@aglit-ai/cli 0.1.1 → 0.1.4

package/src/installation.cjs

@@ -5,7 +5,8 @@ const os = require('node:os');
 const crypto = require('node:crypto');
 const { spawn, execFileSync } = require('node:child_process');
 const { pipeline } = require('node:stream/promises');
-const { Readable, Transform } = require('node:stream');
+const { once } = require('node:events');
+const { createRequire } = require('node:module');
 
 const root = path.join(process.platform === 'darwin' ? path.join(os.homedir(), 'Library/Application Support') :
   process.platform === 'win32' ? process.env.APPDATA || path.join(os.homedir(), 'AppData/Roaming') : path.join(os.homedir(), '.config'), 'Aglit Computer Use');
@@ -56,48 +57,6 @@ function readInstallation(allowPartialCleanup = false) {
   if (!allowPartialCleanup) { canonical(value.executable); canonical(value.profile); }
   return value;
 }
-async function download(url) {
-  for (let hop = 0; hop < 6; hop++) {
-    const target = new URL(url);
-    if (target.protocol !== 'https:' || !['github.com', 'release-assets.githubusercontent.com', 'objects.githubusercontent.com'].includes(target.hostname)) throw Error('Untrusted release URL');
-    const response = await fetch(target, { redirect: 'manual', signal: AbortSignal.timeout(30 * 60 * 1000) });
-    if ([301, 302, 303, 307, 308].includes(response.status)) {
-      await response.body?.cancel();
-      url = new URL(response.headers.get('location'), target).href;
-      continue;
-    }
-    if (!response.ok || !response.body) throw Error(`Release download failed (${response.status})`);
-    return response;
-  }
-  throw Error('Too many release redirects');
-}
-async function json(url) {
-  const response = await download(url);
-  let size = 0;
-  const chunks = [];
-  for await (const chunk of response.body) {
-    size += chunk.length;
-    if (size > 65536) throw Error('Release metadata too large');
-    chunks.push(chunk);
-  }
-  return JSON.parse(Buffer.concat(chunks).toString('utf8'));
-}
-function parseRelease(value, platform) {
-  const fields = ['kind', 'package', 'platform', 'version', 'sourceCommit', 'assets', 'windowsSigningPolicy'];
-  if (!value || Object.keys(value).some(key => !fields.includes(key)) || value.kind !== 'aglit-github-release-v1' ||
-      value.package !== 'desktop-app' || value.platform !== platform || !/^\d+\.\d+\.\d+$/.test(value.version) ||
-      !/^[a-f0-9]{40}$/.test(value.sourceCommit) || !Array.isArray(value.assets) || value.assets.length !== 3 ||
-      value.windowsSigningPolicy !== undefined && (platform !== 'win' || value.windowsSigningPolicy !== 'unsigned-user-accepted')) throw Error('Invalid desktop release receipt');
-  const stem = `Aglit.AI-${value.version}-${platform === 'mac' ? 'mac-arm64' : 'win-x64'}`;
-  const names = platform === 'mac' ? [stem + '.dmg', stem + '.zip', stem + '.zip.blockmap'] : [stem + '.exe', stem + '.exe.blockmap', stem + '.zip'];
-  for (let index = 0; index < 3; index++) {
-    const asset = value.assets[index];
-    if (!asset || Object.keys(asset).sort().join(',') !== 'name,sha256,sha512,size' || asset.name !== names[index] ||
-        !Number.isSafeInteger(asset.size) || asset.size <= 0 || asset.size > 2 * 1024 ** 3 ||
-        !/^[a-f0-9]{64}$/.test(asset.sha256) || !/^[A-Za-z0-9+/]{86}==$/.test(asset.sha512)) throw Error('Invalid release asset');
-  }
-  return value;
-}
 function verifyPublisher(executable) {
   if (process.platform === 'darwin') {
     const bundle = path.resolve(executable, '../../..');
@@ -108,53 +67,131 @@ function verifyPublisher(executable) {
