alink-cli 0.7.5 → 0.8.1

package/README.md

@@ -6,7 +6,14 @@
 npx alink-cli
 ```
 
-首次运行输入 AgentLink 账号和密码，这台电脑会自动加入账号并上线。之后直接重复 `npx alink-cli` 即可上线；密码不会保存到本机。
+直接运行会进入基于 Ink 的交互式 TUI。TUI 采用扁平菜单，最多两级：
+
+- 顶部状态栏实时显示 daemon 是否运行、PID、Hub、凭证状态。
+- 主菜单：启动 / 停止 / 重启 daemon、查看状态详情、登录 / 登出、查看机器、设置、帮助、退出。
+- 未登录时才显示扫码配对入口。
+- 启动 daemon 后它在后台运行，退出 TUI 不会停止它。
+
+首次运行输入 AgentLink 账号和密码，这台电脑会自动加入账号并上线。之后直接重复 `npx alink-cli` 即可管理或启动后台服务；账号密码不会保存到本机，登录会话 JWT 缓存于 `~/.agentlink/session`（0600）。
 
 ```bash
 npm install -g alink-cli
@@ -23,10 +30,12 @@ npx alink-cli --dir /path/to/project
 - 全局安装后可直接使用 `alink-cli`（兼容旧命令 `agentlink`）。
 - `login`：登录账号并注册这台电脑，但不启动服务。
 - `status`：查看当前登录状态和 Hub。
-- `machines`：验证账号密码后查看账号下的所有机器，不展示内部凭证。
+- `machines`：查看账号下的所有机器（在线/离线），不展示内部凭证；首次会验证一次账号密码，之后使用缓存的会话 JWT，无需重复输入。
 - `logout`：退出当前账号并清除本机登录记录，下次运行重新输入账号密码。
 - `--hub`：Hub 地址，默认 `wss://link.harmopath.com`。
 - `--dir`：默认工作目录，缺省为当前目录。
 - `--legacy`：临时运行旧 daemon；默认始终是 daemon-t3。
+- `--no-tui` / `AGENTLINK_TUI=0`：跳过交互式 TUI，按旧行为前台启动 daemon（适合脚本或非 TTY 环境）。
+- `CI=true` 或非 TTY 环境会自动跳过 TUI。
 
 Node.js 22.16+。连接为出站 WebSocket，无需端口转发；Hub 只转发 E2EE 密文。

package/bin/agentlink-account.js

@@ -5,7 +5,7 @@ import { createRequire } from "node:module";
 // `require`; expose this package's resolver so its bundled `ws` dependency is found.
 globalThis.require ??= createRequire(import.meta.url);
 
-const MACHINE_BUCKET = "agentlink-machines";
+const MACHINE_TABLE = "agentlink_machine_keys";
 const REQUEST_TIMEOUT_MS = 10_000;
 
 function httpUrl(hub, pathname) {
@@ -19,12 +19,20 @@ async function json(response) {
   return response.json().catch(() => ({}));
 }
 
-export async function loadAgentLinkAccountConfig(hub, fetchFn = fetch) {
-  const response = await fetchFn(httpUrl(hub, "/api/config"), {
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-  });
-  if (!response.ok) throw new Error(`Hub 配置读取失败 (${response.status})。`);
-  return json(response);
+function timestamp(value) {
+  const parsed = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(parsed) ? parsed : undefined;
+}
+
+function normalizeMachineRow(row) {
+  const createdAt = timestamp(row?.created_at);
+  return {
+    machineId: row?.machine_id,
+    ...(row?.name ? { name: row.name } : {}),
+    ...(row?.hostname ? { hostname: row.hostname } : {}),
+    ...(row?.enckey ? { enckey: row.enckey } : {}),
+    ...(createdAt !== undefined ? { createdAt } : {}),
+  };
 }
 
 function machineIdFromToken(authToken) {
@@ -38,18 +46,12 @@ function machineIdFromToken(authToken) {
   }
 }
 
