@kin-tio/cli 0.6.1 → 0.7.0

package/.env.example

@@ -28,8 +28,10 @@ WECOM_AUTH_CONFIRMATION=Code accepted. You can continue the conversation.
 # WECOM_MCP_OBSERVE_MS=5000
 # SHUTDOWN_TIMEOUT_MS=10000
 
-# Optional Weixin iLink channel. Generate a 32-byte base64url key and keep it in
-# the deployment secret store; Bot and context tokens are encrypted with it.
+# Enable Weixin iLink inside the combined `kintio start` runtime. Standalone
+# `kintio ilink login` and `kintio ilink start` do not require this flag.
+# Generate a 32-byte base64url key and keep it in the deployment secret store;
+# Bot and context tokens are encrypted with it.
 ILINK_ENABLED=false
 # Prefer a deployment-secret value. If omitted, the service creates a private
 # 0600 key file beside SQLite; never register that key with a chat Agent.

package/CHANGELOG.md

@@ -4,6 +4,45 @@ This file records important user-visible changes after the first public release.
 
 ## Unreleased
 
+## 0.7.0
+
+- Added `kintio ilink login`, which reuses the iLink enrollment state machine
+  while rendering its five-minute QR code directly in an interactive terminal;
+  no WeChat KF conversation or Agent turn is required. Accounts
+  enrolled locally receive host-level Agent access and inherit the host runtime
+  configuration, while remotely offered iLink accounts remain restricted
+  ([#54](https://github.com/Gkxie/kintio/issues/54)).
+- Added an explicit `--qr-output <file>` view for `kintio ilink login`, allowing
+  graphical and non-terminal callers to consume a temporary raw PNG directly
+  from the QR payload without parsing ANSI terminal output. The file is created
+  exclusively and removed when the login attempt ends
+  ([#57](https://github.com/Gkxie/kintio/issues/57)).
+- Made iLink a standalone lifecycle: `kintio ilink login` now initializes and
+  persists an account without setup, an environment file, Hono, or a running
+  Worker, while safely delegating to a running instance when present;
+  `kintio ilink start` starts polling and the host Agent in the foreground without
+  a public HTTP listener. The iLink Runtime configuration no longer contains a
+  synthetic WeChat KF adapter
+  ([#59](https://github.com/Gkxie/kintio/issues/59)).
+- Added per-account `kintio ilink list`, `start`, `stop`, and confirmed `delete`
+  lifecycle commands. One Runtime can reconcile multiple selected listeners;
+  complete deletion atomically purges the selected account and all Kintio data
+  scoped to it while preserving unrelated accounts and channels
+  ([#60](https://github.com/Gkxie/kintio/issues/60)).
+
+## 0.6.2
+
+- Added a custom Kintio wordmark and its circular-safe TIO avatar to the English
+  and Simplified Chinese entry pages and public package.
+- Added a repository-scoped Release App that deterministically maintains one
+  fully checked Release PR from the reviewed Unreleased notes; maintainers now
+  authorize a release by reviewing and merging that PR only
+  ([#48](https://github.com/Gkxie/kintio/issues/48)).
+- Made a merged, owner-authored Release PR the sole human release authorization;
+  Kintio now creates the annotated tag and dispatches its verified OIDC release
+  automatically
+  ([#45](https://github.com/Gkxie/kintio/issues/45)).
+
 ## 0.6.1 - 2026-08-31
 
 - Added approval-gated npm Trusted Publishing with an exact artifact integrity

package/README.md

@@ -1,6 +1,8 @@
 <div align="center">
 
-# Kintio
+<h1>
+  <img src="assets/logo.svg" alt="Kintio" width="320" />
+</h1>
 
 **Connect chat channels to an Agent you control.**
 
@@ -65,33 +67,67 @@ Prerequisites:
 
 ```bash
 npm install --global @kin-tio/cli
-kintio setup
 codex login status
 ```
 
-`kintio setup` creates a private instance under `~/.kintio`, installs the bundled Agent
-skill, and writes the channel configuration template. POSIX systems use mode `0600`;
-Windows keeps the instance inside the current user's profile. No adapter is enabled
-by default. Follow the [setup guide](https://github.com/Gkxie/kintio/blob/master/docs/setup.md)
-and edit `~/.kintio/.env` to configure one adapter:
+For an iLink-only instance, no setup file or public HTTP listener is required:
 
