@aglit-ai/cli 0.1.10 → 0.1.17064

package/bin/aglit.cjs

@@ -33,6 +33,8 @@ const help = `Aglit Computer Use
   aglit pipelines [--open]
   aglit providers
   aglit models list | choose
+  aglit models login copilot [--reauth] [--json]
+  aglit models login-status copilot --attempt ATTEMPT_ID [--json]
   aglit models publish | unpublish --connection CONNECTION_ID --model MODEL_ID
   aglit models register --device DEVICE_ID --fingerprint SHA256 [--name NAME]
   aglit models prefer CONNECTION_ID|auto
@@ -66,7 +68,7 @@ async function finishUninstall(receipt) {
 async function main() {
   const delegated = installation.development ? null : updates.delegate(__filename); if (delegated !== null) { process.exitCode = delegated; return; }
   const { values, positionals } = parseArgs({ options: {
-    connections: { type: 'string' },
+    connections: { type: 'string' }, attempt: { type: 'string' }, reauth: {type:'boolean'},
     harness: { type: 'boolean' },
     device: { type: 'string' }, fingerprint: { type: 'string' }, challenge: { type: 'string' }, code: { type: 'string' }, connection: { type: 'string' }, model: { type: 'string' }, name: { type: 'string' }, provider: { type: 'string' }, account: { type: 'string' },
     team: { type: 'string' }, workspace: { type: 'string' }, check: { type: 'boolean' }, channel: { type: 'string' }, open: { type: 'boolean' }, json: { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
@@ -75,7 +77,7 @@ async function main() {
   if (values.help || !positionals.length && !interactive) { process.stdout.write(help); return; }
   const [command = 'init', email, connectionId] = positionals;
   const options = {
-    models: ['device','fingerprint','name','json','challenge','code','connection','connections','model','harness'],
+    models: ['device','fingerprint','name','json','challenge','code','connection','connections','model','harness','attempt','reauth'],
     install: ['json', 'channel'], init: ['name', 'provider', 'account', 'json', 'channel'],
     start: ['json', 'channel'], ui: ['json'], status: ['json'], update: ['check', 'channel', 'json'], updates: ['json'], enable: [], disable: [], rename: ['name', 'json'], console: ['json'], teams: ['json', 'open'], team: ['name', 'team', 'workspace', 'json'], pipelines: ['open', 'json'], providers: ['json'], invite: ['team'], uninstall: [],
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglit-ai/cli",
-  "version": "0.1.10",
+  "version": "0.1.17064",
   "description": "Install and manage Aglit Computer Use",
   "license": "UNLICENSED",
   "type": "commonjs",

package/src/control.cjs

@@ -22,7 +22,7 @@ function control(configPath, action, fields = {}) {
     const id = crypto.randomUUID();
     const socket = net.createConnection(config.endpoint);
     let buffer = '', authenticated = false, settled = false;
-    const timeout = setTimeout(() => finish(Error('Native command timed out; its outcome may be uncertain. Check aglit status before retrying.')), action === 'permissions' ? 5 * 60000 : ['enable','models-test'].includes(action) ? 120000 : 30000);
+    const timeout = setTimeout(() => finish(Error('Native command timed out; its outcome may be uncertain. Check aglit status before retrying.')), action === 'permissions' ? 5 * 60000 : ['enable','models-test','models-login'].includes(action) ? 120000 : 30000);
     const finish = (error, result) => {
       if (settled) return;
       settled = true; clearTimeout(timeout); socket.destroy();

