neoagent 2.4.1-beta.8 → 2.4.1

package/lib/manager.js

@@ -6,6 +6,7 @@ const crypto = require('crypto');
 const readline = require('readline');
 const { spawn, spawnSync } = require('child_process');
 const { CLAUDE_CODE_SCOPES } = require('../server/services/ai/providers/claudeCode');
+const { GROK_OAUTH_SCOPES, GROK_OAUTH_CLIENT_ID } = require('../server/services/ai/providers/grokOauth');
 const {
   buildBundledWebClientIfPossible: buildWebClient,
   commandExists: sharedCommandExists,
@@ -61,29 +62,86 @@ const COLORS = process.stdout.isTTY
       green: '\x1b[1;32m',
       yellow: '\x1b[1;33m',
       blue: '\x1b[1;34m',
+      magenta: '\x1b[1;35m',
       cyan: '\x1b[1;36m',
       dim: '\x1b[2m'
     }
-  : { reset: '', bold: '', red: '', green: '', yellow: '', blue: '', cyan: '', dim: '' };
+  : { reset: '', bold: '', red: '', green: '', yellow: '', blue: '', magenta: '', cyan: '', dim: '' };
+
+const CLI_INTERACTIVE = process.stdout.isTTY;
+const installActionItems = [];
 
 function logInfo(msg) {
-  console.log(`  ${COLORS.blue}->${COLORS.reset} ${msg}`);
+  const mark = CLI_INTERACTIVE ? `${COLORS.blue}◇${COLORS.reset}` : '->';
+  console.log(`  ${mark} ${msg}`);
 }
 
 function logOk(msg) {
-  console.log(`  ${COLORS.green}ok${COLORS.reset} ${msg}`);
+  const mark = CLI_INTERACTIVE ? `${COLORS.green}◆${COLORS.reset}` : 'ok';
+  console.log(`  ${mark} ${msg}`);
 }
 
 function logWarn(msg) {
-  console.warn(`  ${COLORS.yellow}warn${COLORS.reset} ${msg}`);
+  const mark = CLI_INTERACTIVE ? `${COLORS.yellow}▲${COLORS.reset}` : 'warn';
+  console.warn(`  ${mark} ${msg}`);
 }
 
 function logErr(msg) {
-  console.error(`  ${COLORS.red}err${COLORS.reset} ${msg}`);
+  const mark = CLI_INTERACTIVE ? `${COLORS.red}✕${COLORS.reset}` : 'err';
+  console.error(`  ${mark} ${msg}`);
 }
 
 function heading(text) {
-  console.log(`\n${COLORS.bold}${text}${COLORS.reset}`);
+  if (!CLI_INTERACTIVE) {
+    console.log(`\n${text}`);
+    return;
+  }
+  console.log(`\n${COLORS.bold}${COLORS.cyan}${text}${COLORS.reset}`);
+}
+
+function cliBanner(title = APP_NAME, subtitle = 'local agent control') {
+  if (!CLI_INTERACTIVE) return;
+  const c = COLORS;
+  const width = 38;
+  const stripAnsi = (text) => String(text).replace(/\x1b\[[0-9;]*m/g, '');
+  const boxLine = (content) => {
+    const padding = Math.max(0, width - stripAnsi(content).length);
+    console.log(`  ${c.cyan}│${c.reset} ${content}${' '.repeat(padding)} ${c.cyan}│${c.reset}`);
+  };
+  console.log('');
+  console.log(`  ${c.cyan}╭────────────────────────────────────────╮${c.reset}`);
+  boxLine(`${c.bold}${c.magenta}NeoAgent${c.reset} ${c.dim}arcade ops console${c.reset}`);
+  boxLine(`${c.bold}${title}${c.reset} ${c.dim}${subtitle}${c.reset}`);
+  console.log(`  ${c.cyan}╰────────────────────────────────────────╯${c.reset}`);
+}
+
+function cliSection(text) {
+  if (CLI_INTERACTIVE) {
+    console.log(`${COLORS.dim}  ──${COLORS.reset} ${COLORS.bold}${text}${COLORS.reset}`);
+  } else {
+    console.log(text);
+  }
+}
+
+function statusLine(ok, label, value, hint = '') {
+  const mark = ok ? (CLI_INTERACTIVE ? `${COLORS.green}●${COLORS.reset}` : 'ok') : (CLI_INTERACTIVE ? `${COLORS.yellow}●${COLORS.reset}` : 'warn');
+  const padded = String(label).padEnd(9);
+  const suffix = hint ? ` ${COLORS.dim}${hint}${COLORS.reset}` : '';
+  console.log(`  ${mark} ${padded} ${value}${suffix}`);
+}
+
+function rememberInstallAction(message) {
+  if (!installActionItems.includes(message)) {
+    installActionItems.push(message);
+  }
+}
+
+function printInstallActionItems() {
+  if (installActionItems.length === 0) return;
+  heading('Post-install actions');
+  for (const item of installActionItems) {
+    logWarn(item);
+  }
 }
 
 function detectPlatform() {
@@ -164,6 +222,14 @@ function removeEnvValue(key) {
   return true;
 }
 
