@gleapai/kai-bridge 0.10.2 → 0.12.0

package/src/setup.mjs

@@ -1,19 +1,19 @@
-// Interactive onboarding — the whole first run in one guided flow:
+// Interactive onboarding — one screen, four states (see deriveMode):
 //
-//   1. pair this machine with the user's Gleap account
-//   2. offer the background service (start at login, restart on crash)
-//   3. offer harness sign-ins (Claude Code / Codex / Cursor), inline
-//   4. make sure a browser exists for previews (Chrome, else Chromium)
-//   5. say it's done, nicely
+//   first run     the guided steps: pair · background service · agent sign-ins
+//   ready         the machine's state and a short menu (Enter exits)
+//   attention     the same, with what is missing first (Enter fixes it)
+//   disconnected  the device was removed in the dashboard; Enter reconnects
 //
-// Runs from `kai-bridge setup`, from a bare `kai-bridge` on an unpaired
-// machine, and (when npm shows script output — `--foreground-scripts`)
-// straight from `npm i -g @gleapai/kai-bridge`'s postinstall. Re-running is
-// safe: every step detects its current state and offers the next thing,
-// so it doubles as "reconnect", "add a harness", and "log out".
+// Runs from `kai-bridge setup`, from a bare `kai-bridge`, and (when npm
+// shows script output — `--foreground-scripts`) straight from
+// `npm i -g @gleapai/kai-bridge`'s postinstall. Every action re-reads the
+// machine's state afterwards, so the screen doubles as "reconnect",
+// "add a harness", "start the service" and "log out".
 
 import { spawn } from "node:child_process";
-import { homedir } from "node:os";
+import { randomUUID } from "node:crypto";
+import { homedir, platform } from "node:os";
 import { join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 
@@ -22,6 +22,9 @@ import { KAI_HOME, deviceDefaults, loadConfig, saveConfig } from "./config.mjs";
 import { describeHarnesses, installHarness, HARNESS_INFO } from "./harnesses.mjs";
 import { ambientConfigDir, describeProfiles, loginCommand } from "./profiles.mjs";
 import { install, isInstalled, isEphemeralBinPath, uninstall } from "./service.mjs";
+import { collectProcessList, formatAge } from "./ps.mjs";
+import { installedVersionOrNull } from "./selfupdate.mjs";
+import { banner, layout, palette, panel, terminalColumns } from "./tui.mjs";
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
@@ -84,7 +87,19 @@ const out = (s = "") => process.stdout.write(s + "\n");
  */
 export async function pairDevice({ config, name, print = out }) {
   const api = new BridgeApi({ apiBase: config.apiBase });
-  const dev = { ...deviceDefaults(), name: name || deviceDefaults().name, version: "0.1.0" };
+  // Minted once per install and sent with every pairing: the server matches
+  // on it, so re-pairing (new name, lost token) never creates a second device.
+  if (!config.machineId) {
+    config.machineId = randomUUID();
+    saveConfig(config);
+  }
+  // The real version: the server stores it on approve and shows it in the devices list.
+  const dev = {
+    ...deviceDefaults(),
+    name: name || deviceDefaults().name,
+    version: installedVersionOrNull() ?? "0.0.0",
+    machineId: config.machineId,
+  };
   const start = await api.pairStart(dev);
   const url = start.url || `${config.appBase}/connect-device?code=${start.code}`;
   print(`\nOpen this link to connect "${dev.name}" to your Gleap account:\n\n  ${url}\n\nCode: ${start.code}\n`);
@@ -99,15 +114,16 @@ export async function pairDevice({ config, name, print = out }) {
     await sleep(3000);
     const poll = await api.pairPoll(start.pollToken);
     if (poll.status === "approved") {
-      config.device = { id: poll.device.id, name: poll.device.name, token: poll.token, organisationId: poll.device.organisationId, userId: poll.device.userId };