package/src/model-connections.cjs

@@ -0,0 +1,112 @@
+'use strict';
+/** UI-free selection policy lives in runtime-api; the CLI prompts only on its
+ * explicit choice-required result, then persists the choice through native control. */
+async function listModelConnections(control) {
+  try {
+    const view = await control('models-list');
+    if (!view || !Array.isArray(view.connections) || !view.selection || typeof view.selection.status !== 'string') throw Error('Invalid discovery response');
+    return view;
+  } catch {
+    return { connections: [], selection: { status: 'discovery-unavailable', connection_id: null },
+      warnings: ['Model endpoint discovery is unavailable. Existing provider settings are unchanged; retry aglit models list later.'] };
+  }
+}
+async function chooseModelConnection(control, { provider, question } = {}) {
+  let view = await listModelConnections(control);
+  if (view.selection.status === 'discovery-unavailable') return { view, connectionId: null, unavailable: true };
+  // Init/choose is an explicit connection action. Passive models-list never
+  // prompts; reconnect only the saved/chosen endpoint, never every known host.
+  if (['preferred-unavailable','setup-required'].includes(view.selection.status)) {
+    const remote = view.connections.filter(value => value.kind === 'remote');
+    let target = view.preferred_connection_id ? remote.find(value => value.id === view.preferred_connection_id) : remote.length === 1 ? remote[0] : undefined;
+    let chosen = false;
+    if (!target && !view.preferred_connection_id && remote.length > 1) {
+      if (!question) throw Error('More than one model connection is available. Run aglit models choose.');
+      const answer = (await question(remote.map((value,index)=>`${index+1}. ${value.name}`).join('\n')+'\nModel connection: ')).trim();
+      if (!/^[1-9]\d*$/.test(answer) || !remote[Number(answer)-1]) throw Error('Choose a listed model connection');
+      target = remote[Number(answer)-1]; chosen = true;
+    }
+    if (target) {
+      view = await modelCommand(control,'register',undefined,{device:target.device_id,fingerprint:target.identity_fingerprint,name:target.name},question);
+      if (chosen) view = await control('models-prefer',{connection_id:target.id});
+    }
+  }
+  let selection = view.selection;
+  if (provider && provider !== 'auto' && provider !== 'aglit') {
+    const candidates = view.connections.filter(value => value.available && value.models.some(model => model.provider === provider));
+    if (candidates.length === 1) {
+      view = await control('models-prefer', { connection_id: candidates[0].id }); selection = view.selection;
+    } else if (!candidates.length) throw Error('No connected account supplies that provider');
+    else { view = { ...view, connections: candidates }; selection = { status: 'choice-required', connection_id: null }; }
+  }
+  if (selection.status === 'choice-required') {
+    if (!question) throw Error('More than one model connection is available. Run aglit models choose or aglit models prefer CONNECTION_ID.');
+    const choices = view.connections.filter(value => value.available && value.models.length);
+    const answer = await question(choices.map((value,index)=>`${index+1}. ${value.name}`).join('\n')+'\nModel connection: ');
+    if (!/^[1-9]\d*$/.test(answer.trim()) || !choices[Number(answer.trim())-1]) throw Error('Choose a listed model connection');
+    view = await control('models-prefer', { connection_id: choices[Number(answer.trim())-1].id }); selection = view.selection;
+  }
+  if (selection.status === 'preferred-unavailable') throw Error('Your saved model connection is unavailable. Reconnect it or explicitly choose another with aglit models prefer CONNECTION_ID.');
+  if (selection.status !== 'selected') throw Error('No model connection is ready. Connect a local provider or register an Aglit model endpoint.');
+  return { view, connectionId: selection.connection_id };
+}
+function validateModelCommand(command, id, values) {
+  const allowed = {list:['json'],login:['json','reauth'],'login-status':['attempt','json'],test:['connection','model','harness'],choose:[],pool:['name','connections'],publish:['connection','model'],unpublish:['connection','model'],unserve:[],register:['device','fingerprint','name','challenge','code'],prefer:[],remove:[]};
+  if (!Object.hasOwn(allowed,command) || Object.keys(values).some(key=>!allowed[command].includes(key)) ||
+      (!['prefer','remove','pool','login','login-status'].includes(command) && id) || (['prefer','remove','pool','login','login-status'].includes(command) && !id)) throw Error('Invalid model command or options');
+  if(['login','login-status'].includes(command)&&(id!=='copilot'||command==='login-status'&&!/^[a-f0-9-]{36}$/.test(values.attempt??'')))throw Error('Use aglit models login copilot or aglit models login-status copilot --attempt ATTEMPT_ID');
+  if(values.reauth!==undefined&&values.reauth!==true)throw Error('Use --reauth only to explicitly replace the Copilot login');
+  if (command === 'pool' && (!/^[A-Za-z0-9._-]{1,80}$/.test(id) || !values.name?.trim() || values.name.length > 100 ||
