maqcli 0.8.0 → 0.9.1

package/dist/core/launcher.d.ts

@@ -67,6 +67,16 @@ export interface OnboardingResult {
  * knowledge files, so it is directly testable.
  */
 export declare function applyOnboarding(choices: OnboardingChoices): OnboardingResult;
+/** Render a 9-digit key large and spaced, boxed for terminal visibility (spec: "large terminal display"). */
+export declare function renderKeyBox(key: string): string;
+/**
+ * Dependency-free arrow-key-navigable menu (spec Phase 1: "arrow-key
+ * navigable, styled selection highlight" — no inquirer/blessed). Renders each
+ * option, redraws the highlighted one on ↑/↓, and resolves its index on
+ * Enter. Falls back to nothing here — callers that need non-TTY behavior
+ * should check `process.stdin.isTTY` first, same as the rest of the launcher.
+ */
+export declare function renderMenu(options: string[], selected: number): string;
 /**
  * Run the guided launcher. Returns 0 on success. In a non-interactive context
  * (piped stdin), it prints guidance and returns without blocking.

package/dist/core/launcher.js

@@ -163,6 +163,68 @@ export function applyOnboarding(choices) {
     return { config: cfg, knowledgePath, headroom, authKey: generateAuthKey() };
 }
 /* ----------------------------- interactive ----------------------------- */
+/** Render a 9-digit key large and spaced, boxed for terminal visibility (spec: "large terminal display"). */
+export function renderKeyBox(key) {
+    const spaced = key.split("").join(" ");
+    const width = spaced.length + 4;
+    const bar = "─".repeat(width);
+    return [`┌${bar}┐`, `│  ${spaced}  │`, `└${bar}┘`].join("\n");
+}
+/**
+ * Dependency-free arrow-key-navigable menu (spec Phase 1: "arrow-key
+ * navigable, styled selection highlight" — no inquirer/blessed). Renders each
+ * option, redraws the highlighted one on ↑/↓, and resolves its index on
+ * Enter. Falls back to nothing here — callers that need non-TTY behavior
+ * should check `process.stdin.isTTY` first, same as the rest of the launcher.
+ */
+export function renderMenu(options, selected) {
+    return options
+        .map((opt, i) => (i === selected ? `  \x1b[38;5;196m❱ ${opt}\x1b[0m` : `    ${opt}`))
+        .join("\n");
+}
+async function arrowMenu(options) {
+    let selected = 0;
+    const render = () => {
+        process.stdout.write(renderMenu(options, selected) + "\n");
+    };
+    render();
+    return new Promise((resolve) => {
+        const stdin = process.stdin;
+        const wasRaw = stdin.isRaw;
+        stdin.setRawMode?.(true);
+        stdin.resume();
+        stdin.setEncoding("utf8");
+        const redraw = () => {
+            process.stdout.write(`\x1b[${options.length}A`); // move cursor back up
+            render();
+        };
+        const onData = (chunk) => {
+            if (chunk === "\u0003") {
+                // Ctrl-C
+                cleanup();
+                process.exit(130);
+            }
+            if (chunk === "\r" || chunk === "\n") {
+                cleanup();
+                resolve(selected);
+                return;
+            }
+            if (chunk === "\u001b[A" || chunk === "k") {
+                selected = (selected - 1 + options.length) % options.length;
+                redraw();
+            }
+            else if (chunk === "\u001b[B" || chunk === "j") {
+                selected = (selected + 1) % options.length;
+                redraw();
+            }
+        };
+        const cleanup = () => {
+            stdin.off("data", onData);
+            stdin.setRawMode?.(Boolean(wasRaw));
+        };
+        stdin.on("data", onData);
+    });
+}
 function ask(rl, q) {
     return new Promise((resolve) => rl.question(q, (a) => resolve(a.trim())));
 }
@@ -191,14 +253,22 @@ export async function runLauncher(cwd) {
     }
 }
 async function drive(rl, cwd) {
