@oya-ai/cli 1.0.60 → 1.0.61

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 
 // ../sdk/dist/index.js
 var OyaError = class extends Error {
@@ -351,48 +351,921 @@ function resolved() {
 }
 
 // src/prompt.ts
-import { createInterface } from "readline/promises";
+import { createInterface } from "readline";
 import { stdin, stdout } from "process";
-async function ask(question, fallback = "") {
-  const rl = createInterface({ input: stdin, output: stdout });
-  try {
-    const answer = (await rl.question(fallback ? `${question} [${fallback}] ` : `${question} `)).trim();
-    return answer || fallback;
-  } finally {
-    rl.close();
+var ESC = "\x1B";
+var plain = !stdout.isTTY || !!process.env.NO_COLOR || process.env.TERM === "dumb";
+var wrap = (open) => (s) => plain ? s : `${ESC}[${open}m${s}${ESC}[0m`;
+var style = {
+  bold: wrap("1"),
+  dim: wrap("2"),
+  green: wrap("32"),
+  cyan: wrap("36"),
+  yellow: wrap("33"),
+  red: wrap("31"),
+  grey: wrap("90")
+};
+var icon = {
+  ok: style.green("\u2714"),
+  fail: style.red("\u2717"),
+  warn: style.yellow("!"),
+  arrow: style.green("\u276F")
+};
+var clearLine = plain ? "" : `${ESC}[K`;
+var up = (n) => `${ESC}[${n}A`;
+var width = () => Math.min(stdout.columns || 80, 74);
+function banner(title, subtitle) {
+  const line = "\u2500".repeat(width());
+  stdout.write(`
+${style.grey(line)}
+  ${style.bold(title)}
+`);
+  if (subtitle) stdout.write(`  ${style.grey(subtitle)}
+`);
+  stdout.write(`${style.grey(line)}
+`);
+}
+var stepNumber = 0;
+var stepTotal = 0;
+function steps(total) {
+  stepTotal = total;
+  stepNumber = 0;
+}
+function step(title, hint) {
+  stepNumber += 1;
+  const counter = stepTotal ? style.grey(`${stepNumber}/${stepTotal}`) : "";
+  stdout.write(`
+${style.cyan("\u25C6")} ${style.bold(title)} ${counter}
+`);
+  if (hint) stdout.write(`${style.grey("  " + hint)}
+`);
+}
+function note(text) {
+  stdout.write(`${style.grey("  " + text)}
+`);
+}
+function success(text) {
+  stdout.write(`${icon.ok} ${text}
+`);
+}
+function warn(text) {
+  stdout.write(`${icon.warn} ${style.yellow(text)}
+`);
+}
+function spinner(label) {
+  if (plain) {
+    stdout.write(`  ${label}\u2026 `);
+    return {
+      done: (msg = "ok") => stdout.write(`${msg}
+`),
+      fail: (msg = "failed") => stdout.write(`${msg}
+`)
+    };
   }
+  const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+  let i = 0;
+  const timer = setInterval(() => {
+    stdout.write(`\r  ${style.cyan(frames[i++ % frames.length])} ${label}\u2026   `);
+  }, 80);
+  const stop = (mark, msg) => {
+    clearInterval(timer);
+    stdout.write(`\r  ${mark} ${label}  ${style.grey(msg)}${clearLine}
+`);
+  };
+  return { done: (msg = "") => stop(icon.ok, msg), fail: (msg = "") => stop(icon.fail, msg) };
 }
-async function askSecret(question) {
-  const rl = createInterface({ input: stdin, output: stdout, terminal: true });
+var rl = null;
+var masked = false;
+var pending = [];
+var waiter = null;
+var ended = false;
+function iface() {
+  if (rl) return rl;
+  rl = createInterface({ input: stdin, output: stdout, terminal: !!stdin.isTTY });
+  const deliver = (line) => {
+    if (waiter) {
+      const w = waiter;
+      waiter = null;
+      w(line);
+    } else pending.push(line);
+  };
+  rl.on("line", deliver);
+  rl.on("close", () => {
+    ended = true;
+    if (waiter) {
+      const w = waiter;
+      waiter = null;
+      w("");
+    }
+  });
   const asAny = rl;
   asAny._writeToOutput = (s) => {
-    asAny.output.write(s.includes(question) ? s : "*");
+    if (!masked) {
+      asAny.output.write(s);
+      return;
+    }
+    asAny.output.write(s.includes("\n") ? "\n" : "*");
+  };
+  return rl;
+}
+function nextLine() {
+  const queued = pending.shift();
+  if (queued !== void 0) return Promise.resolve(queued);
+  if (ended) return Promise.resolve("");
+  iface();
+  return new Promise((resolve) => {
+    waiter = resolve;
+  });
+}
+function closePrompts() {
+  if (stdin.isTTY && stdin.isRaw) stdin.setRawMode(false);
+  rl?.close();
+  rl = null;
+}
+var InputError = class extends Error {
+};
+async function readValidated(render, fallback, options) {
+  for (; ; ) {
+    render();
+    masked = !!options.secret;
+    let answer;
+    try {
+      answer = (await nextLine()).trim() || fallback;
+    } finally {
+      if (options.secret) {
+        masked = false;
+        stdout.write("\n");
+      }
+    }
+    if (!stdin.isTTY && !options.secret) stdout.write(`${answer}
+`);
+    const problem = options.validate?.(answer);
+    if (!problem) return answer;
+    stdout.write(`  ${icon.fail} ${style.red(problem)}
+`);
+    if (ended && !pending.length) throw new InputError(problem);
+  }
+}
+function ask(question, fallback = "", options = {}) {
+  return readValidated(
+    () => stdout.write(`  ${style.green("?")} ${question}${fallback ? style.grey(` (${fallback})`) : ""} `),
+    fallback,
+    options
+  );
+}
+function askSecret(question, options = {}) {
+  return readValidated(
+    () => stdout.write(`  ${style.green("?")} ${question} `),
+    "",
+    { ...options, secret: true }
+  );
+}
+async function confirm(question, fallback = false) {
+  const answer = await ask(`${question} ${style.grey(fallback ? "[Y/n]" : "[y/N]")}`, fallback ? "y" : "n");
+  return /^y/i.test(answer);
+}
+var visible = (text) => text.replace(/\u001b\[[0-9;]*m/g, "").length;
+function renderOptions(options, active, interactive) {
