@chvor/cli 0.1.1 → 0.1.2

package/dist/cli.js

@@ -28,6 +28,8 @@ program
     .option("-i, --instance <name>", "Named instance to start")
     .action(async (opts) => {
     if (opts.instance) {
+        const { validateInstanceName } = await import("./lib/validate.js");
+        validateInstanceName(opts.instance);
         const { setInstance } = await import("./lib/paths.js");
         setInstance(opts.instance);
     }
@@ -44,6 +46,8 @@ program
     .option("-i, --instance <name>", "Named instance to stop")
     .action(async (opts) => {
     if (opts.instance) {
+        const { validateInstanceName } = await import("./lib/validate.js");
+        validateInstanceName(opts.instance);
         const { setInstance } = await import("./lib/paths.js");
         setInstance(opts.instance);
     }
@@ -72,6 +76,8 @@ instancesCmd
     .command("start <name>")
     .description("Start a named instance")
     .action(async (name) => {
+    const { validateInstanceName } = await import("./lib/validate.js");
+    validateInstanceName(name);
     const { startInstance } = await import("./commands/instances.js");
     await startInstance(name);
 });
@@ -79,6 +85,8 @@ instancesCmd
     .command("stop <name>")
     .description("Stop a named instance")
     .action(async (name) => {
+    const { validateInstanceName } = await import("./lib/validate.js");
+    validateInstanceName(name);
     const { stopInstance } = await import("./commands/instances.js");
     await stopInstance(name);
 });
@@ -208,6 +216,52 @@ toolCmd
     const { toolPublish } = await import("./commands/skill.js");
     await toolPublish(path);
 });
+program
+    .command("open")
+    .description("Open chvor in your default browser")
+    .action(async () => {
+    const { open } = await import("./commands/open.js");
+    await open();
+});
+const serviceCmd = program
+    .command("service")
+    .description("Manage auto-start on login");
+serviceCmd
+    .command("install")
+    .description("Enable auto-start on login")
+    .option("-i, --instance <name>", "Named instance")
+    .action(async (opts) => {
+    if (opts.instance) {
+        const { validateInstanceName } = await import("./lib/validate.js");
+        validateInstanceName(opts.instance);
+    }
+    const { serviceInstall } = await import("./commands/service.js");
+    await serviceInstall(opts);
+});
+serviceCmd
+    .command("uninstall")
+    .description("Disable auto-start on login")
+    .option("-i, --instance <name>", "Named instance")
+    .action(async (opts) => {
+    if (opts.instance) {
+        const { validateInstanceName } = await import("./lib/validate.js");
+        validateInstanceName(opts.instance);
+    }
+    const { serviceUninstall } = await import("./commands/service.js");
+    await serviceUninstall(opts);
+});
+serviceCmd
+    .command("status")
+    .description("Check auto-start status")
+    .option("-i, --instance <name>", "Named instance")
+    .action(async (opts) => {
+    if (opts.instance) {
+        const { validateInstanceName } = await import("./lib/validate.js");
+        validateInstanceName(opts.instance);
+    }
+    const { serviceStatus } = await import("./commands/service.js");
+    await serviceStatus(opts);
+});
 const authCmd = program
     .command("auth")
     .description("Manage authentication");
@@ -217,6 +271,8 @@ authCmd
     .option("-i, --instance <name>", "Named instance to reset")
     .action(async (opts) => {
     if (opts.instance) {
+        const { validateInstanceName } = await import("./lib/validate.js");
+        validateInstanceName(opts.instance);
         const { setInstance } = await import("./lib/paths.js");
         setInstance(opts.instance);
     }

