totemlayer 0.1.20 → 0.1.24

package/bin/device-login.mjs

@@ -2,10 +2,11 @@ import { hostname } from "node:os";
 import { join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { privateRead, privateWrite } from "./runtime-installation.mjs";
+import { privateRead, privateWrite, privateDirectory } from "./runtime-installation.mjs";
+import { mkdir, rm, rename } from "node:fs/promises";
 import { detectInstalledProvider, providerArguments } from "./provider-detection.mjs";
 
-function origin(value) {
+export function origin(value) {
   const url = new URL(value ?? "https://totemlayer.com");
   if (
     url.username ||
@@ -43,6 +44,7 @@ export async function beginDeviceLogin(runtime, env = process.env, options = {})
     pending.baseUrl !== baseUrl ||
     pending.requestedAgentId !== env.TOTEM_AGENT_ID ||
     pending.provider !== (env.TOTEM_PROVIDER ?? "auto") ||
+    pending.redirectUri !== options.binding?.redirectUri ||
     new Date(pending.expiresAt) <= new Date()
   ) {
     const result = await request(
@@ -55,6 +57,12 @@ export async function beginDeviceLogin(runtime, env = process.env, options = {})
           deviceName: hostname().slice(0, 100),
           provider: env.TOTEM_PROVIDER ?? "auto",
           ...(env.TOTEM_AGENT_ID ? { agentId: env.TOTEM_AGENT_ID } : {}),
+          ...(options.binding
+            ? {
+                bindingChallenge: options.binding.challenge,
+                redirectUri: options.binding.redirectUri,
+              }
+            : {}),
         }),
       },
       options.fetch,
@@ -71,6 +79,10 @@ export async function beginDeviceLogin(runtime, env = process.env, options = {})
       baseUrl,
       requestedAgentId: env.TOTEM_AGENT_ID,
       provider: env.TOTEM_PROVIDER ?? "auto",
+      replace: Boolean(options.replace),
+      ...(options.binding
+        ? { redirectUri: options.binding.redirectUri, verifier: options.binding.verifier }
+        : {}),
     };
     await privateWrite(join(runtime.directory, "connection-request.json"), pending);
   }
@@ -86,10 +98,45 @@ export async function beginDeviceLogin(runtime, env = process.env, options = {})
       () => {},
     );
   }
-  return { url, code: pending.code, expiresAt: pending.expiresAt };
+  return { id: pending.id, url, code: pending.code, expiresAt: pending.expiresAt };
 }
 