+  const columns = stdout.columns || 80;
+  let rows = 0;
+  options.forEach((o, i) => {
+    const chosen = interactive && i === active;
+    const bullet = chosen ? icon.arrow : " ";
+    const number = interactive ? "" : style.grey(`${i + 1}) `);
+    const hint = o.disabled ? `\u2014 ${o.disabled}` : o.note ? `\u2014 ${o.note}` : "";
+    const label = o.disabled ? style.grey(o.label) : chosen ? style.green(o.label) : o.label;
+    const line = `  ${bullet} ${number}${label}${hint ? style.grey(`  ${hint}`) : ""}`;
+    stdout.write(`${line}${clearLine}
+`);
+    rows += Math.max(1, Math.ceil(visible(line) / columns));
+  });
+  return rows;
+}
+async function choose(question, options) {
+  const pickable = options.map((o, i) => o.disabled ? -1 : i).filter((i) => i >= 0);
+  if (!pickable.length) throw new Error(`No option available for: ${question}`);
+  stdout.write(`  ${style.green("?")} ${style.bold(question)}
+`);
+  if (!stdin.isTTY) {
+    renderOptions(options, -1, false);
+    const answer = await ask("choice:", String(pickable[0] + 1), {
+      validate: (v) => {
+        const picked = options[Number(v) - 1] || options.find((o) => o.id === v);
+        if (!picked) return "Pick one of the numbers above.";
+        if (picked.disabled) return `${picked.label} is ${picked.disabled}. Pick another.`;
+      }
+    });
+    return (options[Number(answer) - 1] || options.find((o) => o.id === answer)).id;
+  }
+  const hint = style.grey("  \u2191\u2193 move \xB7 enter select");
+  let active = pickable[0];
+  let rows = renderOptions(options, active, true) + 1;
+  const canRedraw = rows < (stdout.rows || 24) - 1;
+  rl?.pause();
+  const wasRaw = !!stdin.isRaw;
+  stdin.setRawMode(true);
+  stdin.resume();
+  stdout.write(`${hint}
+`);
+  const redraw = () => {
+    if (!canRedraw) return;
+    stdout.write(up(rows));
+    rows = renderOptions(options, active, true) + 1;
+    stdout.write(`${hint}
+`);
+  };
+  const move = (delta) => {
+    const here = pickable.indexOf(active);
+    active = pickable[(here + delta + pickable.length) % pickable.length];
+    redraw();
   };
   try {
-    const answer = (await rl.question(`${question} `)).trim();
-    stdout.write("\n");
-    return answer;
+    return await new Promise((resolve, reject) => {
+      const cleanup = () => {
+        stdin.off("data", onData);
+        if (!wasRaw) stdin.setRawMode(false);
+        rl?.resume();
+      };
+      const onData = (buf) => {
+        const key = buf.toString();
+        if (key === "") {
+          cleanup();
+          stdout.write("\n");
+          reject(new InputError("Cancelled."));
+          return;
+        }
+        if (key === `${ESC}[A` || key === "k") return move(-1);
+        if (key === `${ESC}[B` || key === "j") return move(1);
+        if (/^[1-9]$/.test(key)) {
+          const target = Number(key) - 1;
+          if (options[target] && !options[target].disabled) {
+            active = target;
+            redraw();
+          }
+          return;
+        }
+        if (key === "\r" || key === "\n") {
+          cleanup();
+          if (canRedraw) {
+            stdout.write(up(rows));
+            for (let i = 0; i < rows; i++) stdout.write(`${clearLine}
+`);
+            stdout.write(up(rows));
+            stdout.write(`  ${icon.arrow} ${style.green(options[active].label)}${clearLine}
+`);
+          } else {
+            stdout.write(`  ${icon.arrow} ${style.green(options[active].label)}
+`);
+          }
+          resolve(options[active].id);
+        }
+      };
+      stdin.on("data", onData);
+    });
   } finally {
-    rl.close();
+    if (!wasRaw && stdin.isTTY && stdin.isRaw) stdin.setRawMode(false);
   }
 }
-async function choose(question, options) {
+
+// src/install.ts
+import { randomBytes } from "crypto";
+import { existsSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2, chmodSync as chmodSync2, statSync } from "fs";
+import { join as join2, dirname as dirname2 } from "path";
+import { spawn } from "child_process";
+import { createConnection } from "net";
+var ANSWERS_FILE = "oya-install.json";
+var token = () => randomBytes(32).toString("base64url");
+var SECRET_KEYS = /* @__PURE__ */ new Set([
+  "OYA_PROFILE_SECRET",
+  "OYA_OPERATOR_TOKEN",
+  "OYA_METRICS_TOKEN",
+  "API_KEYS",
+  "FLEET_TOKEN",
+  "OYA_CLUSTER_SECRET",
+  "DATABASE_URL",
+  "SUPABASE_SERVICE_KEY",
+  "OPENAI_API_KEY",
+  "OYA_CLOUD_API_KEY",
+  "ANCHOR_API_KEY",
+  "BROWSERBASE_API_KEY",
+  "STEEL_API_KEY",
+  "BROWSERUSE_API_KEY",
+  "OYA_CAPTCHA_API_KEY",
+  "OYA_CDP_WS_URL"
+]);
+function run(cmd, args2, opts = { cwd: process.cwd() }) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args2, { cwd: opts.cwd, stdio: opts.quiet ? "ignore" : "inherit" });
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolve() : reject(new Error(`${cmd} ${args2.join(" ")} exited ${code}`)));
+  });
+}
+async function capture(cmd, args2, cwd = process.cwd()) {
+  return new Promise((resolve) => {
+    const child = spawn(cmd, args2, { cwd, stdio: ["ignore", "pipe", "ignore"] });
+    let out2 = "";
+    child.stdout.on("data", (d) => {
+      out2 += d;
+    });
+    child.on("error", () => resolve(null));
+    child.on("close", (code) => resolve(code === 0 ? out2.trim() : null));
+  });
+}
+var has = async (cmd) => await capture(cmd, ["--version"]) !== null;
+function atLeast(version, major, minor) {
+  const m = /(\d+)\.(\d+)/.exec(version || "");
