aicomputer 0.1.12 → 0.1.13

package/dist/index.js

@@ -7,7 +7,6 @@ import { readFileSync as readFileSync3 } from "fs";
 import { basename as basename2 } from "path";
 
 // src/commands/access.ts
-import { spawn } from "child_process";
 import { Command } from "commander";
 import chalk3 from "chalk";
 import ora from "ora";
@@ -447,6 +446,59 @@ async function generateSSHKey() {
   return { publicKeyPath, privateKeyPath };
 }
 
+// src/lib/ssh-access.ts
+import { spawn } from "child_process";
+async function prepareSSHConnection(computer) {
+  const registered = await ensureDefaultSSHKeyRegistered();
+  const info = await getConnectionInfo(computer.id);
+  if (!info.connection.ssh_available) {
+    throw new Error("SSH is not available for this computer");
+  }
+  return {
+    computer,
+    command: formatSSHCommand(
+      info.connection.ssh_user,
+      info.connection.ssh_host,
+      info.connection.ssh_port
+    ),
+    args: [
+      "-i",
+      registered.privateKeyPath,
+      "-p",
+      String(info.connection.ssh_port),
+      `${info.connection.ssh_user}@${info.connection.ssh_host}`
+    ]
+  };
+}
+async function prepareSSHConnectionByIdentifier(identifier) {
+  const computer = await resolveComputer(identifier);
+  return prepareSSHConnection(computer);
+}
+async function openSSHConnection(connection) {
+  await new Promise((resolve, reject) => {
+    const child = spawn("ssh", connection.args, {
+      stdio: "inherit"
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      reject(new Error(`ssh exited with code ${code ?? 1}`));
+    });
+  });
+}
+function formatSSHCommand(user, host, port) {
+  if (!user.trim() || !host.trim()) {
+    return "ssh unavailable";
+  }
+  if (port <= 0 || port === 22) {
+    return `ssh ${user}@${host}`;
+  }
+  return `ssh -p ${port} ${user}@${host}`;
+}
+
 // src/lib/open-browser.ts
 import { constants } from "fs";
 import { access } from "fs/promises";
@@ -528,41 +580,39 @@ var openCommand = new Command("open").description("Open a computer in your brows
     await openBrowserURL(access2.access_url);
     console.log(chalk3.dim(`  ${access2.access_url}`));
   } catch (error) {
-    spinner.fail(error instanceof Error ? error.message : "Failed to open computer");
+    spinner.fail(
+      error instanceof Error ? error.message : "Failed to open computer"
+    );
     process.exit(1);
   }
 });
-var sshCommand = new Command("ssh").description("Open an SSH session to a computer").argument("[id-or-handle]", "Computer id or handle").option("--setup", "Register key and configure a global SSH alias").option("--alias <alias>", "SSH host alias", "agentcomputer.ai").option("--host <host>", "SSH gateway host", "ssh.agentcomputer.ai").option("--port <port>", "SSH gateway port", "22").action(async (identifier, options) => {
-  if (options.setup) {
-    await setupSSHAlias(options);
-    return;
-  }
-  const spinner = ora(
-    identifier ? "Preparing SSH access..." : "Fetching computers..."
-  ).start();
-  try {
-    const computer = await resolveSSHComputer(identifier, spinner);
-    const info = await getConnectionInfo(computer.id);
-    if (!info.connection.ssh_available) {
-      throw new Error("SSH is not available for this computer");
+var sshCommand = new Command("ssh").description("Open an SSH session to a computer").argument("[id-or-handle]", "Computer id or handle").option("--setup", "Register key and configure a global SSH alias").option("--alias <alias>", "SSH host alias", "agentcomputer.ai").option("--host <host>", "SSH gateway host", "ssh.agentcomputer.ai").option("--port <port>", "SSH gateway port", "22").action(
+  async (identifier, options) => {
+    if (options.setup) {
+      await setupSSHAlias(options);
+      return;
+    }
+    const spinner = ora(
+      identifier ? "Preparing SSH access..." : "Fetching computers..."
