@aglit-ai/cli 1.0.17197 → 1.0.17300

package/README.md

@@ -43,8 +43,8 @@ aglit invite USER_EMAIL --team TEAM_ID
 ```
 
 Setup registers a Personal computer with your signed-in account. It asks for its
-name and AI provider, requests the required OS permissions, guides installation of
-the Aglit AI Chrome extension, and enables Anywhere Access. Team selection and
+name and AI provider, requests the required OS permissions, enables Anywhere
+Access, then offers the Aglit AI Chrome extension. Team selection and
 pipeline discovery are separate from setup.
 Use `aglit team --name "My team"` to associate this computer with a team on your account. The CLI derives its installed workspace; no server-side workspace record or private-key provisioning is required. Manage invitations at teams.aglit.ai.
 Use `aglit teams` to inspect memberships and `aglit pipelines --open` to open the
@@ -130,13 +130,15 @@ Google currently rejects this proposed callback with `redirect_uri_mismatch`.
 No port change has shipped; provider registration and native acceptance remain
 required before qualifying coexistence.
 
-Anywhere Access requires a two-factor security code by default; an explicit off preference is preserved. In CLI headless mode, incoming connection requests display the code in a native window without opening the full app. This requires a logged-in graphical desktop session; an SSH-only/server environment cannot display the prompt. Codes are not printed to the terminal.
+Anywhere Access defaults to no two-factor security code; an explicit on preference is preserved. When enabled, incoming connection requests display the code in a native window without opening the full app. This requires a logged-in graphical desktop session; an SSH-only/server environment cannot display the prompt. Codes are not printed to the terminal.
 
-After computer-use permissions, setup opens the published Aglit AI Chrome Web Store
-listing. Choose Add to Chrome and approve Chrome’s prompt. Setup waits until the
-Store extension is installed and enabled in Chrome’s selected profile; it never
-changes a disabled extension setting or browser policy. Installation detection is
-separate from browser-control connectivity.
+After computer-use permissions, setup enables Anywhere Access before offering
+the Aglit AI Chrome extension. Browser setup failures do not undo computer
+registration. Run `aglit browser setup` to retry, or `aglit browser status --json`
+to inspect it separately. Interactive browser setup waits for installation;
+unattended setup returns the current browser status without waiting for a person.
+It never changes a disabled extension setting or browser policy. Installation
+detection is separate from browser-control connectivity.
 
 This release supports Apple Silicon Macs. Windows publication is deferred until its signed native runtime is available.
 

package/bin/aglit.cjs

@@ -31,6 +31,7 @@ const help = `Aglit Computer Use
   aglit teams [--open]
   aglit team --name "Team name" [--team TEAM_ID] [--workspace WORKSPACE_ID]
   aglit pipelines [--open]
+  aglit browser setup|status [--json]
   aglit providers
   aglit models list | choose
   aglit models login copilot [--reauth] [--json]
@@ -79,12 +80,13 @@ async function main() {
   const options = {
     models: ['device','fingerprint','name','json','challenge','code','connection','connections','model','harness','attempt','reauth'],
     install: ['json', 'channel'], init: ['name', 'provider', 'account', 'json', 'channel', 'headed', 'headless'],
-    start: ['json', 'channel', 'headed', 'headless'], ui: ['json'], status: ['json'], update: ['check', 'channel', 'json'], updates: ['json'], enable: ['two-factor'], disable: [], rename: ['name', 'json'], console: ['json'], teams: ['json', 'open'], team: ['name', 'team', 'workspace', 'json'], pipelines: ['open', 'json'], providers: ['json'], invite: ['team'], uninstall: [],
+    start: ['json', 'channel', 'headed', 'headless'], ui: ['json'], status: ['json'], update: ['check', 'channel', 'json'], updates: ['json'], enable: ['two-factor'], disable: [], rename: ['name', 'json'], console: ['json'], teams: ['json', 'open'], team: ['name', 'team', 'workspace', 'json'], pipelines: ['open', 'json'], browser: ['json'], providers: ['json'], invite: ['team'], uninstall: [],
   };
-  if (!Object.hasOwn(options, command) || Object.keys(values).some(key => !options[command].includes(key)) || positionals.length > (command === 'models' ? 3 : ['invite', 'updates'].includes(command) ? 2 : 1)) throw Error('Invalid command or options. Run aglit --help.');
+  if (!Object.hasOwn(options, command) || Object.keys(values).some(key => !options[command].includes(key)) || positionals.length > (command === 'models' ? 3 : ['invite', 'updates', 'browser'].includes(command) ? 2 : 1)) throw Error('Invalid command or options. Run aglit --help.');
