@beeos-ai/cli 1.0.22 → 1.0.24

package/dist/index.js

@@ -761,7 +761,7 @@ function buildBindUrl(dashboardBaseUrl, bindId) {
   const base = dashboardBaseUrl.replace(/\/+$/, "");
   return `${base}/bind/${bindId}`;
 }
-async function agentBind(apiUrl, publicKey, fingerprint2, agentFramework, hostname, osType) {
+async function agentBind(apiUrl, publicKey, fingerprint2, agentFramework, hostname, osType, vncPassword) {
   const p = getPlatformAdapter();
   const url = `${apiUrl}/api/v1/agent/bind`;
   const body = {
@@ -773,6 +773,9 @@ async function agentBind(apiUrl, publicKey, fingerprint2, agentFramework, hostna
   if (osType && osType.length > 0) {
     body.os_type = osType;
   }
+  if (vncPassword && vncPassword.length > 0) {
+    body.vnc_password = vncPassword;
+  }
   const resp = await p.fetch(url, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -929,7 +932,7 @@ async function bindAgent(opts) {
   const pollTimeoutMs = opts.pollTimeoutMs ?? 6e5;
   let resp;
   try {
-    resp = await agentBind(opts.apiUrl, opts.publicKey, opts.fingerprint, opts.agentFramework, opts.hostname, opts.osType);
+    resp = await agentBind(opts.apiUrl, opts.publicKey, opts.fingerprint, opts.agentFramework, opts.hostname, opts.osType, opts.vncPassword);
   } catch (e) {
     if (isNetworkError(e) && opts.cachedBinding && opts.cachedBinding.fingerprint === opts.fingerprint) {
       return {
@@ -3311,20 +3314,24 @@ var init_desktop_detect = __esm({
     init_platform_adapter();
     MACOS_DESKTOP_HINT_LINES = [
       "Detected macOS Screen Sharing on :5900. Starting vnc-bridge...",
-      "  If desktop view shows a black screen / connection error on the dashboard:",
-      "    \u2022 System Settings \u2192 General \u2192 Sharing \u2192 Screen Sharing must be enabled",
-      "    \u2022 System Settings \u2192 Privacy & Security \u2192 Screen Recording must grant",
-      "      permission to the macOS Screen Sharing process",
-      "    \u2022 If a VNC password was set, export BEEOS_VNC_PASSWORD=<password>",
-      "      before re-running `beeos init`."
+      "  If the dashboard's desktop view shows a black screen, check:",
+      "    \u2022 System Settings \u2192 Privacy & Security \u2192 Screen Recording must",
+      "      grant permission to the Screen Sharing helper (look for an",
+      "      ARDAgent or screensharingd entry; check the box if missing)",
+      "    \u2022 The VNC viewer password BeeOS just installed lives at",
+      "      ~/.beeos/vnc.password \u2014 re-run `beeos init` to regenerate",
+      "      if you suspect it drifted out of sync with macOS."
     ];
     MACOS_DESKTOP_DOCTOR_HINT_LINES = [
       "vnc-bridge-openclaw is failing on macOS. Likely causes:",
-      "  \u2022 System Settings \u2192 General \u2192 Sharing \u2192 Screen Sharing turned off",
-      "  \u2022 System Settings \u2192 Privacy & Security \u2192 Screen Recording missing",
-      "    permission for the macOS Screen Sharing process",
-      "  \u2022 A VNC password is set; export BEEOS_VNC_PASSWORD=<password>",
-      "    before `beeos start openclaw --force` to retry."
+      "  \u2022 System Settings \u2192 General \u2192 Sharing \u2192 Screen Sharing got",
+      "    turned off after BeeOS enabled it (re-run `beeos init` to",
+      "    redo cold-start)",
+      "  \u2022 System Settings \u2192 Privacy & Security \u2192 Screen Recording",
+      "    permission for the Screen Sharing helper was revoked",
+      "  \u2022 The macOS-side VNC viewer password drifted out of sync with",
+      "    ~/.beeos/vnc.password \u2014 re-run `beeos init` to regenerate",
+      "    both ends in one shot."