-- For WeChat KF API, set its callback token, EncodingAESKey, CorpID, and secret. A temporary
-  `WECOM_AUTH_TRIGGER` can authorize the first user without knowing their
-  `external_userid` in advance.
-- For an existing Weixin iLink binding, set `ILINK_ENABLED=true`. Creating a new binding
-  currently starts from an authorized WeChat KF conversation.
+```bash
+kintio ilink login
+kintio ilink start
+```
 
-Start Kintio:
+`ilink login` performs one encrypted enrollment, starts no listener, and exits. `ilink start` then runs provider
+polling and the host Agent in the foreground without Hono or a TCP listener. Both commands
+use `~/.kintio` by default and accept `--home`. With multiple accounts, use `ilink list`
+and pass the displayed provider ID or account key through `--account`. Repeated `start`
+commands add accounts to the live runtime; `stop` removes one.
+
+For a callback-based adapter, create and edit the deployment configuration instead:
 
 ```bash
+kintio setup
 kintio start
 kintio status
 kintio logs --lines 100
 ```
 
-After startup, confirm that `kintio logs` contains `Hono server is listening on port 8888`.
-Complete the callback or binding checks described in the setup guide before sending traffic.
-Use `kintio run` when a foreground process is preferable to the native daemon.
+`kintio setup` creates a private instance under `~/.kintio`, installs the managed Agent
+skill, and writes the channel configuration template. Follow the
+[setup guide](https://github.com/Gkxie/kintio/blob/master/docs/setup.md):
+
+- For WeChat KF API, set its callback token, EncodingAESKey, CorpID, and secret. A temporary
+  `WECOM_AUTH_TRIGGER` can authorize the first user without knowing their
+  `external_userid` in advance.
+- A combined callback + iLink deployment may additionally set `ILINK_ENABLED=true`.
+
+For a graphical or non-terminal caller, select a temporary raw PNG instead of ANSI blocks:
+
+```bash
+kintio ilink login --qr-output ~/.kintio/ilink-login.png
+```
+
+The target must be directly inside the selected Kintio instance directory and must not
+already exist. Kintio removes the PNG when login succeeds, expires, is cancelled, or fails;
+the QR payload is never printed. Without `--qr-output`, the command
+requires an interactive terminal. Both forms stop waiting after five minutes and never
+start an Agent turn. The resulting iLink identity represents
+the local operator and inherits the host Agent configuration without Kintio's untrusted-
+channel capability restrictions. Show this QR code only to someone authorized to control
+the host Agent. Run `kintio ilink start` after enrollment to process messages without Hono.
+
+To permanently remove an account and every Kintio record scoped to it, use:
+
+```bash
+kintio ilink delete --account <provider-id-or-account-key> --yes
+```
+
+The explicit confirmation is mandatory. Credentials, conversations, messages, media,
+delivery records, and enrollment audit rows for that account are deleted atomically.
+
+For callback deployments, confirm that `kintio logs` contains
+`Hono server is listening on port 8888`. Use `kintio run` when a foreground process is
+preferable to the native daemon.
 Existing source-based deployments can keep their current state after the one-time
 process-manager migration described in the setup guide.
 
@@ -109,6 +145,9 @@ Source builds and contributor setup are documented in
   Hono route; every action still requires a short-lived conversation capability.
 - Project-level Agent capability restrictions are not an operating-system sandbox. Use a
   dedicated system account and additional isolation appropriate to the Agent's real powers.
+- An iLink account enrolled by `kintio ilink login` is explicitly host-authorized; its owner
+  receives the capabilities allowed by the host Agent configuration. Accounts enrolled from
+  a remote adapter remain restricted, and chat input cannot change this persisted trust level.
 - A provider accepting an outbound request does not prove that a client displayed it;
   uncertain outcomes remain explicit to avoid duplicate delivery.
 

package/README.zh-CN.md

@@ -1,6 +1,8 @@
 <div align="center">
 
-# Kintio
+<h1>
+  <img src="assets/logo.svg" alt="Kintio" width="320" />
+</h1>
 
 **把聊天通道连接到你掌控的 Agent。**
 
@@ -41,25 +43,49 @@
 
 ```bash
 npm install --global @kin-tio/cli
-kintio setup
 codex login status
 ```
 