+    ).start();
+    try {
+      const computer = await resolveSSHComputer(identifier, spinner);
+      const connection = await prepareSSHConnection(computer);
+      spinner.succeed(`Connecting to ${chalk3.bold(computer.handle)}`);
+      console.log(chalk3.dim(`  ${connection.command}`));
+      console.log();
+      await openSSHConnection(connection);
+    } catch (error) {
+      spinner.fail(
+        error instanceof Error ? error.message : "Failed to prepare SSH access"
+      );
+      process.exit(1);
     }
-    const registered = await ensureDefaultSSHKeyRegistered();
-    spinner.succeed(`Connecting to ${chalk3.bold(computer.handle)}`);
-    console.log(chalk3.dim(`  ${formatSSHCommand(info.connection.ssh_user, info.connection.ssh_host, info.connection.ssh_port)}`));
-    console.log();
-    await runSSH([
-      "-i",
-      registered.privateKeyPath,
-      "-p",
-      String(info.connection.ssh_port),
-      `${info.connection.ssh_user}@${info.connection.ssh_host}`
-    ]);
-  } catch (error) {
-    spinner.fail(error instanceof Error ? error.message : "Failed to prepare SSH access");
-    process.exit(1);
   }
-});
-var portsCommand = new Command("ports").description("Manage published app ports");
+);
+var portsCommand = new Command("ports").description(
+  "Manage published app ports"
+);
 portsCommand.command("ls").description("List published ports for a computer").argument("<id-or-handle>", "Computer id or handle").action(async (identifier) => {
   const spinner = ora("Fetching ports...").start();
   try {
@@ -588,17 +638,20 @@ portsCommand.command("ls").description("List published ports for a computer").ar
       console.log(
         `  ${padEnd(port.subdomain, subWidth + 2)}${padEnd(String(port.target_port), 8)}${port.protocol}`
       );
-      console.log(
-        `  ${chalk3.dim(url)}`
-      );
+      console.log(`  ${chalk3.dim(url)}`);
     }
     console.log();
   } catch (error) {
-    spinner.fail(error instanceof Error ? error.message : "Failed to fetch ports");
+    spinner.fail(
+      error instanceof Error ? error.message : "Failed to fetch ports"
+    );
     process.exit(1);
   }
 });
-portsCommand.command("publish").description("Publish an HTTP app port").argument("<id-or-handle>", "Computer id or handle").argument("<port>", "Target port").option("--subdomain <value>", "Custom left-hand host label before --<handle>").option("--protocol <value>", "http or https", "http").action(async (identifier, port, options) => {
+portsCommand.command("publish").description("Publish an HTTP app port").argument("<id-or-handle>", "Computer id or handle").argument("<port>", "Target port").option(
+  "--subdomain <value>",
+  "Custom left-hand host label before --<handle>"
+).option("--protocol <value>", "http or https", "http").action(async (identifier, port, options) => {
   const spinner = ora("Publishing port...").start();
   try {
     const targetPort = Number.parseInt(port, 10);
@@ -612,10 +665,14 @@ portsCommand.command("publish").description("Publish an HTTP app port").argument
       protocol: options.protocol
     });
     const url = `https://${published.subdomain}--${computer.handle}.computer.agentcomputer.ai`;
-    spinner.succeed(`Published port ${chalk3.bold(String(published.target_port))}`);
+    spinner.succeed(
+      `Published port ${chalk3.bold(String(published.target_port))}`
+    );
     console.log(chalk3.dim(`  ${url}`));
   } catch (error) {
-    spinner.fail(error instanceof Error ? error.message : "Failed to publish port");
+    spinner.fail(
+      error instanceof Error ? error.message : "Failed to publish port"
+    );
     process.exit(1);
   }
 });
