@aglit-ai/cli 1.0.17197 → 1.0.17343

package/README.md

@@ -9,7 +9,6 @@ After the CLI and a compatible signed desktop release have been published:
 pnpm add -g @aglit-ai/cli
 aglit
 aglit ui
-aglit start
 aglit status
 aglit disable
 aglit enable
@@ -20,9 +19,8 @@ Run `aglit` in an interactive terminal to open the guided setup. `aglit init`
 also runs this flow and installs the signed runtime if it is missing. Setup asks
 for a computer name and AI provider, then enables Anywhere Access. It runs in
 the background during setup, then opens the Desktop window when setup succeeds.
-`aglit start` and `aglit ui` open the window using the same app and profile.
-Use `aglit init --headless` or `aglit start --headless` to keep the window hidden
-without disabling its connection. `aglit --help` (or `aglit -h`) lists commands.
+`aglit ui` opens the window using the same app and profile.
+Close the window to leave Aglit running in the background; quit explicitly from its tray/menu icon. `aglit --help` (or `aglit -h`) lists commands.
 
 Setup opens Aglit's Google login in the browser,
 detects existing Codex/Claude logins, and uses a configured authenticated provider
@@ -32,22 +30,22 @@ accounts remain owned by the user; uninstall does not delete their original logi
 
 ```sh
 aglit init --name "Office Mac" --provider codex
-aglit providers
+aglit models accounts
 aglit rename --name "Office Mac"
 aglit console
-aglit team --name "My team"
+aglit teams init --name "My team"
 aglit teams --open
 aglit pipelines
 aglit pipelines --open
-aglit invite USER_EMAIL --team TEAM_ID
+aglit teams invite USER_EMAIL --team TEAM_ID
 ```
 
 Setup registers a Personal computer with your signed-in account. It asks for its
-name and AI provider, requests the required OS permissions, guides installation of
-the Aglit AI Chrome extension, and enables Anywhere Access. Team selection and
+name and AI provider, requests the required OS permissions, enables Anywhere
+Access, then offers the Aglit AI Chrome extension. Team selection and
 pipeline discovery are separate from setup.
-Use `aglit team --name "My team"` to associate this computer with a team on your account. The CLI derives its installed workspace; no server-side workspace record or private-key provisioning is required. Manage invitations at teams.aglit.ai.
-Use `aglit teams` to inspect memberships and `aglit pipelines --open` to open the
+Use `aglit teams init --name "My team"` to associate this computer with a team on your account. The CLI derives its installed workspace; no server-side workspace record or private-key provisioning is required. Manage invitations at teams.aglit.ai.
+Use `aglit teams list` to inspect memberships and `aglit pipelines list` to inspect the
 encrypted pipeline viewer. A listed device does not prove its pipelines are connected.
 
 For unattended setup, use `aglit init --json --name "Office Mac" --provider codex
@@ -130,27 +128,22 @@ Google currently rejects this proposed callback with `redirect_uri_mismatch`.
 No port change has shipped; provider registration and native acceptance remain
 required before qualifying coexistence.
 
-Anywhere Access requires a two-factor security code by default; an explicit off preference is preserved. In CLI headless mode, incoming connection requests display the code in a native window without opening the full app. This requires a logged-in graphical desktop session; an SSH-only/server environment cannot display the prompt. Codes are not printed to the terminal.
+Anywhere Access defaults to no two-factor security code; an explicit on preference is preserved. When enabled, incoming connection requests display the code in a native window without opening the full app. This requires a logged-in graphical desktop session; an SSH-only/server environment cannot display the prompt. Codes are not printed to the terminal.
 
-After computer-use permissions, setup opens the published Aglit AI Chrome Web Store
-listing. Choose Add to Chrome and approve Chrome’s prompt. Setup waits until the
-Store extension is installed and enabled in Chrome’s selected profile; it never
-changes a disabled extension setting or browser policy. Installation detection is
-separate from browser-control connectivity.
+After computer-use permissions, setup enables Anywhere Access before offering
+the Aglit AI Chrome extension. Browser setup failures do not undo computer
+registration. Run `aglit browser setup` to retry, or `aglit browser status --json`
+to inspect it separately. Interactive browser setup waits for installation;
+unattended setup returns the current browser status without waiting for a person.
+It never changes a disabled extension setting or browser policy. Installation
+detection is separate from browser-control connectivity.
 
 This release supports Apple Silicon Macs. Windows publication is deferred until its signed native runtime is available.
 