+  if (!m) return false;
+  return Number(m[1]) > major || Number(m[1]) === major && Number(m[2]) >= minor;
+}
+function portFree(port) {
+  return new Promise((resolve) => {
+    const socket = createConnection({ port, host: "127.0.0.1" }).on("connect", () => {
+      socket.destroy();
+      resolve(false);
+    }).on("error", () => resolve(true));
+    setTimeout(() => {
+      socket.destroy();
+      resolve(true);
+    }, 700);
+  });
+}
+function findRepoRoot(from = process.cwd()) {
+  let dir = from;
+  for (let i = 0; i < 8; i++) {
+    if (existsSync(join2(dir, "docker-compose.yml")) && existsSync(join2(dir, "server", "src", "index.js"))) return dir;
+    const up2 = dirname2(dir);
+    if (up2 === dir) break;
+    dir = up2;
+  }
+  return null;
+}
+async function locateRepo() {
+  const found = findRepoRoot();
+  if (found) return found;
+  console.log("\nThis does not look like an oya-browser checkout.");
+  const where = await ask("Clone it to:", join2(process.cwd(), "oya-browser"));
+  if (existsSync(where)) throw new Error(`${where} already exists`);
+  await run("git", ["clone", "--depth", "1", "https://github.com/OyadotAI/oya-browser.git", where], { cwd: process.cwd() });
+  return where;
+}
+function readEnv(path) {
+  if (!existsSync(path)) return {};
+  const out2 = {};
+  for (const line of readFileSync2(path, "utf8").split("\n")) {
+    const m = /^([A-Z0-9_]+)=(.*)$/.exec(line.trim());
+    if (m) out2[m[1]] = m[2];
+  }
+  return out2;
+}
+var SECTIONS = [
+  ["Server", ["PORT", "OYA_UI_MODE", "OYA_DATA_DIR"]],
+  ["Tenant keys \u2014 each is an identity; add more from the dashboard", ["API_KEYS"]],
+  ["Host operations: /metrics, drain, fleet provision", ["OYA_OPERATOR_TOKEN", "OYA_METRICS_TOKEN"]],
+  ["Credentials at rest. Lose this and every stored cookie, proxy and TOTP seed is unreadable", ["OYA_PROFILE_SECRET"]],
+  ["Database", ["SUPABASE_URL", "SUPABASE_SERVICE_KEY", "DATABASE_URL", "OYA_RECORDING_BUCKET"]],
+  ["Agent LLM. A private or http base URL is operator-only: the dashboard and\n# POST /config/host reject one, on purpose \u2014 tenants can set that field too", ["OPENAI_API_KEY", "OPENAI_BASE_URL", "CHAT_MODEL"]],
+  ["Browser fleet", ["OYA_BROWSER_PROVIDER", "OYA_FLEET_RUNTIME", "OYA_PUBLIC_WS_URL", "OYA_CDP_WS_URL"]],
+  ["Governed Docker runtime", ["OYA_MANAGED_NETWORK", "OYA_MANAGED_IMAGE", "OYA_MANAGED_CONTROL_URL", "OYA_MANAGED_PROXY_URL", "OYA_MANAGED_REGION", "OYA_EGRESS_PORT", "OYA_EGRESS_HOST"]],
+  ["Oya Cloud", ["OYA_CLOUD_API_KEY", "OYA_CLOUD_SNAPSHOT", "OYA_CLOUD_TARGET"]],
+  ["Hosted CDP vendors", ["BROWSERBASE_API_KEY", "BROWSERBASE_PROJECT_ID", "STEEL_API_KEY", "ANCHOR_API_KEY", "BROWSERUSE_API_KEY"]],
+  ["CAPTCHA", ["OYA_CAPTCHA_PROVIDER", "OYA_CAPTCHA_API_KEY"]],
+  ["Multi-replica. One SQLite control database allows exactly one writer", ["OYA_INSTANCE_URL", "OYA_CLUSTER_SECRET"]]
+];
+function renderEnv(values, extra) {
+  const lines = ["# Written by `oya install`. Re-run it, or edit by hand \u2014 both are fine.", ""];
+  const placed = /* @__PURE__ */ new Set();
+  for (const [title, keys] of SECTIONS) {
+    const present = keys.filter((k) => values[k] !== void 0 && values[k] !== "");
+    if (!present.length) continue;
+    lines.push(`# \u2500\u2500 ${title} \u2500\u2500`);
+    for (const k of present) {
+      lines.push(`${k}=${values[k]}`);
+      placed.add(k);
+    }
+    lines.push("");
+  }
+  const leftover = Object.keys(values).filter((k) => !placed.has(k) && values[k]);
+  if (leftover.length) {
+    lines.push("# \u2500\u2500 Other \u2500\u2500");
+    for (const k of leftover) lines.push(`${k}=${values[k]}`);
+    lines.push("");
+  }
+  if (extra.length) lines.push(...extra, "");
+  return lines.join("\n");
+}
+function writeEnv(path, body) {
+  writeFileSync2(path, body, { mode: 384 });
+  chmodSync2(path, 384);
+}
+var LLM_PRESETS = {
+  anthropic: { base: "https://api.anthropic.com/v1", model: "claude-sonnet-4-5", label: "Anthropic (Claude)" },
+  openai: { base: "https://api.openai.com/v1", model: "gpt-4o-mini", label: "OpenAI" }
+};
+async function askLlm() {
+  step("Agent LLM", "Drives `oya ask` and the chat API.");
+  note("CDP, the SDK and MCP all work without one.");
+  const provider = await choose("Which LLM should agents use?", [
+    { id: "anthropic", label: "Anthropic (Claude)" },
+    { id: "openai", label: "OpenAI" },
+    { id: "compatible", label: "An OpenAI-compatible endpoint", note: "OpenRouter, Together, Groq, Azure" },
+    { id: "local", label: "A local model", note: "Ollama, vLLM, LM Studio" },
+    { id: "skip", label: "Skip", note: "no agent control; add it later with `oya config`" }
+  ]);
+  if (provider === "skip") return { answers: { provider, baseUrl: "", model: "" }, key: "" };
+  const preset = LLM_PRESETS[provider];
+  const baseUrl = preset ? preset.base : (await ask("Base URL:", provider === "local" ? "http://localhost:11434/v1" : "https://openrouter.ai/api/v1")).replace(/\/+$/, "");
+  const model = await ask("Model:", preset?.model || (provider === "local" ? "qwen2.5" : ""));
+  for (; ; ) {
+    const key = await askSecret(provider === "local" ? "API key (blank if none):" : "API key:");
+    if (!key) return { answers: { provider, baseUrl, model }, key: "" };
+    const problem = await verifyLlm(baseUrl, key, model);
+    if (!problem) return { answers: { provider, baseUrl, model }, key };
+    warn(problem);