package/dist/commands/onboard.js

@@ -39,46 +39,68 @@ export async function onboard() {
     const version = pkg.version;
     await downloadRelease(version);
     await spawnServer({ port });
-    await pollHealth(port, token);
-    const providerNames = {
-        anthropic: "Anthropic",
-        openai: "OpenAI",
-        "google-ai": "Google AI",
-    };
-    const credRes = await fetch(`http://localhost:${port}/api/credentials`, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${token}`,
-        },
-        body: JSON.stringify({
-            name: providerNames[provider],
-            type: provider,
-            data: { apiKey },
-        }),
-    });
-    if (!credRes.ok) {
-        console.warn(`Warning: failed to save credentials (${credRes.status}). You can add them later in the UI.`);
+    // spawnServer already polls health internally — check once more briefly
+    // to decide whether we can configure credentials via API
+    const serverReady = await pollHealth(port, token, 5000);
+    if (serverReady) {
+        const providerNames = {
+            anthropic: "Anthropic",
+            openai: "OpenAI",
+            "google-ai": "Google AI",
+        };
+        try {
+            const credRes = await fetch(`http://localhost:${port}/api/credentials`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    Authorization: `Bearer ${token}`,
+                },
+                body: JSON.stringify({
+                    name: providerNames[provider],
+                    type: provider,
+                    data: { apiKey },
+                }),
+            });
+            if (!credRes.ok) {
+                console.warn(`Warning: failed to save credentials (${credRes.status}). You can add them later in the UI.`);
+            }
+        }
+        catch {
+            console.warn("Warning: could not reach server to save credentials. You can add them later in the UI.");
+        }
+        try {
+            const personaRes = await fetch(`http://localhost:${port}/api/persona`, {
+                method: "PATCH",
+                headers: {
+                    "Content-Type": "application/json",
+                    Authorization: `Bearer ${token}`,
+                },
+                body: JSON.stringify({
+                    name: userName,
+                    timezone,
+                    onboarded: true,
+                }),
+            });
+            if (!personaRes.ok) {
+                console.warn(`Warning: failed to save persona (${personaRes.status}). You can update it later in the UI.`);
+            }
+        }
+        catch {
+            console.warn("Warning: could not reach server to save persona. You can update it later in the UI.");
+        }
     }
-    const personaRes = await fetch(`http://localhost:${port}/api/persona`, {
-        method: "PATCH",
-        headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${token}`,
-        },
-        body: JSON.stringify({
-            name: userName,
-            timezone,
-            onboarded: true,
-        }),
-    });
-    if (!personaRes.ok) {
-        console.warn(`Warning: failed to save persona (${personaRes.status}). You can update it later in the UI.`);
+    else {
+        console.warn("\n  Server is still starting up. Your config has been saved." +
+            "\n  Credentials and persona will be configured when you open the UI.");
     }
     console.log(`\n  chvor is running at http://localhost:${port}`);
     console.log("  Open this URL in your browser to get started.\n");
     console.log("  Useful commands:");
-    console.log("    chvor stop     Stop the server");
-    console.log("    chvor start    Start the server");
-    console.log("    chvor update   Update to latest version\n");
+    console.log("    chvor stop            Stop the server");
+    console.log("    chvor start           Start the server");
+    console.log("    chvor open            Open chvor in your browser");
+    console.log("    chvor service install  Start automatically on login");
+    console.log("    chvor update          Update to latest version\n");
+    console.log("  Tip: For system tray, auto-updates, and no terminal needed,");
+    console.log("  try the desktop app: https://github.com/luka-zivkovic/chvor/releases/latest\n");
 }

package/dist/commands/open.js

@@ -0,0 +1,19 @@
+import { execFileSync } from "node:child_process";
+import { readConfig } from "../lib/config.js";
+export async function open() {
+    const config = readConfig();
+    const port = config.port ?? "3001";
+    const url = `http://localhost:${port}`;
+    switch (process.platform) {
+        case "darwin":
+            execFileSync("open", [url]);
+            break;
+        case "win32":
+            execFileSync("cmd", ["/c", "start", "", url]);
+            break;
+        default:
+            execFileSync("xdg-open", [url]);
+            break;
+    }
+    console.log(`Opened ${url}`);
+}

