kroki 1.0.5 → 1.0.7

package/bin/kroki.js

@@ -10,8 +10,12 @@
 import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
+import { createServer } from 'node:http';
+import readline, { createInterface } from 'node:readline';
+import { exec } from 'node:child_process';
 
 const CONFIG_DIR = join(homedir(), '.kroki');
+const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
 const SESSION_FILE = join(CONFIG_DIR, 'session.json');
 
 const DEFAULT_SUPABASE_URL = 'https://vjkzlvtvnmorokocnbhp.supabase.co';
@@ -24,43 +28,336 @@ function ensureConfigDir() {
   }
 }
 
+function openBrowser(url) {
+  const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+  exec(`${cmd} "${url}"`, () => {});
+}
+
 function decodePairingCode(code) {
-  const trimmed = code.trim();
+  if (typeof code === 'object' && code !== null) {
+    if (code.token) {
+      if (!code.googleId) {
+        try {
+          const parts = code.token.split('.');
+          if (parts.length >= 2) {
+            const jwtPayload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+            code.googleId = jwtPayload.google_id || jwtPayload.sub;
+          }
+        } catch {}
+      }
+      return code;
+    }
+    throw new Error('Missing token in authorization payload');
+  }
+
+  const trimmed = String(code).trim();
   const raw = trimmed.startsWith('kroki_') ? trimmed.slice(6) : trimmed;
   try {
     const jsonStr = Buffer.from(raw, 'base64url').toString('utf8');
     const parsed = JSON.parse(jsonStr);
-    if (!parsed.googleId || !parsed.token || !parsed.deviceId) {
-      throw new Error('Missing required fields in pairing code');
+    if (!parsed.token) {
+      throw new Error('Missing token in code');
+    }
+    if (!parsed.googleId) {
+      try {
+        const parts = parsed.token.split('.');
+        if (parts.length >= 2) {
+          const jwtPayload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+          parsed.googleId = jwtPayload.google_id || jwtPayload.sub;
+        }
+      } catch {}
     }
     return parsed;
   } catch {
     throw new Error(
-      'Invalid Kroki pairing code.\nPlease get a valid code from your Kroki Devices panel: https://kroki.ai/#/devices',
+      'Invalid Kroki code.\nPlease get a valid code from your Kroki Devices panel: https://kroki.ai/#/devices',
     );
   }
 }
 
-function getActiveSession() {
-  if (!existsSync(SESSION_FILE)) return null;
-  try {
-    return JSON.parse(readFileSync(SESSION_FILE, 'utf8'));
-  } catch {
-    return null;
+// ── Config & Session Management ─────────────────────────────────────────────
+
+function getConfig() {
+  if (existsSync(CONFIG_FILE)) {
+    try {
+      return JSON.parse(readFileSync(CONFIG_FILE, 'utf8'));
+    } catch {}
+  }
+  // Fallback / migration from legacy session.json
+  if (existsSync(SESSION_FILE)) {
+    try {
+      const legacy = JSON.parse(readFileSync(SESSION_FILE, 'utf8'));
+      if (legacy && legacy.token) {
+        const config = {
+          account: {
+            googleId: legacy.googleId,
+            token: legacy.token,
+            supabaseUrl: legacy.supabaseUrl || DEFAULT_SUPABASE_URL,
+            anonKey: legacy.anonKey || DEFAULT_ANON_KEY,
+          },
+          selectedDeviceIds: legacy.deviceId ? [legacy.deviceId] : [],
+          defaultDeviceId: legacy.deviceId || null,
+          devices: {},
+        };
+        if (legacy.deviceId) {
+          config.devices[legacy.deviceId] = {
+            deviceId: legacy.deviceId,
+            deviceName: legacy.deviceName || legacy.deviceId,
+            platform: legacy.platform || 'mac',
+            lastSeenAt: legacy.pairedAt || Date.now(),
+          };
+        }
+        saveConfig(config);
+        return config;
+      }
+    } catch {}
   }
+  return null;
 }
 
-function saveActiveSession(session) {
+function saveConfig(config) {
   ensureConfigDir();
-  writeFileSync(SESSION_FILE, JSON.stringify(session, null, 2), { mode: 0o600 });
+  writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 0o600 });
+  // Also keep session.json in sync for legacy compatibility
+  if (config.account && config.account.token) {
+    const activeDevice = (config.devices && config.defaultDeviceId && config.devices[config.defaultDeviceId]) || null;
+    const legacySession = {
+      v: 1,
+      token: config.account.token,
+      googleId: config.account.googleId,
+      deviceId: activeDevice?.deviceId || '',
+      deviceName: activeDevice?.deviceName || '',
+      platform: activeDevice?.platform || 'mac',
+      supabaseUrl: config.account.supabaseUrl || DEFAULT_SUPABASE_URL,
+      pairedAt: Date.now(),
+    };
+    writeFileSync(SESSION_FILE, JSON.stringify(legacySession, null, 2), { mode: 0o600 });
+  }
 }
 
-function clearActiveSession() {
-  if (existsSync(SESSION_FILE)) {
-    unlinkSync(SESSION_FILE);
+function clearAllSessions() {
+  if (existsSync(CONFIG_FILE)) unlinkSync(CONFIG_FILE);
+  if (existsSync(SESSION_FILE)) unlinkSync(SESSION_FILE);
+}
+
+function saveFromCode(code) {
+  const payload = decodePairingCode(code);
+  const config = getConfig() || {
+    account: {},
+    selectedDeviceIds: [],
+    defaultDeviceId: null,
+    devices: {},
+  };
+
+  config.account = {
+    googleId: payload.googleId,
+    email: payload.email || config.account?.email,
+    token: payload.token,
+    supabaseUrl: payload.supabaseUrl || DEFAULT_SUPABASE_URL,
+    anonKey: payload.anonKey || DEFAULT_ANON_KEY,
+  };
+
+  config.devices = config.devices || {};
+  config.selectedDeviceIds = config.selectedDeviceIds || [];
+
+  if (Array.isArray(payload.accounts)) {
+    for (const acc of payload.accounts) {
+      if (Array.isArray(acc.devices)) {
+        for (const d of acc.devices) {
+          const resolvedEmail =
+            acc.email ||
+            (acc.google_id === payload.googleId ? payload.email : null) ||
+            config.account?.email ||
+            acc.label ||
+            acc.google_id;
+          config.devices[d.device_id] = {
+            deviceId: d.device_id,
+            deviceName: d.device_name || d.device_id,
+            platform: d.platform || 'mac',
+            account: resolvedEmail,
+            googleId: acc.google_id,
+            lastSeenAt: d.last_seen_at ? Date.parse(d.last_seen_at) : Date.now(),
+          };
+          if (!config.defaultDeviceId) {
+            config.defaultDeviceId = d.device_id;
+          }
+          if (!config.selectedDeviceIds.includes(d.device_id)) {
+            config.selectedDeviceIds.push(d.device_id);
+          }
+        }
+      }
+    }
+  }
+
+  if (payload.deviceId) {
+    config.devices[payload.deviceId] = {
+      deviceId: payload.deviceId,
+      deviceName: payload.deviceName || payload.deviceId,
+      platform: payload.platform || 'mac',
+      lastSeenAt: Date.now(),
+    };
+    if (!config.selectedDeviceIds.includes(payload.deviceId)) {
+      config.selectedDeviceIds.push(payload.deviceId);
+    }
+    config.defaultDeviceId = payload.deviceId;
+  }
+
+  saveConfig(config);
+  return config;
+}
+
+function resolveTargetDevice(config, targetQuery) {
+  const devices = config.devices || {};
+  const allDevices = Object.values(devices);
+
+  const query =
+    targetQuery !== null && targetQuery !== undefined && String(targetQuery).trim() !== ''
+      ? targetQuery
+      : process.env.KROKI_DEVICE && String(process.env.KROKI_DEVICE).trim() !== ''
+        ? process.env.KROKI_DEVICE
+        : null;
+
+  if (query !== null && query !== undefined && String(query).trim() !== '') {
+    const q = String(query).toLowerCase().trim();
+    // 1. Index number (1-based, e.g. "1", "2")
+    const num = parseInt(q, 10);
+    if (!isNaN(num) && String(num) === q && num >= 1 && num <= allDevices.length) {
+      return allDevices[num - 1];
+    }
+    // 2. Exact ID
+    let match = allDevices.find(d => d.deviceId.toLowerCase() === q);
+    // 3. Exact name
+    if (!match) match = allDevices.find(d => (d.deviceName || '').toLowerCase() === q);
+    // 4. Exact account / email
+    if (!match) match = allDevices.find(d => (d.account || '').toLowerCase() === q);
+    // 5. Substring name or account
+    if (!match) {
+      match = allDevices.find(
+        d => (d.deviceName || '').toLowerCase().includes(q) || (d.account || '').toLowerCase().includes(q),
+      );
+    }
+    if (!match) {
+      const names = allDevices
+        .map((d, i) => `[${i + 1}] "${d.deviceName || d.deviceId}"${d.account ? ` (${d.account})` : ''}`)
+        .join('\n  ');
+      throw new Error(`Device "${targetQuery}" not found.\nAvailable browsers:\n  ${names || 'none'}`);
+    }
+    return match;
+  }
+
+  // Default: defaultDeviceId or first device
+  const defId = config.defaultDeviceId;
+  if (defId && devices[defId]) {
+    return devices[defId];
+  }
+  if (allDevices.length > 0) {
+    return allDevices[0];
   }
+  return null;
 }
 