     run(powershell, ['-NoLogo', '-NoProfile', '-NonInteractive', '-WindowStyle', 'Hidden', '-Command', script], { env: { ...process.env, AGLIT_VERIFY_EXECUTABLE: executable } });
   }
 }
-async function install() {
+function embeddedRelease(platform, packageDirectory = path.resolve(__dirname, '..'), runtimeDirectory) {
+  const packageName = '@aglit-ai/desktop-runtime-' + (platform === 'mac' ? 'darwin-arm64' : 'win32-x64');
+  let directory = path.join(runtimeDirectory || packageDirectory, 'runtime');
+  if (!fs.existsSync(path.join(directory, 'desktop-runtime.json'))) {
+    try { directory = path.join(path.dirname(createRequire(path.join(packageDirectory, 'package.json')).resolve(packageName + '/package.json')), 'runtime'); }
+    catch (error) { if (error.code === 'MODULE_NOT_FOUND') return null; throw error; }
+  }
+  const metadata = path.join(directory, 'desktop-runtime.json');
+  canonical(metadata);
+  const stat = fs.statSync(metadata);
+  if (!stat.isFile() || stat.size > 65536) throw Error('Invalid bundled Desktop metadata');
+  const value = JSON.parse(fs.readFileSync(metadata, 'utf8'));
+  const aliased = value?.kind === 'aglit-cli-desktop-runtime-v3';
+  const chunked = aliased || value?.kind === 'aglit-cli-desktop-runtime-v2';
+  const keys = chunked ? 'archive,chunks,kind,platform,sourceCommit,version' : 'archive,kind,platform,sourceCommit,version';
+  if (!value || Object.keys(value).sort().join(',') !== keys ||
+      !['aglit-cli-desktop-runtime-v1', 'aglit-cli-desktop-runtime-v2', 'aglit-cli-desktop-runtime-v3'].includes(value.kind) || value.platform !== platform ||
+      !/^\d+\.\d+\.\d+$/.test(value.version) || !/^[a-f0-9]{40}$/.test(value.sourceCommit))
+    throw Error('Bundled Desktop identity differs');
+  const validAsset = asset => asset && Number.isSafeInteger(asset.size) && asset.size > 0 && asset.size <= 2 * 1024 ** 3 &&
+    /^[a-f0-9]{64}$/.test(asset.sha256) && /^[A-Za-z0-9+/]{86}==$/.test(asset.sha512);
+  const asset = value.archive;
+  if (!validAsset(asset) || Object.keys(asset).sort().join(',') !== 'name,sha256,sha512,size' || asset.name !== 'desktop.zip')
+    throw Error('Invalid bundled Desktop archive');
+  const chunks = [];
+  if (aliased) {
+    const descriptor = JSON.parse(fs.readFileSync(path.join(path.dirname(directory), 'package.json'), 'utf8'));
+    const descriptorVersion = value.version + '-runtime.' + (platform === 'mac' ? 'darwin-arm64' : 'win32-x64');
+    if (descriptor.name !== '@aglit-ai/cli' || descriptor.version !== descriptorVersion || !descriptor.dependencies ||
+        Object.keys(descriptor.dependencies).length !== value.chunks?.length) throw Error('Desktop descriptor package differs');
+    for (const part of value.chunks || []) if (descriptor.dependencies[part.installName] !== 'npm:@aglit-ai/cli@' + part.version)
+      throw Error('Desktop part dependency alias differs');
+  }
+  if (chunked) {
+    if (!Array.isArray(value.chunks) || !value.chunks.length || value.chunks.length > 64) throw Error('Invalid Desktop parts');
+    const resolver = createRequire(path.join(path.dirname(directory), 'package.json'));
+    for (let index = 0; index < value.chunks.length; index++) {
+      const part = value.chunks[index];
+      const name = packageName + '-part-' + String(index).padStart(2, '0');
+      const internalVersion = value.version + '-runtime.' + (platform === 'mac' ? 'darwin-arm64' : 'win32-x64') + '.part-' + String(index).padStart(2, '0');
