@meistrari/tela-cli 0.1.0 → 0.2.0

package/src/program.ts

@@ -14,9 +14,11 @@ import {
 } from './ink/screens/feedback-screen.tsx'
 import { PushScreen } from './ink/screens/push-screen.tsx'
 import { RunChatHandoffScreen, RunScreen } from './ink/screens/run-screen.tsx'
-import { SetupScreen, type SetupScreenResult } from './ink/screens/setup-screen.tsx'
+import { SetupScreen, type SetupScreenResult } from './ink/screens/setup/setup-screen.tsx'
 import { SyncScreen, type SyncProgressItem } from './ink/screens/sync-screen.tsx'
 import { renderCommandScreen } from './ink/runtime.tsx'
+import { listOrganizations } from './agent-api.ts'
+import { authenticateWithDeviceFlow, type SetupAuthEvent } from './auth.ts'
 import {
     checkAgentApiReachability,
     getAgentApiOriginCheckStatus,
@@ -69,26 +71,39 @@ import {
 import { getDoctorReport, renderDoctorReport } from './commands/doctor.ts'
 import { getStatusReport, renderStatusReport } from './commands/status.ts'
 import {
-    AGENT_API_BROWSER_HELP,
-    DEFAULT_AGENT_API_URL,
+    DEVICE_FLOW_BROWSER_HELP,
     ensureConfigInteractive,
+    ENVIRONMENT_PRESET_OPTIONS,
+    getPreferredForgejoOrganization,
     getDefaultCloneRoot,
     inspectSavedConfig,
-    redactApiKey,
+    redactSecret,
+    resolveEnvironmentConfigForPreset,
     saveConfig,
     validateAgentApiUrl,
-    validateApiKey,
+    validateApplicationId,
+    validateAuthApiUrl,
+    validateAuthDashboardUrl,
     validateCloneRoot,
+    validateTelaApiUrl,
     setupConfigInteractive,
     type ConfigInspection,
+    type SetupConfigInput,
 } from './config.ts'
 import { findRepositoryRoot, getDiffStatAgainstHead } from './git.ts'
+import {
+    ensureForgejoUserAccess,
+    listDiscoveredSshPublicKeys,
+    type SelectedSshPublicKey,
+} from './forgejo.ts'
 import { commandExists, runInteractiveCommand, runStreamingCommand } from './process.ts'
 import { CommandRuntime } from './runtime.ts'
 import type {
     BatchSyncFailure,
     SyncResult,
+    TelaCliAuthState,
     TelaCliConfig,
+    TelaCliForgejoOrganization,
 } from './types.ts'
 import {
     bulletList,
@@ -109,6 +124,7 @@ function promptValue<T>(value: T | symbol): T {
 }
 
 interface CliDeps {
+    authenticateWithDeviceFlow?: typeof authenticateWithDeviceFlow
     prompts?: PromptModule
     ensureConfigInteractive?: typeof ensureConfigInteractive
     setupConfigInteractive?: typeof setupConfigInteractive
@@ -129,12 +145,15 @@ interface CliDeps {
     getStatusReport?: typeof getStatusReport
     getDoctorReport?: typeof getDoctorReport
     createInkBarkSession?: typeof createInkBarkSession
+    renderCommandScreen?: typeof renderCommandScreen
     commandExists?: typeof commandExists
     runInteractiveCommand?: typeof runInteractiveCommand
     runStreamingCommand?: typeof runStreamingCommand
     fetchFn?: typeof fetch
     writeStdout?: (message: string) => void
     writeStderr?: (message: string) => void
+    stdinIsTTY?: boolean
+    stdoutIsTTY?: boolean
 }
 
 interface GlobalCliOptions {
@@ -190,16 +209,24 @@ function renderOptionsForStdout(): { decorate: boolean } {
     return { decorate: Boolean(process.stdout.isTTY) }
 }
 
-function isInteractiveInkSession(options: GlobalCliOptions = {}): boolean {
-    return !options.json && Boolean(process.stdout.isTTY && process.stdin.isTTY)
+function getStdinIsTTY(deps: CliDeps): boolean {
+    return deps.stdinIsTTY ?? Boolean(process.stdin.isTTY)
+}
+
+function getStdoutIsTTY(deps: CliDeps): boolean {
+    return deps.stdoutIsTTY ?? Boolean(process.stdout.isTTY)
+}
+
+function isInteractiveInkSession(deps: CliDeps, options: GlobalCliOptions = {}): boolean {
+    return !options.json && getStdoutIsTTY(deps) && getStdinIsTTY(deps)
 }
 