+function isTokenExpired(token) {
+  if (!token) return true;
+  try {
+    const parts = token.split('.');
+    if (parts.length >= 2) {
+      const jwt = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+      if (jwt.exp) {
+        return Date.now() / 1000 >= jwt.exp;
+      }
+    }
+  } catch {}
+  return false;
+}
+
+async function fetchOnlineDeviceIds(config, timeoutMs = 1500) {
+  if (!config?.account?.token || !config?.account?.supabaseUrl) {
+    return { onlineIds: new Set(), expired: false };
+  }
+
+  if (isTokenExpired(config.account.token)) {
+    return { onlineIds: new Set(), expired: true };
+  }
+
+  const onlineIds = new Set();
+  const googleIds = new Set();
+  if (config.account.googleId) googleIds.add(config.account.googleId);
+  for (const d of Object.values(config.devices || {})) {
+    if (d.googleId) googleIds.add(d.googleId);
+  }
+
+  const anonKey = config.account.anonKey || DEFAULT_ANON_KEY;
+  const wsBase = (config.account.supabaseUrl || DEFAULT_SUPABASE_URL).replace(/^http/, 'ws');
+  const wsUrl = `${wsBase}/realtime/v1/websocket?apikey=${anonKey}&vsn=1.0.0`;
+
+  await Promise.all(
+    Array.from(googleIds).map(gId => {
+      return new Promise(resolve => {
+        let ws = null;
+        let settled = false;
+        const done = () => {
+          if (!settled) {
+            settled = true;
+            if (ws) {
+              try {
+                ws.close();
+              } catch {}
+            }
+            resolve();
+          }
+        };
+
+        const timer = setTimeout(done, timeoutMs);
+
+        try {
+          ws = new globalThis.WebSocket(wsUrl);
+          ws.onopen = () => {
+            const payload = {
+              topic: `realtime:control:${gId}`,
+              event: 'phx_join',
+              payload: {
+                config: { private: true, broadcast: { self: false }, presence: { key: '' } },
+                access_token: config.account.token,
+              },
+              ref: 'ping_' + gId,
+            };
+            ws.send(JSON.stringify(payload));
+          };
+
+          ws.onmessage = event => {
+            try {
+              const msg = JSON.parse(event.data);
+              if (msg.event === 'presence_state' && msg.payload) {
+                for (const [k, v] of Object.entries(msg.payload)) {
+                  if (k && k.startsWith('device-')) onlineIds.add(k);
+                  const metas = Array.isArray(v) ? v : Array.isArray(v?.metas) ? v.metas : [];
+                  for (const m of metas) {
+                    if (m && m.deviceId) onlineIds.add(m.deviceId);
+                  }
+                }
+                clearTimeout(timer);
+                done();
+              }
+            } catch {}
+          };
+
+          ws.onerror = () => {
+            clearTimeout(timer);
+            done();
+          };
+        } catch {
+          clearTimeout(timer);
+          done();
+        }
+      });
+    }),
+  );
+
+  return { onlineIds, expired: false };
+}
+
+// ── Realtime WebSocket Connection ───────────────────────────────────────────
+
 class RealtimeConnection {
   constructor(config) {
     this.url = config.supabaseUrl || DEFAULT_SUPABASE_URL;
@@ -73,12 +370,17 @@ class RealtimeConnection {
     this.joinRef = null;
     this.ws = null;
     this.heartbeatTimer = null;
+    this.onlineDeviceIds = new Set();
   }
 
   nextRef() {
     return String(++this.ref);
   }
 
+  isDeviceOnline(deviceId) {
+    return this.onlineDeviceIds.has(deviceId);
+  }
+
   async connect(timeoutMs = 15000) {
     return new Promise((resolve, reject) => {
       const wsUrl = `${this.url.replace(/^http/, 'ws')}/realtime/v1/websocket?apikey=${this.anonKey}&vsn=1.0.0`;
@@ -100,7 +402,7 @@ class RealtimeConnection {
                 );
               }
             }, 25000);
-            resolve(this);
+            setTimeout(() => resolve(this), 250);
           })
           .catch(reject);
       };
@@ -119,12 +421,47 @@ class RealtimeConnection {
         topic: this.topic,
         event: 'phx_join',
         payload: {
-          config: { private: true, broadcast: { self: false } },
+          config: { private: true, broadcast: { self: false }, presence: { key: '' } },
           access_token: this.token,
         },
         ref: this.joinRef,
       };
 
+      const presenceHandler = event => {
+        try {
+          const msg = JSON.parse(event.data);
+          if (msg.event === 'presence_state' && msg.payload) {
+            for (const [k, v] of Object.entries(msg.payload)) {
+              if (k && k.startsWith('device-')) this.onlineDeviceIds.add(k);
+              const metas = Array.isArray(v) ? v : Array.isArray(v?.metas) ? v.metas : [];
+              for (const m of metas) {
+                if (m && m.deviceId) this.onlineDeviceIds.add(m.deviceId);
+              }
+            }
+          } else if (msg.event === 'presence_diff' && msg.payload) {
+            if (msg.payload.joins) {
+              for (const [k, v] of Object.entries(msg.payload.joins)) {
+                if (k && k.startsWith('device-')) this.onlineDeviceIds.add(k);
+                const metas = Array.isArray(v) ? v : Array.isArray(v?.metas) ? v.metas : [];
+                for (const m of metas) {
+                  if (m && m.deviceId) this.onlineDeviceIds.add(m.deviceId);
+                }
+              }
+            }
+            if (msg.payload.leaves) {
+              for (const [k, v] of Object.entries(msg.payload.leaves)) {
+                if (k && k.startsWith('device-')) this.onlineDeviceIds.delete(k);
+                const metas = Array.isArray(v) ? v : Array.isArray(v?.metas) ? v.metas : [];
+                for (const m of metas) {
+                  if (m && m.deviceId) this.onlineDeviceIds.delete(m.deviceId);
+                }
+              }
+            }
+          }
+        } catch {}
+      };
+      this.ws.addEventListener('message', presenceHandler);
+
       const handler = event => {
         try {
           const msg = JSON.parse(event.data);
@@ -133,7 +470,12 @@ class RealtimeConnection {
             if (msg.payload?.status === 'ok') {
               resolve();
             } else {
-              reject(new Error(`Channel join rejected: ${JSON.stringify(msg.payload || {})}`));
+              const reason = msg.payload?.response?.reason || JSON.stringify(msg.payload || {});
+              if (typeof reason === 'string' && reason.includes('Token has expired')) {
+                reject(new Error('Session token has expired. Run "kroki login" to reconnect.'));
+              } else {
+                reject(new Error(`Channel join rejected: ${reason}`));
+              }
             }
           }
         } catch {}
@@ -144,38 +486,70 @@ class RealtimeConnection {
     });
   }
 
-  sendCommand(command, onEvent, timeoutMs = 240000) {
+  async sendCommand(command, onEvent, timeoutMs = 600000) {
     return new Promise((resolve, reject) => {
-      const msgRef = this.nextRef();
-      const timer = setTimeout(() => {
-        reject(new Error('Command timed out while waiting for browser response (4 min limit).'));
+      let activityTimeout = null;
+      const resetActivityTimeout = () => {
+        if (activityTimeout) clearTimeout(activityTimeout);
+        // 2-minute silence limit between steps
+        activityTimeout = setTimeout(() => {
+          cleanup();
+          reject(new Error('Task timed out: no activity received for 2 minutes'));
+        }, 120000);
+      };
+      resetActivityTimeout();
+
+      const totalTimeout = setTimeout(() => {
+        cleanup();
+        reject(new Error(`Task reached maximum time limit (${Math.round(timeoutMs / 60000)}m)`));
       }, timeoutMs);
 