+      const expectedFields = aliased ? 'file,installName,package,sha256,sha512,size,version' : 'file,package,sha256,sha512,size,version';
+      if (!validAsset(part) || Object.keys(part).sort().join(',') !== expectedFields ||
+          part.package !== (aliased ? '@aglit-ai/cli' : name) || part.version !== (aliased ? internalVersion : value.version) ||
+          aliased && part.installName !== name || part.file !== 'runtime/part.bin' || part.size > 64 * 1024 ** 2)
+        throw Error('Invalid Desktop part identity');
+      const manifest = resolver.resolve((aliased ? part.installName : part.package) + '/package.json'); canonical(manifest);
+      const identity = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+      if (identity.name !== part.package || identity.version !== part.version) throw Error('Desktop part package differs');
+      const archive = path.join(path.dirname(manifest), part.file); canonical(archive);
+      if (!fs.statSync(archive).isFile() || fs.statSync(archive).size !== part.size) throw Error('Desktop part size differs');
+      chunks.push({ ...part, archive });
+    }
+    if (chunks.reduce((sum, part) => sum + part.size, 0) !== asset.size) throw Error('Desktop parts do not cover archive');
+  } else {
+    const archive = path.join(directory, asset.name); canonical(archive);
+    if (!fs.statSync(archive).isFile() || fs.statSync(archive).size !== asset.size) throw Error('Bundled Desktop archive size differs');
+    chunks.push({ ...asset, archive });
+  }
+  return { release: value, asset, chunks };
+}
+async function copyArchive(bundle, archive) {
+  const output = fs.createWriteStream(archive, { flags: 'wx', mode: 0o600 });
+  const sha256 = crypto.createHash('sha256'), sha512 = crypto.createHash('sha512');
+  let received = 0;
+  try {
+    for (const part of bundle.chunks) {
+      const before = fs.statSync(part.archive);
+      const part256 = crypto.createHash('sha256'), part512 = crypto.createHash('sha512'); let size = 0;
+      for await (const chunk of fs.createReadStream(part.archive)) {
+        size += chunk.length; received += chunk.length;
+        if (size > part.size || received > bundle.asset.size) throw Error('Desktop archive exceeds declared size');
+        part256.update(chunk); part512.update(chunk); sha256.update(chunk); sha512.update(chunk);
+        if (!output.write(chunk)) await once(output, 'drain');
+      }
+      const after = fs.statSync(part.archive);
+      if (size !== part.size || part256.digest('hex') !== part.sha256 || part512.digest('base64') !== part.sha512 ||
+          ['dev', 'ino', 'size', 'mtimeMs', 'ctimeMs'].some(key => before[key] !== after[key])) throw Error('Desktop part checksum differs; archive was not executed');
+    }
+    output.end(); await once(output, 'finish');
+    if (received !== bundle.asset.size || sha256.digest('hex') !== bundle.asset.sha256 || sha512.digest('base64') !== bundle.asset.sha512)
+      throw Error('Desktop archive checksum differs; archive was not executed');
+  } catch (error) { output.destroy(); throw error; }
+}
+async function stageRuntime(bundle, runtime) {
+  const archive = path.join(path.dirname(runtime), 'runtime.zip');
+  await copyArchive(bundle, archive);
+  fs.mkdirSync(runtime, { mode: 0o700 });
+  await require('./extract.cjs').extract(archive, runtime);
+  const executable = process.platform === 'darwin' ? path.join(runtime, 'Aglit AI.app/Contents/MacOS/Aglit AI') : path.join(runtime, 'Aglit AI.exe');
+  verifyRuntime(executable, bundle.release);
+  fs.unlinkSync(archive);