+    const what = await choose("What now?", [
+      { id: "retry", label: "Enter the key again" },
+      { id: "skip", label: "Continue without an LLM", note: "add it later with `oya config`" }
+    ]);
+    if (what === "skip") return { answers: { provider: "skip", baseUrl: "", model: "" }, key: "" };
+  }
+}
+async function verifyLlm(baseUrl, key, model) {
+  const spin = spinner("checking the key");
+  try {
+    const anthropic = /(^|\.)anthropic\.com$/i.test(new URL(baseUrl).hostname);
+    const headers = anthropic ? { "x-api-key": key, "anthropic-version": "2023-06-01" } : { Authorization: `Bearer ${key}` };
+    const res = await fetch(`${baseUrl}/models`, { headers });
+    if (res.status === 401 || res.status === 403) {
+      spin.fail();
+      return `${baseUrl} rejected that key (HTTP ${res.status}).`;
+    }
+    if (!res.ok) {
+      spin.fail(`could not verify (HTTP ${res.status}) \u2014 continuing anyway`);
+      return null;
+    }
+    const body = await res.json().catch(() => null);
+    const ids = (body?.data || []).map((m) => m.id);
+    if (model && ids.length && !ids.includes(model)) {
+      spin.done(`key works, though "${model}" is not in this endpoint's list`);
+      return null;
+    }
+    spin.done("ok");
+    return null;
+  } catch (err) {
+    spin.fail(`could not reach it (${err.message}) \u2014 continuing anyway`);
+    return null;
+  }
+}
+var hostOptions = [
+  { id: "docker", label: "Docker on this machine", note: "one command, no cluster" },
+  { id: "k8s", label: "Kubernetes", disabled: "not in this build yet" },
+  { id: "ecs", label: "Amazon ECS", disabled: "not in this build yet" },
+  { id: "fly", label: "Fly.io", disabled: "coming soon" },
+  { id: "exe", label: "exe.dev", disabled: "coming soon" }
+];
+var dbOptions = (host) => [
+  { id: "sqlite", label: "SQLite", note: "zero config, one replica, API keys only" },
+  { id: "supabase", label: "Supabase", note: "adds email sign-in and the dashboard" },
+  { id: "postgres", label: "Postgres", note: "many replicas; needs psql for migrations" }
+];
+var fleetOptions = [
+  { id: "docker-workers", label: "Docker browser workers here", note: "always-on containers, no daemon access needed" },
+  { id: "oya-selfhosted", label: "Governed Docker, one container per session", note: "policies and budgets; needs Docker socket access" },
+  { id: "oya-cloud", label: "Oya Cloud", note: "managed sandboxes, nothing to run yourself" },
+  { id: "browserbase", label: "Browserbase" },
+  { id: "steel", label: "Steel" },
+  { id: "anchor", label: "Anchor" },
+  { id: "browseruse", label: "Browser Use Cloud" },
+  { id: "cdp", label: "Your own Chrome over CDP" },
+  { id: "k8s", label: "Kubernetes fleet, one pod per session", note: "needs kubectl and a cluster" },
+  { id: "ecs", label: "ECS fleet, one task per session", disabled: "not in this build yet" }
+];
+var VENDOR_KEYS = {
+  browserbase: ["BROWSERBASE_API_KEY", "BROWSERBASE_PROJECT_ID"],
+  steel: ["STEEL_API_KEY"],
+  anchor: ["ANCHOR_API_KEY"],
+  browseruse: ["BROWSERUSE_API_KEY"]
+};
+async function interview(preset, replay) {
+  const secrets = {};
+  let migrateUrl = "";
+  const secretFor = async (field, hidden = true) => {
+    if (replay) return process.env[field] || "";
+    return hidden ? askSecret(`${field}:`) : ask(`${field}:`);
+  };
+  if (!preset.host) step("Control plane", "Where the server itself runs.");
+  const host = preset.host || await choose("Where should the control plane run?", hostOptions);
+  if (!preset.database) step("Database", "What holds sessions, keys and personas.");
+  const database = preset.database || await choose("Which database?", dbOptions(host));
+  if (database === "sqlite") {
+    note("SQLite means API-key auth only \u2014 email sign-in needs Supabase.");
+    note("The dashboard still works: sign in with the API key printed at the end.");
+  }
+  const isPostgresUrl = (v) => {
+    if (!v) return;
+    try {
+      const url = new URL(v);
+      if (!["postgres:", "postgresql:"].includes(url.protocol)) return "Must start with postgres://";
+    } catch {
+      return "That is not a connection string \u2014 postgres://user:pass@host:5432/db";
+    }
+  };
+  if (database === "supabase") {
+    secrets.SUPABASE_URL = replay ? process.env.SUPABASE_URL || "" : await ask("Supabase project URL:");
+    secrets.SUPABASE_SERVICE_KEY = await secretFor("SUPABASE_SERVICE_KEY");
+    if (!replay) {
+      note("Migrations need the Postgres connection string, not the API URL.");
+      note("Leave it blank to apply them yourself later with `make migrate`.");
+      migrateUrl = await askSecret("Postgres connection string (optional):", { validate: isPostgresUrl });
+    }
+  }
+  if (database === "postgres") {
+    secrets.DATABASE_URL = replay ? process.env.DATABASE_URL || "" : await askSecret("Postgres connection string:", {
+      validate: (v) => !v ? "Required for a Postgres deployment." : isPostgresUrl(v)
+    });
+    migrateUrl = secrets.DATABASE_URL;
+  }
+  if (!preset.fleet) step("Browsers", "What actually runs Chrome.");
+  const fleet = preset.fleet || await choose("Where should browsers run?", fleetOptions);
+  let workers = preset.workers ?? 0;
+  if (fleet === "docker-workers" && preset.workers === void 0) {
+    workers = Number(await ask("How many browser workers?", "2", {
+      validate: (v) => /^[1-9][0-9]*$/.test(v) ? void 0 : "Enter a whole number of 1 or more."