+      const cleanup = () => {
+        if (activityTimeout) clearTimeout(activityTimeout);
+        clearTimeout(totalTimeout);
+        this.ws.removeEventListener('message', handler);
+      };
+
       const handler = event => {
         try {
           const msg = JSON.parse(event.data);
-          if (msg.topic === this.topic && msg.event === 'broadcast') {
-            const envelope = msg.payload?.payload;
-            if (!envelope || envelope.deviceId !== this.deviceId) return;
+          let envelope = null;
+          if (msg.event === 'broadcast' && msg.payload) {
+            envelope = msg.payload.payload || msg.payload;
+          } else if (msg.event === 'event' && msg.payload) {
+            envelope = msg.payload;
+          } else if (msg.payload && (msg.payload.kind || msg.payload.taskId)) {
+            envelope = msg.payload;
+          }
 
+          if (envelope && (envelope.taskId === command.taskId || !envelope.taskId)) {
+            resetActivityTimeout();
             if (onEvent) onEvent(envelope);
 
             if (
+              envelope.kind === 'task_complete' ||
               envelope.kind === 'chat_task_complete' ||
               envelope.kind === 'workflow_complete' ||
-              envelope.kind === 'pair_approved'
+              envelope.payload?.state === 'task.ok' ||
+              envelope.payload?.state === 'task.cancel'
             ) {
-              clearTimeout(timer);
-              this.ws.removeEventListener('message', handler);
-              resolve(envelope.payload);
-            } else if (envelope.kind === 'pair_rejected') {
-              clearTimeout(timer);
-              this.ws.removeEventListener('message', handler);
-              reject(new Error('Pairing request was rejected in Kroki browser.'));
-            } else if (envelope.kind === 'error') {
-              clearTimeout(timer);
-              this.ws.removeEventListener('message', handler);
-              reject(new Error(envelope.payload?.message || 'Remote error from Kroki browser'));
+              cleanup();
+              if (envelope.kind === 'workflow_complete' && envelope.payload?.success === false) {
+                const errMsg =
+                  envelope.payload?.error ||
+                  (envelope.payload?.cancelled ? 'Workflow was cancelled' : 'Workflow execution failed');
+                const err = new Error(errMsg);
+                err.payload = envelope.payload;
+                reject(err);
+                return;
+              }
+              resolve(envelope.payload || { success: true });
+            } else if (envelope.kind === 'error' || envelope.payload?.state === 'task.fail') {
+              cleanup();
+              const errMsg = envelope.payload?.message || envelope.payload?.error || 'Task failed';
+              const err = new Error(errMsg);
+              err.payload = envelope.payload;
+              reject(err);
             }
           }
         } catch {}
@@ -183,7 +557,7 @@ class RealtimeConnection {
 
       this.ws.addEventListener('message', handler);
 
-      const packet = {
+      const broadcastMsg = {
         topic: this.topic,
         event: 'broadcast',
         payload: {
@@ -191,84 +565,24 @@ class RealtimeConnection {
           event: 'command',
           payload: command,
         },
-        ref: msgRef,
-        join_ref: this.joinRef,
+        ref: this.nextRef(),
       };
 
-      this.ws.send(JSON.stringify(packet));
+      this.ws.send(JSON.stringify(broadcastMsg));
     });
   }
 
   close() {
-    if (this.heartbeatTimer) {
-      clearInterval(this.heartbeatTimer);
-      this.heartbeatTimer = null;
-    }
+    if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
     if (this.ws) {
       try {
         this.ws.close();
       } catch {}
-      this.ws = null;
     }
   }
 }
 
-async function pairCommand(code) {
-  if (!code) {
-    console.log(`
-\x1b[1mKroki Pairing\x1b[0m
-Requires an active \x1b[33mUltra\x1b[0m plan.
-
-1. Log in at \x1b[36mhttps://kroki.ai/#/devices\x1b[0m
-2. Find your active browser profile
-3. Click \x1b[32m"Скопировать код для AI"\x1b[0m
-4. Run:
-   \x1b[33mnpx kroki pair <YOUR_CODE>\x1b[0m
-`);
-    process.exit(0);
-  }
-
-  const payload = decodePairingCode(code);
-  const name = payload.deviceName || payload.deviceId;
-  console.log(`\x1b[36mConnecting to profile [${name}]...\x1b[0m`);
-
-  const conn = new RealtimeConnection(payload);
-  await conn.connect();
-
-  console.log(`\x1b[33mWaiting for confirmation in Kroki browser (click "Разрешить")...\x1b[0m`);
-
-  const pairCmd = {
-    v: 1,
-    id: `pair-${Date.now()}`,
-    kind: 'pair_request',
-    targetDeviceId: payload.deviceId,
-    taskId: `pair-${Date.now()}`,
-    issuedAt: Date.now(),
-    payload: {
-      clientName: 'Antigravity CLI',
-    },
-  };
-
-  try {
-    await conn.sendCommand(pairCmd, undefined, 60000);
-  } catch (err) {
-    conn.close();
-    console.error(`\x1b[31m✖ ${err.message}\x1b[0m`);
-    process.exit(1);
-  }
-
-  saveActiveSession({
-    ...payload,
-    pairedAt: Date.now(),
-  });
-
-  conn.close();
-
-  console.log(`\x1b[32m✔ Successfully paired with "${name}".\x1b[0m`);
-  console.log('You can now run tasks without entering the code:');
-  console.log('  \x1b[33mnpx kroki "open example.com and extract titles"\x1b[0m');
-  console.log('  \x1b[33mnpx kroki run "My Workflow Name"\x1b[0m\n');
-}
+// ── UI Helpers ──────────────────────────────────────────────────────────────
 
 function createProgressTracker({ verbose = false, isJson = false, initialText = '' }) {
   const steps = [];
@@ -302,6 +616,16 @@ function createProgressTracker({ verbose = false, isJson = false, initialText =
         currentStatus = firstLine;
       }
     },
+    onStatus(statusText) {
+      if (!statusText || typeof statusText !== 'string') return;
+      const firstLine = statusText.split('\n')[0].trim();
+      if (!firstLine) return;
+      if (verbose) {
+        console.log(`  \x1b[90mℹ ${firstLine.slice(0, 100)}\x1b[0m`);
+      } else {
+        currentStatus = firstLine;
+      }
+    },
     stop() {
       if (timer) {
         clearInterval(timer);
@@ -317,81 +641,651 @@ function createProgressTracker({ verbose = false, isJson = false, initialText =
   };
 }
 
-async function taskCommand(taskText, { verbose = false, json = false } = {}) {
-  const session = getActiveSession();
-  if (!session) {
-    console.error('\x1b[31mError: Not paired.\x1b[0m');
-    console.error('Pair first with code from https://kroki.ai/#/devices (Ultra plan required):');
-    console.error('  \x1b[33mnpx kroki pair <YOUR_CODE>\x1b[0m\n');
+// ── Commands ────────────────────────────────────────────────────────────────
+
+async function loginCommand(explicitCode) {
+  if (explicitCode) {
+    saveFromCode(explicitCode);
+    console.log('\x1b[32m✔ Successfully logged in!\x1b[0m\n');
+    await devicesCommand();
+    return;
+  }
+
+  const port = 54321;
+  const authUrl = `https://kroki.ai/#/devices?cli_port=${port}`;
+
+  console.log(`\x1b[36mLogging in to Kroki...\x1b[0m`);
+  console.log(`Opening browser at: \x1b[33m${authUrl}\x1b[0m\n`);
+
+  openBrowser(authUrl);
+
+  console.log('Waiting for browser authentication (or paste your code from https://kroki.ai/#/devices below):');
+
+  let resolved = false;
+  let server = null;
+  let rl = null;
+
+  const finish = async code => {
+    if (resolved) return;
+    resolved = true;
+    if (server) {
+      try {
+        server.close();
+      } catch {}
+    }
+    if (rl) {
+      try {
+        rl.close();
+      } catch {}
+    }
+    try {
+      saveFromCode(code);
+      console.log('\n\x1b[32m✔ Successfully logged in!\x1b[0m\n');
+      await devicesCommand();
+    } catch (e) {
+      console.error(`\x1b[31m✖ Login failed:\x1b[0m ${e.message}`);
+      process.exit(1);
+    }
+  };
+
+  try {
+    server = createServer((req, res) => {
+      const parsedUrl = new URL(req.url, `http://localhost:${port}`);
+      res.setHeader('Access-Control-Allow-Origin', '*');
+      res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+      res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+
+      if (req.method === 'OPTIONS') {
+        res.writeHead(204);
+        res.end();
+        return;
+      }
+
+      if (req.method === 'POST') {
+        let body = '';
+        req.on('data', chunk => {
+          body += chunk;
+        });
+        req.on('end', () => {
+          try {
+            const data = JSON.parse(body);
+            if (data.token || data.code) {
+              const cfg = saveFromCode(data.code ? data.code : data);
+              const activeIds =
+                cfg.selectedDeviceIds && cfg.selectedDeviceIds.length > 0
+                  ? cfg.selectedDeviceIds
+                  : Object.keys(cfg.devices || {});
+              res.writeHead(200, { 'Content-Type': 'application/json' });
+              res.end(JSON.stringify({ ok: true, selectedDeviceIds: activeIds }));
+              finish(data.code ? data.code : data);
+              return;
+            }
+          } catch {}
+          res.writeHead(400);
+          res.end(JSON.stringify({ error: 'invalid payload' }));
+        });
+        return;
+      }
+
+      const codeParam = parsedUrl.searchParams.get('code') || parsedUrl.searchParams.get('token');
+      if (codeParam) {
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        res.end(
+          `<html><body style="font-family:system-ui;text-align:center;padding:50px;background:#18181b;color:#f4f4f5"><h2>✔ Kroki CLI Authorized!</h2><p>You can return to your terminal.</p></body></html>`,
+        );
+        finish(codeParam);
+        return;
+      }
+
+      res.writeHead(404);
+      res.end();
+    });
+
+    server.listen(port, '127.0.0.1');
+    server.on('error', () => {
+      // Port in use, proceed with stdin prompt
+    });
+  } catch {}
+
+  rl = createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+
+  rl.question('> ', answer => {
+    if (answer && answer.trim()) {
+      finish(answer.trim());
+    }
+  });
+}
+
+async function devicesCommand({ json = false, all = false, target = null, args = [] } = {}) {
+  const config = getConfig();
+  if (!config || !config.account || !config.account.token) {
+    console.error('\x1b[31mError: Not logged in.\x1b[0m');
+    console.error('Run \x1b[33mkroki login\x1b[0m to authenticate first.');
     process.exit(1);
   }
 