 export async function resumeDeviceLogin(runtime, env = process.env, options = {}) {
+  await privateDirectory(runtime.directory);
+  const lock = join(runtime.directory, "login.lock");
+  try {
+    await mkdir(lock, { mode: 0o700 });
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const owner = await privateRead(join(lock, "owner.json")).catch(() => null);
+    if (owner && Number.isSafeInteger(owner.pid) && owner.pid > 0) {
+      try {
+        process.kill(owner.pid, 0);
+      } catch (failure) {
+        if (failure.code === "ESRCH") await rm(lock, { recursive: true });
+      }
+    }
+    return { state: "setup_in_progress" };
+  }
+  try {
+    await privateWrite(join(lock, "owner.json"), { pid: process.pid });
+    if (options.reset) {
+      for (const name of ["connection-ready.json", "connection-request.json"])
+        await rename(
+          join(runtime.directory, name),
+          join(runtime.directory, `${name}.reauthorize-${Date.now()}`),
+        ).catch((error) => {
+          if (error.code !== "ENOENT") throw error;
+        });
+      return { state: "reset" };
+    }
+    return await resumeLoginLocked(runtime, env, options);
+  } finally {
+    await rm(lock, { recursive: true });
+  }
+}
+
+async function resumeLoginLocked(runtime, env, options) {
   let staged;
   try {
     staged = await privateRead(join(runtime.directory, "connection-ready.json"));
@@ -111,6 +158,8 @@ export async function resumeDeviceLogin(runtime, env = process.env, options = {}
       { headers: { "x-totem-installation-token": pending.token } },
       options.fetch,
     );
+    if (result.status === "expired")
+      throw new Error("This installer authorization expired. Run totem login again.");
     if (result.status !== "approved") return;
     if (
       !/^[a-f0-9-]{36}$/.test(result.agentId) ||
@@ -122,6 +171,8 @@ export async function resumeDeviceLogin(runtime, env = process.env, options = {}
       key: result.key,
       baseUrl: pending.baseUrl,
       requestId: pending.id,
+      installationId: pending.id,
+      replace: Boolean(pending.replace),
       token: pending.token,
     };
     // Persist privately before acknowledging, so an interrupted setup never loses the key.
@@ -140,8 +191,36 @@ export async function resumeDeviceLogin(runtime, env = process.env, options = {}
     delete staged.token;
     await privateWrite(join(runtime.directory, "connection-ready.json"), staged);
   }
-  const provider = await (options.detectProvider ?? detectInstalledProvider)(env);
-  if (!provider) return { state: "executor_needed" };
+  const reportFailure = async (errorCode) => {
+    const pending = await privateRead(join(runtime.directory, "connection-request.json")).catch(
+      () => null,
+    );
+    if (pending && pending.id === staged.installationId)
+      await request(
+        origin(pending.baseUrl),
+        `/api/installations/${pending.id}/runtime`,
+        {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "x-totem-installation-token": pending.token,
+          },
+          body: JSON.stringify({ errorCode }),
+        },
+        options.fetch,
+      ).catch(() => {});
+  };
+  let provider;
+  try {
+    provider = await (options.detectProvider ?? detectInstalledProvider)(env);
+  } catch (error) {
+    await reportFailure("UNSUPPORTED_ADAPTER");
+    throw error;
+  }
+  if (!provider) {
+    await reportFailure("PROVIDER_AUTH_REQUIRED");
+    return { state: "executor_needed" };
+  }
   const { agentSetupMain } = await import("./agent-setup.mjs");
   const status = await (options.setup ?? agentSetupMain)(
     [
@@ -152,6 +231,7 @@ export async function resumeDeviceLogin(runtime, env = process.env, options = {}
       origin(staged.baseUrl),
       ...(await providerArguments(provider, env)),
       "--no-start",
+      ...(options.replace || staged.replace ? ["--replace"] : []),
       "--json",
     ],
     {
@@ -160,9 +240,21 @@ export async function resumeDeviceLogin(runtime, env = process.env, options = {}
       stderr: { write() {} },
     },
   );
-  if (status) throw new Error("The approved connection could not be saved.");
-  const { rm } = await import("node:fs/promises");
+  if (status) {
+    await reportFailure("LISTENER_START_FAILED");
+    throw new Error("The approved connection could not be saved.");
+  }
+  await privateWrite(join(runtime.directory, "connection-last.json"), {
+    requestId: staged.installationId,
+    profile: staged.agentId,
+  });
   await rm(join(runtime.directory, "connection-ready.json"));
-  await rm(join(runtime.directory, "connection-request.json"), { force: true });
+  const current = await privateRead(join(runtime.directory, "connection-request.json")).catch(
+    (error) => {
+      if (error.code !== "ENOENT") throw error;
+    },
+  );
+  if (current?.id === staged.installationId)
+    await rm(join(runtime.directory, "connection-request.json"), { force: true });
   return { state: "connected", profile: staged.agentId };
 }

package/bin/executor-readiness.mjs

@@ -1,9 +1,68 @@
 import { join } from "node:path";
 import { readFile } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { promisify, stripVTControlCharacters } from "node:util";
 import { modelReply } from "./network-runtime.mjs";
+import { installedClientInvocation, localClientEnvironment } from "./platform-client.mjs";
 import { privateRead, privateWrite } from "./runtime-installation.mjs";
 import { runtimeErrorCode } from "./runtime-diagnostics.mjs";
 