-On macOS, interactive `aglit init` also checks for the BlackHole 2ch audio cable
-and installs the official Homebrew cask when it is missing. Rerun `aglit init` to resume setup. Administrator
-approval happens in your terminal. Unattended setup reports the required action
-without waiting for a password. Audio setup preserves existing BlackHole variants,
-default audio devices and active CoreAudio sessions; restart macOS when the
-installer requires it. In the remote app, select BlackHole 2ch as the microphone
-for forwarded microphone audio. Browser speaker playback still requires a click
-when autoplay is blocked.
-
-When settings already exist, interactive `aglit init` shows the saved computer name,
-account and provider and offers to reuse them. Choosing reuse preserves the saved
-model connection without repeating discovery or selection. Explicit `--name` and
-`--provider` options override the corresponding saved values. Unattended init reuses
-saved settings by default. Permission and connection checks still run.
+Run `aglit init` again to edit setup with the saved account, computer name, and AI provider preselected. Choose a different account in the account step to switch; cloud access is revoked before the previous account signs out.
+
+Manage repositories with `aglit pipelines init --repo GIT_URL --branch master`, inspect local definitions with `aglit pipelines list`, and list accessible computers with `aglit pipelines devices`. Teams use `aglit teams list`, `aglit teams init`, and `aglit teams invite`. These commands do not open browser pages.
+
+Use `aglit models setup` to choose a connection and enable model proxying for the root assistant. `aglit models choose` changes only the saved connection preference; `aglit models proxying on|off` changes the global proxy setting. `aglit models accounts` lists connected local accounts.
+
+Connect an existing private Codex home explicitly with `aglit models import codex --home /absolute/path/to/codex-home --name Brian`. Importing another account preserves connected accounts and pools. The selected home remains the credential and refresh owner; passive discovery never scans homes or starts login. Create or update a pool with `aglit models pool POOL_ID --name NAME --connections local:ACCOUNT_A,local:ACCOUNT_B`. Native account setup and repository operations require a compatible updated runtime.

package/bin/aglit.cjs

@@ -20,7 +20,6 @@ const help = `Aglit Computer Use
     [--name "Computer name"] [--provider codex|claude|auto]
     [--account EMAIL] [--channel latest|canary|embedded]
   aglit install                 Install the signed Desktop runtime
-  aglit start
   aglit ui
   aglit status [--json]
   aglit rename --name "Computer name"
@@ -28,11 +27,16 @@ const help = `Aglit Computer Use
   aglit update [--check] [--channel latest|canary|embedded] [--json]
   aglit updates on|off|status [--json]
   aglit enable [--two-factor on|off] | disable
-  aglit teams [--open]
-  aglit team --name "Team name" [--team TEAM_ID] [--workspace WORKSPACE_ID]
-  aglit pipelines [--open]
-  aglit providers
-  aglit models list | choose
+  aglit teams list
+  aglit teams init --name "Team name" [--team TEAM_ID] [--workspace WORKSPACE_ID]
+  aglit teams invite EMAIL --team TEAM_ID
+  aglit pipelines list | devices
+  aglit pipelines init [--repo GIT_URL] [--branch BRANCH]
+  aglit browser setup|status [--json]
+  aglit models import codex --home ABSOLUTE_CODEX_HOME --name NAME
+  aglit models proxying on|off
+  aglit models accounts
+  aglit models list | setup | choose
   aglit models login copilot [--reauth] [--json]
   aglit models login-status copilot --attempt ATTEMPT_ID [--json]
   aglit models publish | unpublish --connection CONNECTION_ID --model MODEL_ID
@@ -42,11 +46,10 @@ const help = `Aglit Computer Use
   aglit models pool POOL_ID --name NAME --connections local:ACCOUNT_A,local:ACCOUNT_B
   aglit models test --model MODEL_ID [--connection CONNECTION_ID] [--harness]
   aglit models unserve
-  aglit invite EMAIL --team TEAM_ID
   aglit uninstall
 