+    }));
+  }
+  for (const field of VENDOR_KEYS[fleet] || []) {
+    secrets[field] = await secretFor(field, !field.endsWith("PROJECT_ID"));
+  }
+  if (fleet === "oya-cloud") secrets.OYA_CLOUD_API_KEY = await secretFor("OYA_CLOUD_API_KEY");
+  if (fleet === "cdp") secrets.OYA_CDP_WS_URL = await secretFor("OYA_CDP_WS_URL");
+  let k8sFleet = preset.k8sFleet;
+  if (fleet === "k8s" && !k8sFleet) {
+    step("Kubernetes fleet", "One pod per session.");
+    note("The image must be digest-pinned: a tag can move between verification and scheduling.");
+    k8sFleet = {
+      namespace: await ask("Namespace for browser pods:", "oya-browsers"),
+      image: await ask("Browser image:", "ghcr.io/oyadotai/oya-browser:latest"),
+      controlUrl: await ask("Control-plane WebSocket URL, as reachable from the cluster:", "ws://oya-server.oya-browser.svc:3100/ws"),
+      proxyUrl: await ask("Egress proxy URL, as reachable from the cluster:", "http://oya-server.oya-browser.svc:3128")
+    };
+  }
+  const llm = preset.llm ? { answers: preset.llm, key: replay ? process.env.OPENAI_API_KEY || "" : "" } : await askLlm();
+  if (llm.key) secrets.OPENAI_API_KEY = llm.key;
+  step("Address", "Where clients and browsers reach this control plane.");
+  const publicUrl = (preset.publicUrl || await ask("Public URL of this control plane:", "http://localhost:3100", {
+    validate: (v) => {
+      try {
+        const url = new URL(v);
+        if (!["http:", "https:"].includes(url.protocol)) return "Must be http:// or https://";
+      } catch {
+        return "That is not a URL \u2014 try http://localhost:3100";
+      }
+    }
+  })).replace(/\/+$/, "");
+  const optional = preset.optional || { captcha: "", recordingBucket: "", metrics: false };
+  if (!preset.optional) {
+    step("Optional services", "Everything here has a sensible default.");
+    const more = await choose("Configure optional services now?", [
+      { id: "no", label: "No", note: "change any of it later" },
+      { id: "yes", label: "Yes", note: "CAPTCHA solver, recording storage, metrics" }
+    ]);
+    if (more === "yes") {
+      optional.captcha = await choose("Solve CAPTCHAs automatically?", [
+        { id: "", label: "No", note: "hosted vendors still solve natively" },
+        { id: "capsolver", label: "CapSolver" },
+        { id: "2captcha", label: "2Captcha" }
+      ]);
+      if (optional.captcha) secrets.OYA_CAPTCHA_API_KEY = await secretFor("OYA_CAPTCHA_API_KEY");
+      if (database === "supabase") optional.recordingBucket = await ask("Private Storage bucket for recordings (blank to keep them on disk):", "");
+      optional.metrics = await choose("Expose /metrics to a Prometheus scraper?", [
+        { id: "no", label: "No" },
+        { id: "yes", label: "Yes", note: "generates a scrape token" }
+      ]) === "yes";
+    }
+  }
+  return {
+    answers: { version: 1, host, database, fleet, workers, k8sFleet, llm: llm.answers, publicUrl, optional },
+    secrets,
+    migrateUrl
+  };
+}
+async function preflight(root, a) {
+  const checks = [];
+  const needsDocker = a.host === "docker" || a.fleet === "docker-workers" || a.fleet === "oya-selfhosted";
+  if (needsDocker) {
+    const version = await capture("docker", ["--version"]);
+    checks.push({ ok: !!version, label: "docker", detail: version || "not found", fatal: true });
+    const daemon = await capture("docker", ["info", "--format", "{{.ID}}"]);
+    checks.push({ ok: !!daemon, label: "docker daemon reachable", detail: daemon ? "ok" : "not running", fatal: true });
+    const compose = await capture("docker", ["compose", "version", "--short"]);
+    checks.push({ ok: atLeast(compose, 2, 24), label: "docker compose \u2265 2.24", detail: compose || "not found", fatal: !compose });
+  }
+  if (a.host !== "docker") {
+    checks.push({ ok: atLeast(process.versions.node, 22, 13), label: "node \u2265 22.13 (node:sqlite)", detail: process.versions.node, fatal: true });
+  }
+  if (a.fleet === "k8s" || a.host === "k8s") {
+    const version = await capture("kubectl", ["version", "--client=true", "-o", "json"]);
+    checks.push({ ok: !!version, label: "kubectl", detail: version ? "ok" : "not found", fatal: true });
+    const cluster = await capture("kubectl", ["get", "namespace", "kube-system", "-o", "name"]);
+    checks.push({ ok: !!cluster, label: "cluster reachable", detail: cluster || "kubectl cannot reach a cluster", fatal: true });
+  }
+  if (a.database === "postgres" || a.database === "supabase") {
+    checks.push({ ok: await has("psql"), label: "psql (to apply migrations)", detail: "from libpq/postgresql-client", fatal: true });
+  }
+  const port = Number(new URL(a.publicUrl).port || 3100);
+  const free = await portFree(port);
+  checks.push({ ok: free, label: `port ${port} free`, detail: free ? "ok" : "something is already listening" });
+  const envPath = join2(root, ".env");
+  if (existsSync(envPath)) {
+    const mode = (statSync(envPath).mode & 511).toString(8);
+    checks.push({ ok: true, label: ".env exists \u2014 keeping its OYA_PROFILE_SECRET and API keys", detail: `mode ${mode}` });
+  }
+  return checks;
+}
+function buildEnv(a, secrets, existing) {
+  const v = {};
+  const port = String(Number(new URL(a.publicUrl).port || 3100));
+  v.OYA_PROFILE_SECRET = existing.OYA_PROFILE_SECRET || token();
+  const apiKey = existing.API_KEYS?.split(",")[0] || `oya_${token()}`;
+  v.API_KEYS = existing.API_KEYS || apiKey;
+  v.OYA_OPERATOR_TOKEN = existing.OYA_OPERATOR_TOKEN || token();
+  if (a.host !== "docker") v.PORT = port;
+  Object.assign(v, secrets);