+  return { executable, version: bundle.release.version, sourceCommit: bundle.release.sourceCommit, sha256: bundle.asset.sha256 };
+}
+function verifyRuntime(executable, release) {
+  canonical(executable); verifyPublisher(executable);
+  const resources = process.platform === 'darwin' ? path.resolve(path.dirname(executable), '../Resources') : path.join(path.dirname(executable), 'resources');
+  const buildInfoPath = path.join(resources, 'app.asar.unpacked/dist-electron/desktop-app/build-info.json'); canonical(buildInfoPath);
+  if (fs.statSync(buildInfoPath).size > 16 * 1024 * 1024) throw Error('Build metadata too large');
+  const info = JSON.parse(fs.readFileSync(buildInfoPath, 'utf8'));
+  if (info.version !== release.version || info.gitCommit !== release.sourceCommit || info.dirty !== false || info.runtimeMinified !== true || info.computerUseControlVersion !== 1)
+    throw Error('A published obfuscated desktop release with Computer Use CLI support is required; this archive was not launched');
+  return {version: info.version, sourceCommit: info.gitCommit};
+}
+async function install(channel) {
+  if (channel !== undefined && !['latest', 'canary', 'embedded'].includes(channel)) throw Error('Invalid npm channel');
   if (fs.existsSync(path.join(root, 'uninstalling.json'))) throw Error('Finish aglit uninstall before reinstalling');
   if (!(process.platform === 'darwin' && process.arch === 'arm64') && !(process.platform === 'win32' && process.arch === 'x64')) throw Error('Published Computer Use releases currently support Apple silicon Macs and Windows x64');
   if (fs.existsSync(receiptPath)) return { installed: true, ...readInstallation() };
   if (fs.existsSync(root)) throw Error(`Existing unowned installation directory preserved: ${root}`);
   const platform = process.platform === 'darwin' ? 'mac' : 'win';
-  const base = 'https://github.com/Aglit-AI/desktop-app-release/releases/download/';
-  const desired = parseRelease(await json(base + `updates-${platform}/github-release-${platform}.json`), platform);
-  const release = parseRelease(await json(base + `v${desired.version}/github-release-${platform}.json`), platform);
-  if (JSON.stringify(desired) !== JSON.stringify(release)) throw Error('Release pointer differs from immutable release');
-  // The product's unsigned Windows policy is not silently inherited by the CLI.
-  if (release.windowsSigningPolicy) throw Error('This Windows release is unsigned; Computer Use installation requires a signed release');
+  let bundled = embeddedRelease(platform), bootstrap;
+  if (!bundled) {
+    bootstrap = await require('./updates.cjs').bootstrap(channel);
+    bundled = embeddedRelease(platform, bootstrap.packageDirectory);
+    if (!bundled) throw Error('Published npm CLI has no runtime for this platform');
+  }
   canonical(path.dirname(root));
-  fs.mkdirSync(root, { mode: 0o700 });
-  privateRoot(true);
+  fs.mkdirSync(root, { mode: 0o700 }); privateRoot(true);
   fs.writeFileSync(path.join(root, 'installation-attempt.json'), JSON.stringify({ kind: 'aglit-computer-use-attempt-v1', root }) + '\n', { flag: 'wx', mode: 0o600 });
-  const asset = release.assets.find(item => item.name.endsWith('.zip'));
-  const archive = path.join(root, 'runtime.zip');
-  let received = 0;
-  const sha256 = crypto.createHash('sha256'), sha512 = crypto.createHash('sha512');
-  const meter = new Transform({ transform(chunk, _encoding, done) {
-    received += chunk.length;
-    if (received > asset.size) return done(Error('Release exceeds declared size'));
-    sha256.update(chunk); sha512.update(chunk); done(null, chunk);
-  } });
