error('Invalid command or options. Run aglit --help.');
+  if (values.headed && values.headless) throw Error('Choose either --headed or --headless');
   if (values.team && !/^[A-Za-z0-9._:-]{1,128}$/.test(values.team)) throw Error('Invalid team ID');
   if (values.provider && !['auto', 'codex', 'claude'].includes(values.provider)) throw Error('Provider must be auto, codex or claude');
+  const validEmail = value => value.length <= 254 && /^[^\s@*]+@[^\s@*]+\.[^\s@*]+$/.test(value);
   const recipient = command === 'invite' ? email : values.invite;
-  if (recipient && (recipient.length > 254 || !/^[^\s@*]+@[^\s@*]+\.[^\s@*]+$/.test(recipient))) throw Error('An individual invitation email address is required');
+  if (recipient && !validEmail(recipient)) throw Error('An individual invitation email address is required');
+  if (values.account !== undefined && !validEmail(values.account)) throw Error('An individual account email address is required');
   if ((command === 'invite' || values.invite) && (!recipient || !values.team)) throw Error('Invitations require an email address and --team TEAM_ID');
-  if (values.name !== undefined && (!values.name.trim() || values.name.length > 100 || /[\x00-\x1f\x7f]/.test(values.name))) throw Error('Computer name must contain 1–100 printable characters');
-  const print = value => process.stdout.write(JSON.stringify(value, null, 2) + '\n');
-  if (command === 'install') { print(await installation.install()); return; }
-  if (command === 'status' && !fs.existsSync(path.join(installation.root, 'installation.json'))) {
-    print({ product: 'Aglit Computer Use', installed: false, running: false, enabled: false }); return;
+  if (values.name !== undefined && (!values.name.trim() || values.name.length > 100 || /[\x00-\x1f\x7f-\x9f]/.test(values.name))) throw Error('Computer name must contain 1–100 printable characters');
+  const ui = await createUi(interactive);
+  const installed = () => fs.existsSync(path.join(installation.root, 'installation.json'));
+  if (command === 'install') {
+    const receipt = await ui.step('Download and verify Desktop', () => installation.install());
+    if (interactive) ui.info('Desktop installed. Run aglit init to register this computer.');
+    else ui.result(receipt);
+    ui.finish('Ready for setup'); return;
   }
-  if (command === 'uninstall' && !fs.existsSync(path.join(installation.root, 'installation.json'))) {
+  if (command === 'status' && !installed()) {
+    ui.result({ product: 'Aglit Computer Use', installed: false, running: false, enabled: false });
+    ui.finish('Run aglit to set up this computer'); return;
+  }
+  if (command === 'uninstall' && !installed()) {
     if (fs.existsSync(installation.root)) installation.purgeIncomplete();
-    print({ uninstalled: true, purged: true }); return;
+    ui.result({ uninstalled: true, purged: true }); ui.finish('Uninstalled'); return;
   }
-  if (command === 'uninstall' || command === 'status') {
+  if ((command === 'uninstall' || command === 'status') && installed()) {
     const pending = installation.readUninstall();
     if (pending) {
-      if (command === 'uninstall') await finishUninstall(pending);
-      else print({ installed: true, uninstalling: true, enabled: false });
-      return;
+      ui.result(command === 'uninstall' ? await finishUninstall(pending) : { installed: true, uninstalling: true, enabled: false });
+      ui.finish('Uninstall cleanup'); return;
+    }
+  }
+  let name = values.name;
+  let mode = values.headed ? 'headed' : 'headless';
+  if (command === 'init') {
+    if (!name && interactive && !installed()) name = await ui.name(os.hostname());
+    if (interactive && values.headed === undefined && values.headless === undefined) mode = await ui.mode();
+    if (!installed()) {
+      if (!interactive && !name) throw Error('Provide --name for unattended setup');
+      await ui.step('Download and verify Desktop', () => installation.install());
     }
   }
+  if (!installed()) throw Error('Run aglit init to install and register this computer first.');
   installation.readInstallation();
   const configPath = path.join(installation.profile, 'ipc/sdk-ipc.json');
   const control = (action, fields = {}) => require('../src/control.cjs').control(configPath, action, fields);
   let state;
   try { state = await control('status'); } catch (error) {
-    if (command === 'status') { print({ installed: true, running: false, enabled: null, error: error.message }); process.exitCode = 1; return; }