-    line("How do you want to start?");
-    line("  [1] Connect to Mobile   — pair your phone as a control surface");
-    line("  [2] AI Mode             — set up the intelligence layer");
-    line("  [0] Exit to command help");
-    const path = (await ask(rl, "\n> ")) || "2";
-    if (path === "0")
+    line("How do you want to start?  (↑/↓ then Enter, or type a number)");
+    const options = ["Connect to Mobile   — pair your phone as a control surface", "AI Mode             — set up the intelligence layer", "Exit to command help"];
+    let idx;
+    if (typeof process.stdin.setRawMode === "function") {
+        idx = await arrowMenu(options);
+    }
+    else {
+        line("  [1] " + options[0]);
+        line("  [2] " + options[1]);
+        line("  [0] " + options[2]);
+        const path = (await ask(rl, "\n> ")) || "2";
+        idx = path === "0" ? 2 : path === "1" ? 0 : 1;
+    }
+    if (idx === 2)
         return 1;
-    if (path === "1")
+    if (idx === 0)
         return await connectMobile(rl);
     return await aiMode(rl, cwd);
 }
@@ -256,8 +326,10 @@ async function aiMode(rl, cwd) {
     line(`  Headroom model : ${result.headroom?.model ?? "heuristic-local"} (${headroomAuto ? "auto" : "manual"})`);
     line(`  Permissions    : ${permissionMode}`);
     line(`  Knowledge doc  : ${result.knowledgePath}`);
-    line(`  Auth key       : ${result.authKey}`);
     line("─────────────────────────────────────────────");
+    line("");
+    line(renderKeyBox(result.authKey));
+    line("  ↑ session auth key — auto-passed to the browser, or type it if asked");
     const open = (await ask(rl, "\nLaunch the browser UI now? [Y/n] ")).toLowerCase();
     if (open === "" || open === "y" || open === "yes") {
         return await launchUi(result.authKey);
@@ -343,7 +415,8 @@ async function connectMobile(rl) {
     line("  1. On this machine, MAQ will run its daemon (loopback + a tunnel/tailnet for remote).");
     line("  2. In the MAQ phone app, pair using the details below.");
     line("");
-    line(`  Auth key (pairing PIN): ${authKey}`);
+    line(renderKeyBox(authKey));
+    line("  ↑ pairing PIN — copy this into the app");
     line("");
     line("Starting the daemon now with:  maq serve");
     line("  (the app pairs with host/port + the token the daemon prints)");
@@ -353,11 +426,14 @@ async function connectMobile(rl) {
 async function launchUi(authKey) {
     // Reuse the daemon; open its landing page. Import lazily to avoid a cycle.
     const { createDaemon } = await import("../server/daemon.js");
-    const daemon = createDaemon({ token: authKey, version: "0.8.0" });
+    const daemon = createDaemon({ token: authKey, version: "0.9.1" });
     try {
         const { host, port } = await daemon.listen();
-        const url = `http://${host}:${port}/`;
-        line(`\nmaq daemon listening on ${url}`);
+        // Seamless handoff (spec Phase 3): the key rides in the URL so the
+        // browser UI never has to prompt for it. The page reads ?key= once and
+        // keeps it in sessionStorage only — it is not persisted or logged again.
+        const url = `http://${host}:${port}/?key=${authKey}`;
+        line(`\nmaq daemon listening on http://${host}:${port}`);
         line(`auth key/token: ${authKey}`);
         openBrowser(url);
         line("Opened your browser. Press Ctrl-C here to stop the daemon.");

package/dist/index.js

@@ -46,7 +46,7 @@ import { runOrchestration } from "./core/orchestrator.js";
 import { performUpdate, installedGlobalVersion } from "./core/update.js";
 import { checkProtectedPath, scanForInjection, securityLog, securityRules, } from "./core/security.js";
 import { readFileSync, statSync } from "node:fs";
-const VERSION = "0.8.0";
+const VERSION = "0.9.1";
 async function main(argv) {
     const [command, ...rest] = argv;
     switch (command) {