-`kintio setup` 会在 `~/.kintio` 创建私有实例目录、安装内置 Agent Skill，并生成渠道配置
-模板 `.env`。macOS/Linux 使用 `0600`，Windows 则限定在当前用户目录的 ACL
-边界内。默认不启用任何适配器；请按英文
-[部署指南](https://github.com/Gkxie/kintio/blob/master/docs/setup.md)配置 WeChat KF API，或为已有 Weixin iLink 绑定设置
-`ILINK_ENABLED=true`。
+iLink 可以完全独立使用，不需要 `setup`、`.env` 或公网 HTTP：
 
 ```bash
+kintio ilink login
+kintio ilink start
+```
+
+`ilink login` 完成一次扫码、加密保存凭据后退出，不会自行启动监听；`ilink start` 不启动 Hono 或 TCP 端口，
+只以前台方式运行 iLink 长轮询和宿主 Agent。两者默认使用 `~/.kintio`。
+存在多个账号时，先用 `kintio ilink list` 查看账号，再通过 `--account` 指定
+`start`、`stop` 或 `delete` 的目标；正在运行时可继续执行 `start` 增加监听账号。
+
+需要部署公网回调渠道时，再使用：
+
+```bash
+kintio setup
 kintio start
 kintio status
 kintio logs --lines 100
 ```
 
-启动后应确认 `kintio logs` 包含 `Hono server is listening on port 8888`；投入使用前仍需按
-部署指南完成回调或绑定验证。需要前台进程时使用 `kintio run`；现有源码目录部署可以在完成
-部署指南中的一次性进程管理器迁移后，继续使用原数据库和配置。
+具体配置见英文[部署指南](https://github.com/Gkxie/kintio/blob/master/docs/setup.md)。
+
+图形界面或非交互调用方可以显式选择临时的原始 PNG，而不是解析终端字符：
+
+```bash
+kintio ilink login --qr-output ~/.kintio/ilink-login.png
+```
+
+目标文件必须直接位于所选 Kintio 实例目录中且不能预先存在；登录成功、过期、取消或失败后，Kintio 会自动删除该文件，并且
+不会打印二维码原始内容。二维码五分钟后过期；该命令不会唤醒 Agent。通过本机命令建立的 iLink 身份代表宿主机
+所有者的明确授权，后续对话直接继承宿主 Agent 配置，不再套用不可信渠道的能力限制。
+只应让获准控制宿主 Agent 的人扫描该二维码。登录后运行 `kintio ilink start` 即可在不
+启动 Hono 的情况下处理消息。
+
+`kintio ilink delete --account <账号> --yes` 会不可恢复地删除该账号及其在 Kintio
+中的凭据、会话、消息、媒体、发送记录和登录审计；`--yes` 为强制确认参数。
+
+公网回调部署启动后，应确认 `kintio logs` 包含
+`Hono server is listening on port 8888`。
 源码构建与贡献者开发环境见英文
 [贡献指南](https://github.com/Gkxie/kintio/blob/master/CONTRIBUTING.md)。
 

package/assets/avatar.svg

@@ -0,0 +1,32 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  width="200"
+  height="200"
+  viewBox="190 15 190 190"
+  role="img"
+  aria-labelledby="kintio-avatar-title"
+  aria-describedby="kintio-avatar-description"
+>
+  <!-- Letterform foundation: Manrope by Mikhail Sharanda, SIL Open Font License 1.1. -->
+  <title id="kintio-avatar-title">Kintio TIO avatar</title>
+  <desc id="kintio-avatar-description">A circular Kinetic Panels background with the Kintio TIO return aperture.</desc>
+  <defs>
+    <clipPath id="kintio-kinetic-panels-circle">
+      <circle cx="285" cy="110" r="95"/>
+    </clipPath>
+  </defs>
+  <g clip-path="url(#kintio-kinetic-panels-circle)">
+    <rect x="190" y="15" width="190" height="190" fill="#17152B"/>
+    <polygon points="190,15 304,15 270,58 190,88" fill="#5268FF"/>
+    <polygon points="302,152 380,112 380,205 270,205" fill="#3B2F73"/>
+    <polygon points="190,88 214,78 214,104 190,116" fill="#8C78FF"/>
+    <g transform="translate(285 110) scale(0.86) translate(-285 -110)">
+      <path d="M766 0Q661 -20 561 -17Q461 -14 382 21Q303 56 262 132Q226 201 224 272Q222 343 222 433L222 1380L447 1380L447 445Q447 380 448.5 331.5Q450 283 469 251Q505 190 583.5 182.5Q662 175 766 190ZM20 902L20 1080L766 1080L766 902Z" fill="#F6F3EE" transform="translate(204.393 150) scale(0.063 -0.063)"/>
+      <path d="M160 1251L160 1463L385 1463L385 1251ZM160 0L160 1080L385 1080L385 0Z" fill="#FF7656" transform="translate(257.289 150) scale(0.063 -0.063)"/>
+      <path d="M613 -30Q451 -30 331 43Q211 116 145.5 244.5Q80 373 80 541Q80 710 147 838.5Q214 967 334 1038.5Q454 1110 613 1110Q776 1110 896 1037Q1016 964 1082 836Q1148 708 1148 541Q1148 372 1081.5 243.5Q1015 115 894.5 42.5Q774 -30 613 -30ZM613 182Q762 182 835.5 282Q909 382 909 541Q909 704 835 801.5Q761 899 613 899Q512 899 447 853.5Q382 808 350.5 727.5Q319 647 319 541Q319 377 393.5 279.5Q468 182 613 182Z" fill="#F6F3EE" transform="translate(290.624 150) scale(0.063 -0.063)"/>
+      <rect x="286" y="108" width="23" height="18" fill="#17152B"/>
+      <rect x="289" y="113" width="11" height="8" fill="#FF7656"/>
+    </g>
+  </g>
+</svg>
+