package/dist/commands/service.js

@@ -0,0 +1,36 @@
+import { realpathSync } from "node:fs";
+import { isOnboarded } from "../lib/config.js";
+async function getPlatformModule() {
+    switch (process.platform) {
+        case "darwin":
+            return import("../lib/service-darwin.js");
+        case "linux":
+            return import("../lib/service-linux.js");
+        case "win32":
+            return import("../lib/service-win32.js");
+        default:
+            throw new Error(`Unsupported platform: ${process.platform}`);
+    }
+}
+function resolveExecPaths() {
+    const nodePath = process.execPath;
+    const cliPath = realpathSync(process.argv[1]);
+    return { nodePath, cliPath };
+}
+export async function serviceInstall(opts) {
+    if (!isOnboarded()) {
+        console.error("Run `chvor onboard` first.");
+        process.exit(1);
+    }
+    const mod = await getPlatformModule();
+    const { nodePath, cliPath } = resolveExecPaths();
+    await mod.install(nodePath, cliPath, opts.instance);
+}
+export async function serviceUninstall(opts) {
+    const mod = await getPlatformModule();
+    await mod.uninstall(opts.instance);
+}
+export async function serviceStatus(opts) {
+    const mod = await getPlatformModule();
+    await mod.status(opts.instance);
+}

package/dist/commands/stop.js

@@ -1,4 +1,27 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
 import { stopServer } from "../lib/process.js";
+function isServiceInstalled() {
+    switch (process.platform) {
+        case "darwin":
+            return existsSync(join(homedir(), "Library", "LaunchAgents", "ai.chvor.server.plist"));
+        case "linux":
+            return existsSync(join(homedir(), ".config", "systemd", "user", "chvor.service"));
+        case "win32": {
+            const appData = process.env.APPDATA;
+            if (!appData)
+                return false;
+            return existsSync(join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Startup", "chvor-autostart.vbs"));
+        }
+        default:
+            return false;
+    }
+}
 export async function stop() {
     await stopServer();
+    if (isServiceInstalled()) {
+        console.log("Note: Auto-start is configured. Server will restart on next login.");
+        console.log("  Use `chvor service uninstall` to disable auto-start.");
+    }
 }