 Aglit runs in the background. Use aglit ui to open the Desktop window.
-Use --json with install, init, start or status for non-interactive JSON output.
+Use --json with install, init, ui or status for non-interactive JSON output.
 Uninstall revokes access and purges only this installation. Mini Computer,
 VMs, shared browser profiles and original provider logins remain separate.
 Setup registers a Personal computer. Team invitations are separate commands.
@@ -71,20 +74,21 @@ async function main() {
     'two-factor': { type: 'string' }, connections: { type: 'string' }, attempt: { type: 'string' }, reauth: {type:'boolean'},
     harness: { type: 'boolean' },
     device: { type: 'string' }, fingerprint: { type: 'string' }, challenge: { type: 'string' }, code: { type: 'string' }, connection: { type: 'string' }, model: { type: 'string' }, name: { type: 'string' }, provider: { type: 'string' }, account: { type: 'string' },
-    team: { type: 'string' }, workspace: { type: 'string' }, check: { type: 'boolean' }, channel: { type: 'string' }, open: { type: 'boolean' }, json: { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
+    home: { type: 'string' }, repo: { type: 'string' }, branch: { type: 'string' }, team: { type: 'string' }, workspace: { type: 'string' }, check: { type: 'boolean' }, channel: { type: 'string' }, json: { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
   }, allowPositionals: true, strict: true });
   const interactive = Boolean(process.stdin.isTTY && process.stderr.isTTY && !values.json && !process.env.CI);
   if (values.help || !positionals.length && !interactive) { process.stdout.write(help); return; }
-  const [command = 'init', email, connectionId] = positionals;
+  const [command = 'init', email, connectionId] = require('../src/command-groups.cjs').commandGroups(positionals);
   const options = {
-    models: ['device','fingerprint','name','json','challenge','code','connection','connections','model','harness','attempt','reauth'],
-    install: ['json', 'channel'], init: ['name', 'provider', 'account', 'json', 'channel', 'headed', 'headless'],
-    start: ['json', 'channel', 'headed', 'headless'], ui: ['json'], status: ['json'], update: ['check', 'channel', 'json'], updates: ['json'], enable: ['two-factor'], disable: [], rename: ['name', 'json'], console: ['json'], teams: ['json', 'open'], team: ['name', 'team', 'workspace', 'json'], pipelines: ['open', 'json'], providers: ['json'], invite: ['team'], uninstall: [],
+    models: ['home','device','fingerprint','name','json','challenge','code','connection','connections','model','harness','attempt','reauth'],
+    install: ['json', 'channel'], init: ['name', 'provider', 'account', 'json', 'channel'],
+    ui: ['json', 'channel'], status: ['json'], update: ['check', 'channel', 'json'], updates: ['json'], enable: ['two-factor'], disable: [], rename: ['name', 'json'], console: ['json'], teams: ['json'], team: ['name', 'team', 'workspace', 'json'], pipelines: ['json'], 'pipelines-list': ['json'], 'pipelines-init': ['repo','branch','json'], 'models-accounts': ['json'], browser: ['json'], invite: ['team'], uninstall: [],
   };
-  if (!Object.hasOwn(options, command) || Object.keys(values).some(key => !options[command].includes(key)) || positionals.length > (command === 'models' ? 3 : ['invite', 'updates'].includes(command) ? 2 : 1)) throw Error('Invalid command or options. Run aglit --help.');
+  if (!Object.hasOwn(options, command) || Object.keys(values).some(key => !options[command].includes(key)) || require('../src/command-groups.cjs').commandGroups(positionals).length > (command === 'models' ? 3 : ['invite', 'updates', 'browser'].includes(command) ? 2 : 1)) throw Error('Invalid command or options. Run aglit --help.');
   if (values['two-factor'] !== undefined && !['on', 'off'].includes(values['two-factor']))
     throw Error('Choose --two-factor on or off.');
-  if (installation.development && !['models','status','init','providers','enable','disable','ui','start'].includes(command)) throw Error('Source profile supports model/setup, access and window commands; installed runtime management is separate');
+  if (installation.development && !['models','status','init','models-accounts','enable','disable','ui','browser'].includes(command)) throw Error('Source profile supports model/setup, access and window commands; installed runtime management is separate');
+  if (command === 'browser' && !['setup','status'].includes(email)) throw Error('Use aglit browser setup|status');
   if (command === 'updates' && !['on', 'off', 'status'].includes(email)) throw Error('Use aglit updates on|off|status');
   if (values.channel !== undefined && !['latest', 'canary', 'embedded'].includes(values.channel)) throw Error('Update channel must be latest, canary or embedded');
   if (values.team && !/^[A-Za-z0-9._:-]{1,128}$/.test(values.team)) throw Error('Invalid team ID');
@@ -131,7 +135,7 @@ async function main() {
     }
   }
   let name = values.name;
-  const mode = command === 'ui' ? 'headed' : 'headless';
+  const mode = ['init','ui'].includes(command) ? 'headed' : 'headless';
   if (command === 'init') {
     if (!installed()) {
       if (!interactive && !name) throw Error('Provide --name for unattended setup');
@@ -140,11 +144,11 @@ async function main() {
   }
   if (!installed()) throw Error('Run aglit init to install and register this computer first.');
   installation.readInstallation();
-  if (!installation.development && ['start', 'ui', 'init'].includes(command)) {
+  if (!installation.development && ['ui', 'init'].includes(command)) {
     const recovered = await updates.recoverActivation();
     if (recovered.updating) { ui.result(recovered); ui.finish('Update in progress'); return; }
   }
-  if (!installation.development && ['start', 'ui', 'init'].includes(command)) updates.initialize(values.channel);
+  if (!installation.development && ['ui', 'init'].includes(command)) updates.initialize(values.channel);
   const configPath = path.join(installation.profile, 'ipc/sdk-ipc.json');
   const control = (action, fields = {}) => require('../src/control.cjs').control(configPath, action, fields);
   let state;
@@ -156,7 +160,7 @@ async function main() {
       if (updates.state().automatic && updates.runtimeStopped(installation.readInstallation())) {
         try { await updates.update(); } catch {
           if (fs.existsSync(path.join(installation.root, 'update-transaction.json')) || fs.existsSync(path.join(installation.root, 'update-activation.json'))) {
-            const recovered = await updates.recoverActivation(); if (recovered.updating) throw Error('An update is still active; retry aglit start after it finishes');
+            const recovered = await updates.recoverActivation(); if (recovered.updating) throw Error('An update is still active; retry aglit ui after it finishes');
           }
           ui.info('Automatic update deferred; starting the installed Desktop.');
         }
@@ -171,17 +175,22 @@ async function main() {
       throw Error('Computer Use did not become ready. See runtime.log in its installation directory.');
     });
   }
-  if (!installation.development && state.running && ['status', 'start', 'ui', 'init'].includes(command)) updates.rememberStatus(state);
-  if (!installation.development && ['start', 'ui', 'init'].includes(command) && state.running) updates.ensureWorker(state.pid);
+  if (!installation.development && state.running && ['status', 'ui', 'init'].includes(command)) updates.rememberStatus(state);
+  if (!installation.development && ['ui', 'init'].includes(command) && state.running) updates.ensureWorker(state.pid);
   const modelQuestion = interactive ? async text => {
     const prompt = createInterface({ input: process.stdin, output: process.stderr });
     try { return await prompt.question(text); } finally { prompt.close(); }
   } : undefined;
   if (command === 'models') {
-    ui.result(await require('../src/model-connections.cjs').modelCommand(control,email,connectionId,values,modelQuestion));
+    ui.result(await require('../src/model-connections.cjs').modelCommand(control,email,connectionId,values,modelQuestion,interactive ? ui.modelConnection : undefined));
     ui.finish('Model connections'); return;