+function readAdminCredentials() {
+  const env = Object.fromEntries(parseEnv(readEnvFileRaw()).entries());
+  return {
+    username: env.ADMIN_USERNAME || 'admin',
+    password: env.ADMIN_PASSWORD || '(not set — run `neoagent setup`)',
+  };
+}
+
 function maskEnvValue(key, value) {
   if (!/(KEY|TOKEN|SECRET|PASSWORD)/i.test(key)) return value;
   const text = String(value || '');
@@ -476,6 +542,43 @@ async function askSecret(question, currentValue = '') {
   });
 }
 
+function defaultEnvLines(current = {}) {
+  const defaultVmBaseImageUrl = getDefaultVmBaseImageUrl();
+  const port = current.PORT || '3333';
+  const publicUrl = current.PUBLIC_URL || '';
+  const secureCookies = current.SECURE_COOKIES ||
+    (String(publicUrl || '').trim().startsWith('https://') ? 'true' : 'false');
+  const trustProxy = current.TRUST_PROXY || secureCookies;
+  return [
+    'NODE_ENV=production',
+    `PORT=${port}`,
+    publicUrl ? `PUBLIC_URL=${publicUrl}` : '',
+    `SECURE_COOKIES=${String(secureCookies || '').trim().toLowerCase() === 'true' ? 'true' : 'false'}`,
+    `TRUST_PROXY=${String(trustProxy || '').trim().toLowerCase() === 'true' ? 'true' : 'false'}`,
+    `SESSION_SECRET=${current.SESSION_SECRET || randomSecret()}`,
+    `NEOAGENT_PROFILE=${current.NEOAGENT_PROFILE || 'prod'}`,
+    `NEOAGENT_DEPLOYMENT_MODE=${parseDeploymentMode(current.NEOAGENT_DEPLOYMENT_MODE || 'self_hosted')}`,
+    `NEOAGENT_RELEASE_CHANNEL=${parseReleaseChannel(current.NEOAGENT_RELEASE_CHANNEL || 'stable') || 'stable'}`,
+    `NEOAGENT_VM_BASE_IMAGE_URL=${current.NEOAGENT_VM_BASE_IMAGE_URL || defaultVmBaseImageUrl}`,
+    `NEOAGENT_VM_MEMORY_MB=${current.NEOAGENT_VM_MEMORY_MB || '4096'}`,
+    `NEOAGENT_VM_CPUS=${current.NEOAGENT_VM_CPUS || '2'}`,
+    `NEOAGENT_VM_GUEST_TOKEN=${current.NEOAGENT_VM_GUEST_TOKEN || randomSecret()}`,
+    current.XAI_BASE_URL ? `XAI_BASE_URL=${current.XAI_BASE_URL}` : 'XAI_BASE_URL=https://api.x.ai/v1',
+    current.OLLAMA_URL ? `OLLAMA_URL=${current.OLLAMA_URL}` : 'OLLAMA_URL=http://localhost:11434',
+    current.DEEPGRAM_BASE_URL ? `DEEPGRAM_BASE_URL=${current.DEEPGRAM_BASE_URL}` : 'DEEPGRAM_BASE_URL=https://api.deepgram.com',
+    current.DEEPGRAM_MODEL ? `DEEPGRAM_MODEL=${current.DEEPGRAM_MODEL}` : 'DEEPGRAM_MODEL=nova-3',
+    current.DEEPGRAM_LANGUAGE ? `DEEPGRAM_LANGUAGE=${current.DEEPGRAM_LANGUAGE}` : 'DEEPGRAM_LANGUAGE=multi',
+  ].filter(Boolean);
+}
+
+function writeDefaultEnvFile() {
+  ensureRuntimeDirs();
+  const current = Object.fromEntries(parseEnv(readEnvFileRaw()).entries());
+  fs.writeFileSync(ENV_FILE, `${defaultEnvLines(current).join('\n')}\n`, { mode: 0o600 });
+  logOk(`Wrote default config to ${ENV_FILE}`);
+  rememberInstallAction('Add provider keys with `neoagent setup`, `neoagent env set KEY VALUE`, or the login commands when you are ready.');
+}
+
 async function cmdSetup() {
   heading('Environment Setup');
   ensureRuntimeDirs();
@@ -673,6 +776,11 @@ async function cmdSetup() {
     origins ? `ALLOWED_ORIGINS=${origins}` : ''
   ].filter(Boolean);
 