-  const response = await download(base + `v${release.version}/${asset.name}`);
-  await pipeline(Readable.fromWeb(response.body), meter, fs.createWriteStream(archive, { flags: 'wx', mode: 0o600 }));
-  if (received !== asset.size || sha256.digest('hex') !== asset.sha256 || sha512.digest('base64') !== asset.sha512) throw Error('Release checksum differs; archive was not executed');
-  const runtime = path.join(root, 'runtime');
-  fs.mkdirSync(runtime, { mode: 0o700 });
-  await require('./extract.cjs').extract(archive, runtime);
-  const executable = process.platform === 'darwin' ? path.join(runtime, 'Aglit AI.app/Contents/MacOS/Aglit AI') : path.join(runtime, 'Aglit AI.exe');
-  canonical(executable);
-  verifyPublisher(executable);
-  const resources = process.platform === 'darwin' ? path.join(runtime, 'Aglit AI.app/Contents/Resources') : path.join(runtime, 'resources');
-  const buildInfoPath = path.join(resources, 'app.asar.unpacked/dist-electron/desktop-app/build-info.json');
-  canonical(buildInfoPath);
-  if (fs.statSync(buildInfoPath).size > 16 * 1024 * 1024) throw Error('Build metadata too large');
-  const buildInfo = JSON.parse(fs.readFileSync(buildInfoPath, 'utf8'));
-  if (buildInfo.gitCommit !== release.sourceCommit || buildInfo.dirty !== false ||
-      buildInfo.runtimeMinified !== true || buildInfo.computerUseControlVersion !== 1)
-    throw Error('A published obfuscated desktop release with Computer Use CLI support is required; this archive was not launched');
+  const staged = await stageRuntime(bundled, path.join(root, 'runtime'));
   fs.mkdirSync(profile, { mode: 0o700 });
   fs.writeFileSync(path.join(profile, 'system-settings.json'), JSON.stringify({ settings: { enableAnywhereAccess: false, remoteAccessDeviceId: crypto.randomUUID() } }) + '\n', { flag: 'wx', mode: 0o600 });
-  const receipt = { kind: 'aglit-computer-use-installation-v1', root, profile, executable, version: release.version, sourceCommit: release.sourceCommit, sha256: asset.sha256 };
+  const receipt = { kind: 'aglit-computer-use-installation-v1', root, profile, ...staged };
   fs.writeFileSync(receiptPath, JSON.stringify(receipt) + '\n', { flag: 'wx', mode: 0o600 });
-  fs.unlinkSync(archive);
+  if (bootstrap) require('./updates.cjs').adoptBootstrap(bootstrap);
   return { installed: true, ...receipt };
 }
 function start() {
@@ -171,6 +208,8 @@ function start() {
   const child = spawn(installed.executable, ['--computer-use'], { detached: true, windowsHide: true, stdio: ['ignore', log, log], env });
   child.on('error', error => { process.stderr.write(`Computer Use failed to start: ${error.message}\n`); });
   child.unref(); fs.closeSync(log);
+  if (!Number.isSafeInteger(child.pid)) throw Error('Desktop process did not start');
+  return { pid: child.pid };
 }
 function purge() {
   readInstallation(true);
@@ -211,4 +250,4 @@ function readUninstall() {
       !Number.isSafeInteger(receipt.pid) || receipt.pid <= 0) throw Error('Invalid uninstall receipt');
   return receipt;
 }
-module.exports = { root, profile, readInstallation, install, start, purge, purgeIncomplete, readUninstall };
+module.exports = { root, profile, readInstallation, install, start, purge, purgeIncomplete, readUninstall, privateRoot, canonical, verifyPublisher, embeddedRelease, copyArchive, stageRuntime, verifyRuntime };

package/src/launcher.cjs

@@ -0,0 +1,30 @@
+'use strict';
+// Copied to the private installation root. It has no npm dependencies and its
+// filename remains fixed while versioned CLI/runtime generations are replaced.