   if (values['two-factor'] !== undefined && !['on', 'off'].includes(values['two-factor']))
     throw Error('Choose --two-factor on or off.');
-  if (installation.development && !['models','status','init','providers','enable','disable','ui','start'].includes(command)) throw Error('Source profile supports model/setup, access and window commands; installed runtime management is separate');
+  if (installation.development && !['models','status','init','providers','enable','disable','ui','start','browser'].includes(command)) throw Error('Source profile supports model/setup, access and window commands; installed runtime management is separate');
+  if (command === 'browser' && !['setup','status'].includes(email)) throw Error('Use aglit browser setup|status');
   if (command === 'updates' && !['on', 'off', 'status'].includes(email)) throw Error('Use aglit updates on|off|status');
   if (values.channel !== undefined && !['latest', 'canary', 'embedded'].includes(values.channel)) throw Error('Update channel must be latest, canary or embedded');
   if (values.team && !/^[A-Za-z0-9._:-]{1,128}$/.test(values.team)) throw Error('Invalid team ID');
@@ -182,6 +184,10 @@ async function main() {
     ui.finish('Model connections'); return;
   }
   if (command === 'status') { ui.result(state); ui.finish('Computer status'); return; }
+  if (command === 'browser') {
+    ui.result(email === 'status' ? await control('browser-status') : await require('../src/browser-setup.cjs').setupBrowser(control, ui, interactive));
+    ui.finish('Browser extension'); return;
+  }
   if (command === 'console') { ui.result({ url: state.consoleUrl }); ui.finish('Console'); return; }
   if (command === 'rename') {
     if (!values.name) throw Error('Provide --name to rename this computer');
@@ -248,28 +254,15 @@ async function main() {
     if (!interactive) ui.result(permissions);
     if (permissions.permissions?.supported && (permissions.permissions.screenRecording !== 'granted' || permissions.permissions.accessibility !== 'granted'))
       throw Error('Grant Screen Recording and Accessibility in System Settings, then rerun aglit init. Anywhere Access has not been enabled.');
-    let browser = await ui.step('Check Aglit AI browser extension', () => control('browser-status'));
-    if (!browser.enabled) {
-      const prepared = await ui.step('Set up Aglit AI browser extension', () => control('browser-setup'));
-      ui.browserExtension(prepared);
-      browser = await ui.step('Waiting for Chrome extension installation', async () => {
-        const deadline = Date.now() + 180000;
-        do {
-          const current = await control('browser-status');
-          if (current.installed && current.enabled) return current;
-          await delay(1500);
-        } while (Date.now() < deadline);
-        throw Error('Add or enable the Aglit AI Chrome extension, then rerun aglit init.');
-      });
-    }
     state = await ui.step('Connect this computer to your account', async () => {
       await control('enable');
       return control('status');
     });
     if (!installation.development) updates.rememberStatus(state);
     if (typeof state.deviceId !== 'string' || !state.deviceId) throw Error('Registration returned no device ID. Check aglit status before retrying.');
+    const browser = await require('../src/browser-setup.cjs').setupOptionalBrowser(control, ui, interactive);
     state = { ...state, ...await control('window', { mode }) };
-    state = { ...state, employeeUrl: new URL(`/employees/${encodeURIComponent(state.deviceId)}`, state.consoleUrl).href };
+    state = { ...state, browser, employeeUrl: new URL(`/employees/${encodeURIComponent(state.deviceId)}`, state.consoleUrl).href };
     ui.result(state); ui.finish('Anywhere Access enabled'); return;
   }
   if (command === 'invite') { ui.result(await control('invite', { teamId: values.team, email })); ui.finish('Invitation sent'); return; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglit-ai/cli",
-  "version": "1.0.17197",
+  "version": "1.0.17300",
   "description": "Install and manage Aglit Computer Use",
   "license": "UNLICENSED",
   "type": "commonjs",

package/src/browser-setup.cjs

@@ -0,0 +1,27 @@
+'use strict';
+const delay = ms => new Promise(resolve => setTimeout(resolve, ms));
+async function setupBrowser(control, ui, interactive) {
+  let browser = await ui.step('Check Aglit AI browser extension', () => control('browser-status'));
+  if (browser.enabled) return browser;
+  const prepared = await ui.step('Set up Aglit AI browser extension', () => control('browser-setup'));
+  ui.browserExtension(prepared);
+  if (!interactive) return control('browser-status');
