@aopslabs/aops 0.2.1 → 0.3.1

package/dist/lib/setup-init-orchestrator.js

@@ -1,14 +1,12 @@
 import path from 'node:path';
-import { banner, logInfo, logSuccess, logWarn, withSpinner } from '@aopslabs/xf-cli-ui';
+import { logInfo, logSuccess, logWarn } from '@aopslabs/xf-cli-ui';
 import { canonicalCommercialJson, managedInstallationLayoutBinding, sha256Commercial, } from '@aopslabs/artifact-trust-contracts';
-import { runAuthLogin } from '../commands/auth/login.js';
 import { runCommunityServerSetup } from '../commands/community-server.js';
 import { runTargetAdd } from '../commands/target.js';
-import { promptConfirm, promptInput, promptPassword, promptSelect } from '../utils/prompts.js';
-import { inspectSetupReadiness, parseSetupPath, SETUP_PATHS, } from './setup-readiness.js';
-import { applySetupAgentAssets, SETUP_AGENT_ASSETS_GATEWAYS, } from './setup-agent-assets-bridge.js';
+import { inspectSetupReadiness, parseSetupPath, } from './setup-readiness.js';
+import { applySetupAgentAssets, } from './setup-agent-assets-bridge.js';
 import { defaultLocalPostgresAdminUser, defaultLocalPostgresDatabase, provisionLocalPostgres, } from './setup-local-postgres.js';
-import { isExternalPostgresTlsProbeError, probeExternalPostgresConnection, } from './setup-external-postgres.js';
+import { probeExternalPostgresConnection } from './setup-external-postgres.js';
 import { assertCommunityNativeApplicationCurrent, inspectCommunityNativeInstall, inspectCommunityNativeSource, planCommunityNativeInstalledMigration, resolveCommunityNativeDefaultSourceRoot, stopCommunityNativeInstall, } from './community-native-lifecycle.js';
 import { startCommunityNativeCockpit, stopCommunityNativeCockpit, } from './community-cockpit-lifecycle.js';
 import { CommunityDiagnosticError, isCommunityDiagnosticV1, } from './community-diagnostic.js';
@@ -144,22 +142,6 @@ function resolveSetupLocalSecurity(selectedPath, requestedAuth, requestedExposur
     }
     return Object.freeze({ authProvider, exposure, explicit });
 }
-function validateManagedPostgresPassword(value) {
-    if (value.length < 16)
-        return 'Use at least 16 characters.';
-    if (value.length > 128)
-        return 'Use no more than 128 characters.';
-    if (value !== value.trim())
-        return 'Do not begin or end the password with whitespace.';
-    if (/\0|\r|\n/.test(value))
-        return 'The password cannot contain line breaks or NUL characters.';
-    return true;
-}
-function validateLocalPostgresIdentifier(value) {
-    return /^[a-z][a-z0-9_]{0,62}$/.test(value.trim().toLowerCase())
-        ? true
-        : 'Use 1-63 lowercase letters, digits, or underscores; begin with a letter.';
-}
 function validateLocalPostgresAdminPassword(value) {
     if (value.length > 1_024)
         return 'Use no more than 1024 characters.';
@@ -167,22 +149,6 @@ function validateLocalPostgresAdminPassword(value) {
         return 'The password cannot contain line breaks or NUL characters.';
     return true;
 }
-function printMigrationVerification(result) {
-    if (!result || typeof result !== 'object')
-        return;
-    const migration = result.migration;
-    if (!migration || typeof migration !== 'object')
-        return;
-    const summary = migration;
-    if (summary.status !== 'community-native-migration-verified')
-        return;
-    const action = summary.action === 'migrate' ? 'migrate' : 'verify-only';
-    const count = typeof summary.pendingMigrationCount === 'number' ? summary.pendingMigrationCount : 0;
-    const detail = action === 'migrate'
-        ? `${count} migration${count === 1 ? '' : 's'} applied`
-        : 'schema already current';
-    logSuccess(`PostgreSQL schema verified (${detail}).`);
-}
 function printSetupReadiness(result) {
     for (const check of result.checks) {
         const prefix = check.state === 'ready'
@@ -237,79 +203,17 @@ export async function runSetupInitOrchestrator(options = {}, dependencies = {})
     const startInstalledCockpit = dependencies.startInstalledCockpit ?? startCommunityNativeCockpit;
     const stopInstalledCockpit = dependencies.stopInstalledCockpit ?? stopCommunityNativeCockpit;