-async function readMachines(bucket, path) {
-  const { data, error } = await bucket.download(path);
-  if (error) {
-    if (/not found|no such|404/i.test(error.message || "")) return [];
-    throw new Error(`读取账号机器列表失败：${error.message}`);
-  }
-  try {
-    const parsed = JSON.parse(await data.text());
-    return Array.isArray(parsed.machines) ? parsed.machines : [];
-  } catch {
-    throw new Error("账号机器列表格式损坏，请在 Web 端移除异常记录后重试。");
-  }
+export async function loadAgentLinkAccountConfig(hub, fetchFn = fetch) {
+  const response = await fetchFn(httpUrl(hub, "/api/config"), {
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+  });
+  if (!response.ok) throw new Error(`Hub 配置读取失败 (${response.status})。`);
+  return json(response);
 }
 
 export async function registerAgentLinkAccountMachine({
@@ -108,35 +110,82 @@ export async function registerAgentLinkAccountMachine({
   try {
     const user = await auth.getCurrentUser();
     if (!user?.uid) throw new Error("CloudBase 账号登录状态无效。");
-    const path = `${user.uid}/machines.json`;
-    const bucket = app.storage.from(MACHINE_BUCKET);
-    const machines = await readMachines(bucket, path);
-    const current = machines.find((machine) => machine?.machineId === machineId);
+
+    const database = app.rdb();
+    const { data, error: readError } = await database
+      .from(MACHINE_TABLE)
+      .select("machine_id,connected_at,created_at")
+      .order("updated_at", { ascending: false });
+    if (readError) throw new Error(`读取账号机器记录失败：${readError.message}`);
+    const current = (Array.isArray(data) ? data : []).find((row) => row?.machine_id === machineId);
+
     const enckey = randomBytesFn(32).toString("base64url");
-    const machine = {
-      machineId,
-      name: machineName,
-      hostname: machineName,
-      createdAt: current?.createdAt ?? Date.now(),
-      enckey,
-    };
-    // ponytail: read-modify-write is enough for normal first-time setup; add
-    // versioned retries if concurrent registrations for one account become common.
-    const { error } = await bucket.update(
-      path,
-      JSON.stringify({
-        version: 2,
-        machines: [machine, ...machines.filter((entry) => entry?.machineId !== machineId)],
-      }),
-      { contentType: "application/json" },
+    const now = Date.now();
+    const { error } = await database.from(MACHINE_TABLE).upsert(
+      {
+        machine_id: machineId,
+        name: machineName,
+        hostname: machineName,
+        enckey,
+        connected_at: current?.connected_at ?? null,
+        created_at: current?.created_at ?? now,
+        updated_at: now,
+      },
+      { onConflict: "owner_id,machine_id" },
     );
-    if (error) throw new Error(`保存账号机器列表失败：${error.message}`);
-    return { credential: `${authToken}.${enckey}`, machineId };
+    if (error) throw new Error(`保存账号机器记录失败：${error.message}`);
+    return { credential: `${authToken}.${enckey}`, machineId, jwt: login.jwt };
   } finally {
     await auth.signOut().catch(() => undefined);
   }
 }
 