+  return ui.step('Waiting for Chrome extension installation', async () => {
+    const deadline = Date.now() + 180000;
+    do {
+      browser = await control('browser-status');
+      if (browser.installed && browser.enabled) return browser;
+      await delay(1500);
+    } while (Date.now() < deadline);
+    throw Error('Add or enable the Aglit AI Chrome extension, then run aglit browser setup.');
+  });
+}
+async function setupOptionalBrowser(control, ui, interactive) {
+  try { return await setupBrowser(control, ui, interactive); }
+  catch (error) {
+    if (error.cancelled) throw error;
+    ui.info('Browser setup is incomplete: ' + error.message + '\nRetry with aglit browser setup. Anywhere Access remains enabled.');
+    return { installed: false, enabled: false, setupRequired: true };
+  }
+}
+module.exports = {setupBrowser, setupOptionalBrowser};

package/src/installation.cjs

@@ -195,6 +195,21 @@ async function install(channel) {
   if (bootstrap) require('./updates.cjs').adoptBootstrap(bootstrap);
   return { installed: true, ...receipt };
 }
+function runtimePorts() {
+  const file = path.join(root, 'runtime-ports.json');
+  if (fs.existsSync(file)) {
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 1024 ||
+        process.platform !== 'win32' && (stat.uid !== process.getuid() || stat.mode & 0o077)) throw Error('Private runtime ports required');
+    const ports = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (!Array.isArray(ports) || ports.length !== 5 || new Set(ports).size !== 5 || ports.some(port => !Number.isInteger(port) || port < 1024 || port > 65535)) throw Error('Runtime ports differ');
+    return ports;
+  }
+  const probe = `const net=require('node:net');(async()=>{for(let base=49117;base<50117;base+=10){const servers=[];try{for(let i=0;i<5;i++){const server=net.createServer();servers.push(server);await new Promise((resolve,reject)=>{server.once('error',reject);server.listen(base+i,'127.0.0.1',resolve);});}console.log(JSON.stringify(servers.map(server=>server.address().port)));return;}catch{}finally{for(const server of servers)server.close();}}process.exitCode=1;})()`;
+  const ports = JSON.parse(run(process.execPath, ['-e', probe]));
+  fs.writeFileSync(file, JSON.stringify(ports) + '\n', {flag:'wx',mode:0o600});
+  return ports;
+}
 function start() {
   if (development) throw Error('Start the source runtime with scripts/dev/run-computer-use.cjs before invoking this CLI');
   if (fs.existsSync(path.join(root, 'uninstalling.json'))) throw Error('Computer Use is uninstalling. Run aglit uninstall to finish cleanup.');
@@ -202,6 +217,7 @@ function start() {
     '$p=[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()); if($p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){throw "Run aglit init from a non-elevated interactive user terminal"}']);
   const installed = readInstallation();
   verifyPublisher(installed.executable);
+  runtimePorts();
   const log = fs.openSync(path.join(root, 'runtime.log'), 'a', 0o600);
   const env = { ...process.env };
   // Do not let an operator's guest/development environment adopt another identity.
@@ -222,10 +238,10 @@ function start() {
     // Bind the result to the exact installed executable and current OS user.
     const deadline = Date.now() + 10000;
     do {
-      const rows = execFileSync('/bin/ps', ['-axo', 'pid=,uid=,comm='], {encoding: 'utf8', timeout: 15000, maxBuffer: 8 * 1024 ** 2});
+      const rows = execFileSync('/bin/ps', ['-axo', 'pid=,uid=,args='], {encoding: 'utf8', timeout: 15000, maxBuffer: 8 * 1024 ** 2});
       const matches = rows.split('\n').flatMap(line => {
         const row = /^\s*(\d+)\s+(\d+)\s+(.+)$/.exec(line);
-        return row && Number(row[2]) === process.getuid() && row[3].trim() === installed.executable ? [Number(row[1])] : [];
+        return row && Number(row[2]) === process.getuid() && row[3].trim() === installed.executable + ' --computer-use' ? [Number(row[1])] : [];
       });
       if (matches.length > 1) throw Error('Multiple installed Desktop processes; activation remains pending');
       if (matches.length === 1) return { pid: matches[0] };
@@ -278,4 +294,4 @@ function readUninstall() {
       !Number.isSafeInteger(receipt.pid) || receipt.pid <= 0) throw Error('Invalid uninstall receipt');
   return receipt;
 }
-module.exports = { development, root, profile, readInstallation, install, start, purge, purgeIncomplete, readUninstall, privateRoot, canonical, verifyPublisher, embeddedRelease, copyArchive, stageRuntime, verifyRuntime };
+module.exports = { runtimePorts, development, root, profile, readInstallation, install, start, purge, purgeIncomplete, readUninstall, privateRoot, canonical, verifyPublisher, embeddedRelease, copyArchive, stageRuntime, verifyRuntime };