   }
+  if (command === 'models-accounts') { const view=await require('../src/model-connections.cjs').listModelConnections(control);ui.result({accounts:view.connections.filter(value=>value.kind==='local'&&!value.id.startsWith('local:pool:')),warnings:view.warnings||[]});ui.finish('Model accounts');return; }
   if (command === 'status') { ui.result(state); ui.finish('Computer status'); return; }
+  if (command === 'browser') {
+    ui.result(email === 'status' ? await control('browser-status') : await require('../src/browser-setup.cjs').setupBrowser(control, ui, interactive));
+    ui.finish('Browser extension'); return;
+  }
   if (command === 'console') { ui.result({ url: state.consoleUrl }); ui.finish('Console'); return; }
   if (command === 'rename') {
     if (!values.name) throw Error('Provide --name to rename this computer');
@@ -193,83 +202,55 @@ async function main() {
       name: values.name, ...(values.team ? { teamId: values.team } : {}),
       ...(values.workspace ? { workspaceId: values.workspace } : {}),
     })));
-    ui.finish('Manage your team at https://teams.aglit.ai/'); return;
+    ui.finish('Manage your team in Console settings: https://console.aglit.ai/?settings=teams'); return;
+  }
+  if (command === 'pipelines-list' || command === 'pipelines-init') {
+    let fields = {};
+    if (command === 'pipelines-init') {
+      const repositoryUrl = values.repo || require('node:child_process').execFileSync('git', ['remote','get-url','origin'], {encoding:'utf8',stdio:['ignore','pipe','ignore']}).trim();
+      fields = { repository_url: repositoryUrl, branch: values.branch || 'master' };
+    }
+    const result = await control(command, fields);
+    ui.result(result); ui.finish(command === 'pipelines-init' ? 'Repository polling configured' : 'Pipelines'); return;
   }
   if (command === 'teams' || command === 'pipelines') {
     const result = await ui.step(command === 'teams' ? 'Load your teams' : 'Load authorized pipeline devices', () => control(command));
     if (interactive) ui[command](result); else ui.result(result);
-    if (command === 'teams' && values.open) await control('open-teams');
-    if (command === 'pipelines' && values.open) await control('open-pipelines');
     ui.finish(command === 'teams' ? 'Your teams' : 'Your pipelines'); return;
   }
-  if (command === 'start' || command === 'ui') {
+  if (command === 'ui') {
     const window = await control('window', { mode });
     state = { ...state, ...window };
     ui.result(state); ui.finish(mode === 'headed' ? 'Desktop window opened' : 'Running in the background'); return;
   }
   if (command === 'init') {
     assertSetupRuntime(state);
-    if (!state.email) {
-      state = await ui.step('Complete sign-in in your browser', async () => {
-        await control('login');
-        const deadline = Date.now() + 5 * 60000;
-        while (Date.now() < deadline) {
-          await delay(1500); const current = await control('status'); if (current.email) return current;
-        }
-        throw Error('Sign-in timed out. Run aglit init to resume.');
-      });
-    }
-    if (values.account && state.email?.toLowerCase() !== values.account.toLowerCase())
-      throw Error(`Signed in as ${state.email}; expected ${values.account}. Switch the browser sign-in account and rerun aglit init.`);
-    const reuseSavedSetup = Boolean(state.name) && (!interactive || await ui.reuseSetup(state));
-    if (interactive && !reuseSavedSetup && !values.account && !await ui.confirmAccount(state.email))
-      throw Object.assign(Error('Setup cancelled before enabling remote access.'), { cancelled: true });
-    ui.info(`Signed in as ${state.email}`);
-    if (!values.name && interactive && !reuseSavedSetup) name = await ui.name(state.name || os.hostname());
+    state = await require('../src/setup-account.cjs').setupAccount(control, ui, state, { interactive, expectedEmail: values.account });
+    if (!values.name && interactive) name = await ui.name(state.name || os.hostname());
     name ||= state.name;
     if (!name) throw Error('Provide --name for unattended setup');
-    const selected = reuseSavedSetup && !values.provider ? null :
-      await require('../src/model-connections.cjs').chooseModelConnection(control, { provider: values.provider, question: modelQuestion });
+    const selected = !interactive && state.name && !values.provider ? null :
+      await require('../src/model-connections.cjs').chooseModelConnection(control, { provider: values.provider, question: modelQuestion, ...(interactive ? { selectChoice: ui.modelConnection } : {}) });
+    if(selected?.unavailable)throw Error('Update the Aglit runtime to restore model discovery, then rerun aglit init.');
     for (const warning of selected?.view.warnings || []) ui.info(warning);
     await ui.step('Save computer settings', () => control('configure', { name,
-      ...(selected?.connectionId ? { provider: 'aglit', model_connection_id: selected.connectionId } : values.provider && values.provider !== 'auto' ? { provider: values.provider } : {}) }));
+      ...(selected?.connectionId ? { model_connection_id: selected.connectionId } : values.provider && values.provider !== 'auto' ? { provider: values.provider } : {}) }));
     if (process.platform === 'darwin') {
-      try {
-        const audio = require('../src/mac-audio.cjs').setup({ interactive });
-        if (audio.actionRequired) ui.info(audio.actionRequired);
-        if (audio.restartRequired) ui.info('BlackHole is installed. Restart this Mac when convenient to enable the audio cable.');
-        if (!interactive) ui.result({ audio });
-      } catch (error) {
-        ui.info(`${error.message} Rerun aglit init to retry audio setup.`);
-      }
       ui.permissions();
     }
     const permissions = await ui.step('Waiting for screen recording and input permissions', () => control('permissions'));
     if (!interactive) ui.result(permissions);
     if (permissions.permissions?.supported && (permissions.permissions.screenRecording !== 'granted' || permissions.permissions.accessibility !== 'granted'))
       throw Error('Grant Screen Recording and Accessibility in System Settings, then rerun aglit init. Anywhere Access has not been enabled.');
-    let browser = await ui.step('Check Aglit AI browser extension', () => control('browser-status'));
-    if (!browser.enabled) {
-      const prepared = await ui.step('Set up Aglit AI browser extension', () => control('browser-setup'));
-      ui.browserExtension(prepared);
-      browser = await ui.step('Waiting for Chrome extension installation', async () => {
-        const deadline = Date.now() + 180000;
-        do {
-          const current = await control('browser-status');
-          if (current.installed && current.enabled) return current;
-          await delay(1500);
-        } while (Date.now() < deadline);
-        throw Error('Add or enable the Aglit AI Chrome extension, then rerun aglit init.');
-      });
-    }
     state = await ui.step('Connect this computer to your account', async () => {
       await control('enable');
       return control('status');
     });
     if (!installation.development) updates.rememberStatus(state);
     if (typeof state.deviceId !== 'string' || !state.deviceId) throw Error('Registration returned no device ID. Check aglit status before retrying.');
+    const browser = await require('../src/browser-setup.cjs').setupOptionalBrowser(control, ui, interactive);
     state = { ...state, ...await control('window', { mode }) };
-    state = { ...state, employeeUrl: new URL(`/employees/${encodeURIComponent(state.deviceId)}`, state.consoleUrl).href };
+    state = { ...state, browser, employeeUrl: new URL(`/employees/${encodeURIComponent(state.deviceId)}`, state.consoleUrl).href };
     ui.result(state); ui.finish('Anywhere Access enabled'); return;
   }
   if (command === 'invite') { ui.result(await control('invite', { teamId: values.team, email })); ui.finish('Invitation sent'); return; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aglit-ai/cli",
-  "version": "1.0.17197",
+  "version": "1.0.17343",
   "description": "Install and manage Aglit Computer Use",
   "license": "UNLICENSED",
   "type": "commonjs",