@@ -630,25 +687,12 @@ portsCommand.command("rm").description("Unpublish an app port").argument("<id-or
     await deletePublishedPort(computer.id, targetPort);
     spinner.succeed(`Removed port ${chalk3.bold(String(targetPort))}`);
   } catch (error) {
-    spinner.fail(error instanceof Error ? error.message : "Failed to remove port");
+    spinner.fail(
+      error instanceof Error ? error.message : "Failed to remove port"
+    );
     process.exit(1);
   }
 });
-async function runSSH(args) {
-  await new Promise((resolve, reject) => {
-    const child = spawn("ssh", args, {
-      stdio: "inherit"
-    });
-    child.on("error", reject);
-    child.on("exit", (code) => {
-      if (code === 0) {
-        resolve();
-        return;
-      }
-      reject(new Error(`ssh exited with code ${code ?? 1}`));
-    });
-  });
-}
 async function setupSSHAlias(options) {
   const spinner = ora("Configuring global SSH access...").start();
   try {
@@ -672,7 +716,9 @@ async function setupSSHAlias(options) {
     console.log(`  ${chalk3.bold("Direct:")}  ssh <handle>@${alias}`);
     console.log();
   } catch (error) {
-    spinner.fail(error instanceof Error ? error.message : "Failed to configure SSH alias");
+    spinner.fail(
+      error instanceof Error ? error.message : "Failed to configure SSH alias"
+    );
     process.exit(1);
   }
 }
@@ -682,7 +728,9 @@ function normalizeSSHAlias(value) {
     throw new Error("ssh alias cannot be empty");
   }
   if (!/^[A-Za-z0-9._-]+$/.test(alias)) {
-    throw new Error("ssh alias may contain only letters, numbers, dot, dash, or underscore");
+    throw new Error(
+      "ssh alias may contain only letters, numbers, dot, dash, or underscore"
+    );
   }
   return alias;
 }
@@ -703,15 +751,6 @@ function parseSSHPort(value) {
   }
   return parsed;
 }
-function formatSSHCommand(user, host, port) {
-  if (!user.trim() || !host.trim()) {
-    return "ssh unavailable";
-  }
-  if (port <= 0 || port === 22) {
-    return `ssh ${user}@${host}`;
-  }
-  return `ssh -p ${port} ${user}@${host}`;
-}
 async function resolveSSHComputer(identifier, spinner) {
   const trimmed = identifier?.trim();
   if (trimmed) {
@@ -720,7 +759,10 @@ async function resolveSSHComputer(identifier, spinner) {
   const computers = await listComputers();
   spinner.stop();
   try {
-    return await promptForSSHComputer(computers, "Select a computer to SSH into");
+    return await promptForSSHComputer(
+      computers,
+      "Select a computer to SSH into"
+    );
   } finally {
     spinner.start("Preparing SSH access...");
   }
@@ -1736,6 +1778,16 @@ var CLAUDE_OAUTH_TOKEN_URL = process.env.CLAUDE_OAUTH_TOKEN_URL ?? "https://plat
 var CLAUDE_OAUTH_REDIRECT_URL = process.env.CLAUDE_OAUTH_REDIRECT_URL ?? "https://platform.claude.com/oauth/code/callback";
 var CLAUDE_OAUTH_SCOPES = (process.env.CLAUDE_OAUTH_SCOPES ?? "user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload").split(/\s+/).filter(Boolean);
 var claudeLoginCommand = new Command4("claude-login").alias("claude-auth").description("Authenticate Claude Code on a computer").option("--machine <id-or-handle>", "Use a specific computer").option("--keep-helper", "Keep a temporary helper machine if one is created").option("--skip-cross-check", "Skip verification on a second shared machine").option("--verbose", "Show step-by-step auth diagnostics").action(async (options) => {
+  try {
+    await runClaudeLogin(options);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Failed to authenticate Claude";
+    console.error(chalk5.red(`
+${message}`));
+    process.exit(1);
+  }
+});
+async function runClaudeLogin(options) {
   const todos = createTodoList();
   let target = null;
   let helperCreated = false;
