@aitherium/shell-cli 1.11.1 → 1.12.1

package/dist/install-wizard.js

@@ -0,0 +1,397 @@
+/**
+ * AitherShell Installer Wizard
+ * ===========================
+ *
+ * Non-technical user flow: one-click installer via interactive prompts.
+ * Guides the user through device-flow login, license provisioning,
+ * endpoint registration, and adk quickstart bootstrap.
+ *
+ * Endpoints called:
+ *   POST /v1/licenses/issue       (Bearer token auth)
+ *   POST /v1/endpoints/register   (X-License-Key header)
+ *   POST /v1/workspace/sync       (X-License-Key header)
+ */
+import { execSync } from 'node:child_process';
+import { writeFileSync, mkdirSync, chmodSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir, cpus } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import chalk from 'chalk';
+import ora from 'ora';
+import { requestDeviceCode, pollDeviceToken, buildProfile, setProfile, } from './auth.js';
+/* ── Onboarding Client ───────────────────────────────────────── */
+export class OnboardingClient {
+    portalUrl;
+    authToken = null;
+    constructor(portalUrl = 'https://portal.aitherium.com') {
+        this.portalUrl = portalUrl.replace(/\/+$/, '');
+    }
+    setAuthToken(token) {
+        this.authToken = token;
+    }
+    /**
+     * POST /v1/licenses/issue — Mint a license.
+     * Requires: Bearer token in Authorization header
+     * Returns: license_key, tier, entitlements, expires_at
+     */
+    async issueLicense(tierRequest, hardwareId) {
+        if (!this.authToken) {
+            throw new Error('Not authenticated — run device-flow login first');
+        }
+        const body = { tier_request: tierRequest };
+        if (hardwareId)
+            body.hardware_id = hardwareId;
+        const resp = await fetch(`${this.portalUrl}/v1/licenses/issue`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${this.authToken}`,
+            },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(15000),
+        });
+        if (!resp.ok) {
+            const text = await resp.text().catch(() => '');
+            throw new Error(`License issue failed (HTTP ${resp.status}): ${text}`);
+        }
+        return resp.json();
+    }
+    /**
+     * POST /v1/endpoints/register — Register a compute endpoint.
+     * Requires: license_key in request body
+     * Returns: endpoint_id, tenant_id, workspace_id, sync_interval
+     */
+    async registerEndpoint(licenseKey, nodeId, hostname, systemInfo) {
+        const body = {
+            node_id: nodeId,
+            hostname,
+            system_info: systemInfo,
+            license_key: licenseKey,
+        };
+        const resp = await fetch(`${this.portalUrl}/v1/endpoints/register`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(15000),
+        });
+        if (!resp.ok) {
+            const text = await resp.text().catch(() => '');
+            throw new Error(`Endpoint register failed (HTTP ${resp.status}): ${text}`);
+        }
+        return resp.json();
+    }
+    /**
+     * POST /v1/workspace/sync — Sync workspace configuration.
+     * Requires: X-License-Key header
+     * Returns: agent_roster, provider_key_refs, settings, cache_ttl
+     */
+    async syncWorkspace(licenseKey, workspaceId) {
+        const body = {
+            workspace_id: workspaceId,
+            heartbeat: false,
+        };
+        const resp = await fetch(`${this.portalUrl}/v1/workspace/sync`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'X-License-Key': licenseKey,
+            },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(15000),
+        });
+        if (!resp.ok) {
+            const text = await resp.text().catch(() => '');
+            throw new Error(`Workspace sync failed (HTTP ${resp.status}): ${text}`);
+        }
+        return resp.json();
+    }
+}
+/* ── System Detection ────────────────────────────────────────── */
+/**
+ * Detect CPU count (always available).
+ */
+function detectCpuCount() {
+    return cpus().length;
+}
+/**
+ * Best-effort GPU detection via nvidia-smi (NVIDIA only).
+ * Returns { name, vram } or null if not found.