package/dist/lib/download.js

@@ -1,9 +1,13 @@
-import { createWriteStream, createReadStream, existsSync } from "node:fs";
-import { join } from "node:path";
+import { createWriteStream, createReadStream, existsSync, rmSync, readdirSync, realpathSync } from "node:fs";
+import { join, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { Readable } from "node:stream";
 import { createHash } from "node:crypto";
 import { execFileSync } from "node:child_process";
+import { homedir } from "node:os";
+function escapePsPath(p) {
+    return p.replace(/'/g, "''");
+}
 import { getAppDir, getDownloadsDir, ensureDir } from "./paths.js";
 import { readConfig, writeConfig } from "./config.js";
 import { getAssetName, getPlatform } from "./platform.js";
@@ -65,7 +69,6 @@ export async function downloadRelease(version) {
     const assetName = getAssetName(version);
     const tarballPath = join(downloadsDir, assetName);
     // Download the tarball
-    console.log(`Downloading ${assetName}...`);
     const res = await fetch(url, {
         headers: { "User-Agent": "chvor-cli" },
     });
@@ -75,6 +78,9 @@ export async function downloadRelease(version) {
     if (!res.body) {
         throw new Error("Download response has no body");
     }
+    const contentLength = res.headers.get("content-length");
+    const sizeMB = contentLength ? `${Math.round(Number(contentLength) / 1024 / 1024)} MB` : "";
+    console.log(`Downloading ${assetName}${sizeMB ? ` (${sizeMB})` : ""}...`);
     const fileStream = createWriteStream(tarballPath);
     await pipeline(Readable.fromWeb(res.body), fileStream);
     console.log("Download complete.");
@@ -87,25 +93,37 @@ export async function downloadRelease(version) {
         }
         console.log("Checksum verified.");
     }
-    // Extract
+    // Extract — wipe previous install to avoid conflicts (Windows Move-Item
+    // cannot overwrite existing directories even with -Force)
     const appDir = getAppDir();
+    if (existsSync(appDir)) {
+        // Safety: resolve symlinks and verify the target is under the user's home
+        const realAppDir = realpathSync(appDir);
+        const realHome = resolve(homedir());
+        // Case-insensitive comparison on Windows where paths are case-insensitive
+        const norm = (p) => process.platform === "win32" ? p.toLowerCase() : p;
+        if (!norm(realAppDir).startsWith(norm(realHome) + sep)) {
+            throw new Error(`Refusing to delete path outside home directory: ${realAppDir}`);
+        }
+        rmSync(appDir, { recursive: true, force: true });
+    }
     ensureDir(appDir);
     console.log(`Extracting to ${appDir}...`);
     if (getPlatform() === "win") {
         execFileSync("powershell", [
             "-NoProfile", "-Command",
-            `Expand-Archive -Path '${tarballPath}' -DestinationPath '${appDir}' -Force`,
+            `Expand-Archive -Path '${escapePsPath(tarballPath)}' -DestinationPath '${escapePsPath(appDir)}' -Force`,
         ], { stdio: "inherit" });
         // Move contents up from the nested directory (strip-components equivalent)
         const nested = join(appDir, assetName.replace(/\.zip$/, ""));
         if (existsSync(nested)) {
             execFileSync("powershell", [
                 "-NoProfile", "-Command",
-                `Get-ChildItem -Path '${nested}' | Move-Item -Destination '${appDir}' -Force`,
+                `Get-ChildItem -Path '${escapePsPath(nested)}' | Move-Item -Destination '${escapePsPath(appDir)}' -Force`,
             ], { stdio: "inherit" });
             execFileSync("powershell", [
                 "-NoProfile", "-Command",
-                `Remove-Item -Path '${nested}' -Recurse -Force`,
+                `Remove-Item -Path '${escapePsPath(nested)}' -Recurse -Force`,
             ], { stdio: "inherit" });
         }
     }
@@ -115,24 +133,40 @@ export async function downloadRelease(version) {
         });
     }
     console.log("Extraction complete.");
-    // Install Playwright's Chromium browser (required by browser agent / Stagehand)
-    console.log("Installing browser engine (Chromium)...");
+    // Note: Playwright Chromium is installed lazily on first web-agent use,
+    // not during initial setup, to keep install fast.
+    // Update config
+    const config = readConfig();
+    config.installedVersion = version;
+    writeConfig(config);
+    console.log(`Chvor v${version} installed successfully.`);
+}
+export function ensurePlaywright() {
+    const appDir = getAppDir();
+    const playwrightCli = join(appDir, "node_modules", "@playwright", "test", "cli.js");
+    if (!existsSync(playwrightCli))
+        return false;
+    // Check if Chromium is already installed by looking for the local browsers dir.
+    // Playwright stores downloaded browsers under playwright-core/.local-browsers/
+    const localBrowsers = join(appDir, "node_modules", "playwright-core", ".local-browsers");
+    const alreadyInstalled = existsSync(localBrowsers) &&
+        (readdirSync(localBrowsers).some((entry) => entry.toLowerCase().includes("chromium")));
+    if (alreadyInstalled)
+        return true;
     try {
-        execFileSync("node", [
-            join(appDir, "node_modules", "@playwright", "test", "cli.js"),
-            "install", "chromium",
-        ], { stdio: "inherit", cwd: appDir });
+        console.log("Installing browser engine (Chromium) for web agent...");
+        execFileSync("node", [playwrightCli, "install", "chromium"], {
+            stdio: "inherit",
+            cwd: appDir,
+        });
         console.log("Browser engine installed.");
+        return true;
     }
-    catch (err) {
+    catch {
         console.warn("Warning: failed to install browser engine. " +
             "The web agent won't work until you run: npx playwright install chromium");
+        return false;
     }
-    // Update config
-    const config = readConfig();
-    config.installedVersion = version;
-    writeConfig(config);
-    console.log(`Chvor v${version} installed successfully.`);
 }
 async function computeSha256(filePath) {
     return new Promise((resolve, reject) => {