-    installation.start();
-    const deadline = Date.now() + 60000;
-    while (Date.now() < deadline) {
-      await delay(1000);
-      try { state = await control('status'); break; } catch { /* Wait for this installed runtime's native socket. */ }
-    }
-    if (!state) throw Error('Computer Use did not become ready. See runtime.log in its installation directory.');
+    if (command === 'status') { ui.result({ product: 'Aglit Computer Use', installed: true, running: false, enabled: null, error: error.message }); ui.finish('Runtime stopped'); process.exitCode = 1; return; }
+    state = await ui.step('Start Desktop in the background', async () => {
+      installation.start();
+      const deadline = Date.now() + 60000;
+      while (Date.now() < deadline) {
+        await delay(1000);
+        try { return await control('status'); } catch { /* Wait for this installation's authenticated native socket. */ }
+      }
+      throw Error('Computer Use did not become ready. See runtime.log in its installation directory.');
+    });
+  }
+  if (command === 'status') { ui.result(state); ui.finish('Computer status'); return; }
+  if (command === 'teams' || command === 'pipelines') {
+    const result = await ui.step(command === 'teams' ? 'Load your teams' : 'Load authorized pipeline devices', () => control(command));
+    if (interactive) ui[command](result); else ui.result(result);
+    if (command === 'pipelines' && values.open) await control('open-pipelines');
+    ui.finish(command === 'teams' ? 'Your teams' : 'Your pipelines'); return;
+  }
+  if (command === 'start' || command === 'init') {
+    const window = await control('window', { mode });
+    state = { ...state, ...window };
+    if (command === 'start') { ui.result(state); ui.finish(mode === 'headed' ? 'Desktop window opened' : 'Running in the background'); return; }
   }
-  if (command === 'status') { print(state); return; }
   if (command === 'init') {
     if (!state.email) {
-      await control('login');
-      process.stderr.write('Complete sign-in in your browser.\n');
-      const deadline = Date.now() + 5 * 60000;
-      while (Date.now() < deadline) {
-        await delay(1500); state = await control('status'); if (state.email) break;
-      }
-      if (!state.email) throw Error('Sign-in timed out. Run aglit init to resume.');
+      state = await ui.step('Complete sign-in in your browser', async () => {
+        await control('login');
+        const deadline = Date.now() + 5 * 60000;
+        while (Date.now() < deadline) {
+          await delay(1500); const current = await control('status'); if (current.email) return current;
+        }
+        throw Error('Sign-in timed out. Run aglit init to resume.');
+      });
     }
-    let name = values.name || state.name;
-    if (!name && process.stdin.isTTY) {
-      const prompt = createInterface({ input: process.stdin, output: process.stderr });
-      try { name = (await prompt.question(`Computer name [${os.hostname()}]: `)).trim() || os.hostname(); } finally { prompt.close(); }
+    if (values.account && state.email?.toLowerCase() !== values.account.toLowerCase())
+      throw Error(`Signed in as ${state.email}; expected ${values.account}. Switch the browser sign-in account and rerun aglit init.`);
+    if (interactive && !values.account && !await ui.confirmAccount(state.email))
+      throw Object.assign(Error('Setup cancelled before enabling remote access.'), { cancelled: true });
+    ui.info(`Signed in as ${state.email}`);
+    let teamId = values.team;
+    if (interactive) {
+      const discovery = await ui.step('Load your teams and pipelines', () => Promise.allSettled([control('teams'), control('pipelines')]));
+      let teams = [];
+      if (discovery[0].status === 'fulfilled') { ui.teams(discovery[0].value); teams = teamsFromRoles(discovery[0].value); }
+      else ui.info('Teams are unavailable. You can retry with aglit teams.');
+      if (discovery[1].status === 'fulfilled') ui.pipelines(discovery[1].value);
+      else ui.info('Pipeline devices are unavailable. You can retry with aglit pipelines.');
+      if (!teamId && teams.length) teamId = await ui.team(teams);
     }
+    name ||= state.name;
+    if (!name && interactive) name = await ui.name(os.hostname());
     if (!name) throw Error('Provide --name for unattended setup');
-    const detected = await control('providers');