+const execute = promisify(execFile);
+export const CODEX_QUEUE_UNAVAILABLE_MESSAGE =
+  "This Codex CLI cannot queue messages to the selected chat. Update Codex, then check status again.";
+
+function queueUnavailable() {
+  return Object.assign(new Error(CODEX_QUEUE_UNAVAILABLE_MESSAGE), {
+    code: "AGENT_CLI_INCOMPATIBLE",
+  });
+}
+
+export async function checkCodexQueueSupport(environment = process.env, options = {}) {
+  const env = Object.fromEntries(
+    Object.entries(localClientEnvironment(environment)).filter(
+      ([name]) =>
+        ![
+          "TOTEM_NETWORK_API_KEY_FILE",
+          "TOTEM_BASE_URL",
+          "OPENAI_API_KEY",
+          "ANTHROPIC_API_KEY",
+          "CLAUDE_CODE_OAUTH_TOKEN",
+        ].includes(name.toUpperCase()),
+    ),
+  );
+  const args = ["queue", "--help"];
+  try {
+    const invocation =
+      process.platform === "win32"
+        ? installedClientInvocation("codex", args, env)
+        : { command: "codex", args };
+    let result;
+    if (options.runClient) result = await options.runClient("codex", args, env);
+    else {
+      const pending = execute(invocation.command, invocation.args, {
+        env,
+        timeout: 5000,
+        maxBuffer: 64 * 1024,
+        encoding: "utf8",
+        ...(options.signal ? { signal: options.signal } : {}),
+      });
+      // The Windows fallback reads stdin to EOF before invoking the client.
+      pending.child?.stdin?.end();
+      result = await pending;
+    }
+    const help = stripVTControlCharacters(`${result?.stdout ?? ""}\n${result?.stderr ?? ""}`);
+    if (
+      !/\bcodex\s+queue\b/i.test(help) ||
+      !help.includes("--thread") ||
+      !help.includes("--message")
+    )
+      throw queueUnavailable();
+    return true;
+  } catch {
+    throw queueUnavailable();
+  }
+}
+
 export async function verifyExecutorReady(profile, env = process.env, options = {}) {
   const version =
     options.version ??
@@ -20,33 +79,51 @@ export async function verifyExecutorReady(profile, env = process.env, options =
     profile.qwenUrl,
     profile.ollamaUrl,
     profile.nimUrl,
+    profile.codexThreadId,
   ]);
   const previous = await privateRead(file).catch((error) => {
     if (error.code !== "ENOENT") throw error;
     return null;
   });
-  if (previous?.version === version && previous.binding === binding && previous.ready === true)
+  if (
+    !profile.codexThreadId &&
+    previous?.version === version &&
+    previous.binding === binding &&
+    previous.ready === true
+  )
     return previous;
   let response;
   try {
-    response = await (options.generate ?? modelReply)({
-      provider: profile.client ?? profile.provider,
-      model: profile.client && profile.provider === "qwen-local" ? "default" : profile.model,
-      origin: profile.ollamaUrl ?? "http://127.0.0.1:11434",
-      qwenUrl: profile.qwenUrl,
-      nimUrl: profile.nimUrl,
-      adapterSettings: { ...profile, environment: env },
-      messages: [
-        {
-          role: "user",
-          content:
-            "This is a connection readiness check. Reply READY. No tools, file reads or external actions are authorized.",
-        },
-      ],
-      tools: [],
-      signal: options.signal ?? new AbortController().signal,
-      timeoutMs: 30000,
-    });
+    if (profile.codexThreadId) {
+      try {
+        if (
+          (await (options.checkQueue ?? checkCodexQueueSupport)(env, {
+            signal: options.signal,
+          })) === false
+        )
+          throw queueUnavailable();
+      } catch {
+        throw queueUnavailable();
+      }
+    } else
+      response = await (options.generate ?? modelReply)({
+        provider: profile.client ?? profile.provider,
+        model: profile.client && profile.provider === "qwen-local" ? "default" : profile.model,
+        origin: profile.ollamaUrl ?? "http://127.0.0.1:11434",
+        qwenUrl: profile.qwenUrl,
+        nimUrl: profile.nimUrl,
+        adapterSettings: { ...profile, environment: env },
+        messages: [
+          {
+            role: "user",
+            content:
+              "This is a connection readiness check. Reply READY. No tools, file reads or external actions are authorized.",
+          },
+        ],
+        tools: [],
+        signal: options.signal ?? new AbortController().signal,
+        timeoutMs: 30000,
+      });
   } catch (error) {
     await privateWrite(file, {
       version,
@@ -57,7 +134,7 @@ export async function verifyExecutorReady(profile, env = process.env, options =
     });
     throw error;
   }
-  if (typeof response?.content !== "string" || !response.content.trim())
+  if (!profile.codexThreadId && (typeof response?.content !== "string" || !response.content.trim()))
     throw Object.assign(new Error("The selected executor did not complete its readiness check."), {
       code: "INVALID_AGENT_RESULT",
     });