+export async function listAgentLinkAccountMachinesFromHub({ hub, jwt, fetchFn = fetch }) {
+  if (!jwt) throw new Error("没有可用的登录会话，请先运行 alink-cli login。");
+  const response = await fetchFn(httpUrl(hub, "/api/machines"), {
+    method: "GET",
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    headers: {
+      Authorization: `Bearer ${jwt}`,
+      "X-Requested-With": "agentlink",
+    },
+  });
+  const body = await json(response);
+  if (!response.ok) {
+    throw new Error(body.error || `读取机器列表失败 (${response.status})。`);
+  }
+  const machines = Array.isArray(body.machines) ? body.machines : [];
+  return machines.map((row) => ({
+    machineId: typeof row.machineId === "string" ? row.machineId : "",
+    online: row.online === true,
+    name: typeof row.name === "string" ? row.name : undefined,
+    hostname: typeof row.hostname === "string" ? row.hostname : undefined,
+    connectedAt: timestamp(row.connectedAt),
+    createdAt: timestamp(row.createdAt),
+    updatedAt: timestamp(row.updatedAt),
+  })).filter((m) => m.machineId);
+}
+
+export async function exchangeCredentialForSessionJwt({ hub, credential, fetchFn = fetch }) {
+  if (!credential) throw new Error("没有可用的机器凭证。");
+  // The hub only accepts the three-segment auth half; strip the E2EE enckey.
+  const authHalf = credential.split(".").slice(0, 3).join(".");
+  const response = await fetchFn(httpUrl(hub, "/auth/credential"), {
+    method: "POST",
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    headers: {
+      "Content-Type": "application/json",
+      "X-Requested-With": "agentlink",
+    },
+    body: JSON.stringify({ credential: authHalf }),
+  });
+  const body = await json(response);
+  if (!response.ok || typeof body.jwt !== "string" || !body.jwt) {
+    throw new Error(body.error || "凭证换取会话失败。");
+  }
+  return body.jwt;
+}
+
 export async function listAgentLinkAccountMachines({ config, identifier, password, cloudbaseSdk }) {
   if (!config?.cloudbaseEnvId) throw new Error("当前 Hub 尚未配置账号机器目录。");
   const sdk = cloudbaseSdk ?? (await import("@cloudbase/js-sdk")).default;
@@ -149,7 +198,13 @@ export async function listAgentLinkAccountMachines({ config, identifier, passwor
   try {
     const user = await auth.getCurrentUser();
     if (!user?.uid) throw new Error("CloudBase 账号登录状态无效。");
-    return readMachines(app.storage.from(MACHINE_BUCKET), `${user.uid}/machines.json`);
+    const database = app.rdb();
+    const { data, error } = await database
+      .from(MACHINE_TABLE)
+      .select("machine_id,name,hostname,enckey,connected_at,created_at")
+      .order("updated_at", { ascending: false });
+    if (error) throw new Error(`读取账号机器记录失败：${error.message}`);
+    return (Array.isArray(data) ? data : []).map(normalizeMachineRow);
   } finally {
     await auth.signOut().catch(() => undefined);
   }

package/bin/agentlink-prompts.js

@@ -0,0 +1,55 @@
+import { createInterface } from "node:readline/promises";
+
+export async function readPassword(label) {
+  if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== "function") {
+    throw new Error(
+      "当前终端无法安全读取密码，请在交互式终端运行，或设置 AGENTLINK_ACCOUNT 和 AGENTLINK_PASSWORD。",
+    );
+  }
+  process.stdout.write(label);
+  return new Promise((resolve, reject) => {
+    let password = "";
+    const wasRaw = process.stdin.isRaw;
+    const finish = () => {
+      process.stdin.off("data", onData);
+      process.stdin.setRawMode(wasRaw);
+      process.stdin.pause();
+      process.stdout.write("\n");
+    };
+    const onData = (chunk) => {
+      for (const char of String(chunk)) {
+        if (char === "\u0003") {
+          finish();
+          reject(new Error("已取消登录。"));
+          return;
+        }
+        if (char === "\r" || char === "\n") {
+          finish();
+          resolve(password);
+          return;
+        }
+        if (char === "\u007f" || char === "\b") password = password.slice(0, -1);
+        else if (char >= " ") password += char;
+      }
+    };
+    process.stdin.setRawMode(true);
+    process.stdin.setEncoding("utf8");
+    process.stdin.resume();
+    process.stdin.on("data", onData);
+  });
+}
+
+export async function accountCredentials() {
+  const fromEnv = process.env.AGENTLINK_ACCOUNT?.trim();
+  const passwordFromEnv = process.env.AGENTLINK_PASSWORD;
+  if (fromEnv && passwordFromEnv) return { identifier: fromEnv, password: passwordFromEnv };
+  if (!process.stdin.isTTY) {
+    throw new Error("首次运行需要登录账号，请在交互式终端运行。");
+  }
+  const readline = createInterface({ input: process.stdin, output: process.stdout });
+  const identifier = (await readline.question("AgentLink 账号：")).trim();
+  readline.close();
+  const password = await readPassword("AgentLink 密码：");
+  if (!identifier || !password) throw new Error("账号和密码不能为空。");
+  return { identifier, password };
+}

package/bin/agentlink.js

@@ -1,24 +1,73 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
 import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { hostname, homedir } from "node:os";
 import { join } from "node:path";
-import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import WebSocket from "ws";
 