     const addTarget = dependencies.addTarget ?? runTargetAdd;
-    const authLogin = dependencies.authLogin ?? runAuthLogin;
-    const confirm = dependencies.confirm ?? promptConfirm;
-    const password = dependencies.password ?? promptPassword;
-    const input = dependencies.input ?? promptInput;
-    const select = dependencies.select ?? promptSelect;
-    const interactive = !options.yes && !options.json;
     const directProgress = async (_label, action) => action();
-    const progress = interactive
-        ? dependencies.progress ?? (process.stdout.isTTY === true ? withSpinner : directProgress)
-        : directProgress;
+    const progress = directProgress;
     const requestedAgentAssetsAction = normalizeAgentAssetsAction(options.agentAssets);
     const requestedPath = normalizeNonEmpty(options.path);
     if (requestedPath && !parseSetupPath(requestedPath)) {
         throw new Error('setup_init_path_invalid:choose_1_2_3_or_4');
     }
-    if (interactive && !options.skipBanner) {
-        banner('AOPS Setup');
-        logInfo('Install directly here. For guided installation with any terminal AI agent, use `aops setup ai`.');
-        logInfo('Enter database secrets only in masked AOPS prompts; never paste them into chat.');
-    }
-    let selectedPath = parseSetupPath(requestedPath);
-    if (!selectedPath && interactive) {
-        const inferred = await inspectReadiness({
-            postgresConfig: options.postgresConfig,
-            postgresTls: options.postgresTls,
-            apiBaseUrl: options.apiBaseUrl,
-            targetName: options.targetName,
-            instance: options.instance,
-            dataRoot: options.dataRoot,
-            sourceRoot: options.sourceRoot,
-            port: options.port,
-            agentAssetsProvider: dependencies.agentAssets,
-            timeoutMs: options.timeoutMs,
-        });
-        selectedPath = inferred.path.id ?? undefined;
-        if (!selectedPath) {
-            selectedPath = await select({
-                message: 'Choose an AOPS setup path:',
-                choices: SETUP_PATHS.map((entry) => ({
-                    name: `${entry.number}. ${entry.title}`,
-                    value: entry.id,
-                })),
-                default: 'native-external',
-            });
-        }
-    }
+    const selectedPath = parseSetupPath(requestedPath);
     const localSecurity = resolveSetupLocalSecurity(selectedPath, options.auth, options.exposure);
     let effectiveApiBaseUrl = normalizeNonEmpty(options.apiBaseUrl);
     let effectiveTargetName = normalizeNonEmpty(options.targetName);
-    if (selectedPath === 'cli-existing' && interactive) {
-        effectiveApiBaseUrl ??= normalizeNonEmpty(await input({
-            message: 'Existing AOPS Server URL:',
-            default: 'https://aops.example.com',
-            validate: (value) => {
-                try {
-                    const parsed = new URL(value.trim());
-                    return (['http:', 'https:'].includes(parsed.protocol) &&
-                        !parsed.username && !parsed.password && !parsed.search && !parsed.hash &&
-                        (parsed.pathname === '/' || parsed.pathname === '')) || 'Use an http(s) origin without credentials, query, fragment, or path.';
-                }
-                catch {
-                    return 'Use a valid http(s) origin.';
-                }
-            },
-        }));
-        effectiveTargetName ??= normalizeNonEmpty(await input({
-            message: 'Name for this AOPS target:',
-            default: 'external',
-            validate: (value) => /^[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?$/.test(value.trim().toLowerCase())
-                ? true
-                : 'Use 1-32 lowercase letters, digits, or hyphens.',
-        }));
-    }
     let postgresTls = options.postgresTls;
     if (selectedPath === 'native-external' && !postgresTls)
         postgresTls = 'require';
@@ -321,39 +225,6 @@ export async function runSetupInitOrchestrator(options = {}, dependencies = {})
         ?? defaultLocalPostgresDatabase(options.instance);