package/src/browser-setup.cjs

@@ -0,0 +1,27 @@
+'use strict';
+const delay = ms => new Promise(resolve => setTimeout(resolve, ms));
+async function setupBrowser(control, ui, interactive) {
+  let browser = await ui.step('Check Aglit AI browser extension', () => control('browser-status'));
+  if (browser.enabled) return browser;
+  const prepared = await ui.step('Set up Aglit AI browser extension', () => control('browser-setup'));
+  ui.browserExtension(prepared);
+  if (!interactive) return control('browser-status');
+  return ui.step('Waiting for Chrome extension installation', async () => {
+    const deadline = Date.now() + 180000;
+    do {
+      browser = await control('browser-status');
+      if (browser.installed && browser.enabled) return browser;
+      await delay(1500);
+    } while (Date.now() < deadline);
+    throw Error('Add or enable the Aglit AI Chrome extension, then run aglit browser setup.');
+  });
+}
+async function setupOptionalBrowser(control, ui, interactive) {
+  try { return await setupBrowser(control, ui, interactive); }
+  catch (error) {
+    if (error.cancelled) throw error;
+    ui.info('Browser setup is incomplete: ' + error.message + '\nRetry with aglit browser setup. Anywhere Access remains enabled.');
+    return { installed: false, enabled: false, setupRequired: true };
+  }
+}
+module.exports = {setupBrowser, setupOptionalBrowser};