 import {
+  exchangeCredentialForSessionJwt,
   listAgentLinkAccountMachines,
+  listAgentLinkAccountMachinesFromHub,
   loadAgentLinkAccountConfig,
   registerAgentLinkAccountMachine,
 } from "./agentlink-account.js";
+import { accountCredentials } from "./agentlink-prompts.js";
+
+function savedSessionJwt(hub = OFFICIAL_HUB) {
+  try {
+    const raw = readFileSync(SESSION_FILE, "utf8").trim();
+    if (!raw) return undefined;
+    if (!raw.startsWith("{")) {
+      return normalizeHub(hub) === normalizeHub(OFFICIAL_HUB) ? raw : undefined;
+    }
+    const saved = JSON.parse(raw);
+    return saved.hub === normalizeHub(hub) && typeof saved.jwt === "string" ? saved.jwt : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function saveSessionJwt(jwt, hub = OFFICIAL_HUB) {
+  mkdirSync(STATE_DIR, { recursive: true });
+  writeFileSync(SESSION_FILE, JSON.stringify({ hub: normalizeHub(hub), jwt }), { mode: 0o600 });
+  chmodSync(SESSION_FILE, 0o600);
+}
+
+function clearSessionJwt(hub = OFFICIAL_HUB) {
+  try {
+    const raw = readFileSync(SESSION_FILE, "utf8").trim();
+    if (!raw) {
+      rmSync(SESSION_FILE, { force: true });
+      return;
+    }
+    if (!raw.startsWith("{")) {
+      if (normalizeHub(hub) === normalizeHub(OFFICIAL_HUB)) rmSync(SESSION_FILE, { force: true });
+      return;
+    }
+    const saved = JSON.parse(raw);
+    if (saved.hub === normalizeHub(hub)) rmSync(SESSION_FILE, { force: true });
+  } catch {
+    rmSync(SESSION_FILE, { force: true });
+  }
+}
 
 const OFFICIAL_HUB = process.env.AGENTLINK_DEFAULT_HUB || "wss://link.harmopath.com";
 const STATE_DIR = process.env.AGENTLINK_STATE_DIR || join(homedir(), ".agentlink");
 const CREDENTIAL_FILE = join(STATE_DIR, "credential");
+const SESSION_FILE = join(STATE_DIR, "session");
 const args = process.argv.slice(2);
 const legacyCredentialCommands = process.env.AGENTLINK_ENABLE_LEGACY_CREDENTIALS === "1";
+const forceTui = process.env.AGENTLINK_TUI === "1";
+const noTui =
+  !forceTui &&
+  (args.includes("--no-tui") ||
+    process.env.AGENTLINK_TUI === "0" ||
+    process.env.CI === "true" ||
+    !process.stdin.isTTY);
 
 function value(name) {
   const index = args.findIndex((arg) => arg === `--${name}` || arg.startsWith(`--${name}=`));
@@ -36,6 +85,13 @@ function normalizeHub(hub) {
   return url.toString();
 }
 
+function httpUrl(hub, pathname) {
+  const url = new URL(pathname, hub);
+  if (url.protocol === "ws:") url.protocol = "http:";
+  if (url.protocol === "wss:") url.protocol = "https:";
+  return url;
+}
+
 function savedCredential(hub = OFFICIAL_HUB) {
   try {
     const raw = readFileSync(CREDENTIAL_FILE, "utf8").trim();
@@ -89,60 +145,6 @@ async function createSingleCredential(hub) {
   return credential;
 }
 