-function resolveRunSurface(options: RunCommandOptions = {}): 'plain' | 'viewer' | 'json' {
+function resolveRunSurface(deps: CliDeps, options: RunCommandOptions = {}): 'plain' | 'viewer' | 'json' {
     if (options.json) {
         return 'json'
     }
 
-    if (options.plain || !isInteractiveInkSession(options)) {
+    if (options.plain || !isInteractiveInkSession(deps, options)) {
         return 'plain'
     }
 
@@ -230,6 +257,10 @@ function createRuntime(deps: CliDeps, options: GlobalCliOptions = {}): CommandRu
     })
 }
 
+function getRenderCommandScreen(deps: CliDeps): typeof renderCommandScreen {
+    return deps.renderCommandScreen ?? renderCommandScreen
+}
+
 function renderExamples(command: CommandMetadata): string {
     return command.examples
         .map(example => `${example.command.padEnd(36, ' ')} ${example.description}`)
@@ -261,7 +292,7 @@ function renderRootHelp(program: Command): string {
         section('Global flags', table(
             ['Flag', 'Description'],
             [
-                ['--silent-bark', 'Disable bark audio during interactive Ink startup'],
+                ['--silent-bark', 'Disable bark audio during the interactive `tela setup` intro'],
                 ['--verbose', 'Include raw evidence for failures where available'],
                 ['-h, --help', 'Show command help'],
             ],
@@ -322,8 +353,8 @@ function createBarkSession(
         commandTitle,
         enabled: shouldShowBarkIntro({
             json: options.json,
-            stdinIsTTY: process.stdin.isTTY,
-            stdoutIsTTY: process.stdout.isTTY,
+            stdinIsTTY: getStdinIsTTY(deps),
+            stdoutIsTTY: getStdoutIsTTY(deps),
         }),
         silentBark: options.silentBark,
         env: process.env,
@@ -353,6 +384,7 @@ function summarizeConfigInspection(inspection: ConfigInspection): string {
         return kvList([
             { label: 'Config path', value: inspection.path },
             { label: 'Status', value: 'missing' },
+            { label: 'Environment', value: 'production' },
             { label: 'Clone root', value: getDefaultCloneRoot() },
         ])
     }
@@ -367,9 +399,15 @@ function summarizeConfigInspection(inspection: ConfigInspection): string {
 
     return kvList([
         { label: 'Config path', value: inspection.path },
+        { label: 'Environment', value: inspection.config.environment },
         { label: 'Agent API origin', value: inspection.config.agentApiUrl },
+        { label: 'Auth API URL', value: inspection.config.authApiUrl },
+        { label: 'Tela API URL', value: inspection.config.telaApiUrl },
         { label: 'Clone root', value: inspection.config.cloneRoot },
-        { label: 'API key', value: redactApiKey(inspection.config.apiKey) },
+        { label: 'User', value: inspection.config.auth?.user.email ?? '<signed out>' },
+        { label: 'Workspace', value: inspection.config.auth?.workspace.title ?? '<signed out>' },
+        { label: 'Organization', value: inspection.config.forgejoOrganization?.name ?? '<not selected>' },
+        { label: 'Forgejo user', value: inspection.config.forgejoUserRegistered ? 'registered' : 'pending' },
     ])
 }
 
@@ -377,7 +415,7 @@ function buildSetupChecksRows(checks: Array<{ label: string, status: string, det
     return checks.map(check => [check.label, check.status, check.detail])
 }
 
-function ensureCloneRootReady(prompts: PromptModule, cloneRoot: string): { created: boolean, warning?: string } {
+function ensureCloneRootReady(cloneRoot: string): { created: boolean, warning?: string } {
     if (!existsSync(cloneRoot)) {
         return { created: false }
     }
@@ -397,30 +435,51 @@ function ensureCloneRootReady(prompts: PromptModule, cloneRoot: string): { creat
 }
 