@@ -1749,12 +1801,7 @@ var claudeLoginCommand = new Command4("claude-login").alias("claude-auth").descr
     target = prepared.computer;
     helperCreated = prepared.helperCreated;
     sharedInstall = prepared.sharedInstall;
-    markTodo(
-      todos,
-      "target",
-      "done",
-      prepared.detail
-    );
+    markTodo(todos, "target", "done", prepared.detail);
     activeTodoID = "ready";
     target = await waitForRunning(target);
     markTodo(todos, "ready", "done", `${target.handle} is running`);
@@ -1771,7 +1818,10 @@ var claudeLoginCommand = new Command4("claude-login").alias("claude-auth").descr
       sharedInstall ? `installed Claude login on shared home via ${target.handle}` : `installed Claude login on ${target.handle}`
     );
     activeTodoID = "verify-primary";
-    const primaryVerification = await verifyTargetMachine(target.handle, sshTarget);
+    const primaryVerification = await verifyTargetMachine(
+      target.handle,
+      sshTarget
+    );
     markVerificationTodo(
       todos,
       "verify-primary",
@@ -1817,12 +1867,7 @@ var claudeLoginCommand = new Command4("claude-login").alias("claude-auth").descr
         markTodo(todos, "cleanup", "failed", message);
       }
     } else if (helperCreated && target && options.keepHelper) {
-      markTodo(
-        todos,
-        "cleanup",
-        "skipped",
-        `kept helper ${target.handle}`
-      );
+      markTodo(todos, "cleanup", "skipped", `kept helper ${target.handle}`);
     } else {
       markTodo(todos, "cleanup", "skipped", "no helper created");
     }
@@ -1831,9 +1876,7 @@ var claudeLoginCommand = new Command4("claude-login").alias("claude-auth").descr
     }
   }
   if (failureMessage) {
-    console.error(chalk5.red(`
-${failureMessage}`));
-    process.exit(1);
+    throw new Error(failureMessage);
   }
   if (target) {
     console.log(
@@ -1841,15 +1884,23 @@ ${failureMessage}`));
     );
     console.log();
   }
-});
+}
 function createTodoList() {
   return [
     { id: "target", label: "Pick target computer", state: "pending" },
     { id: "ready", label: "Wait for machine readiness", state: "pending" },
     { id: "oauth", label: "Complete Claude browser auth", state: "pending" },
     { id: "install", label: "Install stored Claude login", state: "pending" },
-    { id: "verify-primary", label: "Verify on target machine", state: "pending" },
-    { id: "verify-shared", label: "Verify shared-home propagation", state: "pending" },
+    {
+      id: "verify-primary",
+      label: "Verify on target machine",
+      state: "pending"
+    },
+    {
+      id: "verify-shared",
+      label: "Verify shared-home propagation",
+      state: "pending"
+    },
     { id: "cleanup", label: "Clean up temporary helper", state: "pending" }
   ];
 }
@@ -1889,10 +1940,14 @@ async function prepareTargetMachine(options) {
 async function runManualOAuthFlow() {
   const codeVerifier = base64url(randomBytes2(32));
   const state = randomBytes2(16).toString("hex");
-  const codeChallenge = base64url(createHash("sha256").update(codeVerifier).digest());
+  const codeChallenge = base64url(
+    createHash("sha256").update(codeVerifier).digest()
+  );
   const url = buildAuthorizationURL(codeChallenge, state);
   console.log("We will open your browser so you can authenticate with Claude.");
-  console.log("If the browser does not open automatically, use the URL below:\n");
+  console.log(
+    "If the browser does not open automatically, use the URL below:\n"
+  );
   console.log(url);
   console.log();
   try {
@@ -1903,7 +1958,9 @@ async function runManualOAuthFlow() {
   console.log(
     "After completing authentication, copy the code shown on the success page."
