@aglit-ai/cli 0.1.7 → 0.1.9

package/README.md

@@ -56,6 +56,15 @@ the user. On macOS, Screen Recording and Accessibility must be granted before
 quit while the application shell stays hidden. Login-item registration starts
 the same private profile on the next user login.
 
+Setup requests native screen-capture and Accessibility consent one at a time,
+waiting up to 110 seconds for each grant before continuing. If macOS previously
+denied access, enable the application in the opened System Settings pane. An
+unapproved permission stops setup with remote access disabled; rerun `aglit init`
+to resume. macOS may require an application restart after a screen-capture grant.
+Successful registration prints the direct employee link at
+`https://console.aglit.ai/employees/<device-id>` and includes it as `employeeUrl`
+in JSON output.
+
 `--team` selects the existing backend team/invitation scope. It does not grant team
 members access to a separately registered personal computer. The backend requires
 current accepted membership/admin authority for its operations; a pending
@@ -115,3 +124,5 @@ A separate Computer Use port range requires registering
 Google currently rejects this proposed callback with `redirect_uri_mismatch`.
 No port change has shipped; provider registration and native acceptance remain
 required before qualifying coexistence.
+
+Anywhere Access requires a two-factor security code by default; an explicit off preference is preserved. In CLI headless mode, incoming connection requests display the code in a native window without opening the full app. This requires a logged-in graphical desktop session; an SSH-only/server environment cannot display the prompt. Codes are not printed to the terminal.

package/bin/aglit.cjs

@@ -202,7 +202,8 @@ async function main() {
     if (!provider || !available.includes(provider)) throw Error('Sign in to Codex or Claude on this computer, then rerun aglit init --provider codex|claude.');
     ui.info(`AI provider: ${provider}`);
     await ui.step('Save computer settings', () => control('configure', { name, provider, ...(teamId ? { teamId } : {}) }));
-    const permissions = await ui.step('Check screen recording and input permissions', () => control('permissions'));
+    if (process.platform === 'darwin') ui.info('Approve the macOS screen recording and input-control requests. Setup waits for each permission before continuing. Previously denied permissions must be enabled in System Settings.');
+    const permissions = await ui.step('Waiting for screen recording and input permissions', () => control('permissions'));
     if (!interactive) ui.result(permissions);
     if (permissions.permissions?.supported && (permissions.permissions.screenRecording !== 'granted' || permissions.permissions.accessibility !== 'granted'))
       throw Error('Grant Screen Recording and Accessibility in System Settings, then rerun aglit init. Anywhere Access has not been enabled.');
@@ -218,7 +219,9 @@ async function main() {
     });
     if (values.invite) ui.result(await control('invite', { teamId: values.team, email: values.invite }));
     updates.rememberStatus(state);
-    ui.result(state); ui.finish('Computer ready · https://console.aglit.ai/'); return;
+    if (typeof state.deviceId !== 'string' || !state.deviceId) throw Error('Registration returned no device ID. Check aglit status before retrying.');
+    state = { ...state, employeeUrl: `https://console.aglit.ai/employees/${encodeURIComponent(state.deviceId)}` };
+    ui.result(state); ui.finish(`Computer ready · ${state.employeeUrl}`); return;
   }
   if (command === 'invite') { ui.result(await control('invite', { teamId: values.team, email })); ui.finish('Invitation sent'); return; }
   if (command === 'uninstall') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglit-ai/cli",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Install and manage Aglit Computer Use",
   "license": "UNLICENSED",
   "type": "commonjs",

package/src/installation.cjs

@@ -205,6 +205,18 @@ function start() {
   // Do not let an operator's guest/development environment adopt another identity.
   for (const key of Object.keys(env)) if (key.startsWith('AGLIT_') || key.startsWith('VITE_') || ['NODE_ENV', 'ELECTRON_RUN_AS_NODE', 'SERVER_PORT', 'ELECTRON_BRIDGE_PORT'].includes(key)) delete env[key];
   Object.assign(env, { AGLIT_USER_DATA_PATH: profile, AGLIT_ELECTRON_USER_DATA_PATH: profile });
+  if (process.platform === 'darwin') {
+    // Launch Services makes the signed app responsible for its own TCC grants.
+    // Direct spawn from SSH/Terminal attributes screen/input access to the caller.
+    const bundle = path.dirname(path.dirname(path.dirname(installed.executable)));
+    if (!bundle.endsWith('.app')) { fs.closeSync(log); throw Error('Installed macOS application bundle required'); }
+    fs.closeSync(log);
+    run('/usr/bin/open', ['-n', '-g', '-a', bundle,
+      '--env', 'AGLIT_USER_DATA_PATH=' + profile, '--env', 'AGLIT_ELECTRON_USER_DATA_PATH=' + profile,
+      '--stdout', path.join(root, 'runtime.log'), '--stderr', path.join(root, 'runtime.log'),
+      '--args', '--computer-use'], { env });
+    return { launched: true };
+  }
   const child = spawn(installed.executable, ['--computer-use'], { detached: true, windowsHide: true, stdio: ['ignore', log, log], env });
   child.on('error', error => { process.stderr.write(`Computer Use failed to start: ${error.message}\n`); });
   child.unref(); fs.closeSync(log);