package/assets/logo.svg

@@ -0,0 +1,22 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  width="374"
+  height="142"
+  viewBox="12.757 33.831 374.191 142.059"
+  role="img"
+  aria-labelledby="kintio-wordmark-title"
+  aria-describedby="kintio-wordmark-description"
+>
+  <!-- Letterform foundation: Manrope by Mikhail Sharanda, SIL Open Font License 1.1. -->
+  <title id="kintio-wordmark-title">Kintio</title>
+  <desc id="kintio-wordmark-description">Kintio wordmark with an Ember i and an open return aperture.</desc>
+  <rect x="12.757" y="33.831" width="374.191" height="142.059" fill="#211920"/>
+  <path d="M139 0L140 1440L368 1440L368 560L778 1080L1061 1080L628 540L1102 0L801 0L368 520L368 0Z" fill="#F6F3EE" transform="translate(28.000 150) scale(0.063000 -0.063000)"/>
+  <path d="M160 1251L160 1463L385 1463L385 1251ZM160 0L160 1080L385 1080L385 0Z" fill="#F6F3EE" transform="translate(93.906 150) scale(0.063000 -0.063000)"/>
+  <path d="M893 0L893 526Q893 582 884 646.5Q875 711 847.5 768.5Q820 826 768 862Q716 898 630 898Q579 898 531.5 881Q484 864 447 825.5Q410 787 388.5 721.5Q367 656 367 559L230 614Q230 756 284.5 868.5Q339 981 442.5 1045.5Q546 1110 695 1110Q810 1110 887.5 1072Q965 1034 1011.5 973.5Q1058 913 1081.5 844Q1105 775 1113 710.5Q1121 646 1121 602L1121 0ZM139 0L139 1080L340 1080L340 757L367 757L367 0Z" fill="#F6F3EE" transform="translate(127.241 150) scale(0.063000 -0.063000)"/>
+  <path d="M766 0Q661 -20 561 -17Q461 -14 382 21Q303 56 262 132Q226 201 224 272Q222 343 222 433L222 1380L447 1380L447 445Q447 380 448.5 331.5Q450 283 469 251Q505 190 583.5 182.5Q662 175 766 190ZM20 902L20 1080L766 1080L766 902Z" fill="#F6F3EE" transform="translate(204.393 150) scale(0.063000 -0.063000)"/>
+  <path d="M160 1251L160 1463L385 1463L385 1251ZM160 0L160 1080L385 1080L385 0Z" fill="#FF7656" transform="translate(257.289 150) scale(0.063000 -0.063000)"/>
+  <path d="M613 -30Q451 -30 331 43Q211 116 145.5 244.5Q80 373 80 541Q80 710 147 838.5Q214 967 334 1038.5Q454 1110 613 1110Q776 1110 896 1037Q1016 964 1082 836Q1148 708 1148 541Q1148 372 1081.5 243.5Q1015 115 894.5 42.5Q774 -30 613 -30ZM613 182Q762 182 835.5 282Q909 382 909 541Q909 704 835 801.5Q761 899 613 899Q512 899 447 853.5Q382 808 350.5 727.5Q319 647 319 541Q319 377 393.5 279.5Q468 182 613 182Z" fill="#F6F3EE" transform="translate(290.624 150) scale(0.063000 -0.063000)"/>
+  <rect x="286" y="108" width="23" height="18" fill="#211920"/>
+  <rect x="289" y="113" width="11" height="8" fill="#FF7656"/>
+</svg>