+    const detected = await ui.step('Find signed-in AI providers', () => control('providers'));
     const available = detected.providers.filter(provider => provider.authenticated).map(provider => provider.provider);
     let provider = values.provider && values.provider !== 'auto' ? values.provider :
       available.includes(detected.preferred) ? detected.preferred : available.length === 1 ? available[0] : null;
-    if (!provider && available.length && process.stdin.isTTY) {
-      const prompt = createInterface({ input: process.stdin, output: process.stderr });
-      try { provider = (await prompt.question(`Provider (${available.join(', ')}): `)).trim(); } finally { prompt.close(); }
-    }
-    if (!provider || !available.includes(provider)) throw Error('No provider selected with a usable login. Sign in to Codex or Claude on this computer, then rerun aglit init --provider codex|claude.');
-    await control('configure', { name, provider, ...(values.team ? { teamId: values.team } : {}) });
-    const permissions = await control('permissions');
-    print(permissions);
+    if (!provider && available.length && interactive) provider = await ui.provider(available, detected.preferred);
+    if (!provider || !available.includes(provider)) throw Error('Sign in to Codex or Claude on this computer, then rerun aglit init --provider codex|claude.');
+    await ui.step('Save computer settings', () => control('configure', { name, provider, ...(teamId ? { teamId } : {}) }));
+    const permissions = await ui.step('Check screen recording and input permissions', () => control('permissions'));
+    if (!interactive) ui.result(permissions);
     if (permissions.permissions?.supported && (permissions.permissions.screenRecording !== 'granted' || permissions.permissions.accessibility !== 'granted'))
       throw Error('Grant Screen Recording and Accessibility in System Settings, then rerun aglit init. Anywhere Access has not been enabled.');
-    // An enable receipt is configuration, not proof that capture/input work.
-    await control('enable');
-    const connectionDeadline = Date.now() + 30000;
-    do {
-      state = await control('status');
-      if (state.connected) break;
-      await delay(1000);
-    } while (Date.now() < connectionDeadline);
-    print(state);
-    if (!state.connected) throw Error('Anywhere Access is enabled but its connection is not ready. Check aglit status before retrying.');
-    if (values.invite) print(await control('invite', { teamId: values.team, email: values.invite }));
-    return;
+    state = await ui.step('Connect this computer to your account', async () => {
+      await control('enable');
+      const deadline = Date.now() + 30000;
+      do {
+        const current = await control('status');
+        if (current.connected) return current;
+        await delay(1000);
+      } while (Date.now() < deadline);
+      throw Error('Anywhere Access is enabled but its connection is not ready. Check aglit status before retrying.');
+    });
+    if (values.invite) ui.result(await control('invite', { teamId: values.team, email: values.invite }));
+    ui.result(state); ui.finish('Computer ready · https://console.aglit.ai/'); return;
   }
-  if (command === 'invite') { print(await control('invite', { teamId: values.team, email })); return; }
+  if (command === 'invite') { ui.result(await control('invite', { teamId: values.team, email })); ui.finish('Invitation sent'); return; }
   if (command === 'uninstall') {
     const result = await control('uninstall');
     if (!result?.revoked || !result?.quitting || !Number.isSafeInteger(result.pid) || result.pid <= 0) throw Error('Revocation was not confirmed; installation preserved');
-    await finishUninstall(result); return;
+    ui.result(await ui.step('Remove this installation', () => finishUninstall(result)));
+    ui.finish('Uninstalled'); return;
   }
-  print(await control(command));
+  ui.result(await control(command)); ui.finish('Done');
 }
 
 main().then(() => process.exit(process.exitCode || 0), error => {
-  process.stderr.write(`aglit: ${error.message}\n`); process.exit(1);
+  if (!error.cancelled) process.stderr.write(`aglit: ${error.message}\n`);
+  process.exit(error.cancelled ? 130 : 1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglit-ai/cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Install and manage Aglit Computer Use",
   "license": "UNLICENSED",
   "type": "commonjs",
@@ -16,6 +16,7 @@
     "node": ">=22"
   },