-async function readPassword(label) {
-  if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== "function") {
-    throw new Error(
-      "当前终端无法安全读取密码，请在交互式终端运行，或设置 AGENTLINK_ACCOUNT 和 AGENTLINK_PASSWORD。",
-    );
-  }
-  process.stdout.write(label);
-  return new Promise((resolve, reject) => {
-    let password = "";
-    const wasRaw = process.stdin.isRaw;
-    const finish = () => {
-      process.stdin.off("data", onData);
-      process.stdin.setRawMode(wasRaw);
-      process.stdin.pause();
-      process.stdout.write("\n");
-    };
-    const onData = (chunk) => {
-      for (const char of String(chunk)) {
-        if (char === "\u0003") {
-          finish();
-          reject(new Error("已取消登录。"));
-          return;
-        }
-        if (char === "\r" || char === "\n") {
-          finish();
-          resolve(password);
-          return;
-        }
-        if (char === "\u007f" || char === "\b") password = password.slice(0, -1);
-        else if (char >= " ") password += char;
-      }
-    };
-    process.stdin.setRawMode(true);
-    process.stdin.setEncoding("utf8");
-    process.stdin.resume();
-    process.stdin.on("data", onData);
-  });
-}
-
-async function accountCredentials() {
-  const fromEnv = process.env.AGENTLINK_ACCOUNT?.trim();
-  const passwordFromEnv = process.env.AGENTLINK_PASSWORD;
-  if (fromEnv && passwordFromEnv) return { identifier: fromEnv, password: passwordFromEnv };
-  if (!process.stdin.isTTY) {
-    throw new Error("首次运行需要登录账号，请在交互式终端运行。");
-  }
-  const readline = createInterface({ input: process.stdin, output: process.stdout });
-  const identifier = (await readline.question("AgentLink 账号：")).trim();
-  readline.close();
-  const password = await readPassword("AgentLink 密码：");
-  if (!identifier || !password) throw new Error("账号和密码不能为空。");
-  return { identifier, password };
-}
-
 async function loginAndCreateCredential(hub, config) {
   console.log("[agentlink] 首次使用，请登录 AgentLink 账号。");
   const { identifier, password } = await accountCredentials();
@@ -154,6 +156,7 @@ async function loginAndCreateCredential(hub, config) {
     machineName: hostname(),
   });
   saveCredential(result.credential, hub);
+  if (result.jwt) saveSessionJwt(result.jwt, hub);
   console.log("[agentlink] 登录成功，这台电脑已加入账号。");
   return result.credential;
 }
@@ -208,89 +211,106 @@ async function pair(hub) {
   });
 }
 
-if (args[0] === "help" || args.includes("--help") || args.includes("-h")) {
+// ---------------------------------------------------------------------------
+// Command handlers
+// ---------------------------------------------------------------------------
+
+async function showHelp() {
   console.log(
-    `用法:\n  alink-cli                 登录（首次）并让这台电脑上线\n  alink-cli login           登录账号，不启动服务\n  alink-cli status          查看登录状态\n  alink-cli machines        查看账号下的所有机器\n  alink-cli logout          退出账号\n  alink-cli help            查看帮助\n\n选项:\n  --hub <wss://…>           Hub 地址\n  --dir <目录>              默认工作目录\n  --legacy                  临时运行旧 daemon`,
+    `用法:\n  alink-cli                 进入交互式 TUI（默认）\n  alink-cli --no-tui        跳过 TUI，按旧行为启动 daemon\n  alink-cli login           登录账号\n  alink-cli status          查看登录状态\n  alink-cli machines        查看账号下的所有机器\n  alink-cli logout          退出账号\n  alink-cli --legacy        临时运行旧 daemon\n  alink-cli help            查看帮助\n\n选项:\n  --hub <wss://…>           Hub 地址\n  --dir <目录>              默认工作目录\n  --no-tui                  禁用交互式 TUI`,
   );
-  process.exit(0);
 }
 
-if (args[0] === "status") {
+async function showVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    console.log(pkg.version);
+  } catch {
+    console.log("0.0.0");
+  }
+}
+
+async function showStatus() {
   const hub = value("hub") || OFFICIAL_HUB;
   console.log(`[agentlink] 登录状态：${savedCredential(hub) ? "已登录" : "未登录"}`);
+  console.log(`[agentlink] 会话状态：${savedSessionJwt(hub) ? "已缓存" : "未缓存"}`);
   console.log(`[agentlink] Hub：${normalizeHub(hub)}`);
-  process.exit(0);
 }
 
-if (args[0] === "logout") {
-  const loggedIn = savedCredential(value("hub") || OFFICIAL_HUB);
+async function doLogout() {
+  const hub = value("hub") || OFFICIAL_HUB;
+  const loggedIn = savedCredential(hub);
   if (loggedIn) rmSync(CREDENTIAL_FILE, { force: true });
+  clearSessionJwt(hub);
   console.log(
     loggedIn ? "[agentlink] 已退出账号；下次启动时需要重新登录。" : "[agentlink] 当前未登录。",
   );
-  process.exit(0);
 }
 