 async function executeSetupFlow(
-    input: {
-        agentApiUrl: string
-        cloneRoot: string
-        apiKey: string
+    input: SetupConfigInput & {
         createCloneRoot: boolean
+        sshKey: SelectedSshPublicKey
+        auth: TelaCliAuthState
+        organization: TelaCliForgejoOrganization
     },
     deps: CliDeps = {},
+    onEvent?: (event: Pick<SetupAuthEvent, 'message' | 'title'>) => void,
 ): Promise<SetupScreenResult> {
     const commandExistsFn = deps.commandExists ?? commandExists
     const fetchFn = deps.fetchFn ?? fetch
-    const inspection = (deps.inspectSavedConfig ?? inspectSavedConfig)()
-    const config = {
+
+    const baseConfig: TelaCliConfig = {
+        environment: input.environment,
         agentApiUrl: input.agentApiUrl,
+        authApiUrl: input.authApiUrl,
+        authDashboardUrl: input.authDashboardUrl,
+        telaApiUrl: input.telaApiUrl,
         cloneRoot: input.cloneRoot,
-        apiKey: input.apiKey.trim() || inspection.config?.apiKey || '',
-    }
+        requesterApplicationId: input.requesterApplicationId,
+        targetApplicationId: input.targetApplicationId,
+        auth: input.auth,
+        forgejoOrganization: input.organization,
+        forgejoUserRegistered: false,
+    }
+    const forgejoProvision = await ensureForgejoUserAccess({
+        config: baseConfig,
+        organization: input.organization,
+        sshKey: input.sshKey,
+        fetchFn,
+        onProgress: (message, title) => {
+            onEvent?.({
+                title,
+                message,
+            })
+        },
+        saveConfig,
+    })
+    const config = forgejoProvision.config
 
     const cloneRootExists = existsSync(config.cloneRoot)
     if (!cloneRootExists && input.createCloneRoot) {
         mkdirSync(config.cloneRoot, { recursive: true, mode: 0o755 })
     }
 
-    saveConfig(config)
-
     const [gitAvailable, claudeAvailable, reachability] = await Promise.all([
         commandExistsFn('git'),
         commandExistsFn('claude'),
@@ -434,6 +493,9 @@ async function executeSetupFlow(
         getAgentApiOriginWarning(reachability),
     ].filter((warning): warning is string => Boolean(warning))
     const checks = [
+        { label: 'auth', status: 'authenticated', detail: `${input.auth.user.email} @ ${input.auth.workspace.title}` },
+        { label: 'organization', status: 'selected', detail: input.organization.name },
+        { label: 'forgejo-user', status: forgejoProvision.response.userCreated ? 'created' : 'ensured', detail: forgejoProvision.detail },
         { label: 'clone-root', status: existsSync(config.cloneRoot) ? 'ready' : 'missing', detail: config.cloneRoot },
         { label: 'git', status: gitAvailable ? 'available' : 'missing', detail: gitAvailable ? 'ready' : 'install git' },
         { label: 'claude', status: claudeAvailable ? 'available' : 'missing', detail: claudeAvailable ? 'ready' : 'install Claude CLI' },
@@ -445,7 +507,7 @@ async function executeSetupFlow(
         config,
         warnings,
         nextActions: [
-            'Run `tela status` to review the saved environment.',
+            'Run `tela status` to review the saved workspace session.',
             existsSync(config.cloneRoot)
                 ? 'Run `tela sync <repo>` or `tela sync --current` when you need a checkout.'
                 : 'Create the clone root or rerun setup before the first repository sync.',
@@ -457,25 +519,59 @@ async function executeSetupFlow(
     }
 }
 