package/dist/lib/process.js

@@ -101,18 +101,38 @@ export async function spawnServer(opts = {}) {
             env,
             stdio: "inherit",
         });
+        if (child.pid === undefined) {
+            throw new Error("Failed to spawn server process.");
+        }
         const pidPath = getPidPath();
-        writeFileSync(pidPath, String(child.pid), "utf-8");
+        writeFileSync(pidPath, String(child.pid), { encoding: "utf-8", mode: 0o600 });
+        child.on("error", (err) => {
+            console.error(`Server process error: ${err.message}`);
+            try {
+                unlinkSync(pidPath);
+            }
+            catch { /* ignore */ }
+            process.exit(1);
+        });
+        // Forward SIGTERM/SIGINT to child so service managers (launchd, systemd)
+        // see a clean exit(0) instead of 128+signal
+        for (const sig of ["SIGTERM", "SIGINT"]) {
+            process.on(sig, () => {
+                try {
+                    unlinkSync(pidPath);
+                }
+                catch { /* ignore */ }
+                child.kill(sig);
+            });
+        }
         child.on("exit", (code) => {
             try {
                 unlinkSync(pidPath);
             }
             catch {
-                // ignore
-            }
-            if (code !== 0) {
-                console.error(`Chvor exited with code ${code}`);
+                // ignore — may already be cleaned up by signal handler
             }
+            process.exit(code ?? 1);
         });
         // Wait for health
         const healthy = await pollHealth(port, token);
@@ -134,9 +154,12 @@ export async function spawnServer(opts = {}) {
             stdio: ["ignore", logFd, logFd],
             detached: true,
         });
+        if (child.pid === undefined) {
+            throw new Error("Failed to spawn server process.");
+        }
         child.unref();
         const pidPath = getPidPath();
-        writeFileSync(pidPath, String(child.pid), "utf-8");
+        writeFileSync(pidPath, String(child.pid), { encoding: "utf-8", mode: 0o600 });
         console.log(`Chvor started (PID ${child.pid}). Logs: ${logPath}`);
         const healthy = await pollHealth(port, token);
         if (healthy) {
@@ -182,7 +205,7 @@ export async function stopServer() {
     }
     console.log("Chvor stopped.");
 }
-export async function pollHealth(port, token, timeoutMs = 15000, intervalMs = 500) {
+export async function pollHealth(port, token, timeoutMs = 30000, intervalMs = 500) {
     const start = Date.now();
     const url = `http://localhost:${port}/api/health`;
     const headers = {};