package/dist/src/cli.js

@@ -5,9 +5,12 @@ import path from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
 import { parseArgs } from 'node:util';
 import crossSpawn from 'cross-spawn';
-import { DAEMON_STOP_TIMEOUT_MS, loadConfig, parseStartTimeout, resolveProjectRoot, WORKER_GRACEFUL_TIMEOUT_MS, } from './config.js';
+import { DAEMON_STOP_TIMEOUT_MS, loadConfig, loadIlinkEnrollmentConfig, loadIlinkRuntimeConfig, parseStartTimeout, resolveProjectRoot, WORKER_GRACEFUL_TIMEOUT_MS, } from './config.js';
 import { isPathInside, samePath } from './lib/path-identity.js';
 import { assertTrustedDirectory, ensureContainedDirectory, ensurePrivateDirectory, } from './lib/private-directory.js';
+import { runIlinkCliLogin } from './ilink/cli-login.js';
+import { runIlinkAccountCommand } from './ilink/cli-accounts.js';
+import { startIlinkCliRuntime } from './ilink/cli-start.js';
 import { daemonRecordPath, readDaemonRecord, requestControl, } from './runtime/daemon-protocol.js';
 import { acquireSingleInstanceLock, processIsAlive, SingleInstanceLockError, } from './runtime/single-instance-lock.js';
 import { installManagedSkill } from './runtime/managed-skill.js';
@@ -22,6 +25,11 @@ Commands:
   restart               Restart Kintio with the current installation and config
   status                Show the background process status
   logs                  Follow Kintio logs
+  ilink login [options] Connect an iLink account with a QR code
+  ilink list            List enrolled iLink accounts
+  ilink start [options] Start one iLink account without Hono
+  ilink stop [options]  Stop one iLink account
+  ilink delete [options] Permanently delete one iLink account and its data
 