+function createMissingSetupOrganizationsError(workspaceTitle: string): ReturnType<typeof createUserFacingError> {
+    return createUserFacingError({
+        code: 'workspace_organization_required',
+        summary: 'No Forgejo organizations are registered for this workspace.',
+        details: `Tela authenticated successfully for ${workspaceTitle}, but the workspace does not have any registered organizations yet.`,
+        fixes: [
+            'Ask the Tela team to register at least one organization for this workspace, then rerun `tela setup`.',
+        ],
+    })
+}
+
 async function runSetupInk(
     deps: CliDeps = {},
     options: GlobalCliOptions = {},
     barkSession = createBarkSession(deps, options, 'Setup'),
 ): Promise<SetupScreenResult> {
+    const renderScreen = getRenderCommandScreen(deps)
     const inspection = (deps.inspectSavedConfig ?? inspectSavedConfig)()
+    const defaultEnvironment = inspection.config?.environment ?? 'production'
+    const defaultEnvironmentConfig = defaultEnvironment === 'custom'
+        ? {
+            environment: 'custom' as const,
+            agentApiUrl: inspection.config?.agentApiUrl ?? '',
+            authApiUrl: inspection.config?.authApiUrl ?? '',
+            authDashboardUrl: inspection.config?.authDashboardUrl ?? '',
+            telaApiUrl: inspection.config?.telaApiUrl ?? '',
+            requesterApplicationId: inspection.config?.requesterApplicationId ?? '',
+            targetApplicationId: inspection.config?.targetApplicationId ?? '',
+        }
+        : resolveEnvironmentConfigForPreset(defaultEnvironment)
     await barkSession.playOnce()
-    return await renderCommandScreen<SetupScreenResult>((controller) => React.createElement(SetupScreen, {
+    return await renderScreen<SetupScreenResult>((controller) => React.createElement(SetupScreen, {
         controller,
         currentConfigSummary: summarizeConfigInspection(inspection).split('\n'),
         defaults: {
-            agentApiUrl: inspection.config?.agentApiUrl ?? DEFAULT_AGENT_API_URL,
+            environment: defaultEnvironment,
+            agentApiUrl: inspection.config?.agentApiUrl ?? defaultEnvironmentConfig.agentApiUrl,
+            authApiUrl: inspection.config?.authApiUrl ?? defaultEnvironmentConfig.authApiUrl,
+            authDashboardUrl: inspection.config?.authDashboardUrl ?? defaultEnvironmentConfig.authDashboardUrl,
+            telaApiUrl: inspection.config?.telaApiUrl ?? defaultEnvironmentConfig.telaApiUrl,
+            requesterApplicationId: inspection.config?.requesterApplicationId ?? defaultEnvironmentConfig.requesterApplicationId,
+            targetApplicationId: inspection.config?.targetApplicationId ?? defaultEnvironmentConfig.targetApplicationId,
             cloneRoot: inspection.config?.cloneRoot ?? getDefaultCloneRoot(),
-            apiKey: inspection.config?.apiKey ?? '',
+            forgejoOrganization: inspection.config?.forgejoOrganization ?? null,
+            forgejoUserRegistered: inspection.config?.forgejoUserRegistered ?? false,
         },
-        hasExistingApiKey: Boolean(inspection.config?.apiKey),
+        sshPublicKeys: listDiscoveredSshPublicKeys(),
         validateAgentApiUrl,
+        validateAuthApiUrl,
+        validateAuthDashboardUrl,
+        validateTelaApiUrl,
+        validateApplicationId,
         validateCloneRoot,
-        validateApiKey,
         inspectCloneRoot: (path: string) => {
             if (!existsSync(path)) {
                 return { exists: false, isDirectory: false }
@@ -486,42 +582,58 @@ async function runSetupInk(
                 isDirectory: statSync(path).isDirectory(),
             }
         },
-        execute: async (input: {
-            agentApiUrl: string
-            cloneRoot: string
-            apiKey: string
-            createCloneRoot: boolean
-        }) => await executeSetupFlow(input, deps),
+        authenticate: async (input, onEvent) => await (deps.authenticateWithDeviceFlow ?? authenticateWithDeviceFlow)({
+            environment: input.environment,
+            authApiUrl: input.authApiUrl,
+            authDashboardUrl: input.authDashboardUrl,
+            requesterApplicationId: input.requesterApplicationId,
+            targetApplicationId: input.targetApplicationId,
+        }, {
+            onEvent,
+        }),
+        resolveOrganizations: async (input) => {
+            const config: TelaCliConfig = {
+                environment: input.environment,
+                agentApiUrl: input.agentApiUrl,
+                authApiUrl: input.authApiUrl,
+                authDashboardUrl: input.authDashboardUrl,
+                telaApiUrl: input.telaApiUrl,
+                cloneRoot: input.cloneRoot,
+                requesterApplicationId: input.requesterApplicationId,
+                targetApplicationId: input.targetApplicationId,
+                auth: input.auth,
+                forgejoOrganization: null,
+                forgejoUserRegistered: false,
+            }
+            const organizations = await listOrganizations(config, deps.fetchFn ?? fetch)
+            if (organizations.length === 0) {
+                throw createMissingSetupOrganizationsError(input.auth.workspace.title)
+            }
+
+            return {
+                organizations,
+                preferredOrganization: getPreferredForgejoOrganization(
+                    inspection.config ?? null,
+                    input.auth,
+                    organizations,
+                ),
+            }
+        },
+        execute: async (input, onEvent) => await executeSetupFlow(input, deps, onEvent),
     }))
 }
 
 async function ensureConfigForCommand(
     deps: CliDeps,
-    options: GlobalCliOptions,
-    barkSession?: BarkIntroSession,
 ): Promise<TelaCliConfig> {
     const inspection = (deps.inspectSavedConfig ?? inspectSavedConfig)()
-    if (inspection.valid && inspection.config) {
+    if (inspection.valid && inspection.config?.auth) {
         return inspection.config
     }
 