     ];
     LINUX_VNC_HINT_LINES = [
       "Tip: no VNC server detected on :5901. To enable BeeOS desktop streaming:",
@@ -3337,6 +3344,220 @@ var init_desktop_detect = __esm({
   }
 });
 
+// ../core/dist/openclaw/macos-desktop-cold-start.js
+async function detectColdStartState() {
+  const p = getPlatformAdapter();
+  const port5900Listening = await p.tcpProbe("127.0.0.1", 5900, PORT_5900_PROBE_TIMEOUT_MS).catch(() => false);
+  const passwordFile = p.joinPath(beeoHome(), "vnc.password");
+  let vncPasswordFileExists = false;
+  try {
+    const raw = await p.readFile(passwordFile);
+    vncPasswordFileExists = raw.trim().length > 0;
+  } catch {
+    vncPasswordFileExists = false;
+  }
+  const ardAllLocalUsers = await probeArdAllLocalUsers();
+  return {
+    port5900Listening,
+    vncPasswordFileExists,
+    ardAllLocalUsers
+  };
+}
+async function macosDesktopColdStart(opts = {}) {
+  const log = opts.log ?? ((m) => console.log(m));
+  const p = getPlatformAdapter();
+  if (opts.noDesktop) {
+    return { status: "skipped_opt_out" };
+  }
+  if (p.platform() !== "darwin") {
+    return { status: "skipped_non_macos" };
+  }
+  const state = await detectColdStartState();
+  const passwordFile = p.joinPath(beeoHome(), "vnc.password");
+  const idempotent = state.port5900Listening && state.vncPasswordFileExists && state.ardAllLocalUsers === false;
+  if (idempotent) {
+    let existing;
+    try {
+      existing = (await p.readFile(passwordFile)).trim();
+    } catch {
+      existing = void 0;
+    }
+    return {
+      status: "already_configured",
+      vncPassword: existing
+    };
+  }
+  if (!opts.prompt && !opts.yes) {
+    return { status: "skipped_no_tty" };
+  }
+  if (!opts.yes) {
+    log("");
+    log("BeeOS desktop streaming needs macOS Screen Sharing enabled.");
+    log("This will:");
+    log("  - Turn on macOS Screen Sharing (RFB scheme 2 / legacy VNC)");
+    log("  - Disable Apple ARD's all-local-users mode (avoids the");
+    log("    noVNC scheme-30 trap that leaves the viewer black)");
+    log("  - Generate a fresh 8-char VNC viewer password and store");
+    log("    it both in /Library/Preferences/com.apple.VNCSettings.txt");
+    log("    and in ~/.beeos/vnc.password");
+    log("If you already use Screen Sharing for other tools the existing");
+    log("VNC viewer password will be REPLACED. macOS will pop up a");
+    log("password dialog (that's the OS asking for your login password,");
+    log("not BeeOS \u2014 only this script runs as root).");
+    log("");
+    const answer = (await opts.prompt("Enable macOS Screen Sharing for desktop streaming? [Y/n]: ")).trim();
+    if (answer !== "" && !/^y(es)?$/i.test(answer)) {
+      return { status: "user_declined" };
+    }
+  }
+  const newPassword = generateLegacyVncPassword();
+  try {
+    await ensureBeeoHome(p);
+    await p.writeFile(passwordFile, newPassword);
+    await p.chmod(passwordFile, 384);
+  } catch (e) {
+    return {
+      status: "script_failed",
+      warnings: [
+        `cold-start: failed to write ${passwordFile}: ${e instanceof Error ? e.message : String(e)}. Desktop streaming will not work this run.`
+      ]
+    };
+  }
+  log("Requesting macOS administrator password (system dialog)...");
+  const scriptResult = await runColdStartRootScript(newPassword);
+  if (!scriptResult.ok) {
+    const canceled = /user (canceled|cancelled)|cancellation|User did not enter/i.test(scriptResult.stderr);
+    await p.rm(passwordFile).catch(() => void 0);
+    return {
+      status: canceled ? "user_canceled_dialog" : "script_failed",
+      warnings: [
+        canceled ? "macOS authorization dialog was canceled \u2014 desktop streaming not enabled." : `cold-start root script failed: ${scriptResult.stderr.trim()}. Desktop streaming will not work this run.`
+      ]
+    };
+  }
+  const up = await waitFor5900(VERIFY_5900_TIMEOUT_MS);
+  if (!up) {
+    return {
+      status: "verify_timeout",
+      warnings: [
+        "cold-start ran but :5900 never came up within 5s. Re-run `beeos init` to retrigger, or check `beeos doctor`."