+  if (a.llm.provider !== "skip") {
+    v.OPENAI_BASE_URL = a.llm.baseUrl;
+    v.CHAT_MODEL = a.llm.model;
+  }
+  const wsUrl = a.publicUrl.replace(/^http/, "ws") + "/ws";
+  if (a.fleet === "oya-cloud") {
+    v.OYA_BROWSER_PROVIDER = "oya-cloud";
+    v.OYA_PUBLIC_WS_URL = wsUrl;
+    v.OYA_CLOUD_SNAPSHOT = existing.OYA_CLOUD_SNAPSHOT || existing.DAYTONA_SNAPSHOT || "oya-browser";
+  } else if (a.fleet === "oya-selfhosted") {
+    v.OYA_BROWSER_PROVIDER = "oya-selfhosted";
+    v.OYA_FLEET_RUNTIME = "docker";
+    v.OYA_MANAGED_NETWORK = "oya-browsers";
+    v.OYA_MANAGED_IMAGE = "oya-browser:local";
+    v.OYA_MANAGED_CONTROL_URL = a.host === "docker" ? "ws://server:3100/ws" : wsUrl;
+    v.OYA_EGRESS_PORT = "3128";
+    v.OYA_EGRESS_HOST = "0.0.0.0";
+    v.OYA_MANAGED_PROXY_URL = a.host === "docker" ? "http://server:3128" : "http://127.0.0.1:3128";
+    v.OYA_MANAGED_REGION = "local";
+  } else if (a.fleet === "k8s" && a.k8sFleet) {
+    v.OYA_BROWSER_PROVIDER = "oya-selfhosted";
+    v.OYA_FLEET_RUNTIME = "k8s";
+    v.OYA_K8S_NAMESPACE = a.k8sFleet.namespace;
+    v.OYA_MANAGED_NETWORK = "oya-governed-egress";
+    v.OYA_MANAGED_IMAGE = a.k8sFleet.image;
+    v.OYA_MANAGED_CONTROL_URL = a.k8sFleet.controlUrl;
+    v.OYA_MANAGED_PROXY_URL = a.k8sFleet.proxyUrl;
+    v.OYA_MANAGED_REGION = a.k8sFleet.namespace;
+    v.OYA_EGRESS_PORT = "3128";
+    v.OYA_EGRESS_HOST = "0.0.0.0";
+  } else if (a.fleet === "docker-workers") {
+    v.OYA_BROWSER_PROVIDER = "oya-selfhosted";
+  } else {
+    v.OYA_BROWSER_PROVIDER = a.fleet;
+  }
+  if (a.optional.captcha) v.OYA_CAPTCHA_PROVIDER = a.optional.captcha;
+  if (a.optional.recordingBucket) v.OYA_RECORDING_BUCKET = a.optional.recordingBucket;
+  if (a.optional.metrics) v.OYA_METRICS_TOKEN = existing.OYA_METRICS_TOKEN || token();
+  const extra = [
+    "# \u2500\u2500 Shared fleet enrolment \u2500\u2500",
+    "# Uncomment to let any browser presenting this token enrol itself.",
+    `# FLEET_TOKEN=${token()}`
+  ];
+  return { values: v, extra, apiKey };
+}
+async function priorState() {
+  const volumes = await capture("docker", ["volume", "ls", "-q", "--filter", "name=oya-data"]) || "";
+  for (const name of volumes.split("\n").map((v) => v.trim()).filter(Boolean)) {
+    const listing = await capture("docker", ["run", "--rm", "-v", `${name}:/d`, "alpine", "ls", "/d"]);
+    if (listing === null || /cookies\.json|personas\.json|profiles|\.secret/.test(listing)) return name;
+  }
+  return null;
+}
+async function resolveKekConflict(volume) {
+  warn(`${volume} already holds encrypted data from an earlier install.`);
+  note("Cookies, proxy credentials and TOTP seeds in it were sealed with that");
+  note("install's OYA_PROFILE_SECRET. A new secret cannot open them, and the");
+  note("server refuses to start rather than silently losing them.");
+  const choice = await choose("How should that be handled?", [
+    { id: "paste", label: "I have the previous OYA_PROFILE_SECRET", note: "reuse it and keep the data" },
+    { id: "reset", label: "Delete the old data and start clean", note: "personas, cookies and sessions are lost" },
+    { id: "abort", label: "Stop so I can go and find it" }
+  ]);
+  if (choice === "paste") {
+    return askSecret("Previous OYA_PROFILE_SECRET:", {
+      validate: (v) => v ? void 0 : "Paste the secret, or pick another option."
+    });
+  }
+  if (choice === "abort") throw new InputError("Stopped without changing anything.");
+  if (!await confirm(`Delete ${volume} and everything stored in it?`, false)) {
+    throw new InputError("Stopped without changing anything.");
+  }
+  await run("docker", ["compose", "down", "-v"], { cwd: process.cwd(), quiet: true }).catch(() => {
+  });
+  await run("docker", ["volume", "rm", "-f", volume], { cwd: process.cwd(), quiet: true }).catch(() => {
+  });
+  success(`removed ${volume}`);
+  return null;
+}
+async function waitReady(url, timeoutMs = 18e4) {
+  const deadline = Date.now() + timeoutMs;
+  process.stdout.write("  waiting for /readyz\u2026 ");
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetch(`${url}/readyz`);
+      if (res.ok) {
+        console.log("ready");
+        return;
+      }
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, 2e3));
+  }
+  console.log("timed out");
+  throw new Error(`${url}/readyz did not become ready. Check logs with: docker compose logs -f server`);
+}
+async function pinImage(reference) {
+  if (/@sha256:[0-9a-f]{64}$/.test(reference)) return reference;
+  process.stdout.write(`  resolving ${reference} to a digest\u2026 `);
+  const raw = await capture("docker", ["manifest", "inspect", "--verbose", reference]);
+  const digest = raw && /"digest":\s*"(sha256:[0-9a-f]{64})"/.exec(raw)?.[1];
+  if (!digest) {
+    console.log("could not");
+    throw new Error(
+      `Kubernetes browsers must run a digest-pinned image, and ${reference} is a tag.
+  Get the digest with:  docker manifest inspect --verbose ${reference}
+  then re-run with the image written as ${reference.split(":")[0]}@sha256:<digest>`
+    );
+  }
+  const pinned = `${reference.split("@")[0].replace(/:[^:/]+$/, "")}@${digest}`;
+  console.log(digest.slice(0, 19) + "\u2026");
+  return pinned;
+}
+function networkPolicy(namespace, name) {
+  return JSON.stringify({
+    apiVersion: "networking.k8s.io/v1",
+    kind: "NetworkPolicy",
+    metadata: { name, namespace },
+    spec: {
+      podSelector: { matchLabels: { app: "oya-managed-browser" } },
+      policyTypes: ["Egress"],
+      egress: [
+        // DNS only, to the cluster resolver.