-if (args[0] === "login") {
+async function doLogin() {
   const hub = value("hub") || OFFICIAL_HUB;
   if (savedCredential(hub)) {
     console.log("[agentlink] 已登录。需要切换或修复机器时，请先运行 alink-cli logout。");
-    process.exit(0);
+    return;
   }
   const config = await loadAgentLinkAccountConfig(hub);
   if (config?.mode !== "multi") throw new Error("当前 Hub 不使用账号登录。");
   await loginAndCreateCredential(hub, config);
-  process.exit(0);
 }
 
-if (args[0] === "machines") {
+async function ensureSessionJwt(hub, config) {
+  const jwt = savedSessionJwt(hub);
+  if (jwt) return jwt;
+  console.log("[agentlink] 需要验证 AgentLink 账号密码以获取机器列表。");
+  const { identifier, password } = await accountCredentials();
+  const loginResponse = await fetch(httpUrl(hub, "/auth/password/login"), {
+    method: "POST",
+    signal: AbortSignal.timeout(10_000),
+    headers: { "Content-Type": "application/json", "X-Requested-With": "agentlink" },
+    body: JSON.stringify({ identifier, password, client: "cli" }),
+  });
+  const login = await loginResponse.json().catch(() => ({}));
+  if (!loginResponse.ok || typeof login.jwt !== "string" || !login.jwt) {
+    throw new Error(
+      login.error === "invalid_account_credentials" ? "账号或密码错误。" : login.error || "账号登录失败。",
+    );
+  }
+  saveSessionJwt(login.jwt, hub);
+  return login.jwt;
+}
+
+async function doMachines() {
   const hub = value("hub") || OFFICIAL_HUB;
   const config = await loadAgentLinkAccountConfig(hub);
   if (config?.mode !== "multi") throw new Error("当前 Hub 不使用账号机器目录。");
-  console.log("[agentlink] 查看账号机器，请验证 AgentLink 账号。");
-  const { identifier, password } = await accountCredentials();
-  const machines = await listAgentLinkAccountMachines({ config, identifier, password });
+  let jwt = savedSessionJwt(hub);
+  if (!jwt) {
+    const credential = savedCredential(hub);
+    if (credential) {
+      jwt = await exchangeCredentialForSessionJwt({ hub, credential });
+    } else {
+      jwt = await ensureSessionJwt(hub, config);
+    }
+    saveSessionJwt(jwt, hub);
+  }
+  const machines = await listAgentLinkAccountMachinesFromHub({ hub, jwt });
   if (machines.length === 0) console.log("[agentlink] 账号下还没有机器。");
   else {
     console.log(`[agentlink] 账号下共 ${machines.length} 台机器：`);
     for (const machine of machines) {
-      console.log(
-        `- ${machine.name || machine.hostname || machine.machineId} (${machine.machineId})`,
-      );
+      const onlineMarker = machine.online ? "●" : "○";
+      const label = machine.name || machine.hostname || machine.machineId;
+      console.log(`  ${onlineMarker} ${label} (${machine.machineId})`);
     }
   }
-  process.exit(0);
 }
 