+  const adminUsername = current.ADMIN_USERNAME || 'admin';
+  const adminPassword = current.ADMIN_PASSWORD || crypto.randomBytes(16).toString('hex');
+  lines.push(`ADMIN_USERNAME=${adminUsername}`);
+  lines.push(`ADMIN_PASSWORD=${adminPassword}`);
+
   fs.writeFileSync(ENV_FILE, `${lines.join('\n')}\n`, { mode: 0o600 });
   logOk(`Wrote ${ENV_FILE}`);
 }
@@ -945,10 +1053,135 @@ async function cmdLoginClaudeCode() {
   cmdRestart();
 }
 
+async function cmdLoginGrokOAuth() {
+  heading('Grok (xAI OAuth) Login');
+
+  const http = require('http');
+  const { URL: NodeURL } = require('url');
+
+  const clientId = GROK_OAUTH_CLIENT_ID;
+  const SCOPES = GROK_OAUTH_SCOPES;
+  const redirectPort = 56121;
+  const redirectUri = `http://127.0.0.1:${redirectPort}/callback`;
+
+  const codeVerifier = crypto.randomBytes(48).toString('base64url');
+  const codeChallenge = crypto
+    .createHash('sha256')
+    .update(codeVerifier)
+    .digest('base64url');
+  const state = crypto.randomBytes(16).toString('hex');
+
+  const authUrl = new URL('https://auth.x.ai/oauth2/authorize');
+  authUrl.searchParams.set('response_type', 'code');
+  authUrl.searchParams.set('client_id', clientId);
+  authUrl.searchParams.set('redirect_uri', redirectUri);
+  authUrl.searchParams.set('scope', SCOPES);
+  authUrl.searchParams.set('code_challenge', codeChallenge);
+  authUrl.searchParams.set('code_challenge_method', 'S256');
+  authUrl.searchParams.set('state', state);
+
+  console.log(`\n  ${COLORS.cyan}Opening browser for Grok (xAI) authorization...${COLORS.reset}`);
+  console.log(`  ${COLORS.dim}If the browser doesn't open, visit:${COLORS.reset}`);
+  console.log(`  ${authUrl.toString()}\n`);
+
+  const openCmd = process.platform === 'darwin' ? 'open'
+    : process.platform === 'win32' ? 'start'
+    : 'xdg-open';
+  spawnSync(openCmd, [authUrl.toString()], { stdio: 'ignore' });
+
+  const authCode = await new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      server.close();
+      reject(new Error('Grok OAuth authorization timed out after 5 minutes.'));
+    }, 5 * 60 * 1000);
+
+    const server = http.createServer((req, res) => {
+      try {
+        const reqUrl = new NodeURL(req.url, redirectUri);
+        const code = reqUrl.searchParams.get('code');
+        const returnedState = reqUrl.searchParams.get('state');
+        const error = reqUrl.searchParams.get('error');
+
+        if (error) {
+          res.writeHead(200, { 'Content-Type': 'text/html' });
+          res.end('<html><body><h2>Authorization failed.</h2><p>You can close this tab.</p></body></html>');
+          clearTimeout(timeout);
+          server.close();
+          reject(new Error(`OAuth error: ${error}`));
+          return;
+        }
+
+        if (returnedState && returnedState !== state) {
+          res.writeHead(200, { 'Content-Type': 'text/html' });
+          res.end('<html><body><h2>Authorization failed.</h2><p>State mismatch. You can close this tab.</p></body></html>');
+          clearTimeout(timeout);
+          server.close();
+          reject(new Error('OAuth state mismatch — possible CSRF attempt.'));
+          return;
+        }
+
+        if (code) {
+          res.writeHead(200, { 'Content-Type': 'text/html' });
+          res.end('<html><body><h2>Authorization successful!</h2><p>You can close this tab and return to the terminal.</p></body></html>');
+          clearTimeout(timeout);
+          server.close();
+          resolve(code);
+        }
+      } catch (err) {
+        res.writeHead(500);
+        res.end('Internal error');
+      }
+    });
+
+    server.listen(redirectPort, '127.0.0.1', () => {
+      logInfo(`Waiting for OAuth callback on ${redirectUri} ...`);
+    });
+    server.on('error', (err) => {
+      clearTimeout(timeout);
+      reject(new Error(`Could not start OAuth callback server on port ${redirectPort}: ${err.message}`));
+    });
+  });
+
+  logInfo('Exchanging authorization code for access token...');
+  const tokenRes = await fetch('https://auth.x.ai/oauth2/token', {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded',
+      'Accept': 'application/json',
+    },
+    body: new URLSearchParams({
+      grant_type: 'authorization_code',
+      code: authCode,
+      redirect_uri: redirectUri,
+      client_id: clientId,
+      code_verifier: codeVerifier,
+    }),
+  });
+
+  if (!tokenRes.ok) {
+    const text = await tokenRes.text().catch(() => 'Unknown error');
+    throw new Error(`Token exchange failed: HTTP ${tokenRes.status} — ${text}`);
+  }
+
+  const tokenData = await tokenRes.json();
+  const accessToken = tokenData.access_token;
+  if (!accessToken) {
+    throw new Error('Token exchange succeeded but no access_token was returned.');
+  }
+
+  upsertEnvValue('GROK_OAUTH_ACCESS_TOKEN', accessToken);
+  if (tokenData.refresh_token) {
+    upsertEnvValue('GROK_OAUTH_REFRESH_TOKEN', tokenData.refresh_token);
+  }
+  logOk('Saved Grok OAuth tokens to .env');
+  logInfo('Restarting NeoAgent to apply credentials...');
+  cmdRestart();
+}
+
 async function cmdLogin(args = []) {
   const provider = args[0];
-  if (provider !== 'github-copilot' && provider !== 'openai-codex' && provider !== 'claude-code') {
-    throw new Error(`Unsupported login provider: ${provider || 'none'}. Available: github-copilot, openai-codex, claude-code`);
+  if (provider !== 'github-copilot' && provider !== 'openai-codex' && provider !== 'claude-code' && provider !== 'grok-oauth') {
+    throw new Error(`Unsupported login provider: ${provider || 'none'}. Available: github-copilot, openai-codex, claude-code, grok-oauth`);
   }
 