+      typeof values.connections !== 'string' || values.connections.length > 6400 || !values.connections.split(',').every(value => /^local:[A-Za-z0-9._:-]{1,180}$/.test(value) && !value.startsWith('local:pool:'))))
+    throw Error('Use aglit models pool POOL_ID --name NAME --connections local:ACCOUNT_A,local:ACCOUNT_B');
+  if (command === 'register' && (!/^[A-Za-z0-9._:-]{1,180}$/.test(values.device || '') || !/^[a-f0-9]{64}$/.test(values.fingerprint || '')))
+    throw Error('Use --device DEVICE_ID and --fingerprint with the endpoint SHA-256 fingerprint');
+  if (Boolean(values.challenge) !== Boolean(values.code) || values.code && !/^[0-9]{4,12}$/.test(values.code) ||
+      values.challenge && (!/^[A-Za-z0-9._:-]{1,256}$/.test(values.challenge))) throw Error('Supply both --challenge and a numeric --code');
+  if (id && !/^[A-Za-z0-9._:-]{1,200}$/.test(id)) throw Error('Invalid model connection ID');
+  if (['publish','unpublish'].includes(command) && (!/^local:[A-Za-z0-9._:-]{1,180}$/.test(values.connection||'') || !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/.test(values.model||''))) throw Error('Choose a local --connection and --model');
+  if (command === 'remove' && !id.startsWith('remote:')) throw Error('A registered remote connection ID is required');
+}
+async function modelCommand(control, command, id, values, question) {
+  validateModelCommand(command,id,values);
+  if (command === 'list') return listModelConnections(control);
+  if(command==='login'||command==='login-status')return control(command==='login'?'models-login':'models-login-status',{provider_id:id,...(command==='login-status'?{attempt_id:values.attempt}:values.reauth?{reauth:'true'}:{})});
+  if (command === 'test') {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/.test(values.model || '') || values.connection && !/^[A-Za-z0-9._:-]{1,200}$/.test(values.connection)) throw Error('Use aglit models test --model MODEL_ID [--connection CONNECTION_ID]');
+    return control('models-test', { model_id: values.model, ...(values.connection ? { connection_id: values.connection } : {}), ...(values.harness ? { harness: 'true' } : {}) });
+  }
+  if (command === 'pool') return control('models-pool-save', { pool_id: 'local:pool:' + id, name: values.name,
+    connection_ids: JSON.stringify(values.connections.split(',')) });
+  if (command === 'register') {
+    if (!values.device || !values.fingerprint || id) throw Error('Use aglit models register --device DEVICE_ID --fingerprint SHA256 [--name NAME]');
+    if (Boolean(values.challenge) !== Boolean(values.code) || values.code && !/^[0-9]{4,12}$/.test(values.code)) throw Error('Supply both --challenge and a numeric --code');
+    const fields = {device_id:values.device,identity_fingerprint:values.fingerprint,name:values.name||values.device, ...(values.challenge ? {challenge_id:values.challenge,code:values.code} : {})};
+    let result = await control('models-register',fields);
+    let consoleUrl;
+    if (typeof result.console_url === 'string') {
+      try { const url = new URL(result.console_url);
+        if ((url.protocol === 'https:' || process.env.NODE_ENV === 'development' && url.protocol === 'http:' && url.hostname === '127.0.0.1') &&
+            !url.username && !url.password && !url.search && !url.hash && url.pathname === '/employees/' + encodeURIComponent(values.device)) consoleUrl = url.href;
+      } catch { /* Never present an unvalidated authentication destination. */ }
+    }
+    const instructions = `A security-code dialog appears on ${fields.name}. Check that device.` +
+      (consoleUrl ? ` Open its console on that device if needed: ${consoleUrl}` : '');
+    if (result.authentication_required && result.challenge_id && question) {
+      const code = (await question(instructions + '\nRemote Access authentication code: ')).trim();
+      if (!/^[0-9]{4,12}$/.test(code)) throw Error('A numeric Remote Access code is required');
+      result = await control('models-register',{...fields,challenge_id:result.challenge_id,code});
+    }
+    if (result.authentication_required) throw Error(instructions + ' Complete registration with --challenge CHALLENGE_ID --code CODE' +
+      (result.challenge_id ? ' (challenge '+result.challenge_id+')' : ''));
+    return result;
+  }
+  if (command === 'prefer' || command === 'remove') {
+    if (!id || !/^[A-Za-z0-9._:-]{1,200}$/.test(id)) throw Error('A model connection ID is required');
+    return control(command==='prefer'?'models-prefer':'models-remove',{connection_id:command==='prefer'&&id==='auto'?'':id});
+  }
+  if (command === 'publish' || command === 'unpublish') return control('models-publish',{connection_id:values.connection,model_id:values.model,published:String(command==='publish')});
+  if (command === 'unserve') return control('models-unpublish-all');
+  if (command === 'choose') return (await chooseModelConnection(control,{question})).view;
+  throw Error('Use aglit models list|register|prefer|remove|publish|unpublish|unserve|choose');
+}
+module.exports={chooseModelConnection,listModelConnections,modelCommand,validateModelCommand};