-  const conn = new RealtimeConnection(session);
+  const devices = { ...(config.devices || {}) };
+
+  // Fetch accounts & devices from backend using control token
+  try {
+    const res = await fetch(`${config.account.supabaseUrl || DEFAULT_SUPABASE_URL}/functions/v1/get-control-token`, {
+      method: 'POST',
+      headers: {
+        Origin: 'https://kroki.ai',
+        'Content-Type': 'application/json',
+        apikey: config.account.anonKey || DEFAULT_ANON_KEY,
+        Authorization: `Bearer ${config.account.token}`,
+      },
+      body: JSON.stringify({ action: 'list_devices' }),
+    });
+    if (res.ok) {
+      const data = await res.json();
+      if (Array.isArray(data.accounts)) {
+        for (const acc of data.accounts) {
+          if (Array.isArray(acc.devices)) {
+            for (const d of acc.devices) {
+              const resolvedEmail =
+                acc.email ||
+                (acc.google_id === config.account.googleId ? config.account.email : null) ||
+                config.account.email ||
+                acc.label ||
+                acc.google_id;
+              devices[d.device_id] = {
+                deviceId: d.device_id,
+                deviceName: d.device_name || d.device_id,
+                platform: d.platform || 'mac',
+                account: resolvedEmail,
+                googleId: acc.google_id,
+                lastSeenAt: d.last_seen_at ? Date.parse(d.last_seen_at) : Date.now(),
+              };
+            }
+          }
+        }
+        config.devices = devices;
+        saveConfig(config);
+      }
+    }
+  } catch {}
+
+  const deviceList = Object.values(devices);
+
+  if (deviceList.length === 0) {
+    console.log('\n\x1b[33mNo connected browsers found in this account.\x1b[0m');
+    console.log('Connect Chrome from the Kroki extension or visit https://kroki.ai/#/devices\n');
+    return;
+  }
+
+  // Ensure a default device exists
+  if (!config.defaultDeviceId || !devices[config.defaultDeviceId]) {
+    config.defaultDeviceId = deviceList[0].deviceId;
+    saveConfig(config);
+  }
+
+  const rawInput = (args.length > 0 ? args.join(' ') : target || '').trim();
+
+  // Query live presence
+  const { onlineIds, expired } = await fetchOnlineDeviceIds(config);
+
+  // 1. If arguments provided to select browser(s): e.g. "1", "1, 2", "all"
+  if (rawInput) {
+    if (rawInput.toLowerCase() === 'all') {
+      config.activeDeviceIds = [];
+      saveConfig(config);
+      console.log('\x1b[32m✔ All browsers are now active.\x1b[0m\n');
+      return;
+    }
+
+    const parts = rawInput
+      .split(/[,\s]+/)
+      .map(s => s.trim())
+      .filter(Boolean);
+    const chosen = [];
+    for (const p of parts) {
+      try {
+        const dev = resolveTargetDevice(config, p);
+        if (dev && !chosen.some(c => c.deviceId === dev.deviceId)) {
+          chosen.push(dev);
+        }
+      } catch (err) {
+        console.error(`\x1b[31m✖ Error resolving "${p}":\x1b[0m ${err.message}`);
+        process.exit(1);
+      }
+    }
+
+    if (chosen.length > 0) {
+      config.activeDeviceIds = chosen.map(d => d.deviceId);
+      config.defaultDeviceId = chosen[0].deviceId;
+      saveConfig(config);
+      if (chosen.length === 1) {
+        const idx = deviceList.findIndex(d => d.deviceId === chosen[0].deviceId);
+        const isOnline = onlineIds.has(chosen[0].deviceId);
+        const statusTag = isOnline ? ' \x1b[32m● online\x1b[0m' : ' \x1b[90m○ offline\x1b[0m';
+        console.log(
+          `\x1b[32m✔ Active browser set to:\x1b[0m \x1b[36m[${idx + 1}] ${chosen[0].deviceName}\x1b[0m${statusTag} (${chosen[0].account || 'browser'})\n`,
+        );
+        if (!isOnline && !expired) {
+          console.log(
+            `\x1b[33m⚠ Note: This browser is currently offline. Open Chrome on this profile before running tasks.\x1b[0m\n`,
+          );
+        }
+      } else {
+        console.log(`\x1b[32m✔ Active browsers set (${chosen.length}):\x1b[0m`);
+        let hasOffline = false;
+        chosen.forEach(c => {
+          const idx = deviceList.findIndex(d => d.deviceId === c.deviceId);
+          const isOnline = onlineIds.has(c.deviceId);
+          if (!isOnline) hasOffline = true;
+          const statusTag = isOnline ? ' \x1b[32m● online\x1b[0m' : ' \x1b[90m○ offline\x1b[0m';
+          console.log(`  \x1b[36m[${idx + 1}]\x1b[0m ${c.deviceName}${statusTag} (${c.account || 'browser'})`);
+        });
+        console.log();
+        if (hasOffline && !expired) {
+          console.log(
+            `\x1b[33m⚠ Note: Some chosen browsers are offline. Tasks will only execute on online browsers.\x1b[0m\n`,
+          );
+        }
+      }
+      return;
+    }
+  }
+
+  // 2. JSON output
+  if (json) {
+    const activeIds = config.activeDeviceIds && config.activeDeviceIds.length > 0 ? config.activeDeviceIds : null;
+    const list = activeIds && !all ? deviceList.filter(d => activeIds.includes(d.deviceId)) : deviceList;
+    const output = list.map(d => {
+      const idx = deviceList.findIndex(item => item.deviceId === d.deviceId);
+      const isOnline = onlineIds.has(d.deviceId);
+      return {
+        index: idx + 1,
+        deviceId: d.deviceId,
+        deviceName: d.deviceName,
+        account: d.account || null,
+        platform: d.platform || 'mac',
+        status: isOnline ? 'online' : 'offline',
+        isOnline,
+        isActive: !activeIds || activeIds.includes(d.deviceId),
+        isDefault: config.defaultDeviceId === d.deviceId,
+        lastSeenAt: d.lastSeenAt || null,
+      };
+    });
+    console.log(JSON.stringify(output, null, 2));
+    return;
+  }
+
+  // 3. Display list of browsers
+  const activeIds = config.activeDeviceIds && config.activeDeviceIds.length > 0 ? config.activeDeviceIds : null;
+  console.log(`\n\x1b[1mAvailable Kroki Browsers (${deviceList.length}):\x1b[0m`);
+  deviceList.forEach((d, idx) => {
+    const isAct = !activeIds || activeIds.includes(d.deviceId);
+    const isDef = config.defaultDeviceId === d.deviceId;
+    const isOnline = onlineIds.has(d.deviceId);
+    const statusTag = isOnline ? ' \x1b[32m● online\x1b[0m' : ' \x1b[90m○ offline\x1b[0m';
+    const mark = isAct ? '\x1b[32m✔\x1b[0m ' : '  ';
+    const defTag = isDef ? ' \x1b[33m[default]\x1b[0m' : '';
+    const accTag = d.account && !/^\d{15,}$/.test(d.account) ? ` \x1b[90m(${d.account})\x1b[0m` : '';
+    console.log(`  ${mark}\x1b[36m[${idx + 1}]\x1b[0m ${d.deviceName || d.deviceId}${statusTag}${accTag}${defTag}`);
+  });
+  console.log();
+
+  if (activeIds && activeIds.length < deviceList.length) {
+    console.log(`\x1b[32mActive:\x1b[0m ${activeIds.length} of ${deviceList.length} browsers\n`);
+  }
+
+  if (expired) {
+    console.log(
+      `\x1b[33m⚠ Note: Session token has expired. Run "kroki login" to re-authenticate and refresh live presence.\x1b[0m\n`,
+    );
+  }
+
+  // Interactive selection if in terminal (TTY)
+  if (process.stdin.isTTY) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl.question('Select browser(s) [1..10, or "all"] (Enter to keep current): ', ans => {
+      rl.close();
+      const val = ans.trim();
+      if (!val) return;
+      if (val.toLowerCase() === 'all') {
+        config.activeDeviceIds = [];
+        saveConfig(config);
+        console.log('\n\x1b[32m✔ All browsers are now active.\x1b[0m\n');
+        return;
+      }
+
+      const parts = val
+        .split(/[,\s]+/)
+        .map(s => s.trim())
+        .filter(Boolean);
+      const chosen = [];
+      for (const p of parts) {
+        try {
+          const dev = resolveTargetDevice(config, p);
+          if (dev && !chosen.some(c => c.deviceId === dev.deviceId)) {
+            chosen.push(dev);
+          }
+        } catch (err) {
+          console.warn(`\x1b[33mWarning: ${err.message}\x1b[0m`);
+        }
+      }
+
+      if (chosen.length > 0) {
+        config.activeDeviceIds = chosen.map(d => d.deviceId);
+        config.defaultDeviceId = chosen[0].deviceId;
+        saveConfig(config);
+        console.log(`\n\x1b[32m✔ Active browser(s) set (${chosen.length}):\x1b[0m`);
+        chosen.forEach(c => {
+          const idx = deviceList.findIndex(d => d.deviceId === c.deviceId);
+          const isOnline = onlineIds.has(c.deviceId);
+          const statusTag = isOnline ? ' \x1b[32m● online\x1b[0m' : ' \x1b[90m○ offline\x1b[0m';
+          console.log(`  \x1b[36m[${idx + 1}]\x1b[0m ${c.deviceName}${statusTag} (${c.account || 'browser'})`);
+        });
+        console.log();
+      }
+    });
+  } else {
+    console.log('\x1b[90mSelect browser: kroki devices <number> (e.g. kroki devices 1, kroki devices all)\x1b[0m\n');
+  }
+}
+
+async function pairCommand(code) {
+  if (!code) {
+    console.log(`
+Pair Kroki CLI with a live browser profile.
+
+1. Log in at \x1b[36mhttps://kroki.ai/#/devices\x1b[0m
+2. Find your active browser profile
+3. Click \x1b[32m"Скопировать код для AI"\x1b[0m
+4. Run:
+   \x1b[33mkroki pair <YOUR_CODE>\x1b[0m
+`);
+    process.exit(0);
+  }
+
+  const payload = decodePairingCode(code);
+  const name = payload.deviceName || payload.deviceId;
+  console.log(`\x1b[36mConnecting to profile [${name}]...\x1b[0m`);
+
+  const conn = new RealtimeConnection(payload);
   await conn.connect();
 