   );
-  console.log("You can paste either the full URL, or a value formatted as CODE#STATE.\n");
+  console.log(
+    "You can paste either the full URL, or a value formatted as CODE#STATE.\n"
+  );
   const pasted = (await textInput({
     message: "Paste the authorization code (or URL) here:"
   })).trim();
@@ -1970,7 +2027,9 @@ function parseAuthorizationInput(value, expectedState) {
       throw new Error("pasted URL is missing code or state");
     }
     if (state2 !== expectedState) {
-      throw new Error("state mismatch detected; restart the authentication flow");
+      throw new Error(
+        "state mismatch detected; restart the authentication flow"
+      );
     }
     return { code: code2, state: state2 };
   }
@@ -1984,10 +2043,16 @@ function parseAuthorizationInput(value, expectedState) {
   return { code, state };
 }
 async function installClaudeAuth(target, oauth) {
-  const spinner = ora4(`Installing Claude auth on ${chalk5.bold(target.handle)}...`).start();
+  const spinner = ora4(
+    `Installing Claude auth on ${chalk5.bold(target.handle)}...`
+  ).start();
   try {
     const installScript = buildInstallScript(oauth.refreshToken, oauth.scope);
-    const result = await runRemoteCommand(target, ["bash", "-s"], installScript);
+    const result = await runRemoteCommand(
+      target,
+      ["bash", "-s"],
+      installScript
+    );
     if (result.stdout.trim()) {
       spinner.succeed(`Installed Claude auth on ${chalk5.bold(target.handle)}`);
       return;
@@ -2001,7 +2066,9 @@ async function installClaudeAuth(target, oauth) {
   }
 }
 async function verifyTargetMachine(handle, target) {
-  const spinner = ora4(`Verifying Claude login on ${chalk5.bold(handle)}...`).start();
+  const spinner = ora4(
+    `Verifying Claude login on ${chalk5.bold(handle)}...`
+  ).start();
   const result = await verifyStoredAuth(target);
   if (result.status === "verified") {
     spinner.succeed(`Verified Claude login on ${chalk5.bold(handle)}`);
@@ -2021,7 +2088,9 @@ async function verifySharedInstall(primaryHandle, primaryComputerID, sharedInsta
     verify
   );
   if (result.status === "verified") {
-    spinner.succeed(`Verified shared-home Claude login on ${chalk5.bold(result.handle)}`);
+    spinner.succeed(
+      `Verified shared-home Claude login on ${chalk5.bold(result.handle)}`
+    );
     return result;
   }
   spinner.info(result.reason);
@@ -2934,6 +3003,16 @@ import { Command as Command7 } from "commander";
 import chalk7 from "chalk";
 import ora6 from "ora";
 var codexLoginCommand = new Command7("codex-login").alias("codex-auth").description("Authenticate Codex on a computer").option("--machine <id-or-handle>", "Use a specific computer").option("--keep-helper", "Keep a temporary helper machine if one is created").option("--skip-cross-check", "Skip verification on a second shared machine").option("--verbose", "Show step-by-step auth diagnostics").action(async (options) => {
+  try {
+    await runCodexLogin(options);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Failed to authenticate Codex";
+    console.error(chalk7.red(`
+${message}`));
+    process.exit(1);
+  }
+});
+async function runCodexLogin(options) {
   const todos = createTodoList2();
   let target = null;
   let helperCreated = false;
@@ -2964,7 +3043,10 @@ var codexLoginCommand = new Command7("codex-login").alias("codex-auth").descript
       sharedInstall ? `installed Codex login on shared home via ${target.handle}` : `installed Codex login on ${target.handle}`
     );
     activeTodoID = "verify-primary";
-    const primaryVerification = await verifyTargetMachine2(target.handle, sshTarget);
+    const primaryVerification = await verifyTargetMachine2(
+      target.handle,
+      sshTarget
+    );
     markVerificationTodo2(
       todos,
       "verify-primary",
@@ -3019,9 +3101,7 @@ var codexLoginCommand = new Command7("codex-login").alias("codex-auth").descript
     }
   }
   if (failureMessage) {
-    console.error(chalk7.red(`
-${failureMessage}`));