+        { ports: [{ protocol: "UDP", port: 53 }, { protocol: "TCP", port: 53 }] },
+        // Everything else must go through the control plane's egress proxy, which
+        // is what makes per-session egress policy and budgets enforceable.
+        // `app: server` is the label k8s/base/server.yaml gives the control plane;
+        // the empty namespaceSelector lets the browsers live in their own namespace.
+        // A control plane OUTSIDE the cluster is not matched by any pod selector —
+        // add an ipBlock rule here for that case, or the pods will resolve DNS and
+        // then fail to enrol.
+        { to: [{ namespaceSelector: {}, podSelector: { matchLabels: { app: "server" } } }] }
+      ]
+    }
+  }, null, 2);
+}
+async function provisionK8sFleet(root, a) {
+  const fleet = a.k8sFleet;
+  const policyName = "oya-governed-egress";
+  const pinned = await pinImage(fleet.image);
+  const nsDoc = JSON.stringify({ apiVersion: "v1", kind: "Namespace", metadata: { name: fleet.namespace } });
+  await pipeTo("kubectl", ["apply", "-f", "-"], nsDoc, root);
+  const { writeFileSync: writeFileSync3, mkdirSync: mkdirSync2 } = await import("fs");
+  mkdirSync2(join2(root, "k8s", "fleet"), { recursive: true });
+  const policyPath = join2(root, "k8s", "fleet", "networkpolicy.json");
+  writeFileSync3(policyPath, networkPolicy(fleet.namespace, policyName) + "\n");
+  await pipeTo("kubectl", ["apply", "-f", "-"], networkPolicy(fleet.namespace, policyName), root);
+  console.log(`  applied namespace ${fleet.namespace} and NetworkPolicy ${policyName}`);
+  console.log(`  policy written to ${policyPath} \u2014 review it; it is your egress boundary`);
+  return pinned;
+}
+function pipeTo(cmd, args2, stdin2, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args2, { cwd, stdio: ["pipe", "inherit", "inherit"] });
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolve() : reject(new Error(`${cmd} ${args2.join(" ")} exited ${code}`)));
+    child.stdin.end(stdin2);
+  });
+}
+async function provisionDocker(root, a) {
+  if (a.fleet === "oya-selfhosted") {
+    const exists = await capture("docker", ["network", "inspect", "oya-browsers"]);
+    if (!exists) await run("docker", ["network", "create", "--internal", "--driver", "bridge", "oya-browsers"], { cwd: root });
+    console.log("  building the governed browser image\u2026");
+    await run("docker", ["build", "-t", "oya-browser:local", "browser"], { cwd: root });
+    console.log("\n  Governed browsers need Docker daemon access from the server container.");
+    console.log("  Add this to the server service in docker-compose.yml, then re-run `docker compose up -d`:");
+    console.log("    volumes:\n      - /var/run/docker.sock:/var/run/docker.sock");
+  }
+  const scale = a.fleet === "docker-workers" ? ["--scale", `browser=${a.workers}`] : ["--scale", "browser=0"];
+  await run("docker", ["compose", "up", "-d", "--build", ...scale], { cwd: root });
+}
+async function cmdInstall(flags2) {
+  const dryRun = flags2["dry-run"] === true;
+  const root = await locateRepo();
+  const configPath2 = typeof flags2.config === "string" ? flags2.config : null;
+  const preset = configPath2 ? JSON.parse(readFileSync2(configPath2, "utf8")) : {};
+  banner("Oya Browser \u2014 self-host install", root);
+  if (configPath2) note(`replaying ${configPath2}`);
+  steps(configPath2 ? 0 : 6);
+  const { answers, secrets, migrateUrl } = await interview(preset, !!configPath2);
+  const checks = await preflight(root, answers);
+  console.log(`
+${style.bold("  Preflight")}`);
+  for (const c of checks) {
+    const mark = c.ok ? icon.ok : c.fatal ? icon.fail : icon.warn;
+    console.log(`  ${mark} ${c.label}${c.detail ? style.grey(`  \u2014 ${c.detail}`) : ""}`);
+  }
+  const blocking = checks.filter((c) => !c.ok && c.fatal);
+  if (blocking.length && !dryRun) throw new Error(`Install cannot continue: ${blocking.map((c) => c.label).join(", ")}`);
+  if (answers.host === "docker" && /(localhost|127\.0\.0\.1)/.test(secrets.DATABASE_URL || "")) {
+    warn("DATABASE_URL points at localhost, which inside a container means the container itself.");
+    note("Use host.docker.internal (macOS, Windows) or the host IP so the server can reach it.");
+  }
+  const envPath = join2(root, ".env");
+  const existing = readEnv(envPath);
+  if (!existing.OYA_PROFILE_SECRET && answers.host === "docker" && !dryRun) {
+    const volume = await priorState();
+    if (volume) {
+      const reused = await resolveKekConflict(volume);
+      if (reused) existing.OYA_PROFILE_SECRET = reused;
+    }
+  }
+  const { values, extra, apiKey } = buildEnv(answers, secrets, existing);
+  const body = renderEnv(values, extra);
   console.log(`
-${question}`);
-  options.forEach((o, i) => console.log(`  ${i + 1}) ${o.label}${o.note ? `  \u2014 ${o.note}` : ""}`));
-  while (true) {
-    const answer = await ask("  choice:", "1");
-    const index = Number(answer) - 1;
-    if (options[index]) return options[index].id;
-    const byId = options.find((o) => o.id === answer);
-    if (byId) return byId.id;
-    console.log("  Pick one of the numbers above.");
+${style.bold("  Plan")}`);
+  const row = (k, v) => console.log(`  ${style.grey(k.padEnd(12))}${v}`);
+  row("control", `${answers.host} \xB7 ${answers.database}`);
+  row("browsers", `${answers.fleet}${answers.workers ? ` \xD7${answers.workers}` : ""}`);
+  row("llm", answers.llm.provider === "skip" ? style.grey("none") : `${answers.llm.model} ${style.grey(`@ ${answers.llm.baseUrl}`)}`);
+  row("writes", `${envPath} ${style.grey("(0600)")}`);
+  row("then", `docker compose up -d, wait for ${answers.publicUrl}/readyz`);
+  if (dryRun) {
+    console.log("\n--dry-run: nothing was written. Settings that would be applied:");