     let localPostgresAppUser = normalizeNonEmpty(options.localPostgresAppUser)
         ?? localPostgresDatabase;
-    if (selectedPath === 'native-local' && interactive) {
-        localPostgresHost = await input({
-            message: 'Local PostgreSQL host (loopback only):',
-            default: localPostgresHost,
-            validate: (value) => ['localhost', '127.0.0.1', '::1'].includes(value.trim().toLowerCase())
-                || /^127(?:\.\d{1,3}){3}$/.test(value.trim())
-                ? true
-                : 'Use a loopback host such as 127.0.0.1 or localhost.',
-        });
-        localPostgresPort = Number(await input({
-            message: 'Local PostgreSQL port:',
-            default: String(localPostgresPort),
-            validate: (value) => {
-                const port = Number(value);
-                return Number.isSafeInteger(port) && port >= 1 && port <= 65_535 ? true : 'Use a TCP port from 1 to 65535.';
-            },
-        }));
-        localPostgresAdminUser = await input({
-            message: 'PostgreSQL administrator role:',
-            default: localPostgresAdminUser,
-            validate: validateLocalPostgresIdentifier,
-        });
-        localPostgresDatabase = await input({
-            message: 'New AOPS database name:',
-            default: localPostgresDatabase,
-            validate: validateLocalPostgresIdentifier,
-        });
-        localPostgresAppUser = await input({
-            message: 'New AOPS application role:',
-            default: localPostgresAppUser,
-            validate: validateLocalPostgresIdentifier,
-        });
-    }
     if (selectedPath && !['native-external', 'native-local'].includes(selectedPath) && options.postgresConfig) {
         throw new Error('setup_init_postgres_config_only_valid_for_paths_1_or_3');
     }
@@ -393,26 +264,14 @@ export async function runSetupInitOrchestrator(options = {}, dependencies = {})
         agentAssetsProvider: dependencies.agentAssets,
         timeoutMs: options.timeoutMs,
     });
-    let initial = await inspect();
+    const initial = await inspect();
     const initialServerEnv = initial.checks.find((check) => check.id === 'global-server-env');
     if (!localSecurity.explicit &&
         (initialServerEnv?.data?.authProvider === 'trusted-local')) {
         effectiveAuthProvider = initialServerEnv.data.authProvider;
         effectiveExposure = canonicalSetupExposure(effectiveAuthProvider);
     }
-    const path3Env = initial.checks.find((check) => check.id === 'global-server-env');
-    if (selectedPath === 'native-local' && interactive && !options.postgresConfig &&
-        path3Env?.data?.blocking === true && typeof path3Env.data.path === 'string') {
-        const instance = normalizeNonEmpty(options.instance)?.toLowerCase() ?? 'default';
-        const suggested = path.join(path.dirname(path3Env.data.path), `aops.${instance}.local.server.env`);
-        effectivePostgresConfig = await input({
-            message: 'Private server env for this local PostgreSQL setup:',
-            default: suggested,
-            validate: (value) => path.isAbsolute(value.trim()) ? true : 'Use an absolute private env path.',
-        });
-        initial = await inspect();
-    }
-    const shouldApply = options.apply === true || (interactive && Boolean(selectedPath));
+    const shouldApply = options.apply === true;
     const installerPlan = createSetupInstallerPlan(options, selectedPath, localSecurity, initial, {
         postgresConfig: effectivePostgresConfig,
         postgresTls: effectivePostgresTls,
@@ -433,10 +292,7 @@ export async function runSetupInitOrchestrator(options = {}, dependencies = {})
             }, null, 2));
             return initial;
         }
-        if (!interactive || options.skipBanner || initial.status === 'ready')
-            printSetupReadiness(initial);
-        else
-            logInfo('Setup was not changed. Re-run with `--apply` when using an explicit non-interactive path.');
+        printSetupReadiness(initial);
         return initial;
     }
     if (!selectedPath)
@@ -464,31 +320,8 @@ export async function runSetupInitOrchestrator(options = {}, dependencies = {})