+ */
+function detectGpu() {
+    try {
+        const out = execSync('nvidia-smi --query-gpu=name,memory.total --format=csv,noheader', {
+            encoding: 'utf-8',
+            timeout: 5000,
+        }).trim();
+        const parts = out.split(',').map((s) => s.trim());
+        if (parts.length >= 2) {
+            const name = parts[0];
+            const vramMb = parseInt(parts[1].replace(/[^0-9]/g, ''), 10);
+            return { name, vram: vramMb };
+        }
+    }
+    catch {
+        // nvidia-smi not found or failed — skip
+    }
+    return null;
+}
+/**
+ * Collect basic system info for the portal.
+ */
+export function collectSystemInfo() {
+    const info = {
+        cpu_count: detectCpuCount(),
+        models_present: [],
+    };
+    const gpu = detectGpu();
+    if (gpu) {
+        info.gpu_name = gpu.name;
+        info.gpu_vram = gpu.vram;
+    }
+    return info;
+}
+/**
+ * Check if Docker is running (best-effort).
+ * Returns true if 'docker ps' succeeds, false otherwise.
+ */
+export function isDockerRunning() {
+    try {
+        execSync('docker ps', { stdio: 'ignore', timeout: 5000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Check if 'adk' command is on PATH.
+ */
+export function isAdkAvailable() {
+    try {
+        execSync('adk --version', { stdio: 'ignore', timeout: 5000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/* ── Installation Flow ───────────────────────────────────────── */
+/**
+ * Run the interactive installation wizard.
+ *
+ * Flow:
+ *   1. Welcome banner
+ *   2. Check Docker (optional)
+ *   3. Device-flow portal login
+ *   4. Request license tier
+ *   5. Detect system info
+ *   6. Register endpoint
+ *   7. Sync workspace
+ *   8. Run 'adk quickstart-local' (bootstrap Ollama + model)
+ *   9. Persist workspace config
+ *   10. Print success message
+ */
+export async function runWizard(client, config) {
+    console.log();
+    console.log(chalk.bold(chalk.cyan('╔════════════════════════════════════════╗')));
+    console.log(chalk.bold(chalk.cyan('║   AitherOS Installer Wizard             ║')));
+    console.log(chalk.bold(chalk.cyan('╚════════════════════════════════════════╝')));
+    console.log();
+    // ── Step 1: Check Docker ──────────────────────────────────────────
+    console.log(chalk.bold('Step 1: Pre-flight checks'));
+    const spinner = ora({ prefixText: '  ' });
+    spinner.start('Checking Docker...');
+    const dockerRunning = isDockerRunning();
+    if (dockerRunning) {
+        spinner.succeed('Docker is running');
+    }
+    else {
+        spinner.warn('Docker not running');
+        console.log();
+        console.log(chalk.yellow('  ⚠ Docker is recommended for full AitherOS features.'));
+        console.log(chalk.dim('    Install: https://docker.com'));
+        console.log(chalk.dim('    Or use standalone ADK: pip install aither-adk'));
+        console.log();
+    }
+    // ── Step 2: Device-flow login ────────────────────────────────────
+    console.log();
+    console.log(chalk.bold('Step 2: Sign in to your account'));
+    console.log();
+    let authToken = null;
+    try {
+        const dc = await requestDeviceCode(config.identityUrl, 'AitherShell-Installer');
+        console.log('  Open this URL in your browser:');
+        console.log('  ' + chalk.cyan.underline(dc.verification_uri_complete || dc.verification_uri));
+        if (dc.user_code) {
+            console.log();
+            console.log('  Code: ' + chalk.bold.yellow(dc.user_code));
+        }
+        console.log();
+        spinner.start('Waiting for authorization');
+        const deadline = Date.now() + (dc.expires_in || 900) * 1000;
+        const interval = Math.max(2, dc.interval || 5) * 1000;
+        while (Date.now() < deadline) {
+            await new Promise((r) => setTimeout(r, interval));
+            try {