+    for (const k of Object.keys(values)) {
+      console.log(`  ${k}=${SECRET_KEYS.has(k) ? style.grey("<hidden>") : values[k]}`);
+    }
+    return;
   }
+  writeEnv(envPath, body);
+  writeFileSync2(join2(root, ANSWERS_FILE), JSON.stringify(answers, null, 2) + "\n");
+  success(`wrote ${envPath}`);
+  if (!existing.OYA_PROFILE_SECRET) {
+    warn("OYA_PROFILE_SECRET was generated \u2014 back it up.");
+    note("Without it, stored cookies, proxy credentials and TOTP seeds cannot be decrypted.");
+  }
+  if (migrateUrl) {
+    const spin = spinner("applying migrations");
+    try {
+      await new Promise((resolve, reject) => {
+        const child = spawn(process.execPath, [join2(root, "server", "migrations", "run.mjs")], {
+          cwd: root,
+          stdio: ["ignore", "pipe", "pipe"],
+          env: { ...process.env, DATABASE_URL: migrateUrl }
+        });
+        let err = "";
+        child.stderr.on("data", (d) => {
+          err += d;
+        });
+        child.on("error", reject);
+        child.on("close", (code) => code === 0 ? resolve() : reject(new Error(err.trim() || `migrations exited ${code}`)));
+      });
+      spin.done();
+    } catch (e) {
+      spin.fail();
+      throw new Error(`Migrations failed: ${e.message}
+  Fix the database, then re-run: DATABASE_URL=\u2026 make migrate`);
+    }
+  }
+  if (answers.fleet === "k8s") {
+    const pinned = await provisionK8sFleet(root, answers);
+    if (pinned !== values.OYA_MANAGED_IMAGE) {
+      values.OYA_MANAGED_IMAGE = pinned;
+      writeEnv(envPath, renderEnv(values, extra));
+      console.log("  .env updated with the pinned image digest");
+    }
+  }
+  if (answers.host === "docker") await provisionDocker(root, answers);
+  await waitReady(answers.publicUrl);
+  banner(`${answers.publicUrl} is up`, "Sign in to the dashboard with the key below.");
+  console.log(`
+  ${style.bold("API key")}  ${style.green(apiKey)}
+`);
+  console.log(`  ${style.grey("# your shell may export OYA_API_KEY for the hosted service")}`);
+  console.log(`  unset OYA_API_KEY`);
+  console.log(`  oya login --url ${answers.publicUrl} --key ${apiKey}`);
+  console.log(`  oya ls && oya goto https://example.com
+`);
 }
 
 // src/index.ts
 var HELP = `oya \u2014 thousands of browsers, one API
 
+  oya install                     Stand up a self-hosted control plane
+            [--dry-run] [--config oya-install.json]
   oya login                       Save an API key for this machine
   oya init                        Set your model, browser provider and sign-ins
   oya start [--persona auto]      Start a browser and print its id
@@ -436,12 +1309,12 @@ function parse(argv) {
   const args2 = [];
   const flags2 = {};
   for (let i = 0; i < rest.length; i++) {
-    const token = rest[i];
-    if (!token.startsWith("--")) {
-      args2.push(token);
+    const token2 = rest[i];
+    if (!token2.startsWith("--")) {
+      args2.push(token2);
       continue;
     }
-    const name = token.slice(2);
+    const name = token2.slice(2);
     const next = rest[i + 1];
     if (next === void 0 || next.startsWith("--")) flags2[name] = true;
     else {
@@ -616,8 +1489,8 @@ async function cmdRm(args2, flags2) {
   if (!flags2.all && !args2.length) throw new Error("Usage: oya rm <id>\u2026 | oya rm --all");
   const r = await oya.browser.stop(flags2.all ? "all" : args2);
   for (const x of r.results) {
-    const note = x.sandboxRemoved === true ? " (sandbox destroyed)" : x.sandboxRemoved === false ? " \u2014 sandbox NOT removed, check Daytona" : "";
-    console.log(`${x.ok ? "\u2705" : "\u2717"} ${x.id}${note}${x.error ? ` ${x.error}` : ""}`);
+    const note2 = x.sandboxRemoved === true ? " (sandbox destroyed)" : x.sandboxRemoved === false ? " \u2014 sandbox NOT removed, check Oya Cloud" : "";
+    console.log(`${x.ok ? "\u2705" : "\u2717"} ${x.id}${note2}${x.error ? ` ${x.error}` : ""}`);
   }
   console.log(`stopped ${r.stopped}`);
 }
@@ -700,7 +1573,7 @@ async function cmdOpen(flags2) {
   const browser = await targetBrowser(client(flags2), flags2);
   const url = browser.liveViewUrl();
   const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  spawn(opener, [url], { detached: true, stdio: "ignore" }).unref();
+  spawn2(opener, [url], { detached: true, stdio: "ignore" }).unref();
   console.log(`Opening ${browser.id}`);
 }
 async function cmdConfig(args2, flags2) {
@@ -724,7 +1597,7 @@ async function cmdUsage(flags2) {
 }
 function cmdStealthTest(flags2) {
   return new Promise((resolve, reject) => {
-    const child = spawn("node", ["test-stealth.js", ...flags2.live ? ["--live"] : []], {
+    const child = spawn2("node", ["test-stealth.js", ...flags2.live ? ["--live"] : []], {
       cwd: process.env.OYA_SERVER_DIR || "server",
       stdio: "inherit"
     });
@@ -796,6 +1669,9 @@ try {
     }
     console.log(JSON.stringify(result, null, 2));
   } else switch (command) {
+    case "install":
+      await cmdInstall(flags);
+      break;
     case "login":
       await cmdLogin(flags);
       break;
@@ -858,4 +1734,6 @@ try {
   if (error.status === 401) console.error("  The API key was rejected. Run `oya login`.");
   if (error.status === 429) console.error("  A quota or a persona concurrency cap. `oya personas` shows what is running.");
   process.exit(1);
+} finally {
+  closePrompts();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oya-ai/cli",
-  "version": "1.0.60",
+  "version": "1.0.61",
   "description": "Command line for the Oya browser control plane.",
   "license": "MIT",
   "homepage": "https://browser.getoya.ai",
@@ -39,7 +39,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@oya-ai/browser": "1.0.60",
+    "@oya-ai/browser": "1.0.61",
     "@types/node": "^20.19.43",
     "tsup": "^8.0.0",
     "typescript": "^5.4.0"