     if (selectedPath === 'native-external' && !postgresTls) {
         throw new Error('setup_init_postgres_tls_required_for_path_1');
     }
-    let createPostgresSecret;
+    const createPostgresSecret = undefined;
     let serverEnvChanged = false;
-    if (selectedPath === 'native-container' && interactive) {
-        const passwordMode = await select({
-            message: 'Managed PostgreSQL password:',
-            choices: [
-                { name: 'Generate a strong password automatically (recommended)', value: 'generate' },
-                { name: 'Enter a custom password securely', value: 'custom' },
-            ],
-            default: 'generate',
-        });
-        if (passwordMode === 'custom') {
-            const customPassword = await password({
-                message: 'PostgreSQL password:',
-                validate: validateManagedPostgresPassword,
-            });
-            const confirmedPassword = await password({
-                message: 'Confirm PostgreSQL password:',
-                validate: (value) => value === customPassword ? true : 'Passwords do not match.',
-            });
-            if (confirmedPassword !== customPassword)
-                throw new Error('setup_init_postgres_password_mismatch');
-            createPostgresSecret = () => customPassword;
-        }
-    }
     const localServerPath = selectedPath !== 'cli-existing';
     const localApiBaseUrl = effectiveApiBaseUrl ?? `http://127.0.0.1:${options.port ?? 5900}`;
     let officialCatalogRelease;
@@ -523,36 +356,7 @@ export async function runSetupInitOrchestrator(options = {}, dependencies = {})
     if (selectedPath === 'native-external') {
         const envCheck = initial.checks.find((check) => check.id === 'global-server-env');
         const envReady = envCheck?.state === 'ready';
-        if (interactive) {
-            if (!dependencies.setupServerEnv) {
-                throw new Error('setup_init_external_postgres_env_provider_unavailable');
-            }
-            const serverEnv = await dependencies.setupServerEnv({
-                root: options.sourceRoot,
-                envPath: options.postgresConfig,
-                auth: localSecurity.explicit ? effectiveAuthProvider : undefined,
-                skipBanner: true,
-            });
-            if (!serverEnv.ok || serverEnv.repoDialect !== 'pg') {
-                throw new Error('setup_init_external_postgres_env_not_ready');
-            }
-            effectivePostgresConfig = serverEnv.envPath;
-            if (localSecurity.explicit &&
-                serverEnv.authProvider &&
-                serverEnv.authProvider !== effectiveAuthProvider) {
-                throw new Error('setup_init_server_env_auth_provider_mismatch');
-            }
-            effectiveAuthProvider = serverEnv.authProvider ?? effectiveAuthProvider;
-            effectiveExposure = canonicalSetupExposure(effectiveAuthProvider);
-            serverEnvChanged = serverEnv.updated === true;
-            steps.push({
-                action: 'setup.server-env',
-                status: serverEnv.updated ? 'updated' : 'ready',
-                envPath: serverEnv.envPath,
-                authProvider: effectiveAuthProvider,
-            });
-        }
-        else if (!envReady &&
+        if (!envReady &&
             localSecurity.explicit &&
             envCheck?.data?.postgresReady === true) {
             if (!dependencies.setupServerEnv) {
@@ -601,35 +405,9 @@ export async function runSetupInitOrchestrator(options = {}, dependencies = {})
             connection = await testConnection();
         }
         catch (error) {
-            if (!interactive || options.postgresTls || !isExternalPostgresTlsProbeError(error))
-                throw error;
-            effectivePostgresTls = await select({
-                message: 'PostgreSQL TLS connection failed. Choose how to retry:',
-                choices: [
-                    {
-                        name: 'require',
-                        value: 'require',
-                        description: 'Keep encrypted transport without CA verification; fix PostgreSQL TLS support if this still fails.',