+const fs = require('node:fs'), path = require('node:path'), crypto = require('node:crypto');
+const {spawnSync} = require('node:child_process');
+try {
+  const root = __dirname, record = path.join(root, 'cli-installation.json');
+  const stat = fs.lstatSync(record);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 65536 || stat.nlink !== 1 || fs.realpathSync(root) !== root ||
+      process.platform !== 'win32' && (stat.uid !== process.getuid() || stat.mode & 0o077)) throw Error();
+  const updating = path.join(root, 'updating.lock');
+  if (fs.existsSync(updating)) {
+    const lock = fs.lstatSync(updating);
+    if (!lock.isFile() || lock.isSymbolicLink() || lock.size > 65536 || process.platform !== 'win32' && (lock.uid !== process.getuid() || lock.mode & 0o077)) throw Error();
+    const owner = JSON.parse(fs.readFileSync(updating, 'utf8'));
+    if (!Number.isSafeInteger(owner.pid) || owner.pid <= 0) throw Error();
+    try { process.kill(owner.pid, 0); process.stdout.write('Aglit update is active; startup is deferred.\n'); process.exit(0); } catch (error) { if (error.code !== 'ESRCH') throw error; }
+  }
+  const value = JSON.parse(fs.readFileSync(record, 'utf8')), current = value.current;
+  if (value.kind !== 'aglit-cli-installation-v1' || !current || typeof current.directory !== 'string' ||
+      !current.directory.startsWith(path.join(root, 'cli') + path.sep) || !/^[a-f0-9]{64}$/.test(current.sha256)) throw Error();
+  const entry = path.join(current.directory, 'node_modules/@aglit-ai/cli/bin/aglit.cjs');
+  const file = fs.lstatSync(entry);
+  if (!file.isFile() || file.isSymbolicLink() || fs.realpathSync(entry) !== entry || file.size > 1024 * 1024 ||
+      crypto.createHash('sha256').update(fs.readFileSync(entry)).digest('hex') !== current.sha256) throw Error();
+  const result = spawnSync(process.execPath, [entry, ...process.argv.slice(2)], {stdio: 'inherit', windowsHide: true});
+  process.exitCode = result.status ?? 1;
+} catch {
+  process.stderr.write('Aglit private CLI launcher is unavailable. Reinstall @aglit-ai/cli to repair it.\n'); process.exitCode = 1;
+}

package/src/ui.cjs

@@ -0,0 +1,81 @@
+'use strict';
+
+const clean = value => String(value ?? '').replace(/[\x00-\x1f\x7f-\x9f]/g, '');
+function teamsFromRoles(value) {
+  const teams = new Map();
+  for (const company of value?.companies || []) {
+    for (const team of [...(company.teams || []), ...(company.organizations || []).flatMap(organization => organization.teams || [])]) {
+      if (typeof team.teamId === 'string') teams.set(team.teamId, { id: team.teamId, roles: team.roles || [] });
+    }
+  }
+  for (const role of value?.roles || []) {
+    const id = role.teamId || (role.scopeType === 'team' ? role.scopeId : null);
+    if (typeof id === 'string' && !teams.has(id)) teams.set(id, { id, roles: [role.roleLabel || role.role].filter(Boolean) });
+  }
+  return [...teams.values()];
+}
+async function createUi(interactive) {
+  if (!interactive) return {
+    interactive: false,
+    step: (_label, action) => action(),
+    result: value => process.stdout.write(JSON.stringify(value, null, 2) + '\n'),
+    info: message => process.stderr.write(message + '\n'),
+    finish() {},
+  };
+  const p = await import('@clack/prompts');
+  p.intro('Aglit Computer Use');
+  async function answer(promise) {
+    const value = await promise;
+    if (p.isCancel(value)) {
+      p.cancel('Setup cancelled.');
+      throw Object.assign(Error('Setup cancelled'), { cancelled: true });
+    }
+    return value;
+  }
+  return {
+    interactive: true,
+    name: initialValue => answer(p.text({ message: 'Name this computer', placeholder: initialValue, defaultValue: initialValue,
+      validate: value => value && (!value.trim() || value.length > 100 || /[\x00-\x1f\x7f-\x9f]/.test(value)) ? 'Use 1–100 printable characters.' : undefined })),
+    mode: () => answer(p.select({ message: 'How should Aglit run?', initialValue: 'headless', options: [
+      { value: 'headless', label: 'Headless', hint: 'default · background' },
+      { value: 'headed', label: 'Open Desktop window', hint: 'headed' },
+    ] })),
+    provider: (providers, preferred) => answer(p.select({ message: 'Choose your AI provider', initialValue: preferred,
+      options: providers.map(value => ({ value, label: value === 'codex' ? 'Codex' : 'Claude' })) })),