   if (provider === 'github-copilot') {
@@ -1054,6 +1287,8 @@ async function cmdLogin(args = []) {
     cmdRestart();
   } else if (provider === 'claude-code') {
     await cmdLoginClaudeCode();
+  } else if (provider === 'grok-oauth') {
+    await cmdLoginGrokOAuth();
   }
 }
 
@@ -1065,6 +1300,50 @@ function installDependencies() {
   logOk('Dependencies installed');
 }
 
+function assertSupportedNodeRuntime() {
+  const major = Number(String(process.versions.node || '').split('.')[0]);
+  if (!Number.isInteger(major) || major < 20) {
+    throw new Error(`NeoAgent requires Node.js 20 or newer. Current runtime is ${process.versions.node || 'unknown'}.`);
+  }
+  logOk(`Node.js ${process.versions.node}`);
+}
+
+function installPreflight() {
+  heading('Installer preflight');
+  ensureRuntimeDirs();
+  assertSupportedNodeRuntime();
+
+  if (!commandExists('npm')) {
+    throw new Error('npm was not found in PATH. Install Node.js 20+ with npm, then run `neoagent install` again.');
+  }
+  const npmVersion = runQuiet('npm', ['--version']);
+  logOk(`npm ${npmVersion.status === 0 ? npmVersion.stdout.trim() : '(version unknown)'}`);
+
+  const platform = detectPlatform();
+  if (platform === 'other') {
+    rememberInstallAction('Automatic service installation is available on macOS and Linux. This machine will use a detached process fallback.');
+  } else {
+    logOk(`platform ${platform}`);
+  }
+
+  if (platform === 'macos' && !commandExists('launchctl')) {
+    rememberInstallAction('launchctl was not found, so the installer will use a detached process fallback instead of a login service.');
+  }
+  if (platform === 'linux' && !commandExists('systemctl')) {
+    rememberInstallAction('systemctl was not found, so the installer will use a detached process fallback instead of a user service.');
+  }
+
+  const port = loadEnvPort();
+  const portOwner = commandExists('lsof')
+    ? runQuiet('lsof', ['-nP', '-iTCP:' + port, '-sTCP:LISTEN'])
+    : null;
+  if (portOwner && portOwner.status === 0 && portOwner.stdout.trim()) {
+    logInfo(`Port ${port} already has a listener; install will keep existing processes unless service start replaces them.`);
+  } else {
+    logOk(`port ${port} available`);
+  }
+}
+
 function buildBundledWebClientIfPossible({ required = false } = {}) {
   heading('Web Client');
   return buildWebClient({
@@ -1153,7 +1432,7 @@ function startFallback() {
   logOk(`Started detached process (pid ${child.pid})`);
 }
 