 Options:
   --home <directory>     Instance directory (default: ~/.kintio)
@@ -30,7 +38,132 @@ Options:
   --no-follow            Print logs without following
   -h, --help             Show this help
   -v, --version          Show the Kintio version
+
+Run "kintio ilink --help" for iLink account commands.
+`;
+const ILINK_LOGIN_HELP = `Usage: kintio ilink login [options]
+
+Connect one iLink account, save its encrypted credentials, and exit. This
+command does not require setup, an environment file, Hono, or a running Kintio
+instance. By default, the QR code is rendered directly in an interactive
+terminal and expires after five minutes.
+
+The PNG option is required when stdout is not an interactive terminal. Whoever
+scans this locally issued QR receives the capabilities allowed by the host Agent
+configuration; show it only to an authorized operator.
+
+Options:
+  --qr-output <file>     Write a temporary raw QR PNG instead of terminal blocks
+                         The file must be directly inside the instance directory
+                         The file is removed when the login attempt ends
+  --home <directory>     Instance directory (default: ~/.kintio)
+  --config <file>        Optional environment overrides
+  -h, --help             Show this help
+`;
+const ILINK_START_HELP = `Usage: kintio ilink start [options]
+
+Run iLink long polling and the host Agent in the foreground without starting
+Hono or opening a TCP listener. This command does not require setup or an
+environment file. One account is selected automatically; multiple accounts
+require --account. While this runtime is active, additional start commands add
+accounts to the same process.
+
+Options:
+  --account <id>        Provider account ID or Kintio account key
+  --home <directory>     Instance directory (default: ~/.kintio)
+  --config <file>        Optional environment overrides
+  -h, --help             Show this help
+`;
+const ILINK_STOP_HELP = `Usage: kintio ilink stop [options]
+
+Stop one iLink account. Stopping the last account also exits a foreground
+"kintio ilink start" runtime. One account is selected automatically; multiple
+accounts require --account.
+
+Options:
+  --account <id>        Provider account ID or Kintio account key
+  --home <directory>    Instance directory (default: ~/.kintio)
+  --config <file>       Optional environment overrides
+  -h, --help            Show this help
+`;
+const ILINK_LIST_HELP = `Usage: kintio ilink list [options]
+
+List enrolled iLink accounts and whether each account is currently running.
+
+Options:
+  --home <directory>    Instance directory (default: ~/.kintio)
+  --config <file>       Optional environment overrides
+  -h, --help            Show this help
+`;
+const ILINK_DELETE_HELP = `Usage: kintio ilink delete [options]
+
+Permanently delete one iLink account and all Kintio data scoped to it,
+including credentials, conversations, messages, media, send records, and
+enrollment audit records. This operation cannot be undone.
+
+Options:
+  --account <id>        Provider account ID or Kintio account key
+  --yes                 Confirm permanent deletion
+  --home <directory>    Instance directory (default: ~/.kintio)
+  --config <file>       Optional environment overrides
+  -h, --help            Show this help
+`;
+const ILINK_HELP = `Usage: kintio ilink <command>
+
+Commands:
+  login [options]        Connect an iLink account with a QR code
+  list                   List enrolled accounts
+  start [options]        Start one account without Hono
+  stop [options]         Stop one account
+  delete [options]       Permanently delete one account and its data
+
+Run "kintio ilink <command> --help" for command options.
 `;
+const ILINK_COMMANDS = new Set(['login', 'list', 'start', 'stop', 'delete']);
+const COMMANDS = new Set([
+    'setup',
+    'start',
+    'run',
+    'stop',
+    'restart',
+    'status',
+    'logs',
+    'ilink',
+]);
+const ILINK_SIGNALS = process.platform === 'win32'
+    ? ['SIGINT', 'SIGTERM']
+    : ['SIGINT', 'SIGTERM', 'SIGHUP'];
+function signalExitCode(signal) {
+    if (signal === 'SIGHUP')
+        return 129;
+    if (signal === 'SIGTERM')
+        return 143;
+    return 130;
+}
+async function runWithIlinkSignals(operation) {
+    const controller = new AbortController();
+    let interruptedBy;
+    const interrupt = (signal) => {
+        interruptedBy ||= signal;
+        controller.abort();
+    };
+    const listeners = ILINK_SIGNALS.map((signal) => ({
+        signal,
+        listener: () => interrupt(signal),
+    }));
+    for (const { signal, listener } of listeners)
+        process.once(signal, listener);
+    try {
+        const result = await operation(controller.signal);
+        return result === 130 && interruptedBy
+            ? signalExitCode(interruptedBy)
+            : result;
+    }
+    finally {
+        for (const { signal, listener } of listeners)
+            process.off(signal, listener);
+    }
+}
 function defaultExecute(request) {
     return new Promise((resolve, reject) => {
         const child = crossSpawn(request.file, [...request.args], {
@@ -108,6 +241,11 @@ function runtimeDefaults() {
         launchDaemon: defaultLaunchDaemon,
         stdout: (text) => process.stdout.write(text),
         stderr: (text) => process.stderr.write(text),
+        stdoutIsTTY: Boolean(process.stdout.isTTY),
+        stdoutColumns: process.stdout.columns || 80,
+        ilinkLogin: runIlinkCliLogin,
+        ilinkAccount: runIlinkAccountCommand,
+        ilinkStart: startIlinkCliRuntime,
     };
 }
 function resolveInputPath(value, cwd) {
@@ -508,6 +646,9 @@ export async function runCli(args, overrides = {}) {
                 config: { type: 'string' },
                 lines: { type: 'string' },
                 'no-follow': { type: 'boolean' },
+                'qr-output': { type: 'string' },
+                account: { type: 'string' },