+    team: teams => answer(p.select({ message: 'Team for invitations', initialValue: '', options: [
+      { value: '', label: 'Personal computer', hint: 'access stays with your account' },
+      ...teams.map(team => ({ value: team.id, label: clean(team.id), hint: team.roles.map(clean).join(', ') })),
+    ] })),
+    teams(value) {
+      const teams = teamsFromRoles(value);
+      p.note(teams.length ? teams.map(team => `${clean(team.id)}  ${team.roles.map(clean).join(', ')}`).join('\n') : 'No team memberships.', 'Your teams');
+      return teams;
+    },
+    pipelines(value) {
+      p.note((value.devices.length ? value.devices.map(device => `${clean(device.name)}${device.platform ? ' · ' + clean(device.platform) : ''}`).join('\n') + '\n\n' : 'No authorized pipeline devices.\n\n') +
+        'https://pipelines.aglit.ai/\nOpen the encrypted viewer with aglit pipelines --open.', 'Pipeline devices');
+    },
+    confirmAccount: email => answer(p.confirm({ message: `Register with ${clean(email)}?`, initialValue: true })),
+    async step(label, action) {
+      const spinner = p.spinner(); spinner.start(label);
+      try { const value = await action(); spinner.stop(label); return value; }
+      catch (error) { spinner.stop('Setup paused'); throw error; }
+    },
+    result(value) {
+      if (value.product === 'Aglit Computer Use') {
+        p.note([
+          value.name && `Computer  ${clean(value.name)}`,
+          value.email && `Account   ${clean(value.email)}`,
+          `Runtime   ${value.running ? 'running' : value.installed ? 'stopped' : 'not installed'}`,
+          value.mode && `Window    ${value.windowVisible ? 'open' : 'hidden'}`,
+          `Access    ${value.connected ? 'connected' : value.enabled ? 'connecting' : 'disabled'}`,
+          value.provider && `Provider  ${clean(value.provider)}`,
+        ].filter(Boolean).join('\n'), 'This computer');
+      } else p.log.info(JSON.stringify(value, null, 2));
+    },
+    info: message => p.log.info(clean(message)),
+    finish: message => p.outro(message),
+  };
+}
+
+module.exports = { createUi, teamsFromRoles };

package/src/update-worker.cjs

@@ -0,0 +1,37 @@
+'use strict';
+const fs = require('node:fs'), path = require('node:path');
+const updates = require('./updates.cjs'), installation = require('./installation.cjs');
+const {control} = require('./control.cjs');
+const delay = ms => new Promise(resolve => setTimeout(resolve, ms));
+const config = path.join(installation.profile, 'ipc/sdk-ipc.json');
+async function main() {
+  const expectedPid = Number(process.argv[2]);
+  if (process.argv.length !== 3 || !Number.isSafeInteger(expectedPid) || expectedPid <= 0) throw Error('Invalid updater runtime');
+  installation.readInstallation(); const unlock = updates.lock(path.join(installation.root, 'updater-worker.json'));
+  if (!unlock) return;
+  let replacement = null;
+  try {
+    let nextCheck = 0;
+    for (;;) {
+      if (fs.existsSync(path.join(installation.root, 'uninstalling.json')) || fs.existsSync(path.join(installation.root, 'updater-stop.json')) || !updates.state().automatic || !updates.live(expectedPid)) return;
+      let runtime; try { runtime = await control(config, 'status'); } catch { return; }
+      if (!runtime?.running || runtime.pid !== expectedPid) return;
+      updates.rememberStatus(runtime);
+      if (Date.now() >= nextCheck) {
+        nextCheck = Date.now() + 15 * 60000;
+        try {
+          const result = await updates.update();
+          if (result.runtimePid && result.runtimePid !== expectedPid) { replacement = result.runtimePid; return; }
+          if (result.updated) { replacement = expectedPid; return; }
+          if (result.deferred) nextCheck = Date.now() + 60000;
+        } catch {
+          process.stderr.write('Aglit automatic update deferred; current runtime and profile preserved.\n');
+        }
+      }
+      for (let i = 0; i < 30 && !fs.existsSync(path.join(installation.root, 'updater-stop.json')); i++) await delay(1000);
+    }
+  } finally {
+    unlock(); if (replacement && !fs.existsSync(path.join(installation.root, 'updater-stop.json'))) updates.ensureWorker(replacement);
+  }
+}
+main().catch(() => { process.stderr.write('Aglit updater stopped; run aglit update to inspect or retry.\n'); process.exitCode = 1; });