+      ]
+    };
+  }
+  log("macOS Screen Sharing enabled and listening on :5900.");
+  return {
+    status: "enabled_now",
+    vncPassword: newPassword
+  };
+}
+async function ensureBeeoHome(p) {
+  const home = beeoHome();
+  if (!await p.exists(home)) {
+    await p.mkdir(home);
+  }
+}
+function generateLegacyVncPassword() {
+  const out = new Array(VNC_PASSWORD_LENGTH);
+  const buf = new Uint8Array(VNC_PASSWORD_LENGTH);
+  globalThis.crypto.getRandomValues(buf);
+  for (let i = 0; i < VNC_PASSWORD_LENGTH; i++) {
+    out[i] = VNC_PASSWORD_CHARSET[buf[i] % VNC_PASSWORD_CHARSET.length];
+  }
+  return out.join("");
+}
+function encodeMacosVncPassword(password) {
+  const pwBytes = Buffer.alloc(APPLE_VNC_FIXED_KEY.length);
+  Buffer.from(password, "utf8").copy(pwBytes);
+  const out = Buffer.alloc(APPLE_VNC_FIXED_KEY.length);
+  for (let i = 0; i < APPLE_VNC_FIXED_KEY.length; i++) {
+    out[i] = pwBytes[i] ^ APPLE_VNC_FIXED_KEY[i];
+  }
+  return out.toString("hex");
+}
+async function runColdStartRootScript(vncPassword) {
+  const p = getPlatformAdapter();
+  if (!/^[a-zA-Z0-9]{8}$/.test(vncPassword)) {
+    return {
+      ok: false,
+      stderr: "internal: generated VNC password contains shell-unsafe characters; refusing to run osascript"
+    };
+  }
+  const encodedHex = encodeMacosVncPassword(vncPassword);
+  const shellPayload = `set -e
+launchctl enable system/com.apple.screensharing 2>/dev/null || true
+defaults write ${ARD_PLIST_PATH} VNCLegacyConnectionsEnabled -bool YES
+defaults write ${ARD_PLIST_PATH} ARD_AllLocalUsers -bool NO
+defaults write ${ARD_PLIST_PATH} ARD_AllLocalUsersPrivs -int 0
+printf '%s' '${encodedHex}' > ${VNC_SETTINGS_PATH}
+chmod 0400 ${VNC_SETTINGS_PATH}
+launchctl kickstart -k system/com.apple.screensharing
+`;
+  const aslEscaped = shellPayload.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n");
+  const osascriptArg = `do shell script "${aslEscaped}" with administrator privileges`;
+  let stderr = "";
+  let code = 1;
+  try {
+    const result = await p.exec("osascript", ["-e", osascriptArg], {
+      timeout: OSASCRIPT_TIMEOUT_MS
+    });
+    stderr = result.stderr;
+    code = result.code;
+  } catch (e) {
+    return {
+      ok: false,
+      stderr: `osascript invocation failed: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  return { ok: code === 0, stderr };
+}
+async function waitFor5900(timeoutMs) {
+  const p = getPlatformAdapter();
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (await p.tcpProbe("127.0.0.1", 5900, PORT_5900_PROBE_TIMEOUT_MS).catch(() => false)) {
+      return true;
+    }
+    await sleep3(VERIFY_5900_POLL_INTERVAL_MS);
+  }
+  return false;
+}
+async function probeArdAllLocalUsers() {
+  const p = getPlatformAdapter();
+  try {
+    const result = await p.exec("plutil", ["-extract", "ARD_AllLocalUsers", "raw", ARD_PLIST_PATH], { timeout: 2e3 });
+    if (result.code !== 0)
+      return "unknown";
+    const out = result.stdout.trim().toLowerCase();
+    if (out === "true" || out === "1")
+      return true;
+    if (out === "false" || out === "0")
+      return false;
+    return "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function sleep3(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+var APPLE_VNC_FIXED_KEY, VNC_PASSWORD_LENGTH, VNC_PASSWORD_CHARSET, ARD_PLIST_PATH, VNC_SETTINGS_PATH, PORT_5900_PROBE_TIMEOUT_MS, VERIFY_5900_TIMEOUT_MS, VERIFY_5900_POLL_INTERVAL_MS, OSASCRIPT_TIMEOUT_MS;
+var init_macos_desktop_cold_start = __esm({
+  "../core/dist/openclaw/macos-desktop-cold-start.js"() {
+    "use strict";