   "dependencies": {
+    "@clack/prompts": "1.8.1",
     "yauzl": "3.4.0"
   },
   "publishConfig": {

package/src/ui.cjs

@@ -0,0 +1,81 @@
+'use strict';
+
+const clean = value => String(value ?? '').replace(/[\x00-\x1f\x7f-\x9f]/g, '');
+function teamsFromRoles(value) {
+  const teams = new Map();
+  for (const company of value?.companies || []) {
+    for (const team of [...(company.teams || []), ...(company.organizations || []).flatMap(organization => organization.teams || [])]) {
+      if (typeof team.teamId === 'string') teams.set(team.teamId, { id: team.teamId, roles: team.roles || [] });
+    }
+  }
+  for (const role of value?.roles || []) {
+    const id = role.teamId || (role.scopeType === 'team' ? role.scopeId : null);
+    if (typeof id === 'string' && !teams.has(id)) teams.set(id, { id, roles: [role.roleLabel || role.role].filter(Boolean) });
+  }
+  return [...teams.values()];
+}
+async function createUi(interactive) {
+  if (!interactive) return {
+    interactive: false,
+    step: (_label, action) => action(),
+    result: value => process.stdout.write(JSON.stringify(value, null, 2) + '\n'),
+    info: message => process.stderr.write(message + '\n'),
+    finish() {},
+  };
+  const p = await import('@clack/prompts');
+  p.intro('Aglit Computer Use');
+  async function answer(promise) {
+    const value = await promise;
+    if (p.isCancel(value)) {
+      p.cancel('Setup cancelled.');
+      throw Object.assign(Error('Setup cancelled'), { cancelled: true });
+    }
+    return value;
+  }
+  return {
+    interactive: true,
+    name: initialValue => answer(p.text({ message: 'Name this computer', placeholder: initialValue, defaultValue: initialValue,
+      validate: value => value && (!value.trim() || value.length > 100 || /[\x00-\x1f\x7f-\x9f]/.test(value)) ? 'Use 1–100 printable characters.' : undefined })),
+    mode: () => answer(p.select({ message: 'How should Aglit run?', initialValue: 'headless', options: [
+      { value: 'headless', label: 'Headless', hint: 'default · background' },
+      { value: 'headed', label: 'Open Desktop window', hint: 'headed' },
+    ] })),
+    provider: (providers, preferred) => answer(p.select({ message: 'Choose your AI provider', initialValue: preferred,
+      options: providers.map(value => ({ value, label: value === 'codex' ? 'Codex' : 'Claude' })) })),
+    team: teams => answer(p.select({ message: 'Team for invitations', initialValue: '', options: [
+      { value: '', label: 'Personal computer', hint: 'access stays with your account' },
+      ...teams.map(team => ({ value: team.id, label: clean(team.id), hint: team.roles.map(clean).join(', ') })),
+    ] })),
+    teams(value) {
+      const teams = teamsFromRoles(value);
+      p.note(teams.length ? teams.map(team => `${clean(team.id)}  ${team.roles.map(clean).join(', ')}`).join('\n') : 'No team memberships.', 'Your teams');
+      return teams;
+    },
+    pipelines(value) {
+      p.note((value.devices.length ? value.devices.map(device => `${clean(device.name)}${device.platform ? ' · ' + clean(device.platform) : ''}`).join('\n') + '\n\n' : 'No authorized pipeline devices.\n\n') +
+        'https://pipelines.aglit.ai/\nOpen the encrypted viewer with aglit pipelines --open.', 'Pipeline devices');
+    },
+    confirmAccount: email => answer(p.confirm({ message: `Register with ${clean(email)}?`, initialValue: true })),
+    async step(label, action) {
+      const spinner = p.spinner(); spinner.start(label);
+      try { const value = await action(); spinner.stop(label); return value; }
+      catch (error) { spinner.stop('Setup paused'); throw error; }
+    },
+    result(value) {
+      if (value.product === 'Aglit Computer Use') {
+        p.note([
+          value.name && `Computer  ${clean(value.name)}`,
+          value.email && `Account   ${clean(value.email)}`,
+          `Runtime   ${value.running ? 'running' : value.installed ? 'stopped' : 'not installed'}`,
+          value.mode && `Window    ${value.windowVisible ? 'open' : 'hidden'}`,
+          `Access    ${value.connected ? 'connected' : value.enabled ? 'connecting' : 'disabled'}`,
+          value.provider && `Provider  ${clean(value.provider)}`,
+        ].filter(Boolean).join('\n'), 'This computer');
+      } else p.log.info(JSON.stringify(value, null, 2));
+    },
+    info: message => p.log.info(clean(message)),
+    finish: message => p.outro(message),
+  };
+}
+
+module.exports = { createUi, teamsFromRoles };