+                const result = await pollDeviceToken(config.identityUrl, dc.device_code);
+                if ((result.status === 'complete' || result.status === 'authorized') &&
+                    result.access_token) {
+                    authToken = result.access_token;
+                    const profile = buildProfile(config.identityUrl, config.genesisUrl, result);
+                    setProfile('local', profile);
+                    config.authToken = authToken;
+                    config.authUser = profile.user;
+                    spinner.succeed(chalk.green(`Signed in as ${profile.user.display_name || profile.user.username}`));
+                    break;
+                }
+            }
+            catch (err) {
+                if (String(err?.message || '').includes('expired')) {
+                    spinner.fail('Device code expired');
+                    throw err;
+                }
+            }
+        }
+        if (!authToken) {
+            spinner.fail('Sign-in timed out');
+            throw new Error('Authorization timeout');
+        }
+    }
+    catch (err) {
+        console.log();
+        console.error(chalk.red(`  Error during sign-in: ${err.message}`));
+        process.exit(1);
+    }
+    console.log();
+    // ── Step 3: Issue license ────────────────────────────────────────
+    console.log(chalk.bold('Step 3: Provision license'));
+    const onboarding = new OnboardingClient(process.env.AITHER_PORTAL_URL || 'https://portal.aitherium.com');
+    onboarding.setAuthToken(authToken);
+    let licenseKey;
+    let workspaceId;
+    spinner.start('Requesting license...');
+    try {
+        const licenseResp = await onboarding.issueLicense('developer');
+        licenseKey = licenseResp.license_key;
+        spinner.succeed(`License issued: ${licenseResp.tier} (expires ${new Date(licenseResp.expires_at * 1000).toLocaleDateString()})`);
+    }
+    catch (err) {
+        spinner.fail(`License request failed: ${err.message}`);
+        console.error(chalk.red(`  ${err.message}`));
+        process.exit(1);
+    }
+    console.log();
+    // ── Step 4: Collect system info ──────────────────────────────────
+    console.log(chalk.bold('Step 4: Detect system hardware'));
+    spinner.start('Collecting system info...');
+    const systemInfo = collectSystemInfo();
+    spinner.succeed(`CPU: ${systemInfo.cpu_count} cores${systemInfo.gpu_name ? `, GPU: ${systemInfo.gpu_name}` : ''}`);
+    console.log();
+    // ── Step 5: Register endpoint ────────────────────────────────────
+    console.log(chalk.bold('Step 5: Register endpoint'));
+    const nodeId = process.env.HOSTNAME || randomUUID().slice(0, 12);
+    const hostname = nodeId;
+    spinner.start('Registering endpoint...');
+    try {
+        const regResp = await onboarding.registerEndpoint(licenseKey, nodeId, hostname, systemInfo);
+        workspaceId = regResp.workspace_id;
+        spinner.succeed(`Endpoint registered: ${regResp.endpoint_id}`);
+    }
+    catch (err) {
+        spinner.fail(`Endpoint registration failed: ${err.message}`);
+        console.error(chalk.red(`  ${err.message}`));
+        process.exit(1);
+    }
+    console.log();
+    // ── Step 6: Sync workspace ───────────────────────────────────────
+    console.log(chalk.bold('Step 6: Sync workspace'));
+    spinner.start('Syncing workspace configuration...');
+    try {
+        await onboarding.syncWorkspace(licenseKey, workspaceId);
+        spinner.succeed('Workspace synced');
+    }
+    catch (err) {
+        spinner.warn(`Workspace sync failed (non-fatal): ${err.message}`);
+    }
+    console.log();
+    // ── Step 7: ADK Quickstart ───────────────────────────────────────
+    console.log(chalk.bold('Step 7: Bootstrap ADK and models'));
+    console.log();
+    let adkAvailable = isAdkAvailable();
+    if (!adkAvailable) {