package/src/runtime-download.cjs

@@ -0,0 +1,77 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const crypto = require('node:crypto');
+const { execFile } = require('node:child_process');
+const { promisify } = require('node:util');
+const run = promisify(execFile);
+const need = (value, message) => { if (!value) throw Error(message); };
+
+// Read a single payload from a verified npm tarball. Native tar writes only to
+// stdout: package paths, links and lifecycle scripts never write into the guest.
+async function packageFile(manifest, file, maximum, signal = AbortSignal.timeout(120000)) {
+  const url = new URL(manifest.dist.tarball);
+  need(url.protocol === 'https:' && url.hostname === 'registry.npmjs.org' && !url.port && !url.username && !url.password &&
+    /^sha512-[A-Za-z0-9+/]{86}==$/.test(manifest.dist.integrity), 'Untrusted runtime npm package');
+  need(['runtime/desktop-runtime.json', 'runtime/part.bin'].includes(file), 'Unknown runtime payload');
+  const directory = fs.mkdtempSync(path.join(fs.realpathSync(os.tmpdir()), 'aglit-runtime-'));
+  const archive = path.join(directory, 'package.tgz');
+  try {
+    const response = await fetch(url, {redirect: 'error', signal: AbortSignal.any([signal, AbortSignal.timeout(120000)])});
+    need(response.ok && response.body, 'Runtime npm download unavailable');
+    const fd = fs.openSync(archive, 'wx', 0o600), digest = crypto.createHash('sha512');
+    let size = 0;
+    try {
+      for await (const chunk of response.body) {
+        size += chunk.length; need(size <= maximum + 2 * 1024 ** 2, 'Runtime npm package exceeds limit');
+        digest.update(chunk);
+        let offset = 0;
+        while (offset < chunk.length) offset += fs.writeSync(fd, chunk, offset, chunk.length - offset);
+      }
+      need('sha512-' + digest.digest('base64') === manifest.dist.integrity, 'Runtime npm integrity differs');
+    } finally { fs.closeSync(fd); }
+    const tar = process.platform === 'win32' ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32/tar.exe') : '/usr/bin/tar';
+    const {stdout} = await run(tar, ['-xOf', archive, 'package/' + file], {encoding: 'buffer', maxBuffer: maximum + 1, timeout: 30000, windowsHide: true});
+    need(stdout.length > 0 && stdout.length <= maximum, 'Runtime payload exceeds limit');
+    return stdout;
+  } finally { fs.rmSync(directory, {recursive: true, force: true}); }
+}
+
+// The same verified part stream feeds normal downloads and native baseline
+// admission, whose existing descriptor custody stays owned by its native worker.
+async function* archiveParts({descriptor, parts, signal}) {
+  need(parts.length === descriptor.chunks.length && parts.length > 0 && parts.length <= 32, 'Runtime part graph differs');
+  const sha256 = crypto.createHash('sha256'), sha512 = crypto.createHash('sha512');
+  let received = 0;
+  for (const [index, part] of descriptor.chunks.entries()) {
+    need(parts[index].name === part.package && parts[index].version === part.version, 'Runtime part identity differs');
+    const bytes = await packageFile(parts[index], part.file, part.size, signal);
+    need(bytes.length === part.size && crypto.createHash('sha256').update(bytes).digest('hex') === part.sha256 &&
+      crypto.createHash('sha512').update(bytes).digest('base64') === part.sha512, 'Runtime part checksum differs');
+    received += bytes.length; sha256.update(bytes); sha512.update(bytes);
+    yield bytes;
+  }
+  need(received === descriptor.archive.size && sha256.digest('hex') === descriptor.archive.sha256 &&
+    sha512.digest('base64') === descriptor.archive.sha512, 'Runtime archive checksum differs');
+}
+
+async function downloadArchive({descriptor, parts, destination, onProgress = () => {}}) {
+  const fd = fs.openSync(destination, 'wx', 0o600), owned = fs.fstatSync(fd);
+  let received = 0, verified = false;
+  try {
+    for await (const bytes of archiveParts({descriptor, parts})) {
+      let offset = 0;
+      while (offset < bytes.length) offset += fs.writeSync(fd, bytes, offset, bytes.length - offset);
+      received += bytes.length; onProgress(received);
+    }
+    fs.fsyncSync(fd); verified = true;
+  } finally {
+    fs.closeSync(fd);
+    if (!verified) {
+      const current = fs.lstatSync(destination);
+      if (current.dev === owned.dev && current.ino === owned.ino && current.isFile() && !current.isSymbolicLink()) fs.unlinkSync(destination);
+    }
+  }
+}
+module.exports = {packageFile, archiveParts, downloadArchive};