-if (args[0] === "credential" && legacyCredentialCommands) {
-  const hub = value("hub") || OFFICIAL_HUB;
-  const command = args[1] || "status";
-  if (command === "path") console.log(CREDENTIAL_FILE);
-  else if (command === "status") console.log(savedCredential(hub) ? "已保存凭证" : "未保存凭证");
-  else if (command === "show") console.log(savedCredential(hub) || "");
-  else if (command === "set" && args[2] && !/\s/.test(args[2])) saveCredential(args[2], hub);
-  else if (command === "clear") rmSync(CREDENTIAL_FILE, { force: true });
-  else throw new Error("用法: alink-cli credential status|path|show|set <credential>|clear");
-  process.exit(0);
-}
-
-if (args[0] === "qr" && legacyCredentialCommands) {
-  const credential =
-    value("token") || process.env.AGENTLINK_TOKEN || savedCredential(value("hub") || OFFICIAL_HUB);
-  if (!credential) throw new Error("这台电脑还没有凭证，请先运行 npx alink-cli 完成配对。");
-  await printQr(credential);
-  process.exit(0);
-}
-
-if (args[0] && !args[0].startsWith("-")) {
-  console.error(`[agentlink] 未知命令：${args[0]}。运行 alink-cli help 查看帮助。`);
-  process.exit(1);
-}
-
-if (args.includes("--legacy")) {
+async function doLegacy() {
   process.argv = process.argv.filter((arg) => arg !== "--legacy");
   await import(new URL("../dist/daemon.js", import.meta.url));
-} else {
+}
+
+async function doNoTuiStart() {
   const hub = value("hub") || OFFICIAL_HUB;
   const explicit = value("token") || process.env.AGENTLINK_TOKEN;
   const config =
@@ -322,3 +342,96 @@ if (args.includes("--legacy")) {
   for (const signal of ["SIGINT", "SIGTERM"]) process.on(signal, () => child.kill(signal));
   process.exitCode = await new Promise((resolve) => child.on("exit", (code) => resolve(code ?? 1)));
 }
+
+async function doTui() {
+  const uiPath = fileURLToPath(new URL("../dist/ui.js", import.meta.url));
+  if (!existsSync(uiPath)) {
+    console.error(
+      `[agentlink] 交互式 UI 包不存在: ${uiPath}\n请先运行 pnpm --filter alink-cli run build。`,
+    );
+    process.exit(1);
+  }
+  await import(new URL("../dist/ui.js", import.meta.url));
+}
+
+// ---------------------------------------------------------------------------
+// Router
+// ---------------------------------------------------------------------------
+
+async function main() {
+  // Strip internal-only flags before dispatching so downstream handlers see clean args.
+  const publicArgs = args.filter((a) => a !== "--no-tui");
+
+  if (publicArgs.includes("--version") || publicArgs.includes("-v")) {
+    await showVersion();
+    return;
+  }
+
+  if (publicArgs[0] === "help" || publicArgs.includes("--help") || publicArgs.includes("-h")) {
+    await showHelp();
+    return;
+  }
+
+  if (publicArgs[0] === "status") {
+    await showStatus();
+    return;
+  }
+
+  if (publicArgs[0] === "logout") {
+    await doLogout();
+    return;
+  }
+
+  if (publicArgs[0] === "login") {
+    await doLogin();
+    return;
+  }
+
+  if (publicArgs[0] === "machines") {
+    await doMachines();
+    return;
+  }
+
+  if (publicArgs[0] === "credential" && legacyCredentialCommands) {
+    const hub = value("hub") || OFFICIAL_HUB;
+    const command = publicArgs[1] || "status";
+    if (command === "path") console.log(CREDENTIAL_FILE);
+    else if (command === "status") console.log(savedCredential(hub) ? "已保存凭证" : "未保存凭证");
+    else if (command === "show") console.log(savedCredential(hub) || "");
+    else if (command === "set" && publicArgs[2] && !/\s/.test(publicArgs[2])) saveCredential(publicArgs[2], hub);
+    else if (command === "clear") rmSync(CREDENTIAL_FILE, { force: true });
+    else throw new Error("用法: alink-cli credential status|path|show|set <credential>|clear");
+    return;
+  }
+
+  if (publicArgs[0] === "qr" && legacyCredentialCommands) {
+    const credential =
+      value("token") || process.env.AGENTLINK_TOKEN || savedCredential(value("hub") || OFFICIAL_HUB);
+    if (!credential) throw new Error("这台电脑还没有凭证，请先运行 npx alink-cli 完成配对。");
+    await printQr(credential);
+    return;
+  }
+
+  if (publicArgs[0] && !publicArgs[0].startsWith("-")) {
+    console.error(`[agentlink] 未知命令：${publicArgs[0]}。运行 alink-cli help 查看帮助。`);
+    process.exit(1);
+  }
+
+  if (publicArgs.includes("--legacy")) {
+    await doLegacy();
+    return;
+  }
+
+  // Non-TTY, CI, or explicit --no-tui: preserve the original foreground daemon behavior.
+  if (noTui) {
+    await doNoTuiStart();
+    return;
+  }
+
+  await doTui();
+}
+
+main().catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});