+  console.log(`\x1b[33mWaiting for confirmation in Kroki browser (click "Разрешить")...\x1b[0m`);
+
+  const pairCmd = {
+    v: 1,
+    id: `pair-${Date.now()}`,
+    kind: 'pair_request',
+    targetDeviceId: payload.deviceId,
+    taskId: `pair-${Date.now()}`,
+    issuedAt: Date.now(),
+    payload: {
+      clientName: 'Antigravity CLI',
+    },
+  };
+
+  try {
+    await conn.sendCommand(pairCmd, undefined, 60000);
+  } catch (err) {
+    conn.close();
+    console.error(`\x1b[31m✖ ${err.message}\x1b[0m`);
+    process.exit(1);
+  }
+
+  saveFromCode(code);
+  conn.close();
+
+  console.log(`\x1b[32m✔ Successfully paired with "${name}".\x1b[0m`);
+  console.log('You can now run tasks without entering the code:');
+  console.log('  \x1b[33mkroki "open example.com and extract titles"\x1b[0m');
+  console.log('  \x1b[33mkroki run "My Workflow Name"\x1b[0m\n');
+}
+
+async function runSingleDeviceTask(config, device, taskText, { verbose = false, json = false } = {}) {
+  const devList = Object.values(config.devices || {});
+  const devIdx = devList.findIndex(d => d.deviceId === device.deviceId) + 1;
+  const idxStr = devIdx > 0 ? `[${devIdx}] ` : '';
+  const devLabel = `${idxStr}${device.deviceName || device.deviceId}`;
+
+  if (isTokenExpired(config.account?.token)) {
+    const errMsg = 'Session token has expired. Run "kroki login" to re-authenticate.';
+    if (!json) {
+      console.error('\x1b[31m✖ Error: Session token has expired.\x1b[0m');
+      console.error('Run \x1b[33mkroki login\x1b[0m to re-authenticate.\n');
+    }
+    return { device, ok: false, error: errMsg, steps: [] };
+  }
+
+  const targetGoogleId = device.googleId || config.account.googleId;
+  const conn = new RealtimeConnection({
+    ...config.account,
+    googleId: targetGoogleId,
+    deviceId: device.deviceId,
+  });
+
+  try {
+    await conn.connect();
+  } catch (err) {
+    return { device, ok: false, error: err.message, steps: [] };
+  }
+
+  if (!conn.isDeviceOnline(device.deviceId)) {
+    conn.close();
+    const errMsg = `Browser ${devLabel} is offline. Make sure Google Chrome is open with the Kroki extension active on this profile.`;
+    if (!json) {
+      console.error(`\x1b[31m✖ Cannot run task: Browser ${devLabel} is offline.\x1b[0m`);
+      console.error(`  Make sure Google Chrome is open with the Kroki extension active on this profile.\n`);
+    }
+    return { device, ok: false, error: errMsg, steps: [] };
+  }
+
   const command = {
     v: 1,
-    id: `task-${Date.now()}`,
+    id: `task-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
     kind: 'chat_task',
-    targetDeviceId: session.deviceId,
-    taskId: `task-${Date.now()}`,
+    targetDeviceId: device.deviceId,
+    taskId: `task-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
     issuedAt: Date.now(),
     payload: {
       task: taskText,
     },
   };
 
-  const initialMsg = `\x1b[36m[Kroki: ${session.deviceName || 'Browser'}]\x1b[0m Running: "${taskText}"...`;
+  const initialMsg = `\x1b[36m[Kroki: ${devLabel}]\x1b[0m Running: "${taskText}"...`;
   const tracker = createProgressTracker({ verbose, isJson: json, initialText: initialMsg });
 
   try {
     const result = await conn.sendCommand(command, ev => {
       if (ev.kind === 'execution') {
         const details = ev.payload?.data?.details || ev.payload?.title || ev.payload?.type;
-        if (details) tracker.onStep(details);
+        if (details) tracker.onStep(`[${devLabel}] ${details}`);
       }
     });
 
     tracker.stop();
+    return { device, ok: true, result, steps: tracker.getSteps() };
+  } catch (err) {
+    tracker.stop();
+    return { device, ok: false, error: err.message, steps: tracker.getSteps() };
+  } finally {
+    conn.close();
+  }
+}
 