-                    },
-                    {
-                        name: 'verify-full',
-                        value: 'verify-full',
-                        description: 'Use certificate and hostname verification with a trusted CA certificate.',
-                    },
-                    {
-                        name: 'disable',
-                        value: 'disable',
-                        description: 'Retry without encryption only when you explicitly accept an unencrypted connection.',
-                    },
-                ],
-                default: 'require',
-            });
-            connection = await testConnection();
+            throw error;
         }
         steps.push({ action: 'setup.postgres-connection', ...connection });
-        if (interactive) {
-            logSuccess(`PostgreSQL connection verified (${connection.transport}, server ${connection.serverMajor}).`);
-        }
     }
     if (selectedPath === 'native-local') {
         const localCheck = initial.checks.find((check) => check.id === 'local-postgresql');
@@ -694,13 +472,7 @@ export async function runSetupInitOrchestrator(options = {}, dependencies = {})
             const passwordValidation = validateLocalPostgresAdminPassword(adminPassword);
             if (passwordValidation !== true)
                 throw new Error('setup_init_local_postgres_admin_password_invalid');
-            if (interactive) {
-                adminPassword = await password({
-                    message: 'Existing PostgreSQL administrator password (leave blank only for local trust auth):',
-                    validate: validateLocalPostgresAdminPassword,
-                });
-            }
-            else if (!adminPassword && options.localPostgresAdminNoPassword !== true) {
+            if (!adminPassword && options.localPostgresAdminNoPassword !== true) {
                 throw new Error('setup_init_local_postgres_admin_password_required:use_private_environment_or_--local-postgres-admin-no-password');
             }
             const provision = dependencies.provisionLocalPostgres ?? provisionLocalPostgres;
@@ -786,8 +558,6 @@ export async function runSetupInitOrchestrator(options = {}, dependencies = {})
                         migrationAction: 'verify-only',
                         acceptedPlanSha256: installedPlan.planning.acceptedPlanSha256,
                     });
-                    if (interactive)
-                        logSuccess('Running AOPS server database schema is already current.');
                 }
             }
             catch (error) {
@@ -814,7 +584,6 @@ export async function runSetupInitOrchestrator(options = {}, dependencies = {})
         }
         if (!reuseRunningServer) {
             let lifecycleResult;
-            const reportedStages = new Set();
             await progress('Preparing PostgreSQL, verifying migrations, and starting AOPS server...', () => setupCommunityServer({
                 runtime: 'native',
                 postgres: selectedPath === 'native-external' || selectedPath === 'native-local'
@@ -838,19 +607,10 @@ export async function runSetupInitOrchestrator(options = {}, dependencies = {})
                 createPostgresSecret: selectedPath === 'native-container' ? createPostgresSecret : undefined,
                 apply: true,
                 silent: true,
-                progressSink: interactive
-                    ? (event) => {
-                        if (reportedStages.has(event.stage))
-                            return;
-                        reportedStages.add(event.stage);
-                        logInfo(`  ${event.message}`);
-                    }
-                    : undefined,
+                progressSink: undefined,
                 resultSink: (result) => { lifecycleResult = result; },
             }));
             steps.push({ action: 'community-server.setup', status: 'applied', result: lifecycleResult ?? null });
-            if (interactive)
-                printMigrationVerification(lifecycleResult);
         }
         const cockpit = await progress('Starting AOPS Cockpit on its separate loopback port...', () => startInstalledCockpit({