-    if (isInteractiveInkSession(options)) {
-        const setupResult = await runSetupInk(
-            deps,
-            options,
-            barkSession ?? createBarkSession(deps, options, 'Setup'),
-        )
-        return setupResult.config
-    }
-
-    if (deps.prompts) {
-        const ensureConfig = deps.ensureConfigInteractive ?? ensureConfigInteractive
-        return await ensureConfig({ prompts: deps.prompts })
-    }
-
     throw createUserFacingError({
         code: 'config_required',
-        summary: 'Tela CLI is not configured.',
+        summary: inspection.valid ? 'Tela CLI is signed out.' : 'Tela CLI is not configured.',
         fixes: [
             'Run `tela setup` in an interactive terminal first.',
         ],
@@ -532,7 +644,7 @@ export async function runSetup(
     deps: CliDeps = {},
     options: GlobalCliOptions = {},
 ): Promise<SetupCommandResult> {
-    if (isInteractiveInkSession(options)) {
+    if (isInteractiveInkSession(deps, options)) {
         return await runSetupInk(deps, options)
     }
 
@@ -542,17 +654,20 @@ export async function runSetup(
     const inspect = deps.inspectSavedConfig ?? inspectSavedConfig
     const commandExistsFn = deps.commandExists ?? commandExists
     const fetchFn = deps.fetchFn ?? fetch
+    const authenticate = deps.authenticateWithDeviceFlow ?? authenticateWithDeviceFlow
     const inspection = inspect()
 
     prompts.intro('Tela CLI setup')
     emitBootstrap(runtime, 'Tela setup', 'Bootstrap the local Tela environment before the first sync or push.')
     runtime.emit(resultCard('Setup preflight', [
         section('Current config', summarizeConfigInspection(inspection), { decorate: runtime.decorate }),
-        section('Agent API', AGENT_API_BROWSER_HELP, { decorate: runtime.decorate }),
+        section('Authentication', DEVICE_FLOW_BROWSER_HELP, { decorate: runtime.decorate }),
         section('What setup updates', bulletList([
-            'Agent API target and origin URL',
+            'Tela environment and service endpoints',
             'Clone root directory',
-            'API key',
+            'Workspace-backed Tela session',
+            'Forgejo organization selection for the workspace',
+            'Forgejo user access with your SSH public key',
         ]), { decorate: runtime.decorate }),
     ], { decorate: runtime.decorate }))
 
@@ -560,11 +675,22 @@ export async function runSetup(
         prompts,
         existingConfig: inspection.config ?? null,
         skipLifecycle: true,
+        authenticate: async (input, notify) => {
+            return await authenticate({
+                environment: input.environment,
+                authApiUrl: input.authApiUrl,
+                authDashboardUrl: input.authDashboardUrl,
+                requesterApplicationId: input.requesterApplicationId,
+                targetApplicationId: input.targetApplicationId,
+            }, {
+                onEvent: event => notify(event.message, event.title),
+            })
+        },
     })
 
     let cloneRootCreated = false
     let cloneRootWarning: string | undefined
-    const cloneRootStatus = ensureCloneRootReady(prompts, config.cloneRoot)
+    const cloneRootStatus = ensureCloneRootReady(config.cloneRoot)
     cloneRootWarning = cloneRootStatus.warning
 
     if (!existsSync(config.cloneRoot)) {
@@ -599,7 +725,7 @@ export async function runSetup(
     ].filter((warning): warning is string => Boolean(warning))
 
     const nextSetupActions = [
-        'Run `tela status` to review the saved environment.',
+        'Run `tela status` to review the saved workspace session.',
         cloneRootCreated
             ? 'Run `tela sync <repo>` to clone a repository into the new clone root.'
             : 'Run `tela sync <repo>` or `tela sync --current` when you need a checkout.',
@@ -610,14 +736,24 @@ export async function runSetup(
 