+                yes: { type: 'boolean' },
                 help: { type: 'boolean', short: 'h' },
                 version: { type: 'boolean', short: 'v' },
             },
@@ -517,18 +658,118 @@ export async function runCli(args, overrides = {}) {
             return 0;
         }
         const command = parsed.positionals[0];
-        if (parsed.values.help || !command || command === 'help') {
+        const subcommand = parsed.positionals[1];
+        if (!command) {
+            if (parsed.values['qr-output'] !== undefined) {
+                throw new Error('--qr-output is valid only for "kintio ilink login"');
+            }
             runtime.stdout(HELP);
             return 0;
         }
-        if (parsed.positionals.length !== 1) {
-            throw new Error(`Unexpected argument: ${parsed.positionals[1]}`);
+        if (command === 'help') {
+            if (parsed.positionals.length !== 1) {
+                throw new Error(`Unexpected argument: ${subcommand}`);
+            }
+            runtime.stdout(HELP);
+            return 0;
+        }
+        if (!COMMANDS.has(command))
+            throw new Error(`Unknown command: ${command}`);
+        if (command === 'ilink') {
+            if (parsed.values.help && parsed.positionals.length === 1) {
+                runtime.stdout(ILINK_HELP);
+                return 0;
+            }
+            if (!subcommand || !ILINK_COMMANDS.has(subcommand) ||
+                parsed.positionals.length !== 2) {
+                throw new Error('Usage: kintio ilink <login|list|start|stop|delete>');
+            }
+        }
+        else if (parsed.positionals.length !== 1) {
+            throw new Error(`Unexpected argument: ${subcommand}`);
+        }
+        if (parsed.values.help) {
+            runtime.stdout(command !== 'ilink'
+                ? HELP
+                : subcommand === 'login' ? ILINK_LOGIN_HELP
+                    : subcommand === 'list' ? ILINK_LIST_HELP
+                        : subcommand === 'start' ? ILINK_START_HELP
+                            : subcommand === 'stop' ? ILINK_STOP_HELP
+                                : ILINK_DELETE_HELP);
+            return 0;
         }
         if (command !== 'logs' &&
             (parsed.values.lines !== undefined || parsed.values['no-follow'])) {
             throw new Error('--lines and --no-follow are valid only for "kintio logs"');
         }
+        if ((command !== 'ilink' || subcommand !== 'login') &&
+            parsed.values['qr-output'] !== undefined) {
+            throw new Error('--qr-output is valid only for "kintio ilink login"');
+        }
+        if (parsed.values['qr-output'] === '') {
+            throw new Error('--qr-output requires a non-empty file path');
+        }
+        if (parsed.values.account !== undefined &&
+            (command !== 'ilink' || !['start', 'stop', 'delete'].includes(subcommand || ''))) {
+            throw new Error('--account is valid only for "kintio ilink start|stop|delete"');
+        }
+        if (parsed.values.account === '') {
+            throw new Error('--account requires a non-empty account ID or key');
+        }
+        if (parsed.values.yes && (command !== 'ilink' || subcommand !== 'delete')) {
+            throw new Error('--yes is valid only for "kintio ilink delete"');
+        }
         const location = instanceLocation(parsed.values, runtime);
+        const qrOutputPath = parsed.values['qr-output'] === undefined
+            ? undefined
+            : resolveInputPath(parsed.values['qr-output'], runtime.cwd);
+        if (qrOutputPath && !samePath(path.dirname(qrOutputPath), location.home)) {
+            throw new Error('iLink QR output must be directly inside the instance directory');
+        }
+        if (command === 'ilink') {
+            if (privateFile(location.configFile, 'Kintio config')) {
+                assertTrustedDirectory(path.dirname(location.configFile), 'Kintio config directory', false);
+            }
+            prepareDirectories(location.home);
+            return await runWithIlinkSignals(async (signal) => {
+                const enrollmentConfig = loadIlinkEnrollmentConfig({
+                    environment: { ...runtime.env },
+                    envFile: location.configFile,
+                    root: location.home,
+                });
+                if (subcommand === 'login') {
+                    return await runtime.ilinkLogin({
+                        config: enrollmentConfig,
+                        packageRoot: runtime.packageRoot,
+                        stdout: runtime.stdout,
+                        stdoutIsTTY: runtime.stdoutIsTTY,
+                        stdoutColumns: runtime.stdoutColumns,
+                        ...(qrOutputPath ? { qrOutputPath } : {}),
+                        signal,
+                    });
+                }
+                const commandResult = await runtime.ilinkAccount({
+                    command: subcommand,
+                    ...(parsed.values.account ? { selector: parsed.values.account } : {}),
+                    confirmed: Boolean(parsed.values.yes),
+                    config: enrollmentConfig,
+                    packageRoot: runtime.packageRoot,
+                    signal,
+                    stdout: runtime.stdout,
+                });
+                if (subcommand !== 'start' || !commandResult.startForeground)
+                    return 0;
+                return await runtime.ilinkStart({
+                    config: loadIlinkRuntimeConfig({
+                        environment: { ...runtime.env },
+                        envFile: location.configFile,
+                        root: location.home,
+                    }),
+                    signal,
+                    stdout: runtime.stdout,
+                });
+            });
+        }
         if (command === 'setup')
             return setup(location, runtime);
         if (command === 'start')