             instanceName: options.instance,
@@ -926,12 +686,6 @@ export async function runSetupInitOrchestrator(options = {}, dependencies = {})
     }
     else if (!agentAssetsAction && dependencies.agentAssets?.apply) {
         const recommendedAction = agentAssetsCheck?.data?.recommendedAction === 'repair' ? 'repair' : 'install';
-        if (interactive) {
-            logInfo(`Codex gateway: ${SETUP_AGENT_ASSETS_GATEWAYS.codex}`);
-            logInfo(`Claude gateway: ${SETUP_AGENT_ASSETS_GATEWAYS.claude}`);
-            logInfo(`Setup will ${recommendedAction} the verified AOPS core and gateway for every registered runtime.`);
-            logInfo('Rich mounted-domain guides and discipline references will be available; setup will not select a working discipline for you.');
-        }
         agentAssetsAction = recommendedAction;
     }
     if (agentAssetsAction === 'install' || agentAssetsAction === 'repair') {
@@ -956,13 +710,6 @@ export async function runSetupInitOrchestrator(options = {}, dependencies = {})
         steps.push({ action: `assets.${agentAssetsAction}`, status: appliedAssets.state, target: 'all' });
         result = await inspect();
     }
-    if (interactive && result.checks.find((check) => check.id === 'target-login')?.state === 'action-required') {
-        if (await confirm({ message: 'Login to the selected target now?', default: true })) {
-            await authLogin({ apiBaseUrl: effectiveApiBaseUrl, target: effectiveTargetName });
-            steps.push({ action: 'auth.login', status: process.exitCode === 1 ? 'failed' : 'applied' });
-            result = await inspect();
-        }
-    }
     if (options.json) {
         console.log(JSON.stringify({
             command: 'setup.init',

package/dist/lib/setup-install-guide.js

@@ -46,7 +46,7 @@ export function buildAopsInstallAgentPrompt() {
 1. Run \`aops setup guide --json\` and follow its packaged \`aops-install\` skill as the current installation guide.
 2. Run \`aops setup init --yes --json\` first and explain the available PostgreSQL paths and remaining actions briefly.
 3. Ask me only for choices or authority you cannot safely infer. Use the installed command's exact nested \`--help\`; do not guess flags.
-4. Never ask me to paste PostgreSQL URLs or passwords into chat and never place secrets in command arguments. Let me enter private values through AOPS's masked interactive prompts.
+4. Never ask me to paste PostgreSQL URLs or passwords into chat and never place secrets in command arguments. Pass private values through the documented environment variables or private configuration files.
 5. Keep the signed official catalog and Gateway assets for all registered agent runtimes unless I explicitly opt out. Do not seed starter/demo user data.
 6. Apply the selected setup path, then verify migrations, server health, Gateway asset bindings, and Cockpit. Report the Cockpit URL and any remaining safe action.`;
 }

package/dist/main.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
+import { createCliProgram, runCli } from '@aopslabs/cli-kit';
 import { logError } from '@aopslabs/xf-cli-ui';
 import { resolveCommunityCliIdentity } from './lib/community-client-contract.js';
 import { makeInitCommand } from './commands/init.js';
@@ -28,7 +29,6 @@ import { makeMissionCommand } from './commands/mission.js';
 import { makePlaybookCommand } from './commands/playbook.js';
 import { makeResourceCommand } from './commands/resource.js';
 import { makeArtifactCommand } from './commands/artifact.js';
-import { makeCommercialLicenseCommand } from './commands/commercial-license.js';
 import { makeActivityCommand } from './commands/activity.js';
 import { makeSkillCommand } from './commands/skill.js';
 import { makeDocCommand } from './commands/doc.js';
@@ -36,11 +36,65 @@ import { makePmCommand } from './commands/pm/index.js';
 import { makeCommunityServerCommand } from './commands/community-server.js';
 import { makeCommunityCockpitCommand } from './commands/community-cockpit.js';
 import { makeCommunityDoctorCommand } from './commands/community-doctor.js';