+    init_platform_adapter();
+    init_paths();
+    APPLE_VNC_FIXED_KEY = Buffer.from("1734516E8BA8C5E2FF1C39567390ADCA", "hex");
+    VNC_PASSWORD_LENGTH = 8;
+    VNC_PASSWORD_CHARSET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+    ARD_PLIST_PATH = "/Library/Preferences/com.apple.RemoteManagement.plist";
+    VNC_SETTINGS_PATH = "/Library/Preferences/com.apple.VNCSettings.txt";
+    PORT_5900_PROBE_TIMEOUT_MS = 200;
+    VERIFY_5900_TIMEOUT_MS = 5e3;
+    VERIFY_5900_POLL_INTERVAL_MS = 250;
+    OSASCRIPT_TIMEOUT_MS = 6e4;
+  }
+});
+
 // ../core/dist/detect.js
 async function detectExistingInstall() {
   const p = getPlatformAdapter();
@@ -5192,6 +5413,7 @@ var init_dist = __esm({
     init_constants();
     init_agent_status();
     init_desktop_detect();
+    init_macos_desktop_cold_start();
     init_detect();
     init_registry();
     init_target_spec();
@@ -5417,7 +5639,7 @@ var init_upgrade2 = __esm({
 });
 
 // src/lib/instance-picker.ts
-import readline from "readline";
+import readline2 from "readline";
 function resolveIO(ctx) {
   return {
     input: ctx.input ?? process.stdin,
@@ -5429,7 +5651,7 @@ function isTTY(ctx, io) {
   return Boolean(io.input.isTTY);
 }
 function ask(io, question) {
-  const rl = readline.createInterface({ input: io.input, output: io.output });
+  const rl = readline2.createInterface({ input: io.input, output: io.output });
   return new Promise((resolve) => {
     rl.question(question, (answer) => {
       rl.close();
@@ -5682,7 +5904,7 @@ var init_state2 = __esm({
 
 // src/commands/device/attach.ts
 import { spawn as spawn2 } from "child_process";
-import readline2 from "readline";
+import readline3 from "readline";
 function resolvePerDeviceAgentGatewayUrl(cfg, override) {
   if (override === void 0) return resolveAgentGatewayUrl(cfg);
   const trimmed = override.trim();
@@ -5748,7 +5970,7 @@ async function attach(options) {
   await deviceRuntime.ensureAgent(reporter);
   reporter.stop();
   const pubkeyB64 = await deviceRuntime.ensureKeyAndGetPubkey(serial);
-  const instanceId = await bindDevice(pubkeyB64, name, cfg);
+  const instanceId = await bindDevice(pubkeyB64, name, cfg, options.vncPassword);
   if (!instanceId) {
     console.error("Bind was not completed \u2014 device-agent will not start without a platform binding.");
     console.error("Run `beeos device attach` again to retry.");
@@ -5904,7 +6126,7 @@ async function attachAll(cfg, reporter, withVideo, options) {
   for (const device of devices) {
     try {
       const pubkeyB64 = await deviceRuntime.ensureKeyAndGetPubkey(device.serial);
-      const instanceId = await bindDevice(pubkeyB64, device.serial, cfg);
+      const instanceId = await bindDevice(pubkeyB64, device.serial, cfg, options.vncPassword);
       if (!instanceId) {
         console.error(`  Skipping ${device.serial} \u2014 bind not completed`);
         continue;
@@ -6066,7 +6288,7 @@ async function runAttachStage2(params) {
     return { ok: false, serial, error: e };
   }
 }
-async function bindDevice(pubkeyB64, name, cfg) {
+async function bindDevice(pubkeyB64, name, cfg, vncPassword) {
   const fp = fingerprintFromB64(pubkeyB64);
   const outcome = await bindAgent({
     apiUrl: cfg.platform.api_url,
@@ -6075,6 +6297,7 @@ async function bindDevice(pubkeyB64, name, cfg) {
     fingerprint: fp,
     agentFramework: "device",
     hostname: name,
+    vncPassword,
     // Device bind has no cached fallback — each device has its own
     // identity, and we never want to "silently come up offline" on
     // first attach.