package/bin/installation.mjs

@@ -5,6 +5,11 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { ensureInstalledRuntime, installRuntimeService } from "./runtime-installation.mjs";
 import { beginDeviceLogin } from "./device-login.mjs";
+import { resumeDeviceLogin } from "./device-login.mjs";
+import { beginBoundLogin } from "./bound-login.mjs";
+import { readAgentProfile } from "./agent-profile.mjs";
+import { readAgentRuntimeStatus } from "./agent-runner.mjs";
+import { setTimeout as sleep } from "node:timers/promises";
 import { detectInstalledProvider, providerArguments } from "./provider-detection.mjs";
 
 export async function activateConnection(profile, env = process.env, options = {}) {
@@ -19,7 +24,7 @@ export async function activateConnection(profile, env = process.env, options = {
   if (!enabled) return { state: "paused", ...service, entry: runtime.cli };
   const { verifyExecutorReady } = await import("./executor-readiness.mjs");
   try {
-    await (options.verifyExecutor ?? verifyExecutorReady)(profile, env);
+    if (profile.codexThreadId) await (options.verifyExecutor ?? verifyExecutorReady)(profile, env);
   } catch (error) {
     return {
       state: "needs_attention",
@@ -31,42 +36,18 @@ export async function activateConnection(profile, env = process.env, options = {
     };
   }
   const { agentStartMain } = await import("./agent-runner.mjs");
-  const started = await (options.start ?? agentStartMain)(
+  const result = await (options.start ?? agentStartMain)(
     ["--profile", profile.profileName, "--background", "--json"],
     { env, automatic: true, stdout: { write() {} } },
   );
-  if (started !== 0)
-    return {
-      state: "needs_attention",
-      ...service,
-      entry: runtime.cli,
-      code: "WORKER_START_FAILED",
-    };
-  const { readAgentRuntimeStatus } = await import("./agent-runner.mjs");
-  const state = await (options.readStatus ?? readAgentRuntimeStatus)(profile);
-  if (
-    state.running &&
-    state.phase === "blocked" &&
-    ["INSPECTION_BLOCKED", "INSPECTION_LIMIT", "INSPECTION_UNSUPPORTED_FILE"].includes(state.blockerCode)
-  )
-    return {
-      state: "running",
-      ...service,
-      entry: runtime.cli,
-      phase: state.phase,
-      quarantinedMessage: true,
-      code: state.blockerCode,
-      message: "The listener is running. An unsafe message was quarantined; other messages can still be processed.",
-    };
-  if (!state.running || !["connected", "working", "waiting"].includes(state.phase))
-    return {
-      state: "needs_attention",
-      ...service,
-      entry: runtime.cli,
-      code: state.blockerCode ?? "WORKER_NOT_READY",
-      phase: state.phase,
-    };
-  return { state: "running", ...service, entry: runtime.cli };
+  if (result) throw new Error("The listener could not start. Check totem status for this profile.");
+  const status = await (options.readStatus ?? readAgentRuntimeStatus)(profile);
+  return {
+    state: status.ready ? "ready" : "needs_attention",
+    ready: Boolean(status.ready),
+    ...service,
+    entry: runtime.cli,
+  };
 }
 