package/dist/server/daemon.js

@@ -52,7 +52,7 @@ export function createDaemon(opts = {}) {
     const host = opts.host ?? process.env.MAQ_HOST ?? "127.0.0.1";
     const port = opts.port ?? Number(process.env.MAQ_PORT ?? 7717);
     const token = opts.token ?? process.env.MAQ_TOKEN ?? generateToken();
-    const version = opts.version ?? "0.8.0";
+    const version = opts.version ?? "0.9.1";
     const corsOrigin = opts.corsOrigin ?? process.env.MAQ_CORS_ORIGIN;
     const registry = opts.registry ?? new SessionRegistry();
     const interactive = new InteractiveRegistry();

package/dist/server/webui.d.ts

@@ -1,26 +1,28 @@
 /**
- * webui.ts — the self-contained control surface the daemon serves at `/app`
- * (and `/`). Zero build step, zero dependencies: one HTML document with
- * inline CSS + vanilla JS. It renders the SAME normalized event stream the
+ * webui.ts — the self-contained "Megalodon" control surface the daemon serves
+ * at `/app` (and `/`). Zero build step, zero dependencies: one HTML document
+ * with inline CSS + vanilla JS. It renders the SAME normalized event stream the
  * mobile app consumes, so there is no second source of truth.
  *
- * Design system: dark OLED canvas, two elevation surfaces, one signal accent
- * (teal — "alive/running", not the generic AI purple/blue gradient). Type:
- * Space Grotesk for the brand mark + section labels (used sparingly), Inter
- * for UI/body, JetBrains Mono for the console/data surfaces. Signature
- * element: a live depth-of-work TIMELINE — phases render as connected nodes
- * that fill in as work progresses, with orchestration rounds (parallel/loop/
- * safe) nesting as a sub-rail beneath the active phase — replacing static
- * chips with something that actually shows depth of work over time.
+ * This is a from-spec rebuild (maq_cli_ui_spec Phases 4-6). The recommended
+ * SPA stack (React + Monaco + Framer + react-resizable-panels) is deliberately
+ * NOT used: the daemon ships one static asset with no build pipeline, so the
+ * same UX is delivered dependency-free —
+ *   - real drag-resizable 3-panel shell (custom pointer-drag splitters)
+ *   - universal preview: JSON tree / code+line-numbers / markdown / sandboxed
+ *     HTML / images (replaces Monaco + react-markdown + react-json-view)
+ *   - send button with a toggle-up mode picker popover (Single/Parallel/Loop/
+ *     Safe), mode icon on the button face, selection persisted
+ *   - orchestration visualizations derived from the event stream (parallel
+ *     round dashboard / loop progress / safe split→merge→validate rail)
+ *   - custom animated cursor follower + micro-interactions (CSS, not Framer)
  *
- * Layout: a named-grid-area app shell. Sidebar collapses to a drawer under
- * 900px; the preview panel becomes a full-screen sheet under 1200px; the
- * composer sticks to the bottom on narrow viewports. Motion is 150/220ms
- * ease-out and fully disabled under prefers-reduced-motion.
+ * Theme (Megalodon): deep matte black base, controlled blue-white accents (not
+ * neon), sparse red for status/danger, white primary text, no gradients except
+ * intentional depth cues. Everything references CSS custom-property tokens.
  *
  * Auth: the daemon requires a Bearer token for /v1/*. The page reads it from
- * ?token=… or a prompt, keeps it in memory only, and streams SSE via fetch +
- * ReadableStream (so the token rides in the Authorization header, never the
- * URL).
+ * ?key= / ?token= or a prompt, keeps it in memory only, and streams SSE via
+ * fetch + ReadableStream (token in the Authorization header, never the URL).
  */
 export declare function webuiHtml(version: string): string;