@@ -6117,7 +6340,7 @@ async function maybeNotifyFleetWithHint(cfg) {
   console.log("it, the device is recorded in ~/.beeos/devices.json but");
   console.log("no process is supervising the per-device agent.");
   console.log("");
-  const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
   const answer = await new Promise((resolve) => {
     rl.question("Enable fleet now (registers a launchd service)? [Y/n]: ", (a) => {
       rl.close();
@@ -6291,7 +6514,7 @@ Android SDK Platform-Tools (adb) is licensed under the Android SDK License Agree
 Set BEEOS_ACCEPT_ADB_LICENSE=1 in your environment to skip this prompt next time.
 `
   );
-  const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
   const ans = await new Promise((resolve) => {
     rl.question("Agree to the Android SDK license and download platform-tools? [Y/n]: ", (a) => {
       rl.close();
@@ -6842,6 +7065,7 @@ init_progress2();
 init_fallback_banner();
 init_json_envelope();
 import os6 from "os";
+import readline from "readline";
 async function run(agentFramework, options) {
   const p = getPlatformAdapter();
   await ensureDirs();
@@ -6888,9 +7112,23 @@ async function run(agentFramework, options) {
   const launchWarnings = [...launchOutcome.warnings];
   reporter.stop();
   const ttyHints = !options.json && process.stdin.isTTY === true;
+  let coldStart = null;
+  if (agentFramework === OPENCLAW_ID) {
+    const interactive = !options.json && process.stdin.isTTY === true && process.stdout.isTTY === true;
+    coldStart = await macosDesktopColdStart({
+      prompt: interactive ? promptYesNo : void 0,
+      log: options.json ? () => void 0 : (m) => console.log(m),
+      yes: options.force === true,
+      noDesktop: process.env.BEEOS_NO_DESKTOP === "1"
+    });
+    if (coldStart.warnings && coldStart.warnings.length > 0) {
+      launchWarnings.push(...coldStart.warnings);
+    }
+  }
   const vncEndpoint = agentFramework === OPENCLAW_ID ? await probeLocalVnc({ ttyHints }) : null;
   const hostname = buildHostname();
   const cachedBinding = await loadBindingInfo();
+  const bindVncPassword = vncEndpoint ? await readVncPasswordOptional() : void 0;
   const outcome = await bindAgent({
     apiUrl: cfg.platform.api_url,
     dashboardBaseUrl: cfg.platform.dashboard_base_url,
@@ -6899,6 +7137,7 @@ async function run(agentFramework, options) {
     agentFramework,
     hostname,
     osType: vncEndpoint?.osType,
+    vncPassword: bindVncPassword,
     headless: options.browser === false,
     cachedBinding: cachedBinding ? {
       fingerprint: cachedBinding.fingerprint,
@@ -7072,6 +7311,18 @@ async function readVncPasswordOptional() {
     return void 0;
   }
 }
+async function promptYesNo(question) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer);
+    });
+  });
+}
 function buildHostname() {
   const machine = os6.hostname();
   const user = process.env.USER || process.env.USERNAME || "";
@@ -7295,7 +7546,7 @@ init_device2();
 
 // src/commands/init.ts
 init_dist();
-import readline3 from "readline";
+import readline4 from "readline";
 init_attach();
 init_progress2();
 init_fallback_banner();
@@ -7547,7 +7798,7 @@ function printNextSteps() {
   console.log("");
 }
 function prompt(question) {
-  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+  const rl = readline4.createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve) => {
     rl.question(question, (answer) => {
       rl.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beeos-ai/cli",
-  "version": "1.0.22",
+  "version": "1.0.24",
   "type": "module",
   "description": "BeeOS CLI — run AI agents from your desktop",
   "bin": {