+      config.device = { id: poll.device.id, name: poll.device.name, token: poll.token, organisationId: poll.device.organisationId, organisationName: poll.device.organisationName ?? null, userId: poll.device.userId };
       saveConfig(config);
       print(`\nConnected as ${poll.device.name} (${poll.device.organisationName ?? poll.device.organisationId}).`);
       return poll.device;
     }
-    if (poll.status === "denied" || poll.status === "expired") throw new Error(`pairing ${poll.status}`);
+    if (poll.status === "denied") throw new Error("pairing denied in the dashboard. Run `kai-bridge` to try again.");
+    if (poll.status === "expired") throw new Error("pairing code expired (codes last 10 minutes). Run `kai-bridge` to get a fresh one.");
     process.stdout.write(".");
   }
-  throw new Error("pairing timed out");
+  throw new Error("pairing timed out (codes last 10 minutes). Run `kai-bridge` to get a fresh one.");
 }
 
 /**
@@ -124,7 +140,7 @@ export async function logout({ config = loadConfig(), print = out } = {}) {
   try {
     await new BridgeApi({ apiBase: config.apiBase, token: config.device.token }).logout();
   } catch {
-    print("(Couldn't reach Gleap to revoke the pairing — it was removed locally; you can also remove it under Kai Code → Settings → Devices.)");
+    print("(Couldn't reach Gleap to revoke the pairing — it was removed locally; you can also remove it under Kai Code → Settings → Kai Code Bridge.)");
   }
   if (isServiceHome() && isInstalled()) {
     uninstall();
@@ -149,140 +165,407 @@ async function harnessRows(config) {
   });
 }
 
+/** "2.1.258 (Claude Code)" / "codex-cli 0.153.4" → "2.1.258"; anything else unchanged. */
+const shortVersion = (v) => (v ? (/\d+\.\d+\.\d+/.exec(v)?.[0] ?? v) : null);
+
+// ── Screen state ──────────────────────────────────────────────────────
+//
+// Everything the wizard draws or decides comes from this one snapshot,
+// so the screen and its menu can never disagree. `probe` asks Gleap
+// whether the pairing still exists (read-only call): a device removed in
+// the dashboard otherwise looks "connected" until the daemon's next 403.
+
+/**
+ * @returns {{ paired, connection: "none"|"ok"|"revoked"|"unknown", device, service, harnesses, version, appBase }}
+ */
+export async function collectSetupState({ config, kaiHome = KAI_HOME, probe = true, fetchImpl } = {}) {
+  const paired = !!config.device?.token;
+  let connection = paired ? "unknown" : "none";
+  if (paired && probe) {
+    try {
+      const api = new BridgeApi({ apiBase: config.apiBase, token: config.device.token, ...(fetchImpl ? { fetchImpl } : {}) });
+      await api.request("GET", "/gleapcode/bridge/devices/me/pending", undefined, { timeoutMs: 8_000 });
+      connection = "ok";
+    } catch (err) {
+      connection = err?.status === 401 || err?.status === 403 ? "revoked" : "unknown";
+    }
+  }
+  const daemon = collectProcessList({ kaiHome }).daemon;
+  const managed = isServiceHome();
+  const service = { managed, installed: managed ? isInstalled() : false, running: daemon.running, startedAt: daemon.startedAt };
+  const harnesses = (await harnessRows(config)).map((h) => ({
+    id: h.id,
+    label: h.label,
+    installed: h.installed,
+    version: shortVersion(h.version),
+    authState: h.installed ? (h.profile?.authState ?? "signed_out") : "missing",
+    account: h.profile?.account ?? null,
+  }));
+  return { paired, connection, device: config.device ?? null, service, harnesses, version: installedVersionOrNull(), appBase: config.appBase };
+}
+
+/**
+ * Which screen to show:
+ *   first_run    — not paired
+ *   disconnected — paired, but Gleap says the device is gone
+ *   attention    — paired, something the daemon needs is missing
+ *   ready        — nothing to do
+ * `fixes` are the attention items, in the order "finish all" runs them.