-    if (json) {
-      console.log(JSON.stringify(result, null, 2));
-    } else {
-      if (verbose) {
-        console.log('\x1b[32m✔ Task completed.\x1b[0m\n');
+async function taskCommand(taskText, { verbose = false, json = false, device: targetQuery = null, all = false } = {}) {
+  const config = getConfig();
+  if (!config || !config.account || !config.account.token) {
+    console.error('\x1b[31mError: Not logged in or paired.\x1b[0m');
+    console.error('Run \x1b[33mkroki login\x1b[0m or \x1b[33mkroki pair <CODE>\x1b[0m first.\n');
+    process.exit(1);
+  }
+
+  // Auto-detect natural language requests to run a workflow (e.g. 'запусти Order Ali', 'run workflow Ali')
+  const wfMatch = taskText.match(
+    /^(?:запусти(?:ть)?|стартуй|run|launch|execute)\s+(?:воркфлоу|workflow\s+)?["']?([^"']+)["']?$/i,
+  );
+  if (wfMatch) {
+    const candidate = wfMatch[1].trim();
+    const resolvedDev = resolveTargetDevice(config, targetQuery);
+    const targetGoogleId = resolvedDev?.googleId || config.account.googleId;
+    try {
+      const res = await fetch(`${config.account.supabaseUrl || DEFAULT_SUPABASE_URL}/functions/v1/get-control-token`, {
+        method: 'POST',
+        headers: {
+          Origin: 'https://kroki.ai',
+          'Content-Type': 'application/json',
+          apikey: config.account.anonKey || DEFAULT_ANON_KEY,
+          Authorization: `Bearer ${config.account.token}`,
+        },
+        body: JSON.stringify({ action: 'list_workflows', owner_google_id: targetGoogleId }),
+      });
+      if (res.ok) {
+        const data = await res.json();
+        if (Array.isArray(data.workflows)) {
+          const q = candidate.toLowerCase();
+          const match =
+            data.workflows.find(w => w.id === candidate) ||
+            data.workflows.find(w => (w.name || '').toLowerCase() === q) ||
+            data.workflows.find(w => (w.name || '').toLowerCase().includes(q));
+          if (match) {
+            console.log(
+              `\x1b[36m[Kroki]\x1b[0m Detected workflow "${match.name || match.id}". Launching workflow runner...\n`,
+            );
+            return workflowCommand(match.id, null, { verbose, json, device: targetQuery, taskText });
+          }
+        }
       }
-      if (result && typeof result === 'object' && result.message) {
-        console.log(result.message);
-      } else if (result && typeof result === 'object') {
-        console.log(JSON.stringify(result, null, 2));
+    } catch {}
+  }
+
+  const isAll =
+    all ||
+    targetQuery === 'all' ||
+    targetQuery === 'both' ||
+    /обоих браузер|всех браузер|на всех|на обоих|все браузеры|оба браузера/i.test(taskText);
+
+  let targetDevices = [];
+  if (isAll) {
+    targetDevices = Object.values(config.devices || {});
+  } else {
+    const device = resolveTargetDevice(config, targetQuery);
+    if (device) targetDevices = [device];
+  }
+
+  if (targetDevices.length === 0) {
+    console.error('\x1b[31mError: No target browser device found.\x1b[0m');
+    console.error('Run \x1b[33mkroki devices\x1b[0m to select active browsers.\n');
+    process.exit(1);
+  }
+
+  if (targetDevices.length === 1) {
+    const r = await runSingleDeviceTask(config, targetDevices[0], taskText, { verbose, json });
+    if (!r.ok) {
+      if (!verbose && r.steps && r.steps.length > 0) {
+        console.error('\x1b[90mRecent steps before failure:\x1b[0m');
+        for (const step of r.steps.slice(-10)) {
+          console.error(`  \x1b[90m→ ${step}\x1b[0m`);
+        }
+        console.error('');
       }
-    }
-  } catch (err) {
-    tracker.stop();
-    if (!verbose && tracker.getSteps().length > 0) {
-      console.error('\x1b[90mRecent steps before failure:\x1b[0m');
-      for (const step of tracker.getSteps().slice(-10)) {
-        console.error(`  \x1b[90m→ ${step}\x1b[0m`);
+      if (json) {
+        console.error(JSON.stringify({ success: false, error: r.error, steps: r.steps }, null, 2));
+      } else {
+        console.error(`\x1b[31m✖ Error: ${r.error}\x1b[0m`);
       }
-      console.error('');
+      process.exit(1);
     }
+
     if (json) {
-      console.error(JSON.stringify({ success: false, error: err.message, steps: tracker.getSteps() }, null, 2));
+      console.log(JSON.stringify(r.result, null, 2));
     } else {
-      console.error(`\x1b[31m✖ Error: ${err.message}\x1b[0m`);
+      if (verbose) console.log('\x1b[32m✔ Task completed.\x1b[0m\n');
+      if (r.result && typeof r.result === 'object' && r.result.message) {
+        console.log(r.result.message);
+      } else if (r.result && typeof r.result === 'object') {
+        console.log(JSON.stringify(r.result, null, 2));
+      }
     }
+    return;
+  }
+
+  // Multi-device parallel dispatch
+  console.log(`\x1b[36mDispatching task to ${targetDevices.length} browsers in parallel...\x1b[0m\n`);
+  const results = await Promise.all(
+    targetDevices.map(d => runSingleDeviceTask(config, d, taskText, { verbose, json })),
+  );
+
+  if (json) {
+    console.log(JSON.stringify(results, null, 2));
+  } else {
+    console.log('\n\x1b[32m✔ Completed on all target browsers:\x1b[0m');
+    for (const r of results) {
+      const devName = r.device.deviceName || r.device.deviceId;
+      if (r.ok) {
+        const msg = r.result && typeof r.result === 'object' && r.result.message ? r.result.message : 'Success';
+        console.log(`  \x1b[32m✔\x1b[0m \x1b[1m${devName}\x1b[0m: ${msg}`);
+      } else {
+        console.log(`  \x1b[31m✖\x1b[0m \x1b[1m${devName}\x1b[0m: ${r.error}`);
+      }
+    }
+  }
+}
+
+async function workflowsCommand({ json = false, device: targetQuery = null } = {}) {
+  const config = getConfig();
+  if (!config || !config.account || !config.account.token) {
+    console.error('\x1b[31mError: Not logged in.\x1b[0m');
+    console.error('Run \x1b[33mkroki login\x1b[0m first.\n');
     process.exit(1);
-  } finally {
-    conn.close();
   }
+
+  const device = resolveTargetDevice(config, targetQuery);
+  const targetGoogleId = device?.googleId || config.account.googleId;
+
+  const res = await fetch(`${config.account.supabaseUrl || DEFAULT_SUPABASE_URL}/functions/v1/get-control-token`, {
+    method: 'POST',
+    headers: {
+      Origin: 'https://kroki.ai',
+      'Content-Type': 'application/json',
+      apikey: config.account.anonKey || DEFAULT_ANON_KEY,
+      Authorization: `Bearer ${config.account.token}`,
+    },
+    body: JSON.stringify({ action: 'list_workflows', owner_google_id: targetGoogleId }),
+  });
+  if (!res.ok) {
+    console.error('Failed to load workflows.');
+    process.exit(1);
+  }
+  const data = await res.json();
+  const list = data.workflows || [];
+  if (json) {
+    console.log(JSON.stringify(list, null, 2));
+    return;
+  }
+  console.log(`\n\x1b[1mAvailable workflows for ${device?.deviceName || 'browser'}:\x1b[0m`);
+  for (const wf of list) {
+    console.log(`  • \x1b[36m${wf.name}\x1b[0m \x1b[90m(${wf.id})\x1b[0m`);
+  }
+  console.log('\nRun workflow with:\n  \x1b[33mkroki run "<name>"\x1b[0m\n');
 }
 
-async function workflowCommand(nameOrId, varsJson, { verbose = false, json = false } = {}) {
-  const session = getActiveSession();
-  if (!session) {
-    console.error('\x1b[31mError: Not paired.\x1b[0m');
-    console.error('Pair first with code from https://kroki.ai/#/devices (Ultra plan required):');
-    console.error('  \x1b[33mnpx kroki pair <YOUR_CODE>\x1b[0m\n');
+async function workflowCommand(
+  nameOrId,
+  varsJson,
+  { verbose = false, json = false, device: targetQuery = null, taskText = null } = {},
+) {
+  const config = getConfig();
+  if (!config || !config.account || !config.account.token) {
+    console.error('\x1b[31mError: Not logged in or paired.\x1b[0m');
+    console.error('Run \x1b[33mkroki login\x1b[0m or \x1b[33mkroki pair <CODE>\x1b[0m first.\n');
+    process.exit(1);
+  }
+
+  const device = resolveTargetDevice(config, targetQuery);
+  if (!device) {
+    console.error('\x1b[31mError: No target browser device found.\x1b[0m');
+    console.error('Run \x1b[33mkroki devices\x1b[0m to select active browsers.\n');
     process.exit(1);
   }
 
@@ -404,56 +1298,219 @@ async function workflowCommand(nameOrId, varsJson, { verbose = false, json = fal
     }
   }
 