-async function ensureQemuInstalled() {
+async function ensureQemuInstalled({ required = false } = {}) {
   heading('Ensure QEMU Installed');
   const platform = detectPlatform();
   
@@ -1167,35 +1446,54 @@ async function ensureQemuInstalled() {
 
   logInfo('QEMU components not found. Attempting to install...');
 
-  if (platform === 'macos') {
-    if (!commandExists('brew')) {
-      throw new Error('Homebrew is required to install QEMU on macOS. Please install it first: https://brew.sh/');
-    }
-    logInfo('Running "brew install qemu"...');
-    runOrThrow('brew', ['install', 'qemu']);
-  } else if (platform === 'linux') {
-    const isArm = process.arch === 'arm64' || process.arch === 'aarch64';
-    if (commandExists('apt-get')) {
-      const pkgs = ['qemu-utils'];
-      if (isArm) {
-        pkgs.push('qemu-system-arm');
+  try {
+    if (platform === 'macos') {
+      if (!commandExists('brew')) {
+        const message = 'Homebrew is required for automatic QEMU install on macOS. Install Homebrew from https://brew.sh/ and run `neoagent install` again.';
+        if (required) throw new Error(message);
+        logWarn('Homebrew not found; VM features will stay unavailable until QEMU is installed.');
+        rememberInstallAction(message);
+        return false;
+      }
+      logInfo('Running "brew install qemu"...');
+      runOrThrow('brew', ['install', 'qemu']);
+    } else if (platform === 'linux') {
+      const isArm = process.arch === 'arm64' || process.arch === 'aarch64';
+      if (commandExists('apt-get')) {
+        const pkgs = ['qemu-utils'];
+        if (isArm) {
+          pkgs.push('qemu-system-arm');
+        } else {
+          pkgs.push('qemu-system-x86');
+        }
+        logInfo(`Running "sudo apt-get update && sudo apt-get install -y ${pkgs.join(' ')}"...`);
+        runOrThrow('sudo', ['apt-get', 'update']);
+        runOrThrow('sudo', ['apt-get', 'install', '-y', ...pkgs]);
+      } else if (commandExists('dnf')) {
+        logInfo('Running "sudo dnf install -y qemu-kvm qemu-img"...');
+        runOrThrow('sudo', ['dnf', 'install', '-y', 'qemu-kvm', 'qemu-img']);
+      } else if (commandExists('yum')) {
+        logInfo('Running "sudo yum install -y qemu-kvm qemu-img"...');
+        runOrThrow('sudo', ['yum', 'install', '-y', 'qemu-kvm', 'qemu-img']);
       } else {
-        pkgs.push('qemu-system-x86');
+        const message = 'Unsupported Linux package manager for automatic QEMU install. Install qemu-system and qemu-utils, then run `neoagent install` again.';
+        if (required) throw new Error(message);
+        logWarn('Could not find apt-get, dnf, or yum for QEMU installation.');
+        rememberInstallAction(message);
+        return false;
       }
-      logInfo(`Running "sudo apt-get update && sudo apt-get install -y ${pkgs.join(' ')}"...`);
-      runOrThrow('sudo', ['apt-get', 'update']);
-      runOrThrow('sudo', ['apt-get', 'install', '-y', ...pkgs]);
-    } else if (commandExists('dnf')) {
-      logInfo('Running "sudo dnf install -y qemu-kvm qemu-img"...');
-      runOrThrow('sudo', ['dnf', 'install', '-y', 'qemu-kvm', 'qemu-img']);
-    } else if (commandExists('yum')) {
-      logInfo('Running "sudo yum install -y qemu-kvm qemu-img"...');
-      runOrThrow('sudo', ['yum', 'install', '-y', 'qemu-kvm', 'qemu-img']);
     } else {
-      throw new Error('Unsupported Linux distribution. Please install qemu-system and qemu-utils manually.');
+      const message = 'Unsupported platform for automatic QEMU installation. Install QEMU manually if you need VM-isolated runtime features.';
+      if (required) throw new Error(message);
+      logWarn('Skipping QEMU auto-install on this platform.');
+      rememberInstallAction(message);
+      return false;
     }
-  } else {
-    throw new Error('Unsupported platform for automatic QEMU installation. Please install QEMU manually.');
+  } catch (err) {
+    if (required) throw err;
+    logWarn(`QEMU install did not complete: ${err.message}`);
+    rememberInstallAction('Install QEMU manually or rerun `neoagent install` after your package manager is ready.');
+    return false;
   }
 