+ */
+export function deriveMode(state, { ephemeral = false } = {}) {
+  if (!state.paired) return { mode: "first_run", fixes: [] };
+  if (state.connection === "revoked") return { mode: "disconnected", fixes: [] };
+  const fixes = [];
+  if (state.service.managed && !ephemeral) {
+    if (!state.service.installed) fixes.push({ id: "service", label: "Install the background service" });
+    else if (!state.service.running) fixes.push({ id: "service", label: "Start the background service" });
+  }
+  if (!state.harnesses.some((h) => h.authState === "signed_in")) fixes.push({ id: "agents", label: "Sign in to a coding agent" });
+  return { mode: fixes.length > 0 ? "attention" : "ready", fixes };
+}
+
+/** The numbered menu for a returning user. Never more than five entries. */
+export function buildMenu(state, { mode, fixes }) {
+  if (mode === "disconnected") {
+    return {
+      items: [
+        { id: "reconnect", label: "Reconnect this machine", recommended: true },
+        { id: "logout", label: "Remove the service and quit" },
+      ],
+      enter: { id: "reconnect", label: "Reconnect" },
+    };
+  }
+  const items = fixes.map((f, i) => ({ ...f, recommended: i === 0 }));
+  const agentsOpen = state.harnesses.some((h) => h.authState !== "signed_in");
+  if (agentsOpen && !fixes.some((f) => f.id === "agents")) items.push({ id: "agents", label: "Sign in or install coding agents" });
+  if (mode === "ready" && state.service.managed && state.service.running) items.push({ id: "service", label: "Restart the background service" });
+  items.push({ id: "dashboard", label: "Open the dashboard", hint: `${state.appBase}/dashboard` });
+  items.push({ id: "reconnect", label: "Reconnect this machine" });
+  items.push({ id: "logout", label: "Log out and quit" });
+  const enter =
+    fixes.length > 1 ? { id: "fix_all", label: "Finish all" } : fixes.length === 1 ? { id: fixes[0].id, label: fixes[0].label } : { id: "exit", label: "Exit" };
+  return { items: items.slice(0, 5), enter };
+}
+
+// ── Drawing ───────────────────────────────────────────────────────────
+
+const STATUS_PILL = {
+  first_run: (p) => p.dim("○ not set up"),
+  disconnected: (p) => p.red("● disconnected"),
+  attention: (p) => p.yellow("● needs attention"),
+  ready: (p, state) => p.green(state.service.running ? "● online" : "● connected"),
+};
+
+/** Header + the two panels, as lines. Pure: pass `paint`/`cols` in tests. */
+export function renderOverview(state, { mode }, { paint = palette(), cols = terminalColumns() } = {}) {
+  const p = paint;
+  const head = banner({ left: `${p.bold("KAI CODE BRIDGE")}  ${p.dim(`v${state.version ?? "?"}`)}`, right: STATUS_PILL[mode](p, state), cols, paint: p });
+
+  const machine = [];
+  machine.push(state.device?.name ?? deviceDefaults().name);
+  if (!state.paired) machine.push(p.yellow("not connected to Gleap"));
+  else if (state.connection === "revoked") machine.push(p.red("no longer connected"));
+  else machine.push(`${state.device.organisationName ? `${state.device.organisationName} ${p.dim("· Gleap")}` : "connected to Gleap"}${state.connection === "unknown" ? p.dim(" · offline?") : ""}`);
+  if (!state.service.managed) machine.push(`service ${p.dim("n/a (custom KAI_HOME)")}`);
+  else if (state.service.running) machine.push(`service ${p.green("running")} ${p.dim(`· up ${formatAge(state.service.startedAt)}`)}`);
+  else if (state.service.installed) machine.push(`service ${(mode === "disconnected" ? p.dim : p.yellow)("stopped")}`);
+  else machine.push(`service ${(state.paired ? p.yellow : p.dim)("not installed")}`);
+
+  const agents = state.harnesses.map((h) => {
+    const status =
+      h.authState === "signed_in" ? p.green("signed in".padEnd(13)) : h.authState === "missing" ? p.dim("not installed".padEnd(13)) : p.yellow("signed out".padEnd(13));
+    return `${h.id.padEnd(7)} ${status}${h.version ? ` ${p.dim(h.version)}` : ""}`;
+  });
+
+  const panels = layout([panel("machine", machine, { paint: p, inner: 29 }), panel("agents", agents, { paint: p })], { cols });