package/dist/lib/service-darwin.js

@@ -0,0 +1,104 @@
+import { writeFileSync, unlinkSync, existsSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { join } from "node:path";
+import { homedir } from "node:os";
+function escapeXml(s) {
+    return s
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&apos;");
+}
+function getPlistPath(instance) {
+    const name = instance ? `ai.chvor.server.${instance}` : "ai.chvor.server";
+    return join(homedir(), "Library", "LaunchAgents", `${name}.plist`);
+}
+function getLabel(instance) {
+    return instance ? `ai.chvor.server.${instance}` : "ai.chvor.server";
+}
+function getUid() {
+    return execFileSync("id", ["-u"], { encoding: "utf-8" }).trim();
+}
+export async function install(nodePath, cliPath, instance) {
+    const plistPath = getPlistPath(instance);
+    const label = getLabel(instance);
+    const args = ["start", "--foreground"];
+    if (instance)
+        args.push("-i", instance);
+    const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${escapeXml(label)}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${escapeXml(nodePath)}</string>
+    <string>${escapeXml(cliPath)}</string>
+${args.map((a) => `    <string>${escapeXml(a)}</string>`).join("\n")}
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>StandardOutPath</key>
+  <string>${escapeXml(join(homedir(), ".chvor", "logs", "launchd-stdout.log"))}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(join(homedir(), ".chvor", "logs", "launchd-stderr.log"))}</string>
+</dict>
+</plist>`;
+    writeFileSync(plistPath, plist, "utf-8");
+    const uid = getUid();
+    try {
+        execFileSync("launchctl", ["bootout", `gui/${uid}/${label}`], { stdio: "pipe" });
+    }
+    catch {
+        // Not loaded yet — fine
+    }
+    execFileSync("launchctl", ["bootstrap", `gui/${uid}`, plistPath], { stdio: "inherit" });
+    console.log(`Auto-start installed. Chvor will start on login.`);
+    console.log(`  Plist: ${plistPath}`);
+}
+export async function uninstall(instance) {
+    const plistPath = getPlistPath(instance);
+    const label = getLabel(instance);
+    if (!existsSync(plistPath)) {
+        console.log("Auto-start is not installed.");
+        return;
+    }
+    const uid = getUid();
+    try {
+        execFileSync("launchctl", ["bootout", `gui/${uid}/${label}`], { stdio: "pipe" });
+    }
+    catch {
+        // Already unloaded
+    }
+    unlinkSync(plistPath);
+    console.log("Auto-start removed.");
+}
+export async function status(instance) {
+    const plistPath = getPlistPath(instance);
+    if (!existsSync(plistPath)) {
+        console.log("Auto-start: not installed");
+        return;
+    }
+    const label = getLabel(instance);
+    const uid = getUid();
+    try {
+        const output = execFileSync("launchctl", ["print", `gui/${uid}/${label}`], {
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        const running = output.includes("state = running");
+        console.log(`Auto-start: installed (${running ? "running" : "stopped"})`);
+        console.log(`  Plist: ${plistPath}`);
+    }
+    catch {
+        console.log("Auto-start: installed (not loaded)");
+        console.log(`  Plist: ${plistPath}`);
+    }
+}