   const verifiedSystem = commandExists('qemu-system-x86_64') || commandExists('qemu-system-aarch64');
@@ -1203,8 +1501,13 @@ async function ensureQemuInstalled() {
 
   if (verifiedSystem && verifiedImg) {
     logOk('QEMU installed successfully');
+    return true;
   } else {
-    throw new Error('QEMU installation failed or components not found in PATH after install.');
+    const message = 'QEMU installation finished but required binaries were not found in PATH.';
+    if (required) throw new Error(message);
+    logWarn(message);
+    rememberInstallAction('Ensure qemu-system and qemu-img are available in PATH, then run `neoagent install` again.');
+    return false;
   }
 }
 
@@ -1213,7 +1516,7 @@ function ensureYtDlpInstalled() {
   if (commandExists('yt-dlp')) {
     const ver = runQuiet('yt-dlp', ['--version']);
     logOk(`yt-dlp ${ver.status === 0 ? ver.stdout.trim() : '(version unknown)'}`);
-    return;
+    return true;
   }
 
   logInfo('yt-dlp not found. Attempting to install...');
@@ -1221,16 +1524,19 @@ function ensureYtDlpInstalled() {
 
   if (platform === 'macos') {
     if (!commandExists('brew')) {
-      logWarn('Homebrew not found — skipping yt-dlp install. Install manually: brew install yt-dlp');
-      return;
+      logWarn('Homebrew not found; skipping yt-dlp auto-install.');
+      rememberInstallAction('Install yt-dlp with `brew install yt-dlp` if you need video/audio extraction.');
+      return false;
     }
     try {
       runOrThrow('brew', ['install', 'yt-dlp']);
       logOk('yt-dlp installed via Homebrew');
+      return true;
     } catch {
-      logWarn('yt-dlp install failed. Install manually: brew install yt-dlp');
+      logWarn('yt-dlp install failed.');
+      rememberInstallAction('Install yt-dlp with `brew install yt-dlp` if you need video/audio extraction.');
+      return false;
     }
-    return;
   }
 
   if (platform === 'linux') {
@@ -1238,7 +1544,7 @@ function ensureYtDlpInstalled() {
       try {
         runOrThrow('pipx', ['install', 'yt-dlp']);
         logOk('yt-dlp installed via pipx');
-        return;
+        return true;
       } catch {
         // fall through to pip3
       }
@@ -1247,24 +1553,39 @@ function ensureYtDlpInstalled() {
       try {
         runOrThrow('pip3', ['install', '--user', 'yt-dlp']);
         logOk('yt-dlp installed via pip3');
-        return;
+        return true;
       } catch {
         // fall through to warn
       }
     }
-    logWarn('Could not install yt-dlp automatically. Install manually: pipx install yt-dlp');
+    logWarn('Could not install yt-dlp automatically.');
+    rememberInstallAction('Install yt-dlp with `pipx install yt-dlp` or your OS package manager if you need video/audio extraction.');
+    return false;
   }
+  rememberInstallAction('Install yt-dlp manually if you need video/audio extraction.');
+  return false;
 }
 
 async function cmdInstall() {
+  installActionItems.length = 0;
+  cliBanner(`Install ${APP_NAME}`, 'guided bootstrap');
   heading(`Install ${APP_NAME}`);
+  installPreflight();
+
   if (!fs.existsSync(ENV_FILE)) {
-    logWarn('.env not found; starting setup');
-    await cmdSetup();
+    if (process.stdin.isTTY) {
+      logWarn('.env not found; starting guided setup');
+      await cmdSetup();
+    } else {
+      logWarn('.env not found and stdin is not interactive; writing a secure default config');
+      writeDefaultEnvFile();
+    }
+  } else {
+    logOk(`Using config ${ENV_FILE}`);
   }
 
   installDependencies();
-  await ensureQemuInstalled();
+  await ensureQemuInstalled({ required: false });
   ensureYtDlpInstalled();
   buildBundledWebClientIfPossible({ required: true });
 