-    process.exit(1);
+    throw new Error(failureMessage);
   }
   if (target) {
     console.log(
@@ -3029,15 +3109,23 @@ ${failureMessage}`));
     );
     console.log();
   }
-});
+}
 function createTodoList2() {
   return [
     { id: "target", label: "Pick target computer", state: "pending" },
     { id: "ready", label: "Wait for machine readiness", state: "pending" },
     { id: "local-auth", label: "Complete local Codex auth", state: "pending" },
     { id: "install", label: "Install stored Codex login", state: "pending" },
-    { id: "verify-primary", label: "Verify on target machine", state: "pending" },
-    { id: "verify-shared", label: "Verify shared-home propagation", state: "pending" },
+    {
+      id: "verify-primary",
+      label: "Verify on target machine",
+      state: "pending"
+    },
+    {
+      id: "verify-shared",
+      label: "Verify shared-home propagation",
+      state: "pending"
+    },
     { id: "cleanup", label: "Clean up temporary helper", state: "pending" }
   ];
 }
@@ -3083,10 +3171,16 @@ async function ensureLocalCodexAuth() {
     };
   }
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
-    throw new Error("local Codex login is required when not running interactively");
+    throw new Error(
+      "local Codex login is required when not running interactively"
+    );
   }
-  console.log("We will open your browser so you can authenticate Codex locally.");
-  console.log("If Codex falls back to device auth, complete that flow and return here.\n");
+  console.log(
+    "We will open your browser so you can authenticate Codex locally."
+  );
+  console.log(
+    "If Codex falls back to device auth, complete that flow and return here.\n"
+  );
   await runInteractiveCodexLogin();
   const refreshedStatus = await getLocalCodexStatus();
   if (!refreshedStatus.loggedIn) {
@@ -3166,7 +3260,9 @@ async function captureLocalCommand(command, args) {
   });
 }
 async function installCodexAuth(target, authJSON) {
-  const spinner = ora6(`Installing Codex login on ${chalk7.bold(target.handle)}...`).start();
+  const spinner = ora6(
+    `Installing Codex login on ${chalk7.bold(target.handle)}...`
+  ).start();
   try {
     const installScript = buildInstallScript2(authJSON);
     await runRemoteCommand(target, ["bash", "-s"], installScript);
@@ -3179,7 +3275,9 @@ async function installCodexAuth(target, authJSON) {
   }
 }
 async function verifyTargetMachine2(handle, target) {
-  const spinner = ora6(`Verifying Codex login on ${chalk7.bold(handle)}...`).start();
+  const spinner = ora6(
+    `Verifying Codex login on ${chalk7.bold(handle)}...`
+  ).start();
   const result = await verifyStoredCodexAuth(target);
   if (result.status === "verified") {
     spinner.succeed(`Verified Codex login on ${chalk7.bold(handle)}`);
@@ -3199,7 +3297,9 @@ async function verifySharedInstall2(primaryHandle, primaryComputerID, sharedInst
     verify
   );
   if (result.status === "verified") {
-    spinner.succeed(`Verified shared-home Codex login on ${chalk7.bold(result.handle)}`);
+    spinner.succeed(
+      `Verified shared-home Codex login on ${chalk7.bold(result.handle)}`
+    );
     return result;
   }
   spinner.info(result.reason);
@@ -3653,10 +3753,12 @@ import ora8 from "ora";
 
 // src/lib/browser-login.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { createServer } from "http";
+import {
+  createServer
+} from "http";
 var CALLBACK_HOST = "127.0.0.1";
 var CALLBACK_PATH = "/callback";
-var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
+var LOGIN_TIMEOUT_MS = 15 * 60 * 1e3;
 async function createBrowserLoginAttempt() {
   const state = randomBytes3(16).toString("hex");
   const deferred = createDeferred();
@@ -3736,7 +3838,11 @@ async function handleRequest(input) {
     return;
   }
   if (settledRef.current) {
-    writeHTML(response, 409, renderErrorPage("This login link has already been used."));
+    writeHTML(
+      response,
+      409,
+      renderErrorPage("This login link has already been used.")