package/src/command-groups.cjs

@@ -0,0 +1,18 @@
+'use strict';
+function commandGroups(positionals) {
+  const [group, action, argument] = positionals;
+  if (['start','providers','team','invite'].includes(group)) throw Error('Use aglit ui, aglit models, or aglit teams. Run aglit --help.');
+  if (group === 'teams') {
+    if (action === 'list' && positionals.length === 2) return ['teams'];
+    if (action === 'init' && positionals.length === 2) return ['team'];
+    if (action === 'invite' && argument && positionals.length === 3) return ['invite',argument];
+    throw Error('Use aglit teams list, teams init, or teams invite EMAIL.');
+  }
+  if (group === 'pipelines') {
+    if (positionals.length === 2 && ['list','init','devices'].includes(action)) return [action === 'devices' ? 'pipelines' : 'pipelines-'+action];
+    throw Error('Use aglit pipelines list, pipelines init, or pipelines devices.');
+  }
+  if (group === 'models' && action === 'accounts' && positionals.length === 2) return ['models-accounts'];
+  return positionals;
+}
+module.exports = { commandGroups };

package/src/installation.cjs

@@ -195,6 +195,21 @@ async function install(channel) {
   if (bootstrap) require('./updates.cjs').adoptBootstrap(bootstrap);
   return { installed: true, ...receipt };
 }
+function runtimePorts() {
+  const file = path.join(root, 'runtime-ports.json');
+  if (fs.existsSync(file)) {
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 1024 ||
+        process.platform !== 'win32' && (stat.uid !== process.getuid() || stat.mode & 0o077)) throw Error('Private runtime ports required');
+    const ports = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (!Array.isArray(ports) || ports.length !== 5 || new Set(ports).size !== 5 || ports.some(port => !Number.isInteger(port) || port < 1024 || port > 65535)) throw Error('Runtime ports differ');
+    return ports;
+  }
+  const probe = `const net=require('node:net');(async()=>{for(let base=49117;base<50117;base+=10){const servers=[];try{for(let i=0;i<5;i++){const server=net.createServer();servers.push(server);await new Promise((resolve,reject)=>{server.once('error',reject);server.listen(base+i,'127.0.0.1',resolve);});}console.log(JSON.stringify(servers.map(server=>server.address().port)));return;}catch{}finally{for(const server of servers)server.close();}}process.exitCode=1;})()`;
+  const ports = JSON.parse(run(process.execPath, ['-e', probe]));
+  fs.writeFileSync(file, JSON.stringify(ports) + '\n', {flag:'wx',mode:0o600});
+  return ports;
+}
 function start() {
   if (development) throw Error('Start the source runtime with scripts/dev/run-computer-use.cjs before invoking this CLI');
   if (fs.existsSync(path.join(root, 'uninstalling.json'))) throw Error('Computer Use is uninstalling. Run aglit uninstall to finish cleanup.');
@@ -202,6 +217,7 @@ function start() {
     '$p=[Security.Principal.WindowsPrincipal]::new([Security.Principal.WindowsIdentity]::GetCurrent()); if($p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){throw "Run aglit init from a non-elevated interactive user terminal"}']);
   const installed = readInstallation();
   verifyPublisher(installed.executable);
+  runtimePorts();
   const log = fs.openSync(path.join(root, 'runtime.log'), 'a', 0o600);
   const env = { ...process.env };
   // Do not let an operator's guest/development environment adopt another identity.
@@ -222,10 +238,10 @@ function start() {
     // Bind the result to the exact installed executable and current OS user.
     const deadline = Date.now() + 10000;
     do {
-      const rows = execFileSync('/bin/ps', ['-axo', 'pid=,uid=,comm='], {encoding: 'utf8', timeout: 15000, maxBuffer: 8 * 1024 ** 2});
+      const rows = execFileSync('/bin/ps', ['-axo', 'pid=,uid=,args='], {encoding: 'utf8', timeout: 15000, maxBuffer: 8 * 1024 ** 2});
       const matches = rows.split('\n').flatMap(line => {
         const row = /^\s*(\d+)\s+(\d+)\s+(.+)$/.exec(line);
-        return row && Number(row[2]) === process.getuid() && row[3].trim() === installed.executable ? [Number(row[1])] : [];
+        return row && Number(row[2]) === process.getuid() && row[3].trim() === installed.executable + ' --computer-use' ? [Number(row[1])] : [];
       });
       if (matches.length > 1) throw Error('Multiple installed Desktop processes; activation remains pending');
       if (matches.length === 1) return { pid: matches[0] };
@@ -278,4 +294,4 @@ function readUninstall() {
       !Number.isSafeInteger(receipt.pid) || receipt.pid <= 0) throw Error('Invalid uninstall receipt');
   return receipt;
 }
-module.exports = { development, root, profile, readInstallation, install, start, purge, purgeIncomplete, readUninstall, privateRoot, canonical, verifyPublisher, embeddedRelease, copyArchive, stageRuntime, verifyRuntime };
+module.exports = { runtimePorts, development, root, profile, readInstallation, install, start, purge, purgeIncomplete, readUninstall, privateRoot, canonical, verifyPublisher, embeddedRelease, copyArchive, stageRuntime, verifyRuntime };