package/dist/lib/service-linux.js

@@ -0,0 +1,86 @@
+import { writeFileSync, unlinkSync, existsSync, mkdirSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { join } from "node:path";
+import { homedir } from "node:os";
+function getServicePath(instance) {
+    const name = instance ? `chvor-${instance}` : "chvor";
+    return join(homedir(), ".config", "systemd", "user", `${name}.service`);
+}
+function getServiceName(instance) {
+    return instance ? `chvor-${instance}.service` : "chvor.service";
+}
+function escapeSystemdArg(s) {
+    return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+export async function install(nodePath, cliPath, instance) {
+    const servicePath = getServicePath(instance);
+    const serviceName = getServiceName(instance);
+    mkdirSync(join(homedir(), ".config", "systemd", "user"), { recursive: true });
+    const args = ["start", "--foreground"];
+    if (instance)
+        args.push("-i", instance);
+    const execArgs = [`"${escapeSystemdArg(nodePath)}"`, `"${escapeSystemdArg(cliPath)}"`, ...args.map((a) => `"${escapeSystemdArg(a)}"`)].join(" ");
+    const unit = `[Unit]
+Description=Chvor AI Server${instance ? ` (${instance})` : ""}
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=${execArgs}
+Restart=on-failure
+RestartSec=5
+Environment=NODE_ENV=production
+
+[Install]
+WantedBy=default.target
+`;
+    writeFileSync(servicePath, unit, "utf-8");
+    execFileSync("systemctl", ["--user", "daemon-reload"], { stdio: "inherit" });
+    execFileSync("systemctl", ["--user", "enable", serviceName], { stdio: "inherit" });
+    execFileSync("systemctl", ["--user", "start", serviceName], { stdio: "inherit" });
+    console.log(`Auto-start installed. Chvor will start on login.`);
+    console.log(`  Service: ${servicePath}`);
+}
+export async function uninstall(instance) {
+    const servicePath = getServicePath(instance);
+    const serviceName = getServiceName(instance);
+    if (!existsSync(servicePath)) {
+        console.log("Auto-start is not installed.");
+        return;
+    }
+    try {
+        execFileSync("systemctl", ["--user", "stop", serviceName], { stdio: "pipe" });
+    }
+    catch {
+        // Already stopped
+    }
+    try {
+        execFileSync("systemctl", ["--user", "disable", serviceName], { stdio: "pipe" });
+    }
+    catch {
+        // Already disabled
+    }
+    unlinkSync(servicePath);
+    execFileSync("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
+    console.log("Auto-start removed.");
+}
+export async function status(instance) {
+    const servicePath = getServicePath(instance);
+    const serviceName = getServiceName(instance);
+    if (!existsSync(servicePath)) {
+        console.log("Auto-start: not installed");
+        return;
+    }
+    try {
+        const output = execFileSync("systemctl", ["--user", "is-active", serviceName], {
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        console.log(`Auto-start: installed (${output.trim()})`);
+        console.log(`  Service: ${servicePath}`);
+    }
+    catch {
+        console.log("Auto-start: installed (inactive)");
+        console.log(`  Service: ${servicePath}`);
+    }
+}

package/dist/lib/service-win32.js

@@ -0,0 +1,43 @@
+import { writeFileSync, unlinkSync, existsSync } from "node:fs";
+import { join } from "node:path";
+function getVbsPath(instance) {
+    const appData = process.env.APPDATA;
+    if (!appData)
+        throw new Error("APPDATA environment variable not set");
+    const name = instance ? `chvor-${instance}-autostart` : "chvor-autostart";
+    return join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Startup", `${name}.vbs`);
+}
+function escapeVbs(s) {
+    return s.replace(/"/g, '""');
+}
+export async function install(nodePath, cliPath, instance) {
+    const vbsPath = getVbsPath(instance);
+    const escapedNode = escapeVbs(nodePath);
+    const escapedCli = escapeVbs(cliPath);
+    const args = instance ? `start -i ""${escapeVbs(instance)}""` : "start";
+    // VBScript that runs chvor start in a hidden window (no console flash)
+    const vbs = `Set WshShell = CreateObject("WScript.Shell")
+WshShell.Run """${escapedNode}"" ""${escapedCli}"" ${args}", 0, False
+`;
+    writeFileSync(vbsPath, vbs, "utf-8");
+    console.log(`Auto-start installed. Chvor will start on login.`);
+    console.log(`  Script: ${vbsPath}`);
+}
+export async function uninstall(instance) {
+    const vbsPath = getVbsPath(instance);
+    if (!existsSync(vbsPath)) {
+        console.log("Auto-start is not installed.");
+        return;
+    }
+    unlinkSync(vbsPath);
+    console.log("Auto-start removed.");
+}
+export async function status(instance) {
+    const vbsPath = getVbsPath(instance);
+    if (!existsSync(vbsPath)) {
+        console.log("Auto-start: not installed");
+        return;
+    }
+    console.log("Auto-start: installed");
+    console.log(`  Script: ${vbsPath}`);
+}

package/dist/lib/validate.js

@@ -5,3 +5,9 @@ export function validatePort(value) {
     }
     return value;
 }
+export function validateInstanceName(name) {
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(name)) {
+        throw new Error(`Invalid instance name "${name}". Use only letters, digits, hyphens, and underscores (max 64 chars, must start with alphanumeric).`);
+    }
+    return name;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chvor/cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Your own AI — install and run chvor.",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",