+  return [...head, "", ...panels];
+}
+
+/** Parse "1,3" / "2 3" / "" against a menu; Enter → the recommended action. */
+export function parseMenuChoice(answer, menu) {
+  const picked = String(answer || "")
+    .split(/[\s,]+/)
+    .filter(Boolean)
+    .map((n) => menu.items[Number(n) - 1]?.id)
+    .filter(Boolean);
+  return picked.length > 0 ? picked : [menu.enter.id];
+}
+
+// ── Steps (each one re-checks its own state, so they are safe to re-run) ──
+
+async function serviceStep({ state, binPath, prompter, confirm = true }) {
+  if (!state.service.managed) {
+    out(p().dim("(Custom KAI_HOME — skipping the background service; it always runs on the machine's default ~/.kai.)"));
+    return;
+  }
+  if (binPath && isEphemeralBinPath(binPath)) {
+    out(p().dim("(Running via npx — install it with `npm i -g @gleapai/kai-bridge`, then `kai-bridge service install`.)"));
+    return;
+  }
+  if (state.service.installed && state.service.running && confirm) {
+    out("Background service: already running.");
+    return;
+  }
+  if (confirm && !state.service.installed) {
+    out(`  Kai only reaches this machine while the bridge is running. ${p().yellow("Recommended:")} keep it`);
+    out("  running in the background — it starts at login and restarts after crashes.");
+    out("");
+    const yes = await prompter.yesNo(`  ${p().blue("?")} Keep Kai reachable in the background?`, true);
+    if (!yes) {
+      out(p().dim("Skipped — run `kai-bridge start` whenever you want this machine available."));
+      return;
+    }
+  }
+  const res = install({ binPath, logDir: join(KAI_HOME, "logs") });
+  out(`${p().green("✓")} Background service ${state.service.installed ? "restarted" : "installed"} (${res.kind})${state.service.installed ? "." : " — running now, and again after every restart."}`);
+}
+
+async function agentsStep({ config, prompter }) {
+  let rows = await harnessRows(config);
+  out(p().bold("Coding agents on this machine"));
+  for (const [i, h] of rows.entries()) out(`  ${p().magenta(String(i + 1))}  ${rowLine(h)}`);
+  const pick = await prompter.ask(`${p().blue("?")} Sign in / install now? Numbers like \`1,3\`, or Enter to skip: `);
+  const picked = pick
+    .split(/[\s,]+/)
+    .map((n) => rows[Number(n) - 1])
+    .filter(Boolean);
+  for (const h of picked) {
+    if (!h.installed) {
+      out(`Installing ${h.label}…`);
+      const res = await installHarness(h.id, { kaiHome: KAI_HOME, onLog: out });
+      if (!res.ok) {
+        out(`Couldn't install ${h.label} — skipping (guide: ${HARNESS_INFO[h.id]?.label} docs).`);
+        continue;
+      }
+    }
+    if (h.profile?.authState === "signed_in") {
+      out(`${h.label} is already signed in — nothing to do.`);
+      continue;
+    }
+    const configDir = h.resolvedProfile?.configDir ?? ambientConfigDir(h.id);
+    const c = loginCommand(h.id, configDir);
+    if (!c) {
+      out(`${h.label} has no login command — skipping.`);
+      continue;
+    }
+    out(`\nSigning in to ${h.label} — follow its own prompts:`);
+    await new Promise((res) => spawn(c.cmd, c.args, { env: c.env, stdio: "inherit" }).on("close", res));
+  }
+  if (picked.length > 0) {
+    rows = await harnessRows(config);
+    out("");
+    for (const h of rows) out(`  ${rowLine(h)}`);
+  }
+}
+
 const rowLine = (h) => {
   const status = !h.installed
-    ? "not installed"
+    ? p().dim("not installed")
     : h.profile?.authState === "signed_in"
-      ? `✓ signed in${h.profile.account ? ` as ${h.profile.account}` : ""}`
-      : "installed · signed out";
+      ? p().green(`✓ signed in${h.profile.account ? ` as ${h.profile.account}` : ""}`)
+      : p().yellow("signed out");
   return `${h.label.padEnd(12)} ${status}`;
 };
 
+// The preview warm-up and the agent's browser tools need a real browser.
+// System Chrome needs nothing; otherwise Playwright's Chromium is
+// downloaded once here (the daemon would do it lazily before the first
+// preview, which is a bad moment to wait for 150 MB).