@@ -1279,19 +1600,31 @@ async function cmdInstall() {
 
   const port = loadEnvPort();
   logOk(`Running on http://localhost:${port}`);
+  printInstallActionItems();
+  heading('Ready');
+  logInfo(`Open http://localhost:${port} or run \`neoagent status\` for a health check.`);
+  const adminCreds = readAdminCredentials();
+  heading('Admin Dashboard');
+  logOk(`URL:      http://localhost:${port}/admin`);
+  logInfo(`Username: ${adminCreds.username}`);
+  logInfo(`Password: ${adminCreds.password}`);
+  logWarn('Save these credentials — stored in .env and shown again with `neoagent admin`');
 }
 
 function cmdStart() {
+  cliBanner(`Start ${APP_NAME}`, 'boot sequence');
   heading(`Start ${APP_NAME}`);
   const platform = detectPlatform();
 
   if (platform === 'macos' && fs.existsSync(PLIST_DST)) {
+    logInfo('Handing launch to launchd');
     installMacService();
     logOk('launchd start requested');
     return;
   }
 
   if (platform === 'linux' && fs.existsSync(SYSTEMD_UNIT)) {
+    logInfo('Handing launch to systemd');
     runOrThrow('systemctl', ['--user', 'start', 'neoagent']);
     runOrThrow('systemctl', ['--user', 'is-active', '--quiet', 'neoagent']);
     logOk('systemd start requested');
@@ -1384,54 +1717,68 @@ function cmdUninstall() {
 }
 
 async function cmdStatus() {
+  cliBanner(`${APP_NAME} Status`, 'systems sweep');
   heading(`${APP_NAME} Status`);
   const port = loadEnvPort();
   const running = await isPortOpen(port);
   const releaseChannel = currentReleaseChannel();
   const platform = detectPlatform();
 
-  if (running) {
-    logOk(`server   http://localhost:${port}`);
-  } else {
-    logWarn(`server   not reachable on port ${port}`);
-  }
+  cliSection('Runtime');
+  statusLine(
+    running,
+    'server',
+    running ? `http://localhost:${port}` : `not reachable on port ${port}`,
+  );
 
   if (platform === 'macos' && fs.existsSync(PLIST_DST)) {
     const svcRes = runQuiet('launchctl', ['list', SERVICE_LABEL]);
-    if (svcRes.status === 0 && svcRes.stdout.trim()) {
-      logOk(`service  launchd (${SERVICE_LABEL})`);
-    } else {
-      logWarn(`service  launchd unit not loaded — run: neoagent install`);
-    }
+    statusLine(
+      svcRes.status === 0 && Boolean(svcRes.stdout.trim()),
+      'service',
+      svcRes.status === 0 && svcRes.stdout.trim()
+        ? `launchd (${SERVICE_LABEL})`
+        : 'launchd unit not loaded',
+      svcRes.status === 0 && svcRes.stdout.trim() ? '' : 'run: neoagent install',
+    );
   } else if (platform === 'linux' && fs.existsSync(SYSTEMD_UNIT)) {
     const svcRes = runQuiet('systemctl', ['--user', 'is-active', 'neoagent']);
-    if (svcRes.status === 0 && svcRes.stdout.trim() === 'active') {
-      logOk('service  systemd (neoagent)');
-    } else {
-      logWarn('service  systemd unit not active — run: neoagent install');
-    }
+    statusLine(
+      svcRes.status === 0 && svcRes.stdout.trim() === 'active',
+      'service',
+      svcRes.status === 0 && svcRes.stdout.trim() === 'active'
+        ? 'systemd (neoagent)'
+        : 'systemd unit not active',
+      svcRes.status === 0 && svcRes.stdout.trim() === 'active' ? '' : 'run: neoagent install',
+    );
   }
 
-  if (fs.existsSync(ENV_FILE)) {
-    logOk(`config   ${ENV_FILE}`);
-  } else {
-    logWarn(`config   .env not found — run: neoagent setup`);
-  }
+  cliSection('Assets');
+  statusLine(
+    fs.existsSync(ENV_FILE),
+    'config',
+    fs.existsSync(ENV_FILE) ? ENV_FILE : '.env not found',
+    fs.existsSync(ENV_FILE) ? '' : 'run: neoagent setup',
+  );
 