+    );
     return;
   }
   const returnedState = url.searchParams.get("state")?.trim();
@@ -3763,6 +3869,9 @@ async function handleRequest(input) {
     writeHTML(response, 400, renderErrorPage(error.message));
     return;
   }
+  const machineHandle = url.searchParams.get("machine_handle")?.trim() || void 0;
+  const provider = parseProvider(url.searchParams.get("provider"));
+  const autoSSH = parseAutoSSH(url.searchParams.get("auto_ssh"));
   try {
     const me = await apiWithKey(apiKey, "/v1/me");
     setAPIKey(apiKey);
@@ -3771,9 +3880,21 @@ async function handleRequest(input) {
       apiKey,
       callbackURL,
       loginURL: buildBrowserLoginURL(callbackURL, state),
-      me
+      me,
+      machineHandle,
+      provider,
+      autoSSH
     });
-    writeHTML(response, 200, renderSuccessPage(me.user.email));
+    writeHTML(
+      response,
+      200,
+      renderSuccessPage({
+        autoSSH,
+        email: me.user.email,
+        machineHandle,
+        provider
+      })
+    );
   } catch (error) {
     settledRef.current = true;
     const message = error instanceof Error ? error.message : "Failed to validate browser login";
@@ -3781,6 +3902,22 @@ async function handleRequest(input) {
     writeHTML(response, 401, renderErrorPage(message));
   }
 }
+function parseProvider(rawValue) {
+  switch (rawValue?.trim()) {
+    case "claude":
+    case "codex":
+    case "skip":
+      return rawValue.trim();
+    default:
+      return void 0;
+  }
+}
+function parseAutoSSH(rawValue) {
+  if (rawValue === null) {
+    return void 0;
+  }
+  return !(rawValue === "0" || rawValue === "false");
+}
 function createDeferred() {
   let resolve;
   let reject;
@@ -3824,7 +3961,9 @@ function writeHTML(response, statusCode, body) {
   response.setHeader("content-type", "text/html; charset=utf-8");
   response.end(body);
 }
-function renderSuccessPage(email) {
+function renderSuccessPage(input) {
+  const providerMessage = input.provider && input.provider !== "skip" ? ` The CLI will continue with ${escapeHTML(input.provider)} setup.` : "";
+  const machineMessage = input.machineHandle ? ` Your new sandbox <code>${escapeHTML(input.machineHandle)}</code> is ready.${providerMessage} Return to the terminal to finish setup.` : " You can close this tab.";
   return `<!doctype html>
 <html lang="en">
 	<head>
@@ -3842,7 +3981,7 @@ function renderSuccessPage(email) {
 	<body>
 		<main>
 			<h1>Computer CLI login complete</h1>
-			<p>Signed in as <code>${escapeHTML(email)}</code>. You can close this tab.</p>
+			<p>Signed in as <code>${escapeHTML(input.email)}</code>.${machineMessage}</p>
 		</main>
 		<script>
 			window.setTimeout(() => window.close(), 150);
@@ -3881,7 +4020,9 @@ var loginCommand = new Command9("login").description("Authenticate the CLI").opt
   const existingKey = getStoredAPIKey();
   if (existingKey && !options.force) {
     console.log();
-    console.log(chalk9.yellow("  Already logged in. Use --force to overwrite."));
+    console.log(
+      chalk9.yellow("  Already logged in. Use --force to overwrite.")