+async function browserStep({ quiet = false } = {}) {
+  if (!quiet) out(p().bold("Browser for previews"));
+  try {
+    const { ensurePreviewBrowser } = await import("./preview.mjs");
+    const { createLogger } = await import("./daemon.mjs");
+    let announced = false;
+    const res = await ensurePreviewBrowser({
+      log: (level, event, data) => {
+        createLogger()(level, event, data);
+        if (event === "browser.install.start" && !announced) {
+          announced = true;
+          out("  Downloading Chromium for previews (one time, ~150 MB)…");
+        }
+      },
+    });
+    if (res.browser === "chrome") {
+      if (!quiet) out(`  ${p().green("✓")} Using Google Chrome on this machine.`);
+    } else if (res.ok) {
+      if (!quiet || res.installed) out(`  ${p().green("✓")} ${res.installed ? "Chromium installed for previews." : "Bundled Chromium already installed."}`);
+    } else out(`  No browser for previews yet — they will try again later (${res.error}).`);
+  } catch (err) {
+    if (!quiet) out(`  Skipped (${err?.message || err}).`);
+  }
+}
+
+function openDashboard(appBase) {
+  const url = `${appBase}/dashboard`;
+  const opener = platform() === "darwin" ? ["open", [url]] : platform() === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    spawn(opener[0], opener[1], { detached: true, stdio: "ignore" }).on("error", () => undefined).unref();
+  } catch {
+    /* printing the link is enough */
+  }
+  out(`  ${url}`);
+}
+
+let paintCache;
+const p = () => (paintCache ??= palette());
+
+/** The first-run steps, in order. Shown as a rail, never as a menu. */
+export const SETUP_STEPS = [
+  { id: "connect", label: "Connect", hint: "open a link, approve it in the dashboard" },
+  { id: "service", label: "Service", hint: "keep Kai running at login" },
+  { id: "agents", label: "Agents", hint: "sign in to Claude Code, Codex or Cursor" },
+];
+
 /**
- * The wizard. `binPath` is the CLI entry (for the service plist);
- * re-runnable at any time.
+ * `● Connect ──── ● Service ──── ◉ Agents ──── ○ Browser   step 3 of 4`
+ * Done steps are green, the current one bold, the rest dim.
  */
-export async function runSetup({ binPath, prompter = makePrompter() } = {}) {
+export function stepRail(current, { paint = palette(), steps = SETUP_STEPS } = {}) {
+  const parts = steps.map((s, i) => (i < current ? paint.green(`● ${s.label}`) : i === current ? paint.bold(`◉ ${s.label}`) : paint.dim(`○ ${s.label}`)));
+  const rail = parts.join(paint.dim(" ──── "));
+  return current < steps.length ? `${rail}   ${paint.dim(`step ${current + 1} of ${steps.length}`)}` : rail;
+}
+
+// ── The wizard ────────────────────────────────────────────────────────
+
+/**
+ * `kai-bridge setup` / a bare `kai-bridge`. One screen, four states (see
+ * deriveMode): a first run walks through the steps; every later run
+ * shows the machine's state and a short menu whose Enter does the one
+ * recommended thing. `binPath` is the CLI entry (for the service plist).
+ */
+export async function runSetup({ binPath, prompter = makePrompter(), paint, cols } = {}) {
   const config = loadConfig();
-  out("");
-  out("── Kai Code Bridge ────────────────────────────────────────────────");
-  out("Run Kai Code sessions on this machine — with your own Claude /");
-  out("Codex / Cursor login, against your local checkouts.");
-  out("");
+  paintCache = paint ?? palette();
+  const draw = (state, derived) => {
+    out("");
+    for (const line of renderOverview(state, derived, { paint: p(), cols: cols ?? terminalColumns() })) out(line);
+    out("");
+  };
+  const ephemeral = !!(binPath && isEphemeralBinPath(binPath));
 
   try {
-    // 1 ── Pairing ---------------------------------------------------
-    if (config.device?.token) {
-      out(`This machine is already connected as ${config.device.name}.`);
-      const choice = (
-        await prompter.ask("Press Enter to keep it, `r` to reconnect, or `o` to log out and quit: ")
-      ).toLowerCase();
-      if (choice === "o") {
-        await logout({ config });
+    let state = await collectSetupState({ config });
+    let derived = deriveMode(state, { ephemeral });
+
+    // ── First run: the guided steps ───────────────────────────────
+    if (derived.mode === "first_run") {
+      draw(state, derived);
+      out(`  ${p().bold("Let's set this machine up")} ${p().dim(`— ${SETUP_STEPS.length} short steps, about 2 minutes`)}`);
+      out("");
+      for (const step of SETUP_STEPS) out(`    ${p().dim("○")} ${step.label.padEnd(9)} ${p().dim(step.hint)}`);
+      out("");
+      if (!process.stdin.isTTY) {
+        out(p().dim("  Not a terminal — run `kai-bridge setup` interactively to pair this machine."));
         return;
       }
-      if (choice === "r") {
-        await logout({ config });
-        await pairDevice({ config });
+      if (!(await prompter.yesNo(`  ${p().blue("?")} Start now?`, true))) {
+        out("");
+        out(p().dim("  Later: `kai-bridge setup` picks up right here."));
+        return;
       }
-    } else {
-      out("Step 1 — connect this machine to your Gleap account.");
+      const stepHeader = (i) => {
+        out("");
+        out(`  ${stepRail(i, { paint: p() })}`);
+        out("");
+      };
+      stepHeader(0);
       await pairDevice({ config });
+      stepHeader(1);
+      state = await collectSetupState({ config, probe: false });
+      await serviceStep({ state, binPath, prompter });
+      stepHeader(2);
+      await agentsStep({ config, prompter });
+      out("");
+      out(`  ${stepRail(SETUP_STEPS.length, { paint: p() })}`);
+      // Not a step of its own: silent when Chrome or Chromium is already
+      // there, a one-line notice when the Chromium download has to run.