-import { makeCommunityConsoleCommand } from './commands/community-console.js';
 import { makeTargetCommand } from './commands/target.js';
 import { makeVersionCommand } from './commands/version.js';
 import { launchBundledTui, shouldLaunchBundledTui } from './lib/tui-launcher.js';
 import { CommunityDiagnosticError, formatCommunityDiagnostic, } from './lib/community-diagnostic.js';
+import { resolveCliApiBaseUrl } from './utils/api.js';
+const KERNEL_COMMANDS_REPLACED_BY_AOPS = new Set(['agent', 'api', 'auth', 'client', 'host']);
+function removeReplacedKernelCommands(program) {
+    const mutable = program;
+    mutable.commands = mutable.commands.filter((command) => !KERNEL_COMMANDS_REPLACED_BY_AOPS.has(command.name()));
+}
+function renderTrustedLocalLicenseStatus(command) {
+    const payload = {
+        ok: true,
+        schemaVersion: 1,
+        contract: 'aops-trusted-local-license-status-v1',
+        profile: 'trusted-local',
+        commercialAvailable: false,
+        southRequired: false,
+        builtInDomains: ['agentspace', 'chatv3', 'docman', 'projectman', 'sys'],
+        next: 'South-backed licensing and external domains are not available in this public profile.',
+    };
+    const json = command.optsWithGlobals().json === true;
+    process.stdout.write(`${JSON.stringify(payload, null, json ? 0 : 2)}\n`);
+}
+function refuseTrustedLocalCommercialActivation(command) {
+    const payload = {
+        ok: false,
+        schemaVersion: 1,
+        error: 'commercial_profile_required',
+        profile: 'trusted-local',
+        action: 'license.activate',
+        message: 'South-backed licensing is not available in the public trusted-local profile.',
+    };
+    const json = command.optsWithGlobals().json === true;
+    const output = `${JSON.stringify(payload, null, json ? 0 : 2)}\n`;
+    if (json)
+        process.stdout.write(output);
+    else
+        process.stderr.write(output);
+    process.exitCode = 1;
+}
+function makeTrustedLocalLicenseCommand() {
+    const command = new Command('license')
+        .description('Inspect the public trusted-local license profile; commercial activation is unavailable');
+    command
+        .command('status')
+        .description('Show the free built-in domain profile')
+        .option('--json', 'Emit compact JSON')
+        .action((_options, actionCommand) => renderTrustedLocalLicenseStatus(actionCommand));
+    command
+        .command('activate')
+        .description('Return commercial_profile_required without accepting commercial evidence')
+        .allowUnknownOption(true)
+        .allowExcessArguments(true)
+        .argument('[args...]')
+        .option('--json', 'Emit compact JSON')
+        .action((_args, _options, actionCommand) => refuseTrustedLocalCommercialActivation(actionCommand));
+    return command;
+}
 for (const stream of [process.stdout, process.stderr]) {
     stream.on('error', (error) => {
         if (error?.code === 'EPIPE') {
@@ -50,13 +104,18 @@ for (const stream of [process.stdout, process.stderr]) {
     });
 }
 export function buildCommunityProgram() {
-    const program = new Command();
     const version = resolveCommunityCliIdentity().version;
+    const program = createCliProgram({
+        name: 'aops',
+        version,
+        description: 'AOPS Community operator CLI for local-trusted, self-hosted workflows',
+        brand: 'aops',
+        defaultApiBaseUrl: resolveCliApiBaseUrl(),
+        moduleSearchRoot: process.cwd(),
+    });
+    removeReplacedKernelCommands(program);
     program
-        .name('aops')
-        .description('AOPS Community operator CLI for local-trusted, self-hosted workflows')
         .enablePositionalOptions()
-        .version(version)
         .version(version, '--cli-version', 'output the CLI version (legacy alias)');
     program.addCommand(makeInitCommand());
     program.addCommand(makeCommunitySetupCommand());
@@ -84,7 +143,7 @@ export function buildCommunityProgram() {
     program.addCommand(makePlaybookCommand());
     program.addCommand(makeResourceCommand());
     program.addCommand(makeArtifactCommand());
-    program.addCommand(makeCommercialLicenseCommand());