+    );
     console.log();
     return;
   }
@@ -3927,7 +4068,9 @@ async function runBrowserLogin() {
     } catch {
       spinner.stop();
       console.log();
-      console.log(chalk9.yellow("  Browser auto-open failed. Open this URL to continue:"));
+      console.log(
+        chalk9.yellow("  Browser auto-open failed. Open this URL to continue:")
+      );
       console.log(chalk9.dim(`  ${attempt.loginURL}`));
       console.log();
       spinner.start("Waiting for browser login...");
@@ -3935,8 +4078,11 @@ async function runBrowserLogin() {
     spinner.text = "Waiting for browser login...";
     const result = await attempt.waitForResult();
     spinner.succeed(`Logged in as ${chalk9.bold(result.me.user.email)}`);
+    await continueFirstLoginFlow(result);
   } catch (error) {
-    spinner.fail(error instanceof Error ? error.message : "Browser login failed");
+    spinner.fail(
+      error instanceof Error ? error.message : "Browser login failed"
+    );
     process.exit(1);
   } finally {
     await attempt?.close();
@@ -3958,6 +4104,73 @@ async function resolveAPIKeyInput(flagValue, readFromStdin) {
   }
   return Buffer.concat(chunks).toString("utf8").trim();
 }
+async function continueFirstLoginFlow(result) {
+  const machineHandle = result.machineHandle?.trim();
+  if (!machineHandle) {
+    return;
+  }
+  console.log();
+  console.log(
+    chalk9.cyan(
+      `Continuing first-time setup for ${chalk9.bold(machineHandle)}...
+`
+    )
+  );
+  try {
+    await runSelectedProvider(result.provider, machineHandle);
+    if (result.autoSSH === false) {
+      printNextStep(machineHandle);
+      return;
+    }
+    const spinner = ora8(`Preparing SSH access for ${machineHandle}...`).start();
+    try {
+      const connection = await prepareSSHConnectionByIdentifier(machineHandle);
+      spinner.succeed(`Connecting to ${chalk9.bold(machineHandle)}`);
+      console.log(chalk9.dim(`  ${connection.command}`));
+      console.log();
+      await openSSHConnection(connection);
+    } catch (error) {
+      spinner.fail(
+        error instanceof Error ? error.message : "Failed to prepare SSH access"
+      );
+      throw error;
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Failed to finish first-time setup";
+    console.error(chalk9.red(`
+${message}`));
+    console.log();
+    if (result.provider === "claude") {
+      console.log(
+        chalk9.dim(`  computer claude-login --machine ${machineHandle}`)
+      );
+    } else if (result.provider === "codex") {
+      console.log(
+        chalk9.dim(`  computer codex-login --machine ${machineHandle}`)
+      );
+    }
+    console.log(chalk9.dim(`  computer ssh ${machineHandle}`));
+    console.log();
+    process.exit(1);
+  }
+}
+async function runSelectedProvider(provider, machineHandle) {
+  if (provider === "claude") {
+    await runClaudeLogin({ machine: machineHandle });
+    return;
+  }
+  if (provider === "codex") {
+    await runCodexLogin({ machine: machineHandle });
+    return;
+  }
+  console.log(chalk9.green(`Sandbox ${chalk9.bold(machineHandle)} is ready.`));
+  console.log();
+}
+function printNextStep(machineHandle) {
+  console.log(chalk9.green(`Sandbox ${chalk9.bold(machineHandle)} is ready.`));
+  console.log(chalk9.dim(`  computer ssh ${machineHandle}`));
+  console.log();
+}
 
 // src/commands/logout.ts
 import { Command as Command10 } from "commander";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aicomputer",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Computer CLI - manage your Agent Computer fleet from the terminal",
   "homepage": "https://agentcomputer.ai",
   "repository": {