+      await browserStep({ quiet: true });
+      state = await collectSetupState({ config, probe: false });
+      derived = deriveMode(state, { ephemeral });
+      draw(state, derived);
+      out(`  ${p().green("✓ All set.")} ${state.device?.name ?? "This machine"} now shows up in Kai Code.`);
+      out("");
+      out("  The connect page in your browser flips to \"ready\" on its own.");
+      out("  Pick this machine in the Run-on menu of any session, and it runs");
+      out("  right here — on your own subscription, with your local checkouts");
+      out("  and dev servers. Happy shipping!");
+      out("");
+      out(`  ${state.appBase}/dashboard`);
+      out("");
+      out(p().dim("  Handy later:  kai-bridge status · kai-bridge setup · kai-bridge logout"));
+      return;
     }
-    out("");
 
-    // 2 ── Background service ---------------------------------------
-    if (!isServiceHome()) {
-      out("(Custom KAI_HOME — skipping the background service; it always runs on the machine's default ~/.kai.)");
-    } else if (binPath && isEphemeralBinPath(binPath)) {
-      out("(Running via npx — install it with `npm i -g @gleapai/kai-bridge` to add the background service.)");
-    } else if (isInstalled()) {
-      out("Background service: already installed — Kai stays reachable here.");
-    } else if (
-      await prompter.yesNo("Step 2 — keep Kai reachable in the background? Starts at login, restarts after crashes.", true)
-    ) {
-      const res = install({ binPath, logDir: join(KAI_HOME, "logs") });
-      out(`Installed (${res.kind}) — running now, and again after every restart.`);
-    } else {
-      out("Skipped — run `kai-bridge start` whenever you want this machine available.");
-    }
-    out("");
-
-    // 3 ── Harness sign-ins ------------------------------------------
-    out("Step 3 — coding agents on this machine:");
-    let rows = await harnessRows(config);
-    for (const [i, h] of rows.entries()) out(`  ${i + 1}. ${rowLine(h)}`);
-    const pick = await prompter.ask("Sign in / install now? Numbers like `1,3`, or Enter to skip: ");
-    const picked = pick
-      .split(/[\s,]+/)
-      .map((n) => rows[Number(n) - 1])
-      .filter(Boolean);
-    for (const h of picked) {
-      if (!h.installed) {
-        out(`Installing ${h.label}…`);
-        const res = await installHarness(h.id, { kaiHome: KAI_HOME, onLog: out });
-        if (!res.ok) {
-          out(`Couldn't install ${h.label} — skipping (guide: ${HARNESS_INFO[h.id]?.label} docs).`);
-          continue;
-        }
+    // ── Returning user: state + menu, until they exit ─────────────
+    for (let round = 0; round < 8; round += 1) {
+      draw(state, derived);
+      const menu = buildMenu(state, derived);
+      if (derived.mode === "disconnected") {
+        out(`  ${p().red("This machine was removed from Gleap")} ${p().dim("(Settings → Kai Code Bridge)")}`);
+        out("  Your agent logins are untouched. Reconnecting takes a minute.");
+      } else if (derived.mode === "attention") {
+        const n = derived.fixes.length;
+        out(`  ${p().yellow(n === 1 ? "1 thing to finish" : `${n} things to finish`)}`);
+      } else {
+        out(`  ${p().green("✓ All set.")} Pick this machine in the Run-on menu of any session.`);
       }
-      if (h.profile?.authState === "signed_in") {
-        out(`${h.label} is already signed in — nothing to do.`);
-        continue;
+      out("");
+      for (const [i, item] of menu.items.entries()) {
+        const tag = item.recommended ? `   ${p().yellow("recommended")}` : item.hint ? `   ${p().dim(item.hint)}` : "";
+        out(`  ${p().magenta(String(i + 1))}  ${tag ? item.label.padEnd(32) + tag : item.label}`);
       }
-      const configDir = h.resolvedProfile?.configDir ?? ambientConfigDir(h.id);
-      const c = loginCommand(h.id, configDir);
-      if (!c) {
-        out(`${h.label} has no login command — skipping.`);
-        continue;
+      out(`  ${p().dim("Enter")}  ${menu.enter.label}`);
+      out("");
+      // No terminal (a script, CI, `< /dev/null`): show the state, never act.