-  const conn = new RealtimeConnection(session);
-  await conn.connect();
+  const targetGoogleId = device.googleId || config.account.googleId;
+
+  // Resolve human workflow name to actual workflowId
+  let targetWorkflowId = nameOrId;
+  let resolvedName = nameOrId;
+
+  try {
+    const res = await fetch(`${config.account.supabaseUrl || DEFAULT_SUPABASE_URL}/functions/v1/get-control-token`, {
+      method: 'POST',
+      headers: {
+        Origin: 'https://kroki.ai',
+        'Content-Type': 'application/json',
+        apikey: config.account.anonKey || DEFAULT_ANON_KEY,
+        Authorization: `Bearer ${config.account.token}`,
+      },
+      body: JSON.stringify({ action: 'list_workflows', owner_google_id: targetGoogleId }),
+    });
+    if (res.ok) {
+      const data = await res.json();
+      if (Array.isArray(data.workflows)) {
+        const q = nameOrId.toLowerCase().trim();
+        const match =
+          data.workflows.find(w => w.id === nameOrId) ||
+          data.workflows.find(w => (w.name || '').toLowerCase() === q) ||
+          data.workflows.find(w => (w.name || '').toLowerCase().includes(q));
+        if (match) {
+          targetWorkflowId = match.id;
+          resolvedName = match.name || match.id;
+        }
+      }
+    }
+  } catch {}
+
+  if (isTokenExpired(config.account?.token)) {
+    console.error('\x1b[31m✖ Error: Session token has expired.\x1b[0m');
+    console.error('Run \x1b[33mkroki login\x1b[0m to re-authenticate.\n');
+    process.exit(1);
+  }
+
+  const conn = new RealtimeConnection({
+    ...config.account,
+    googleId: targetGoogleId,
+    deviceId: device.deviceId,
+  });
+
+  try {
+    await conn.connect();
+  } catch (err) {
+    console.error(`\x1b[31m✖ Error: ${err.message}\x1b[0m\n`);
+    process.exit(1);
+  }
+
+  const devList = Object.values(config.devices || {});
+  const devIdx = devList.findIndex(d => d.deviceId === device.deviceId) + 1;
+  const idxStr = devIdx > 0 ? `[${devIdx}] ` : '';
+  const devLabel = `${idxStr}${device.deviceName || device.deviceId}`;
+
+  if (!conn.isDeviceOnline(device.deviceId)) {
+    conn.close();
+    console.error(`\x1b[31m✖ Cannot run workflow: Browser ${devLabel} is offline.\x1b[0m`);
+    console.error(`  Make sure Google Chrome is open with the Kroki extension active on this profile.\n`);
+    process.exit(1);
+  }
 
   const command = {
     v: 1,
     id: `wf-${Date.now()}`,
     kind: 'workflow_execute',
-    targetDeviceId: session.deviceId,
+    targetDeviceId: device.deviceId,
     taskId: `wf-${Date.now()}`,
     issuedAt: Date.now(),
     payload: {
-      workflowId: nameOrId,
+      workflowId: targetWorkflowId,
+      workflowName: resolvedName,
+      task: taskText || `Run workflow "${resolvedName}"`,
       variables,
     },
   };
 
-  const initialMsg = `\x1b[36m[Kroki: ${session.deviceName || 'Browser'}]\x1b[0m Executing workflow "${nameOrId}"...`;
-  const tracker = createProgressTracker({ verbose, isJson: json, initialText: initialMsg });
+  const devName = device.deviceName || device.deviceId || 'Browser';
+  const initialMsg = `\x1b[36m[Kroki: ${devName}]\x1b[0m Started workflow "${resolvedName}" (ID: ${targetWorkflowId})`;
+  if (!json) {
+    console.log(initialMsg);
+  }
+
+  const tracker = createProgressTracker({ verbose, isJson: json, initialText: 'Running workflow...' });
+  const startTime = Date.now();
+  let stepCount = 0;
+  const stepHistory = [];
+  let currentStepStartTime = Date.now();
 
   try {
     const result = await conn.sendCommand(command, ev => {
-      if (ev.kind === 'workflow_step_start') {
-        const stepDesc = `[step] ${ev.payload?.stepType || 'action'}: ${ev.payload?.comment || ''}`;
-        tracker.onStep(stepDesc);
+      if (ev.kind === 'workflow_queued') {
+        const queuePos = ev.payload?.position;
+        tracker.onStatus(`Queued (position ${queuePos || 1}). Waiting for runner...`);
+      } else if (ev.kind === 'workflow_step_start') {
+        stepCount++;
+        currentStepStartTime = Date.now();
+        const type = ev.payload?.stepType || 'ACTION';
+        const comment = ev.payload?.comment ? `: ${ev.payload.comment}` : '';
+        const stepDesc = `[step ${stepCount}] ${type}${comment}`;
+        stepHistory.push({
+          index: stepCount,
+          id: ev.payload?.stepId,
+          type,
+          comment: ev.payload?.comment || '',
+          startedAt: currentStepStartTime,
+          status: 'running',
+        });
+        if (verbose) {
+          tracker.onStep(stepDesc);
+        } else {
+          tracker.onStatus(`Running "${resolvedName}" (step ${stepCount})...`);
+        }
+      } else if (ev.kind === 'workflow_step_result') {
+        const lastStep = stepHistory[stepHistory.length - 1];
+        const duration = ((Date.now() - currentStepStartTime) / 1000).toFixed(1);
+        if (lastStep) {
+          lastStep.duration = `${duration}s`;
+          lastStep.status = ev.payload?.success ? 'success' : 'failed';
+          lastStep.error = ev.payload?.error;
+        }
+        if (verbose) {
+          const stepLabel = lastStep ? `[step ${lastStep.index}] ${lastStep.type}` : 'step';
+          if (ev.payload?.success) {
+            console.log(`    \x1b[32m✔\x1b[0m ${stepLabel} completed in ${duration}s`);
+          } else {
+            console.log(`    \x1b[31m✖\x1b[0m ${stepLabel} failed: ${ev.payload?.error || 'Unknown error'}`);
+          }
+        }
       }
     });
 
     tracker.stop();
+    const elapsed = ((Date.now() - startTime) / 1000).toFixed(1) + 's';
 
     if (json) {
-      console.log(JSON.stringify(result, null, 2));
+      console.log(
+        JSON.stringify(
+          {
+            success: true,
+            workflowId: targetWorkflowId,
+            workflowName: resolvedName,
+            device: devName,
+            elapsed,
+            totalSteps: stepCount,
+            steps: stepHistory,
+            result,
+          },
+          null,
+          2,
+        ),
+      );
     } else {
+      console.log(
+        `\x1b[32m✔ Workflow "${resolvedName}" completed successfully on ${devName} in ${elapsed} (${stepCount} steps executed).\x1b[0m`,
+      );
       if (verbose) {
-        console.log('\x1b[32m✔ Workflow finished.\x1b[0m\n');
+        if (stepHistory.length > 0) {
+          console.log('\n\x1b[1mExecution Details:\x1b[0m');
+          for (const s of stepHistory) {
+            const icon = s.status === 'success' ? '\x1b[32m✔\x1b[0m' : '\x1b[31m✖\x1b[0m';
+            const comment = s.comment ? ` - ${s.comment}` : '';
+            const dur = s.duration ? ` (${s.duration})` : '';
+            console.log(`  ${icon} [step ${s.index}] \x1b[1m${s.type}\x1b[0m${comment}${dur}`);
+          }
+        }
+        if (result && typeof result === 'object' && Object.keys(result).length > 0) {
+          console.log('\n\x1b[1mResult Payload:\x1b[0m');
+          console.log(JSON.stringify(result, null, 2));
+        }
+        console.log('');
       }
-      if (result) console.log(JSON.stringify(result, null, 2));
     }
   } catch (err) {
     tracker.stop();
-    if (!verbose && tracker.getSteps().length > 0) {
-      console.error('\x1b[90mRecent steps before failure:\x1b[0m');
-      for (const step of tracker.getSteps().slice(-10)) {
-        console.error(`  \x1b[90m→ ${step}\x1b[0m`);
-      }
-      console.error('');
-    }
+    const elapsed = ((Date.now() - startTime) / 1000).toFixed(1) + 's';
+    const isCancelled = err.payload?.cancelled || /cancelled/i.test(err.message);
+    const failStatus = isCancelled ? 'was cancelled' : 'failed';
+
     if (json) {
-      console.error(JSON.stringify({ success: false, error: err.message, steps: tracker.getSteps() }, null, 2));
+      console.error(
+        JSON.stringify(
+          {
+            success: false,
+            cancelled: isCancelled,
+            workflowId: targetWorkflowId,
+            workflowName: resolvedName,
+            device: devName,
+            elapsed,
+            error: err.message,
+            totalSteps: stepCount,
+            steps: stepHistory,
+          },
+          null,
+          2,
+        ),
+      );
     } else {
-      console.error(`\x1b[31m✖ Error: ${err.message}\x1b[0m`);
+      console.error(
+        `\x1b[31m✖ Workflow "${resolvedName}" ${failStatus} on ${devName} in ${elapsed}: ${err.message}\x1b[0m`,
+      );
+      if (stepHistory.length > 0) {
+        console.error('\n\x1b[90mRecent steps before failure:\x1b[0m');
+        for (const s of stepHistory.slice(-5)) {
+          const icon = s.status === 'failed' ? '\x1b[31m✖\x1b[0m' : '\x1b[90m→\x1b[0m';
+          const comment = s.comment ? ` - ${s.comment}` : '';
+          const dur = s.duration ? ` (${s.duration})` : '';
+          console.error(`  ${icon} [step ${s.index}] ${s.type}${comment}${dur}`);
+        }
+        console.error('');
+      }
     }
     process.exit(1);
   } finally {
@@ -462,26 +1519,36 @@ async function workflowCommand(nameOrId, varsJson, { verbose = false, json = fal
 }
 