-  if (hasBundledWebClient(WEB_CLIENT_DIR)) {
-    logOk('web      bundled Flutter client present');
-  } else {
-    logWarn('web      no bundled client — run: neoagent rebuild-web');
-  }
+  statusLine(
+    hasBundledWebClient(WEB_CLIENT_DIR),
+    'web',
+    hasBundledWebClient(WEB_CLIENT_DIR)
+      ? 'bundled Flutter client present'
+      : 'no bundled client',
+    hasBundledWebClient(WEB_CLIENT_DIR) ? '' : 'run: neoagent rebuild-web',
+  );
 
   console.log('');
-  console.log(`  install  ${APP_DIR}`);
-  console.log(`  version  ${currentInstalledVersionLabel()}`);
-  console.log(`  channel  ${releaseChannelSummary(releaseChannel)}`);
+  cliSection('Build');
+  console.log(`  install   ${APP_DIR}`);
+  console.log(`  version   ${currentInstalledVersionLabel()}`);
+  console.log(`  channel   ${releaseChannelSummary(releaseChannel)}`);
 
   const processes = listNeoAgentServerProcesses();
   if (processes.length > 0) {
-    console.log(`  pids     ${processes.map((proc) => proc.pid).join(', ')}`);
+    console.log(`  pids      ${processes.map((proc) => proc.pid).join(', ')}`);
     if (processes.length > 1) {
       logWarn(`multiple NeoAgent processes detected (${processes.length})`);
     }
@@ -1601,14 +1948,15 @@ function printHelp() {
 
   function row(cmd, desc) {
     const padded = `  neoagent ${cmd}`.padEnd(W);
-    console.log(`${padded}${c.dim}${desc}${c.reset}`);
+    const arrow = CLI_INTERACTIVE ? `${c.cyan}›${c.reset} ` : '';
+    console.log(`${padded}${arrow}${c.dim}${desc}${c.reset}`);
   }
 
-  console.log(`\n${c.bold}neoagent${c.reset}  —  manage your NeoAgent server\n`);
-  console.log(`${c.bold}Usage${c.reset}  neoagent <command> [args]\n`);
+  cliBanner('neoagent', 'command deck');
+  console.log(`\n${c.bold}Usage${c.reset}  neoagent <command> [args]\n`);
 
-  console.log(`${c.bold}Lifecycle${c.reset}`);
-  row('install',              'First-time install and service setup');
+  cliSection('Lifecycle');
+  row('install',              'Guided bootstrap, dependencies, config, service');
   row('start',               'Start the server');
   row('stop',                'Stop the server');
   row('restart',             'Stop, then start');
@@ -1617,7 +1965,7 @@ function printHelp() {
   row('uninstall',           'Remove the system service');
   console.log('');
 
-  console.log(`${c.bold}Configuration${c.reset}`);
+  cliSection('Configuration');
   row('setup',               'Interactive configuration wizard');
   row('env list',            'List all variables (secrets masked)');
   row('env get KEY',         'Print a single variable');
@@ -1627,15 +1975,20 @@ function printHelp() {
   row('channel stable|beta', 'Switch release channel');
   console.log('');
 
-  console.log(`${c.bold}Updates & Auth${c.reset}`);
+  cliSection('Updates & Auth');
   row('update',              'Update to latest on current channel');
   row('update stable|beta',  'Update and switch channel');
   row('login github-copilot','Authenticate GitHub Copilot');
   row('login openai-codex',  'Authenticate OpenAI Codex');
   row('login claude-code',   'Authenticate Claude Code');
+  row('login grok-oauth',    'Authenticate Grok (xAI OAuth)');
+  console.log('');
+
+  cliSection('Admin');
+  row('admin',               'Show admin dashboard URL and credentials');
   console.log('');
 
-  console.log(`${c.bold}Maintenance${c.reset}`);
+  cliSection('Maintenance');
   row('migrate',             'Migrate from another agent installation');
   row('migrate dry-run',     'Preview what would be migrated');
   row('rebuild-web',         'Rebuild the bundled Flutter web client');
@@ -1691,6 +2044,15 @@ async function runCLI(argv) {
     case 'login':
       await cmdLogin(argv.slice(1));
       break;
+    case 'admin': {
+      cliBanner('Admin Dashboard', 'credentials');
+      const adminCreds = readAdminCredentials();
+      const port = loadEnvPort();
+      logOk(`URL:      http://localhost:${port}/admin`);
+      logInfo(`Username: ${adminCreds.username}`);
+      logInfo(`Password: ${adminCreds.password}`);
+      break;
+    }
     case 'version':
     case '--version':
     case '-V':