+        spinner.start('Installing aither-adk...');
+        try {
+            execSync('pip install aither-adk', { stdio: 'inherit', timeout: 60000 });
+            spinner.succeed('aither-adk installed');
+            adkAvailable = true;
+        }
+        catch (err) {
+            spinner.warn('Could not auto-install aither-adk. Please run: pip install aither-adk');
+        }
+    }
+    if (adkAvailable) {
+        console.log();
+        console.log(chalk.dim('  Running: adk quickstart-local'));
+        console.log(chalk.dim('  (This bootstraps Ollama and downloads a model — may take a few minutes)'));
+        console.log();
+        try {
+            execSync('adk quickstart-local', { stdio: 'inherit' });
+        }
+        catch (err) {
+            console.error(chalk.yellow('\n  ⚠ ADK quickstart encountered an error'));
+            console.error(chalk.dim(`  Error: ${err.message}`));
+            console.log();
+            console.log(chalk.dim('  You can retry manually: adk quickstart-local'));
+        }
+    }
+    console.log();
+    // ── Step 8: Persist workspace config ─────────────────────────────
+    console.log(chalk.bold('Step 8: Save configuration'));
+    const configDir = join(homedir(), '.aither');
+    const workspaceConfPath = join(configDir, 'workspace.conf');
+    const workspaceConf = {
+        workspace_id: workspaceId,
+        license_key: licenseKey,
+        node_id: nodeId,
+        endpoint_id: nodeId,
+        registered_at: new Date().toISOString(),
+    };
+    try {
+        if (!existsSync(configDir)) {
+            mkdirSync(configDir, { recursive: true });
+        }
+        writeFileSync(workspaceConfPath, JSON.stringify(workspaceConf, null, 2), 'utf-8');
+        try {
+            chmodSync(workspaceConfPath, 0o600);
+        }
+        catch {
+            // Windows — ignore chmod errors
+        }
+        spinner.succeed(`Workspace config saved to ${workspaceConfPath}`);
+    }
+    catch (err) {
+        spinner.warn(`Could not save workspace config: ${err.message}`);
+    }
+    console.log();
+    // ── Success banner ───────────────────────────────────────────────
+    console.log(chalk.green(chalk.bold('✓ Installation complete!')));
+    console.log();
+    console.log('  Next steps:');
+    console.log();
+    console.log(chalk.cyan('  1. Start the shell:'));
+    console.log(chalk.dim('     aither'));
+    console.log();
+    console.log(chalk.cyan('  2. View dashboard (if Docker is running):'));
+    console.log(chalk.dim('     http://localhost:3000'));
+    console.log();
+    console.log(chalk.cyan('  3. Try a quick command:'));
+    console.log(chalk.dim('     aither "What services are running?"'));
+    console.log();
+    if (!dockerRunning) {
+        console.log(chalk.yellow('  ℹ Docker is not running.'));
+        console.log(chalk.dim('    Start Docker Desktop to unlock the full dashboard and GPU inference.'));
+        console.log();
+    }
+}

package/dist/main.js

@@ -1,7 +1,19 @@
 #!/usr/bin/env node
-// Trust AitherOS self-signed TLS certs without disabling all verification.
-// Prefer NODE_EXTRA_CA_CERTS (adds our CA to the trust chain) if available;
-// only fall back to NODE_TLS_REJECT_UNAUTHORIZED=0 when no CA chain exists.
+// Trust AitherOS internal TLS certs.
+//
+// Reality of the fleet's PKI: each internal service ships a SELF-SIGNED leaf
+// (e.g. Identity at :8115 → subject==issuer CN=aitheros-identity, no SAN for
+// 127.0.0.1). Those certs are NOT issued by ca-chain.pem and carry no loopback
+// SAN, so NODE_EXTRA_CA_CERTS can never validate them — under Node, fetch() to an
+// https-only internal service (Identity) fails cert/hostname verification and the
+// status banner false-flags it DOWN even though it's up. (Bun ignores
+// NODE_EXTRA_CA_CERTS entirely; its per-request `tls` opt is handled in the probe.)