     runtime.emit(resultCard('Setup complete', [
         section('Saved config', kvList([
+            { label: 'Environment', value: config.environment },
             { label: 'Agent API origin', value: config.agentApiUrl },
+            { label: 'Auth API URL', value: config.authApiUrl },
+            { label: 'Tela API URL', value: config.telaApiUrl },
             { label: 'Clone root', value: config.cloneRoot },
-            { label: 'API key', value: redactApiKey(config.apiKey) },
+            { label: 'User', value: config.auth?.user.email ?? '<missing>' },
+            { label: 'Workspace', value: config.auth?.workspace.title ?? '<missing>' },
+            { label: 'Organization', value: config.forgejoOrganization?.name ?? '<missing>' },
+            { label: 'Forgejo user', value: config.forgejoUserRegistered ? 'registered' : 'pending' },
+            { label: 'Session', value: config.auth ? `${redactSecret(config.auth.session.accessToken)} (expires ${new Date(config.auth.session.expiresAt).toISOString()})` : '<missing>' },
         ]), { decorate: runtime.decorate }),
-        section('Agent API', AGENT_API_BROWSER_HELP, { decorate: runtime.decorate }),
+        section('Authentication', DEVICE_FLOW_BROWSER_HELP, { decorate: runtime.decorate }),
         section('Checks', table(
             ['Check', 'Status', 'Detail'],
             buildSetupChecksRows([
+                { label: 'auth', status: 'authenticated', detail: `${config.auth?.user.email ?? '<missing>'} @ ${config.auth?.workspace.title ?? '<missing>'}` },
+                { label: 'organization', status: config.forgejoOrganization ? 'selected' : 'missing', detail: config.forgejoOrganization?.name ?? 'not selected' },
+                { label: 'forgejo-user', status: config.forgejoUserRegistered ? 'registered' : 'pending', detail: config.forgejoUserRegistered ? 'SSH-key provisioning completed.' : 'SSH-key provisioning is pending.' },
                 { label: 'clone-root', status: cloneRootCreated ? 'created' : (existsSync(config.cloneRoot) ? 'ready' : 'missing'), detail: config.cloneRoot },
                 { label: 'git', status: gitAvailable ? 'available' : 'missing', detail: gitAvailable ? 'ready' : 'install git' },
                 { label: 'claude', status: claudeAvailable ? 'available' : 'missing', detail: claudeAvailable ? 'ready' : 'install Claude CLI' },
@@ -841,8 +977,7 @@ async function runSyncInk(
     deps: CliDeps,
     options: SyncCommandOptions,
 ): Promise<SyncCommandResult> {
-    const barkSession = createBarkSession(deps, options, 'Sync')
-    await barkSession.playOnce()
+    const renderScreen = getRenderCommandScreen(deps)
     const findRepo = deps.findRepositoryRoot ?? findRepositoryRoot
     const listRepositories = deps.listCloneRootRepositories ?? listCloneRootRepositories
     const syncAll = deps.syncAllRepositories ?? syncAllRepositories
@@ -852,10 +987,10 @@ async function runSyncInk(
     const mode = resolveSyncMode(repository, options, repoRoot)
     const config = mode === 'current'
         ? undefined
-        : await ensureConfigForCommand(deps, options, barkSession)
+        : await ensureConfigForCommand(deps)
     const availableRepositories = config ? listRepositories(config.cloneRoot) : undefined
 
-    return await renderCommandScreen<SyncCommandResult>((controller) => React.createElement(SyncScreen, {
+    return await renderScreen<SyncCommandResult>((controller) => React.createElement(SyncScreen, {
         controller,
         mode,
         dryRun: options.dryRun,
@@ -942,7 +1077,7 @@ export async function runSync(
 ): Promise<SyncCommandResult> {
     validateSyncOptions(repository, options)
 
-    if (isInteractiveInkSession(options)) {
+    if (isInteractiveInkSession(deps, options)) {
         return await runSyncInk(repository, deps, options)
     }
 
@@ -959,7 +1094,7 @@ export async function runSync(
 
     const repoRoot = await findRepo(process.cwd())
     const config = options.all || !repoRoot || Boolean(repository)
-        ? await ensureConfig({ prompts })
+        ? await ensureConfig()
         : undefined
 
     if (options.all) {
@@ -1170,8 +1305,7 @@ async function runPushInk(
     deps: CliDeps,
     options: PushCommandOptions,
 ): Promise<PushCommandResult> {
-    const barkSession = createBarkSession(deps, options, 'Push')
-    await barkSession.playOnce()
+    const renderScreen = getRenderCommandScreen(deps)
     const findRepo = deps.findRepositoryRoot ?? findRepositoryRoot
     const preview = deps.previewPush ?? previewPush
     const push = deps.pushRepository ?? pushRepository
@@ -1190,7 +1324,7 @@ async function runPushInk(
         : undefined
     const initialManualMessage = options.message?.trim() || undefined
 