+    program.addCommand(makeTrustedLocalLicenseCommand());
     program.addCommand(makeActivityCommand());
     program.addCommand(makeSkillCommand());
     program.addCommand(makeDocCommand());
@@ -92,7 +151,6 @@ export function buildCommunityProgram() {
     program.addCommand(makeCommunityServerCommand());
     program.addCommand(makeCommunityCockpitCommand());
     program.addCommand(makeCommunityDoctorCommand());
-    program.addCommand(makeCommunityConsoleCommand());
     program.addCommand(makeTargetCommand());
     program.addCommand(makeVersionCommand());
     program.addHelpText('after', `
@@ -126,7 +184,10 @@ async function main() {
             : process.argv;
         guardChatv3UnknownSubcommand(argv);
         guardCommunitySecretArgv(argv);
-        await program.parseAsync(argv);
+        const kernelArgv = argv.includes('--no-client-plugin')
+            ? argv
+            : [argv[0], argv[1], '--no-client-plugin', ...argv.slice(2)];
+        await runCli(program, kernelArgv);
     }
     catch (error) {
         if (error instanceof CommunityDiagnosticError) {

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@aopslabs/aops",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "type": "module",
   "description": "AOPS CLI and terminal setup application.",
-  "aopsDockerServerVersion": "0.2.2",
+  "aopsDockerServerVersion": "0.2.3",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {
     "type": "git",
@@ -47,15 +47,16 @@
     "test:r6-cutover-baseline": "node scripts/verify-r6-cutover-baseline.mjs",
     "test:r6-auth-cutover": "node --test test/r6-auth-cutover.test.mjs",
     "test:container-runtime": "node --test test/container-runtime.test.mjs",
+    "test:kernel-alignment": "node --test test/kernel-alignment.test.mjs",
     "test:home": "node --test test/home-menu.test.mjs",
-    "test:console": "node --test test/community-console.test.mjs",
     "test:launchers": "node --test test/terminal-launchers.test.mjs",
-    "test:shortcuts": "pnpm run test:home && pnpm run test:cockpit && pnpm run test:console && pnpm run test:launchers && pnpm run test:assets-menu && pnpm run test:agent-assets-content && pnpm run test:setup-install && pnpm run test:container-runtime && pnpm run test:native-lifecycle && pnpm run test:operation-journal && pnpm run test:commercial-canonical-order && pnpm run test:commercial-runtime-closure && pnpm run test:commercial-artifact && pnpm run test:commercial-final-readiness && pnpm run test:commercial-admission && pnpm run test:commercial-license && pnpm run test:commercial-runbook && pnpm run test:package-identity && pnpm run test:skill-discovery && pnpm run test:target-transport && pnpm run test:target-auth && pnpm run test:r6-auth-cutover && pnpm run test:r6-cutover-baseline",
+    "test:shortcuts": "pnpm run test:home && pnpm run test:cockpit && pnpm run test:launchers && pnpm run test:assets-menu && pnpm run test:agent-assets-content && pnpm run test:setup-install && pnpm run test:container-runtime && pnpm run test:native-lifecycle && pnpm run test:operation-journal && pnpm run test:commercial-canonical-order && pnpm run test:commercial-runtime-closure && pnpm run test:commercial-artifact && pnpm run test:commercial-final-readiness && pnpm run test:commercial-admission && pnpm run test:commercial-license && pnpm run test:commercial-runbook && pnpm run test:package-identity && pnpm run test:skill-discovery && pnpm run test:target-transport && pnpm run test:target-auth && pnpm run test:r6-auth-cutover && pnpm run test:r6-cutover-baseline",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "start": "node dist/main.js"
   },
   "dependencies": {
-    "@aopslabs/artifact-trust-contracts": "0.2.0",
+    "@aopslabs/artifact-trust-contracts": "0.3.0",
+    "@aopslabs/cli-kit": "0.1.0",
     "@aopslabs/aops-host-registration": "0.2.0",
     "@aopslabs/aops-pg-bootstrap": "0.2.0",
     "@aopslabs/aops-runtime-config": "0.2.0",
@@ -67,7 +68,6 @@
     "@aopslabs/domain-product-client-chatv3": "0.2.0",
     "@aopslabs/xf-cli-ui": "0.2.0",
     "commander": "14.0.3",
-    "inquirer": "13.3.0",
     "pg": "8.20.0",
     "sigstore": "4.1.1"
   },