+//
+// So: when the primary endpoint is a LOCAL/loopback fleet (the self-signed trust
+// domain), disable verification. For a PUBLIC endpoint (idp/gateway.aitherium.com,
+// real CA-issued certs) keep strict TLS — those validate normally and must stay
+// protected against MITM. NODE_EXTRA_CA_CERTS is still set when present (harmless,
+// and helps any service that IS chain-issued).
 import { existsSync } from 'fs';
 import { join, basename } from 'path';
 const _caChainPaths = [
@@ -10,11 +22,26 @@ const _caChainPaths = [
     '/app/AitherOS/Library/Data/tls/ca-chain.pem',
 ];
 const _caChain = _caChainPaths.find(p => p && existsSync(p));
-if (_caChain) {
+if (_caChain)
     process.env.NODE_EXTRA_CA_CERTS = _caChain;
-}
-else {
-    // No CA chain found — disable verification as last resort (suppress warning via env)
+// Resolve the primary endpoint the same way loadConfig() does (env precedence),
+// then decide if we're in the internal self-signed trust domain.
+const _primaryUrl = process.env.AITHER_API_URL || process.env.AITHER_GENESIS_URL ||
+    process.env.AITHER_GATEWAY_URL || 'http://127.0.0.1:8001';
+const _isLoopbackFleet = (() => {
+    try {
+        const h = new URL(_primaryUrl).hostname;
+        return h === 'localhost' || h === '127.0.0.1' || h === '::1' ||
+            /^10\./.test(h) || /^192\.168\./.test(h) ||
+            /^172\.(1[6-9]|2\d|3[01])\./.test(h) ||
+            h.endsWith('.local') || h.endsWith('.internal');
+    }
+    catch {
+        return true;
+    } // unparseable → assume local dev
+})();
+// Explicit override always wins; otherwise relax only for the loopback fleet.
+if (process.env.NODE_TLS_REJECT_UNAUTHORIZED == null && _isLoopbackFleet) {
     process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
 }
 /**
@@ -79,7 +106,7 @@ async function resolveResume(client, config, mode, id) {
 // Install global crash reporter — catches uncaught exceptions/rejections,
 // prompts user to send error report, creates GitHub issue automatically.
 installCrashReporter();
-const VERSION = '1.10.0'; // keep in sync with package.json
+const VERSION = '1.12.0'; // keep in sync with package.json
 async function main() {
     const args = process.argv.slice(2);
     if (args.includes('--help') || args.includes('-h')) {
@@ -224,7 +251,7 @@ async function main() {
     // ── Explicit one-shot subcommands that must NOT fall through to chat ──
     // e.g. `aither node ls`, `aither node enroll --tenant acme`. Without this,
     // "node ls" became a positional chat prompt → intent-classified as a query.
-    const ONESHOT_CMDS = new Set(['node', 'nodes']);
+    const ONESHOT_CMDS = new Set(['node', 'nodes', 'install']);
     if (args[0] && ONESHOT_CMDS.has(args[0].toLowerCase())) {
         const { getCommand } = await import('./commands.js');
         const cmd = getCommand(args[0].toLowerCase());

package/dist/renderer.js

@@ -33,7 +33,7 @@ export function osc8Link(url, label) {
 }
 /* ── Banner ─────────────────────────────────────────────────── */
 export function renderBanner(info) {
-    const version = 'v1.11.1'; // keep in sync with package.json
+    const version = 'v1.12.0'; // keep in sync with package.json
     const title = `AitherShell ${version}`;
     let connected;
     if (info.genesisOnline === true) {
@@ -379,6 +379,11 @@ export function createStreamRenderer(sessionId, prompt, steeringBar) {
     let lastStage = ''; // Current pipeline stage — shown in heartbeat spinner
     let eagerActive = false; // Eager streaming: multiple answer_segments this turn
     let eagerSegments = 0; // Count of segments rendered
+    let segmentTokenStreamed = false; // Did THIS segment receive token events? If a
+    // segment header printed but no tokens arrived
+    // (engine sent the answer as one 'answer' event),
+    // we must print the answer ourselves or the user
+    // is left staring at just the preamble line.