-    return await renderCommandScreen<PushCommandResult>((controller) => React.createElement(PushScreen, {
+    return await renderScreen<PushCommandResult>((controller) => React.createElement(PushScreen, {
         controller,
         initialMode,
         initialManualMessage,
@@ -1241,7 +1375,7 @@ export async function runPush(
     deps: CliDeps = {},
     options: PushCommandOptions = {},
 ): Promise<PushCommandResult> {
-    if (isInteractiveInkSession(options)) {
+    if (isInteractiveInkSession(deps, options)) {
         return await runPushInk(deps, options)
     }
 
@@ -1446,7 +1580,7 @@ async function runFeedbackServiceFlow(
     deps: CliDeps,
     options: FeedbackCommandFlags & GlobalCliOptions,
 ): Promise<FeedbackRunResult> {
-    const config = await ensureConfigForCommand(deps, options)
+    const config = await ensureConfigForCommand(deps)
     const loadFeedbackDataFn = deps.loadFeedbackData ?? loadFeedbackData
     const launchFeedbackClaudeFn = deps.launchFeedbackClaude ?? launchFeedbackClaude
     const commandExistsFn = deps.commandExists ?? commandExists
@@ -1504,9 +1638,8 @@ async function runFeedbackInk(
     deps: CliDeps,
     options: FeedbackCommandFlags & GlobalCliOptions,
 ): Promise<FeedbackRunResult> {
-    const barkSession = createBarkSession(deps, options, 'Feedback')
-    await barkSession.playOnce()
-    const config = await ensureConfigForCommand(deps, options, barkSession)
+    const renderScreen = getRenderCommandScreen(deps)
+    const config = await ensureConfigForCommand(deps)
     const loadFeedbackDataFn = deps.loadFeedbackData ?? loadFeedbackData
     const launchFeedbackClaudeFn = deps.launchFeedbackClaude ?? launchFeedbackClaude
     const commandExistsFn = deps.commandExists ?? commandExists
@@ -1517,7 +1650,7 @@ async function runFeedbackInk(
         config,
     })
 
-    const selection = await renderCommandScreen<{
+    const selection = await renderScreen<{
         selectedFeedbacks: FeedbackData['entries']
         prompt?: string
         launchedClaude: boolean
@@ -1545,7 +1678,7 @@ async function runFeedbackInk(
         })
     }
 
-    await renderCommandScreen<void>((controller) => React.createElement(FeedbackClaudeHandoffScreen, {
+    await renderScreen<void>((controller) => React.createElement(FeedbackClaudeHandoffScreen, {
         controller,
         repoRoot: data.repoRoot,
         commitHash: data.commitHash,
@@ -1559,7 +1692,7 @@ async function runFeedbackInk(
 
     const diffStat = await getDiffStatAgainstHeadFn(repoRoot)
 
-    await renderCommandScreen<void>((controller) => React.createElement(FeedbackOutcomeScreen, {
+    await renderScreen<void>((controller) => React.createElement(FeedbackOutcomeScreen, {
         controller,
         commitHash: data.commitHash,
         selectionMode,
@@ -1594,7 +1727,7 @@ export async function runFeedback(
         })
     }
 
-    const interactive = isInteractiveInkSession(normalizedOptions)
+    const interactive = isInteractiveInkSession(deps, normalizedOptions)
     if (!interactive) {
         emitBootstrap(runtime, 'Tela feedback', 'Review commit feedback and optionally hand selected fixes to Claude.')
     }
@@ -1625,9 +1758,10 @@ export async function runAgent(
     options: RunCommandOptions = {},
 ): Promise<RunCommandResult> {
     const runtime = createRuntime(deps, options)
+    const renderScreen = getRenderCommandScreen(deps)
     const runAgentCommandFn = deps.runLocalAgentCommand ?? runLocalAgentCommand
     const prepareRunFn = deps.prepareLocalAgentRun ?? prepareLocalAgentRun
-    const surface = resolveRunSurface(options)
+    const surface = resolveRunSurface(deps, options)
 