 function statusCommand({ json = false } = {}) {
-  const session = getActiveSession();
-  if (!session) {
+  const config = getConfig();
+  if (!config || !config.account || !config.account.token) {
     if (json) {
-      console.log(JSON.stringify({ paired: false }, null, 2));
+      console.log(JSON.stringify({ authenticated: false, paired: false }, null, 2));
       return;
     }
-    console.log('No active paired profile.');
-    console.log('To pair, get a code from https://kroki.ai/#/devices and run:');
-    console.log('  npx kroki pair <CODE>');
+    console.log('Not logged in.');
+    console.log('Run \x1b[33mkroki login\x1b[0m or \x1b[33mkroki pair <CODE>\x1b[0m to connect.');
     return;
   }
+
+  const defaultDevice = (config.devices && config.defaultDeviceId && config.devices[config.defaultDeviceId]) || null;
+  const selectedCount = (config.selectedDeviceIds || []).length;
+  const totalCount = Object.keys(config.devices || {}).length;
+
   if (json) {
     console.log(
       JSON.stringify(
         {
-          paired: true,
-          deviceId: session.deviceId,
-          deviceName: session.deviceName,
-          platform: session.platform,
-          pairedAt: session.pairedAt,
+          authenticated: true,
+          googleId: config.account.googleId,
+          defaultDevice: defaultDevice
+            ? {
+                deviceId: defaultDevice.deviceId,
+                deviceName: defaultDevice.deviceName,
+                platform: defaultDevice.platform,
+              }
+            : null,
+          selectedDevicesCount: selectedCount,
+          totalDevicesCount: totalCount,
         },
         null,
         2,
@@ -489,10 +1556,17 @@ function statusCommand({ json = false } = {}) {
     );
     return;
   }
+
+  console.log(`\x1b[32m✔ Authenticated\x1b[0m (Account ID: ${config.account.googleId})`);
+  if (defaultDevice) {
+    console.log(
+      `  Default browser: \x1b[36m${defaultDevice.deviceName || defaultDevice.deviceId}\x1b[0m (${defaultDevice.account || defaultDevice.platform || 'browser'})`,
+    );
+    console.log(`  Device ID: ${defaultDevice.deviceId}`);
+  }
   console.log(
-    `\x1b[32m✔ Paired\x1b[0m with "${session.deviceName || session.deviceId}" (${session.platform || 'browser'})`,
+    `  All ${totalCount} browsers are available (use -d <number|name> to target, or 'kroki devices' to list)`,
   );
-  console.log(`  Device ID: ${session.deviceId}`);
 }
 
 function helpCommand() {
@@ -500,17 +1574,30 @@ function helpCommand() {
 \x1b[1mKroki CLI\x1b[0m — Browser Automation & AI Agent Bridge for Google Chrome
 
 \x1b[1mUsage:\x1b[0m
-  npx kroki "<task>" [options]             Send an AI task to the live browser
-  npx kroki run "<workflow>" [json] [opts] Execute a saved workflow
-  npx kroki pair <CODE>                    Pair with a browser profile (from https://kroki.ai/#/devices)
-  npx kroki status [options]               View paired profile and status
-  npx kroki clear                          Disconnect active pairing session
+  kroki login [code]                       Log in to your Kroki account
+  kroki devices [1..N | all]               View or select working browser(s)
+  kroki "<task>" [options]                 Send an AI task to the live browser
+  kroki run "<workflow>" [json] [opts]     Execute a saved workflow
+  kroki list / workflows [options]         List available workflows
+  kroki status [options]                   View active account and browsers
+  kroki clear / logout                     Clear local credentials and logout
 
 \x1b[1mOptions:\x1b[0m
+  -d, --device <number|name|id>            Target specific browser on-demand
   -v, --verbose                            Show real-time execution steps and logs
   -j, --json                               Output result as JSON
   -h, --help                               Show help
 
+\x1b[1mExamples:\x1b[0m
+  kroki devices
+  kroki devices 1
+  kroki devices 1, 2
+  kroki devices all
+  kroki "open apple.com"
+  kroki "check orders" -d 2
+  kroki run "Order Ali"
+  kroki "open google.com" --all
+
 \x1b[1mDashboard:\x1b[0m
   https://kroki.ai/#/devices
 `);
@@ -521,13 +1608,24 @@ function helpCommand() {
 const rawArgs = process.argv.slice(2);
 let verbose = false;
 let json = false;
+let targetDevice = process.env.KROKI_DEVICE || null;
+let runOnAll = false;
 const filteredArgs = [];
 
-for (const arg of rawArgs) {
+for (let i = 0; i < rawArgs.length; i++) {
+  const arg = rawArgs[i];
   if (arg === '--verbose' || arg === '-v') {
     verbose = true;
   } else if (arg === '--json' || arg === '-j') {
     json = true;
+  } else if (arg === '--all' || arg === '-a') {
+    runOnAll = true;
+  } else if (arg === '-d' || arg === '--device') {
+    targetDevice = rawArgs[++i] || null;
+  } else if (arg.startsWith('--device=')) {
+    targetDevice = arg.slice(9);
+  } else if (arg.startsWith('-d=')) {
+    targetDevice = arg.slice(3);
   } else {
     filteredArgs.push(arg);
   }
@@ -536,6 +1634,25 @@ for (const arg of rawArgs) {
 const first = filteredArgs[0] || 'help';
 
 switch (first) {
+  case 'login':
+  case 'auth':
+    loginCommand(filteredArgs[1]).catch(e => {
+      console.error(`\x1b[31mError:\x1b[0m ${e.message}`);
+      process.exit(1);
+    });
+    break;
+
+  case 'device':
+  case 'devices':
+  case 'use':
+  case 'select':
+  case 'default':
+    devicesCommand({ json, all: runOnAll, target: targetDevice, args: filteredArgs.slice(1) }).catch(e => {
+      console.error(`\x1b[31mError:\x1b[0m ${e.message}`);
+      process.exit(1);
+    });
+    break;
+
   case 'pair':
   case 'connect':
     pairCommand(filteredArgs[1]).catch(e => {
@@ -550,16 +1667,25 @@ switch (first) {
 
   case 'run':
   case 'workflow':
-    workflowCommand(filteredArgs[1], filteredArgs[2], { verbose, json }).catch(e => {
+    workflowCommand(filteredArgs[1], filteredArgs[2], { verbose, json, device: targetDevice }).catch(e => {
+      console.error(`\x1b[31mError:\x1b[0m ${e.message}`);
+      process.exit(1);
+    });
+    break;
+
+  case 'list':
+  case 'workflows':
+    workflowsCommand({ json, device: targetDevice }).catch(e => {
       console.error(`\x1b[31mError:\x1b[0m ${e.message}`);
       process.exit(1);
     });
     break;
 
   case 'clear':
+  case 'logout':
   case 'disconnect':
-    clearActiveSession();
-    console.log('\x1b[32m✔ Session cleared.\x1b[0m');
+    clearAllSessions();
+    console.log('\x1b[32m✔ Logged out and sessions cleared.\x1b[0m');
     break;
 
   case 'help':
@@ -574,7 +1700,7 @@ switch (first) {
       helpCommand();
       break;
     }
-    taskCommand(taskText, { verbose, json }).catch(e => {
+    taskCommand(taskText, { verbose, json, device: targetDevice, all: runOnAll }).catch(e => {
       console.error(`\x1b[31mError:\x1b[0m ${e.message}`);
       process.exit(1);
     });