package/src/model-connections.cjs

@@ -11,9 +11,21 @@ async function listModelConnections(control) {
       warnings: ['Model endpoint discovery is unavailable. Existing provider settings are unchanged; retry aglit models list later.'] };
   }
 }
-async function chooseModelConnection(control, { provider, question } = {}) {
+async function chooseModelConnection(control, { provider, question, selectChoice } = {}) {
   let view = await listModelConnections(control);
   if (view.selection.status === 'discovery-unavailable') return { view, connectionId: null, unavailable: true };
+  if (selectChoice) {
+    const choices = view.connections.filter(value => value.models.length && (value.available || value.kind === 'remote') &&
+      (!provider || ['auto','aglit'].includes(provider) || value.models.some(model=>model.provider===provider)));
+    if (!choices.length) throw Error('No model connection is ready. Connect an account with aglit models.');
+    const id = await selectChoice(choices, view.preferred_connection_id || view.selection.connection_id || choices[0].id);
+    const selected = choices.find(value=>value.id===id); if (!selected) throw Error('Choose a listed model connection');
+    if (selected.kind === 'remote' && !selected.available)
+      await modelCommand(control,'register',undefined,{device:selected.device_id,fingerprint:selected.identity_fingerprint,name:selected.name},question);
+    view = await control('models-prefer',{connection_id:id});
+    if (view.selection.status !== 'selected' || view.selection.connection_id !== id) throw Error('Selected model connection is unavailable');
+    return {view,connectionId:id};
+  }
   // Init/choose is an explicit connection action. Passive models-list never
   // prompts; reconnect only the saved/chosen endpoint, never every known host.
   if (['preferred-unavailable','setup-required'].includes(view.selection.status)) {
@@ -51,9 +63,11 @@ async function chooseModelConnection(control, { provider, question } = {}) {
   return { view, connectionId: selection.connection_id };
 }
 function validateModelCommand(command, id, values) {
-  const allowed = {list:['json'],login:['json','reauth'],'login-status':['attempt','json'],test:['connection','model','harness'],choose:[],pool:['name','connections'],publish:['connection','model'],unpublish:['connection','model'],unserve:[],register:['device','fingerprint','name','challenge','code'],prefer:[],remove:[]};
+  const allowed = {list:['json'],import:['home','name','json'],proxying:[],login:['json','reauth'],'login-status':['attempt','json'],test:['connection','model','harness'],setup:[],choose:[],pool:['name','connections'],publish:['connection','model'],unpublish:['connection','model'],unserve:[],register:['device','fingerprint','name','challenge','code'],prefer:[],remove:[]};
   if (!Object.hasOwn(allowed,command) || Object.keys(values).some(key=>!allowed[command].includes(key)) ||
-      (!['prefer','remove','pool','login','login-status'].includes(command) && id) || (['prefer','remove','pool','login','login-status'].includes(command) && !id)) throw Error('Invalid model command or options');
+      (!['prefer','remove','pool','login','login-status','import','proxying'].includes(command) && id) || (['prefer','remove','pool','login','login-status','import','proxying'].includes(command) && !id)) throw Error('Invalid model command or options');
+  if(command==='import'&&(id!=='codex'||typeof values.home!=='string'||!require('node:path').isAbsolute(values.home)||values.home.length>4096||/[\x00-\x1f\x7f]/.test(values.home)||typeof values.name!=='string'||!values.name.trim()||values.name.length>100||/[\x00-\x1f\x7f]/.test(values.name)))throw Error('Use aglit models import codex --home ABSOLUTE_CODEX_HOME --name NAME');
+  if(command==='proxying'&&!['on','off'].includes(id))throw Error('Use aglit models proxying on|off');
   if(['login','login-status'].includes(command)&&(id!=='copilot'||command==='login-status'&&!/^[a-f0-9-]{36}$/.test(values.attempt??'')))throw Error('Use aglit models login copilot or aglit models login-status copilot --attempt ATTEMPT_ID');
   if(values.reauth!==undefined&&values.reauth!==true)throw Error('Use --reauth only to explicitly replace the Copilot login');
   if (command === 'pool' && (!/^[A-Za-z0-9._-]{1,80}$/.test(id) || !values.name?.trim() || values.name.length > 100 ||
@@ -67,8 +81,10 @@ function validateModelCommand(command, id, values) {
   if (['publish','unpublish'].includes(command) && (!/^local:[A-Za-z0-9._:-]{1,180}$/.test(values.connection||'') || !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/.test(values.model||''))) throw Error('Choose a local --connection and --model');
   if (command === 'remove' && !id.startsWith('remote:')) throw Error('A registered remote connection ID is required');
 }
-async function modelCommand(control, command, id, values, question) {
+async function modelCommand(control, command, id, values, question, selectChoice) {
   validateModelCommand(command,id,values);
+  if(command==='import')return control('models-import',{provider_id:id,home:values.home,name:values.name});
+  if(command==='proxying')return control('models-proxying',{enabled:String(id==='on')});
   if (command === 'list') return listModelConnections(control);
   if(command==='login'||command==='login-status')return control(command==='login'?'models-login':'models-login-status',{provider_id:id,...(command==='login-status'?{attempt_id:values.attempt}:values.reauth?{reauth:'true'}:{})});
   if (command === 'test') {
@@ -106,7 +122,9 @@ async function modelCommand(control, command, id, values, question) {
   }
   if (command === 'publish' || command === 'unpublish') return control('models-publish',{connection_id:values.connection,model_id:values.model,published:String(command==='publish')});
   if (command === 'unserve') return control('models-unpublish-all');
-  if (command === 'choose') return (await chooseModelConnection(control,{question})).view;
+  if (command === 'setup' || command === 'choose') { const selected=await chooseModelConnection(control,{question,selectChoice});
+    if(selected.unavailable)throw Error('Update the Aglit runtime to restore model discovery before configuring model proxying');
+    return command==='setup'?control('models-setup',{connection_id:selected.connectionId}):selected.view; }
   throw Error('Use aglit models list|register|prefer|remove|publish|unpublish|unserve|choose');
 }
 module.exports={chooseModelConnection,listModelConnections,modelCommand,validateModelCommand};