+      // Reconnecting or logging out from a script is how a healthy machine
+      // gets unpaired by accident.
+      if (!process.stdin.isTTY) {
+        out(p().dim("  Not a terminal — showing the state only. Run `kai-bridge setup` interactively to change it."));
+        return;
       }
-      out(`\nSigning in to ${h.label} — follow its own prompts:`);
-      await new Promise((res) => spawn(c.cmd, c.args, { env: c.env, stdio: "inherit" }).on("close", res));
-    }
-    if (picked.length > 0) {
-      rows = await harnessRows(config);
+      const answer = await prompter.ask(`  ${p().blue("?")} Choose: `);
       out("");
-      for (const h of rows) out(`  ${rowLine(h)}`);
-    }
-    out("");
-
-    // 4 ── Browser for previews --------------------------------------
-    // The preview warm-up and the agent's browser tools need a real
-    // browser. System Chrome needs nothing; otherwise Playwright's Chromium
-    // is downloaded once here (the daemon would do it lazily before the
-    // first preview, which is a bad moment to wait for 150 MB).
-    out("Step 4 — browser for previews:");
-    try {
-      const { ensurePreviewBrowser } = await import("./preview.mjs");
-      const { createLogger } = await import("./daemon.mjs");
-      let announced = false;
-      const res = await ensurePreviewBrowser({
-        log: (level, event, data) => {
-          createLogger()(level, event, data);
-          if (event === "browser.install.start" && !announced) {
-            announced = true;
-            out("  Downloading Chromium for previews (one time, ~150 MB)…");
-          }
-        },
-      });
-      if (res.browser === "chrome") out("  Using Google Chrome on this machine.");
-      else if (res.ok) out(res.installed ? "  Chromium installed." : "  Bundled Chromium already installed.");
-      else out(`  No browser yet — previews will try again later (${res.error}).`);
-    } catch (err) {
-      out(`  Skipped (${err?.message || err}).`);
+      const actions = parseMenuChoice(answer, menu);
+      const run = async (id) => {
+        switch (id) {
+          case "exit":
+            return true;
+          case "fix_all":
+            for (const f of derived.fixes) await run(f.id);
+            return false;
+          case "service":
+            await serviceStep({ state, binPath, prompter, confirm: false });
+            return false;
+          case "agents":
+            await agentsStep({ config, prompter });
+            return false;
+          case "dashboard":
+            openDashboard(state.appBase);
+            return false;
+          case "reconnect":
+            await logout({ config });
+            await pairDevice({ config });
+            if (state.service.managed && !ephemeral) {
+              // logout() removed the service; a reconnected machine wants it back.
+              const res = install({ binPath, logDir: join(KAI_HOME, "logs") });
+              out(`${p().green("✓")} Background service installed (${res.kind}).`);
+            }
+            return false;
+          case "logout":
+            await logout({ config });
+            return true;
+          default:
+            return false;
+        }
+      };
+      let done = false;
+      for (const id of actions) done = (await run(id)) || done;
+      if (done) return;
+      state = await collectSetupState({ config });
+      derived = deriveMode(state, { ephemeral });
     }
-    out("");
-
-    // 5 ── Done -------------------------------------------------------
-    const name = config.device?.name ?? "This machine";
-    out("──────────────────────────────────────────────────────────────");
-    out(`🎉 All set. ${name} now shows up in Kai Code.`);
-    out("");
-    out("Open Gleap → Kai Code, pick this machine in the Run-on menu,");
-    out("and sessions run right here — on your own subscription, with");
-    out("your local checkouts and dev servers. Happy shipping!");
-    out("");
-    out("Handy later:  kai-bridge status · kai-bridge setup · kai-bridge logout");
   } finally {
     prompter.close();
   }