     // ── Session trace collection ──
     const traceEvents = [];
     const traceToolCalls = [];
@@ -592,6 +597,7 @@ export function createStreamRenderer(sessionId, prompt, steeringBar) {
                         log(chalk.cyan('  💬 Initial') + segReason);
                     }
                     tokensStarted = false; // re-enter first-token path for this segment
+                    segmentTokenStreamed = false; // reset per-segment token tracking
                     content = ''; // per-segment accumulator (final captured at complete)
                     break;
                 }
@@ -614,6 +620,7 @@ export function createStreamRenderer(sessionId, prompt, steeringBar) {
                     process.stdout.write(t);
                     hasOutput = true;
                     tokenStreamed = true;
+                    segmentTokenStreamed = true;
                     contentDisplayed = true;
                     break;
                 }
@@ -622,10 +629,21 @@ export function createStreamRenderer(sessionId, prompt, steeringBar) {
                 case 'final_answer': {
                     stopSpinner();
                     // Eager streaming already rendered the answer as live segments —
-                    // the terminal `answer` event is just the canonical copy for
-                    // trace/getContent. Capture it, don't re-print.
+                    // the terminal `answer` event is normally just the canonical copy
+                    // for trace/getContent. BUT if the current segment printed a header
+                    // ("💬 Initial …") yet no token events streamed (the engine returned
+                    // the answer as a single 'answer' event, e.g. the search fastpath),
+                    // the user would see only the preamble. In that case print it now.
                     if (eagerActive) {
-                        content = event.data.answer || event.data.content || content;
+                        const eagerAnswer = event.data.answer || event.data.content || content;
+                        if (!segmentTokenStreamed && eagerAnswer && eagerAnswer.trim()) {
+                            process.stdout.write('\r\x1b[2K');
+                            process.stdout.write(renderMarkdown(wrapBareCode(eagerAnswer)));
+                            if (!eagerAnswer.endsWith('\n'))
+                                process.stdout.write('\n');
+                            segmentTokenStreamed = true; // guard against double-print at complete
+                        }
+                        content = eagerAnswer;
                         contentDisplayed = true;
                         hasOutput = true;
                         break;
@@ -686,6 +704,25 @@ export function createStreamRenderer(sessionId, prompt, steeringBar) {
                     }
                     break;
                 }
+                case 'tool_decision': {
+                    // Pre-execution preamble: names the chosen tools the instant they're
+                    // parsed, before the (silent) tool execution wait.
+                    stopSpinner();
+                    const preamble = event.data.preamble
+                        || `Calling tools: ${(event.data.tools || []).join(', ')}`;
+                    log('  ' + chalk.yellow(`⚡ ${preamble}`));
+                    break;
+                }
+                case 'tool_call_preview': {
+                    // Trace-only: the model committed to a tool NAME mid-stream. Shown the
+                    // instant it's known; execution still happens from the done chunk.
+                    stopSpinner();
+                    const argHint = event.data.arguments_preview
+                        ? chalk.gray(` ${String(event.data.arguments_preview).slice(0, 80)}`)
+                        : '';
+                    log('  ' + chalk.yellow(`🔧 Calling ${event.data.name || 'tool'}…`) + argHint);
+                    break;
+                }
                 case 'tool_call': {
                     stopSpinner();
                     const turnLabel2 = event.data.turn != null ? chalk.cyan(`[Turn ${event.data.turn}] `) : '';
@@ -778,6 +815,17 @@ export function createStreamRenderer(sessionId, prompt, steeringBar) {
                         hasOutput = true;
                     break;
                 }
+                case 'suggested_followups': {
+                    // Proactive next-steps. Plain REPL is append-only (no digit-select);
+                    // the eager answer already streamed above, so these land beneath it.
+                    const fups = Array.isArray(event.data.followups) ? event.data.followups : [];
+                    if (fups.length) {
+                        process.stdout.write('\n' + chalk.dim('  Next →') + '\n');
+                        fups.forEach((t, i) => process.stdout.write('  ' + chalk.cyan(`[${i + 1}]`) + ' ' + chalk.dim(String(t)) + '\n'));
+                        hasOutput = true;
+                    }
+                    break;
+                }
                 case 'done':
                 case 'complete': {
                     stopSpinner();