package/src/setup-account.cjs

@@ -0,0 +1,24 @@
+'use strict';
+async function setupAccount(control, ui, state, { interactive, expectedEmail, delay = ms => new Promise(resolve => setTimeout(resolve, ms)) } = {}) {
+  if (state.email && interactive) {
+    const choice = await ui.account(state.email);
+    if (choice === 'change') {
+      try { await control('account-sign-out'); }
+      catch (error) { if (/Unknown Computer Use command/.test(error.message)) throw Error('Update the Aglit runtime before switching accounts. The current account is unchanged.'); throw error; }
+      state = await control('status');
+      if (state.email) throw Error('The previous account has not signed out. Setup stopped.');
+    }
+  }
+  if (!state.email) {
+    state = await ui.step('Sign in to Aglit in your browser', async () => {
+      await control('login'); const deadline = Date.now() + 5 * 60000;
+      while (Date.now() < deadline) { await delay(1500); const current = await control('status'); if (current.email) return current; }
+      throw Error('Sign-in timed out. Run aglit init to resume.');
+    });
+    ui.selection('Aglit account', state.email);
+  }
+  if (expectedEmail && state.email.toLowerCase() !== expectedEmail.toLowerCase())
+    throw Error(`Signed in as ${state.email}; expected ${expectedEmail}. Rerun aglit init and choose a different account.`);
+  return state;
+}
+module.exports = { setupAccount };

package/src/ui.cjs

@@ -40,15 +40,12 @@ async function createUi(interactive) {
       return teams;
     },
     pipelines(value) {
-      p.note((value.devices.length ? value.devices.map(device => `${clean(device.name)}${device.platform ? ' · ' + clean(device.platform) : ''}`).join('\n') + '\n\n' : 'No authorized pipeline devices.\n\n') +
-        'https://pipelines.aglit.ai/\nOpen the encrypted viewer with aglit pipelines --open.', 'Pipeline devices');
+      p.note((value.devices.length ? value.devices.map(device => `${clean(device.name)}${device.platform ? ' · ' + clean(device.platform) : ''}`).join('\n') + '\n\n' : 'No authorized pipeline devices.\n\n'), 'Pipeline devices');
     },
-    reuseSetup: state => {
-      p.note([`Computer  ${clean(state.name)}`, `Account   ${clean(state.email)}`,
-        state.provider && `Provider  ${clean(state.provider)}`].filter(Boolean).join('\n'), 'Saved setup');
-      return answer(p.confirm({ message: 'Reuse these settings?', initialValue: true }));
-    },
-    confirmAccount: email => answer(p.confirm({ message: `Register with ${clean(email)}?`, initialValue: true })),
+    account: email => answer(p.select({ message: 'Aglit account', initialValue: 'keep',
+      options: [{value:'keep',label:clean(email)},{value:'change',label:'Use a different account'}] })),
+    modelConnection: (connections, preferred) => answer(p.select({ message:'AI provider', initialValue:preferred,
+      options:connections.map(value=>({value:value.id,label:clean(value.name),hint:value.kind==='remote'?'Shared account':'This computer'})) })),
     async step(label, action) {
       const spinner = p.spinner(); spinner.start(label);
       try { const value = await action(); spinner.stop(label); return value; }