     let result: RunCommandResult
 
@@ -1636,11 +1770,9 @@ export async function runAgent(
             cwd: process.cwd(),
             commandExists: deps.commandExists,
         })
-        const barkSession = createBarkSession(deps, options, 'Run')
-        await barkSession.playOnce()
 
         if (prepared.config.isMultiturn) {
-            await renderCommandScreen<void>((controller) => React.createElement(RunChatHandoffScreen, {
+            await renderScreen<void>((controller) => React.createElement(RunChatHandoffScreen, {
                 controller,
                 snapshot: createInitialRunSnapshot(prepared, 'chat'),
             }), {
@@ -1656,13 +1788,13 @@ export async function runAgent(
                 runStreamingCommand: deps.runStreamingCommand,
                 writeStdout: deps.writeStdout,
                 writeStderr: deps.writeStderr,
-                stdinIsTTY: process.stdin.isTTY,
-                stdoutIsTTY: process.stdout.isTTY,
+                stdinIsTTY: getStdinIsTTY(deps),
+                stdoutIsTTY: getStdoutIsTTY(deps),
                 verbose: options.verbose,
             })
         }
         else {
-            result = await renderCommandScreen<RunCommandResult>((controller) => React.createElement(RunScreen, {
+            result = await renderScreen<RunCommandResult>((controller) => React.createElement(RunScreen, {
                 controller,
                 initialSnapshot: createInitialRunSnapshot(prepared, 'one-shot'),
                 execute: async ({ onSnapshot, onControl }) => {
@@ -1677,8 +1809,8 @@ export async function runAgent(
                         writeStderr: deps.writeStderr,
                         onSnapshot,
                         onControl,
-                        stdinIsTTY: process.stdin.isTTY,
-                        stdoutIsTTY: process.stdout.isTTY,
+                        stdinIsTTY: getStdinIsTTY(deps),
+                        stdoutIsTTY: getStdoutIsTTY(deps),
                         verbose: options.verbose,
                     })
                 },
@@ -1698,8 +1830,8 @@ export async function runAgent(
             runStreamingCommand: deps.runStreamingCommand,
             writeStdout: deps.writeStdout,
             writeStderr: deps.writeStderr,
-            stdinIsTTY: process.stdin.isTTY,
-            stdoutIsTTY: process.stdout.isTTY,
+            stdinIsTTY: getStdinIsTTY(deps),
+            stdoutIsTTY: getStdoutIsTTY(deps),
             verbose: options.verbose,
         })
     }
@@ -1765,16 +1897,16 @@ function addStandardReadOptions(command: Command): Command {
 export function createProgram(deps: CliDeps = {}): Command {
     const program = new Command()
         .name('tela')
-        .description('Tela CLI workspace helper')
+        .description('Tela CLI workspace and auth helper')
         .showHelpAfterError()
-        .option('--silent-bark', 'disable bark audio during interactive Ink startup')
+        .option('--silent-bark', 'disable bark audio during the interactive tela setup intro')
         .option('--verbose', 'include raw evidence on failures')
 
     installCustomHelp(program)
 
     program
         .command('setup')
-        .description('Configure Tela CLI settings and choose the Agent API target')
+        .description('Configure Tela CLI settings and complete device-flow authentication')
         .action(async () => {
             const globalOptions = program.opts<GlobalCliOptions>()
             await runSetup(deps, globalOptions)
@@ -1842,7 +1974,7 @@ export function createProgram(deps: CliDeps = {}): Command {
     addStandardReadOptions(
         program
             .command('status')
-            .description('Show Tela config, repo state, tool availability, and Agent API origin reachability'),
+            .description('Show Tela config, session state, repo state, tool availability, and Agent API reachability'),
     ).action(async (commandOptions: StatusCommandOptions) => {
         const globalOptions = program.opts<GlobalCliOptions>()
         await runStatus(deps, {
@@ -1855,7 +1987,7 @@ export function createProgram(deps: CliDeps = {}): Command {
         program
             .command('doctor')
             .alias('diag')
-            .description('Diagnose config, tools, filesystem permissions, repo health, and Agent API origin reachability'),
+            .description('Diagnose config, auth session, tools, filesystem permissions, repo health, and Agent API reachability'),
     ).action(async (commandOptions: DoctorCommandOptions) => {
         const globalOptions = program.opts<GlobalCliOptions>()
         await runDoctor(deps, {