 export async function installationMain(args = [], options = {}) {
@@ -80,13 +61,16 @@ export async function installationMain(args = [], options = {}) {
       "agent-id": { type: "string" },
       "base-url": { type: "string" },
       "no-browser": { type: "boolean" },
+      "device-login": { type: "boolean" },
+      reauthorize: { type: "boolean" },
+      "host-kind": { type: "string" },
       help: { type: "boolean", short: "h" },
       json: { type: "boolean" },
     },
   }).values;
   if (flags.help) {
     stdout.write(
-      "totem login [--provider codex|claude|qwen-local|ollama-local|nim-local|command|http] [--no-browser]\nConnect this installation once. Totem securely saves its connection and automatically runs and restarts the listener.\n",
+      "totem login [--provider codex|claude|qwen-local|ollama-local|nim-local|command|http] [--no-browser] [--device-login]\nAuthorize your agent in the initial browser flow. Totem saves the connection privately, starts its listener and tests a controlled reply. Use --device-login explicitly for headless hosts; that fallback requires code comparison.\n",
     );
     return 0;
   }
@@ -95,7 +79,15 @@ export async function installationMain(args = [], options = {}) {
     ...(flags.provider ? { TOTEM_PROVIDER: flags.provider } : {}),
     ...(flags["agent-id"] ? { TOTEM_AGENT_ID: flags["agent-id"] } : {}),
     ...(flags["base-url"] ? { TOTEM_BASE_URL: flags["base-url"] } : {}),
+    ...(flags["host-kind"] ? { TOTEM_RUNTIME_HOST_KIND: flags["host-kind"] } : {}),
   };
+  if (
+    environment.TOTEM_RUNTIME_HOST_KIND &&
+    !["local", "hosted"].includes(environment.TOTEM_RUNTIME_HOST_KIND)
+  )
+    throw new Error(
+      "Choose --host-kind local or hosted. Hosted mode labels an already provisioned, explicitly authorized host; it does not provision one.",
+    );
   const runtime = await (options.ensureRuntime ?? ensureInstalledRuntime)(environment);
   const service = await (options.installService ?? installRuntimeService)(runtime, environment);
   if (environment.TOTEM_NETWORK_API_KEY || environment.TOTEM_NETWORK_API_KEY_FILE) {
@@ -129,6 +121,7 @@ export async function installationMain(args = [], options = {}) {
       [
         "--profile",
         environment.TOTEM_AGENT_ID ?? "default",
+        ...(flags.reauthorize ? ["--replace"] : []),
         ...(environment.TOTEM_AGENT_ID ? ["--agent-id", environment.TOTEM_AGENT_ID] : []),
         ...(await providerArguments(provider, environment)),
         ...(flags.json ? ["--json"] : []),
@@ -140,61 +133,74 @@ export async function installationMain(args = [], options = {}) {
       },
     );
   }
-  try {
-    await privateRead(join(runtime.directory, "connection-ready.json"));
+  const activate = async (name) => {
+    const profile = await (options.readProfile ?? readAgentProfile)(name, { environment });
+    return (options.activateConnection ?? activateConnection)(profile, environment, options);
+  };
+  const reportActivation = (status) => {
     stdout.write(
-      "Your Totem connection is saved privately. Sign in to your AI client; the listener connects automatically.\n",
+      flags.json
+        ? JSON.stringify(status) + "\n"
+        : status.ready
+          ? "Ready. The listener passed its controlled receive, wake and reply check. This host must remain awake and online.\n"
+          : `Runtime ${status.state}. Run totem status for diagnostics; an installed or paused listener is not ready.\n`,
     );
-    return 0;
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
+    return status.ready ? 0 : 1;
+  };
+  const resume = options.resumeLogin ?? resumeDeviceLogin;
+  const loginOptions = { ...options, replace: Boolean(flags.reauthorize) };
+  if (flags.reauthorize) {
+    const reset = await resume(runtime, environment, { ...loginOptions, reset: true });
+    if (reset?.state !== "reset") {
+      stdout.write(
+        "Another installer is saving this connection. Wait for it to finish before reauthorizing.\n",
+      );
+      return 1;
+    }
+  }
+  const staged = flags.reauthorize
+    ? undefined
+    : await resume(runtime, environment, loginOptions).catch((error) => {
+        if (error.message?.includes("authorization expired")) return undefined;
+        throw error;
+      });
+  if (staged?.state === "connected") return reportActivation(await activate(staged.profile));
+  if (staged?.state === "executor_needed") {
+    stdout.write(
+      "Authorization is saved privately. Sign in to an installed Codex or Claude client, or configure a supported local/custom adapter, then retry totem login. The listener is not ready.\n",
+    );
+    return 1;
   }
   // An upgrade reuses private profiles and starts their existing connections.
   const { opendir } = await import("node:fs/promises");
