@beeos-ai/cli 1.0.22 → 1.0.23

package/dist/index.js

@@ -761,7 +761,7 @@ function buildBindUrl(dashboardBaseUrl, bindId) {
   const base = dashboardBaseUrl.replace(/\/+$/, "");
   return `${base}/bind/${bindId}`;
 }
-async function agentBind(apiUrl, publicKey, fingerprint2, agentFramework, hostname, osType) {
+async function agentBind(apiUrl, publicKey, fingerprint2, agentFramework, hostname, osType, vncPassword) {
   const p = getPlatformAdapter();
   const url = `${apiUrl}/api/v1/agent/bind`;
   const body = {
@@ -773,6 +773,9 @@ async function agentBind(apiUrl, publicKey, fingerprint2, agentFramework, hostna
   if (osType && osType.length > 0) {
     body.os_type = osType;
   }
+  if (vncPassword && vncPassword.length > 0) {
+    body.vnc_password = vncPassword;
+  }
   const resp = await p.fetch(url, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -929,7 +932,7 @@ async function bindAgent(opts) {
   const pollTimeoutMs = opts.pollTimeoutMs ?? 6e5;
   let resp;
   try {
-    resp = await agentBind(opts.apiUrl, opts.publicKey, opts.fingerprint, opts.agentFramework, opts.hostname, opts.osType);
+    resp = await agentBind(opts.apiUrl, opts.publicKey, opts.fingerprint, opts.agentFramework, opts.hostname, opts.osType, opts.vncPassword);
   } catch (e) {
     if (isNetworkError(e) && opts.cachedBinding && opts.cachedBinding.fingerprint === opts.fingerprint) {
       return {
@@ -5748,7 +5751,7 @@ async function attach(options) {
   await deviceRuntime.ensureAgent(reporter);
   reporter.stop();
   const pubkeyB64 = await deviceRuntime.ensureKeyAndGetPubkey(serial);
-  const instanceId = await bindDevice(pubkeyB64, name, cfg);
+  const instanceId = await bindDevice(pubkeyB64, name, cfg, options.vncPassword);
   if (!instanceId) {
     console.error("Bind was not completed \u2014 device-agent will not start without a platform binding.");
     console.error("Run `beeos device attach` again to retry.");
@@ -5904,7 +5907,7 @@ async function attachAll(cfg, reporter, withVideo, options) {
   for (const device of devices) {
     try {
       const pubkeyB64 = await deviceRuntime.ensureKeyAndGetPubkey(device.serial);
-      const instanceId = await bindDevice(pubkeyB64, device.serial, cfg);
+      const instanceId = await bindDevice(pubkeyB64, device.serial, cfg, options.vncPassword);
       if (!instanceId) {
         console.error(`  Skipping ${device.serial} \u2014 bind not completed`);
         continue;
@@ -6066,7 +6069,7 @@ async function runAttachStage2(params) {
     return { ok: false, serial, error: e };
   }
 }
-async function bindDevice(pubkeyB64, name, cfg) {
+async function bindDevice(pubkeyB64, name, cfg, vncPassword) {
   const fp = fingerprintFromB64(pubkeyB64);
   const outcome = await bindAgent({
     apiUrl: cfg.platform.api_url,
@@ -6075,6 +6078,7 @@ async function bindDevice(pubkeyB64, name, cfg) {
     fingerprint: fp,
     agentFramework: "device",
     hostname: name,
+    vncPassword,
     // Device bind has no cached fallback — each device has its own
     // identity, and we never want to "silently come up offline" on
     // first attach.
@@ -6891,6 +6895,7 @@ async function run(agentFramework, options) {
   const vncEndpoint = agentFramework === OPENCLAW_ID ? await probeLocalVnc({ ttyHints }) : null;
   const hostname = buildHostname();
   const cachedBinding = await loadBindingInfo();
+  const bindVncPassword = vncEndpoint ? await readVncPasswordOptional() : void 0;
   const outcome = await bindAgent({
     apiUrl: cfg.platform.api_url,
     dashboardBaseUrl: cfg.platform.dashboard_base_url,
@@ -6899,6 +6904,7 @@ async function run(agentFramework, options) {
     agentFramework,
     hostname,
     osType: vncEndpoint?.osType,
+    vncPassword: bindVncPassword,
     headless: options.browser === false,
     cachedBinding: cachedBinding ? {
       fingerprint: cachedBinding.fingerprint,
@@ -7007,6 +7013,10 @@ async function run(agentFramework, options) {
     if (vncEndpoint.kind === "macos" && ttyHints) {
       printMacosDesktopHint();
     }
+    if (vncEndpoint.kind === "macos") {
+      const ardWarning = await checkMacosARDConflict();
+      if (ardWarning) launchWarnings.push(ardWarning);
+    }
     const desktopWarning = await tryAttachOpenclawDesktopBridge({
       vncEndpoint,
       instanceId: boundInstanceId,
@@ -7072,6 +7082,24 @@ async function readVncPasswordOptional() {
     return void 0;
   }
 }
+async function checkMacosARDConflict() {
+  if (process.platform !== "darwin") return null;
+  const p = getPlatformAdapter();
+  try {
+    const result = await p.exec("plutil", [
+      "-extract",
+      "ARD_AllLocalUsers",
+      "raw",
+      "/Library/Preferences/com.apple.RemoteManagement.plist"
+    ], { timeout: 2e3 });
+    const out = String(result.stdout || "").trim().toLowerCase();
+    if (out === "true" || out === "1") {
+      return "macOS ARD_AllLocalUsers is enabled \u2014 Screen Sharing also advertises RFB scheme 30 (Apple Auth) which noVNC will prefer over scheme 2 (legacy VNC password). The dashboard's device-viewer will then loop on `credentialsrequired` and never paint. Disable ARD to keep only legacy VNC:\n  sudo defaults write /Library/Preferences/com.apple.RemoteManagement ARD_AllLocalUsers -bool NO\n  sudo launchctl kickstart -k system/com.apple.screensharing";
+    }
+  } catch {
+  }
+  return null;
+}
 function buildHostname() {
   const machine = os6.hostname();
   const user = process.env.USER || process.env.USERNAME || "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beeos-ai/cli",
-  "version": "1.0.22",
+  "version": "1.0.23",
   "type": "module",
   "description": "BeeOS CLI — run AI agents from your desktop",
   "bin": {