-  let saved = false;
-  const savedProfiles = [];
+  const saved = [];
   try {
     const profiles = await opendir(join(runtime.root, "connections"));
     for await (const entry of profiles)
       if (
         entry.isDirectory() &&
         (!environment.TOTEM_AGENT_ID || entry.name === environment.TOTEM_AGENT_ID)
-      ) {
-        saved = true;
-        savedProfiles.push(entry.name);
-      }
+      )
+        saved.push(entry.name);
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
-  if (saved && options.forceLogin !== true) {
-    const { readAgentProfile } = await import("./agent-profile.mjs");
+  if (saved.length && options.forceLogin !== true && !flags.reauthorize) {
     const results = [];
-    for (const name of savedProfiles) {
-      const profile = await readAgentProfile(name, { environment });
-      results.push({
-        profile: name,
-        ...(await (options.activateConnection ?? activateConnection)(profile, environment)),
-      });
-    }
-    const ready = results.every((result) => ["running", "paused"].includes(result.state));
-    const report = {
+    for (const name of saved) results.push({ profile: name, ...(await activate(name)) });
+    return reportActivation({
       installed: true,
-      connection: "saved",
-      automatic: true,
-      ready,
+      ready: results.every((r) => r.ready),
+      state: results.every((r) => r.ready) ? "ready" : "needs_attention",
       profiles: results,
       service,
-    };
-    stdout.write(
-      flags.json
-        ? JSON.stringify(report) + "\n"
-        : ready
-          ? "Totem's automatic listener reuses your saved connections; startup checks passed.\n"
-          : "Totem is installed, but an agent failed its startup check. Run totem status to inspect it.\n",
-    );
-    return ready ? 0 : 1;
+    });
   }
-  const connection = await (options.beginLogin ?? beginDeviceLogin)(runtime, environment, {
+  const connection = await (
+    options.beginLogin ?? (flags["device-login"] ? beginDeviceLogin : beginBoundLogin)
+  )(runtime, environment, {
+    ...options,
+    replace: Boolean(flags.reauthorize),
     openBrowser: !flags["no-browser"] && environment.TOTEM_NO_BROWSER !== "1",
   });
   const report = {
@@ -202,14 +208,63 @@ export async function installationMain(args = [], options = {}) {
     connection: "sign_in_required",
     automatic: true,
     service,
-    ...connection,
+    url: connection.url,
+    ...(flags["device-login"] ? { code: connection.code } : {}),
+    ready: false,
   };
   stdout.write(
     flags.json
       ? JSON.stringify(report) + "\n"
-      : `Totem is installed. Connect your agent once at:\n${connection.url}\nConnection code: ${connection.code.match(/.{1,4}/g).join(" ")}\nThe listener starts automatically after you connect.\n`,
+      : `Authorize your agent in the installer browser:\n${connection.url}\n${flags["device-login"] ? `Compare this code before approving: ${connection.code.match(/.{1,4}/g).join(" ")}\n` : ""}Waiting for authorization and the controlled listener check.\n`,
   );
-  return 0;
+  try {
+    const deadline = Math.min(
+      Date.parse(connection.expiresAt),
+      Date.now() + (options.loginTimeoutMs ?? 600000),
+    );
+    while (Date.now() < deadline && !options.signal?.aborted) {
+      const result = await resume(runtime, environment, loginOptions);
+      if (result?.state === "connected") return reportActivation(await activate(result.profile));
+      const receipt = await privateRead(join(runtime.directory, "connection-last.json")).catch(
+        (error) => {
+          if (error.code !== "ENOENT") throw error;
+        },
+      );
+      if (receipt?.requestId === connection.id && receipt.profile)
+        return reportActivation(await activate(receipt.profile));
+      if (result?.state === "executor_needed") {
+        stdout.write(
+          "Authorization saved. Sign in to an installed AI client or configure a supported adapter, then run totem login again. Runtime is not ready.\n",
+        );
+        return 1;
+      }
+      // The supervisor may have saved the profile while this installer was polling.
+      const pending = await privateRead(join(runtime.directory, "connection-request.json")).catch(
+        (error) => {
+          if (error.code !== "ENOENT") throw error;
+        },
+      );
+      const name = environment.TOTEM_AGENT_ID ?? pending?.requestedAgentId;
+      if (name) {
+        const profile = await (options.readProfile ?? readAgentProfile)(name, {
+          environment,
+        }).catch((error) => {
+          if (error.code !== "AGENT_PROFILE_NOT_FOUND") throw error;
+        });
+        if (profile)
+          return reportActivation(
+            await (options.activateConnection ?? activateConnection)(profile, environment, options),
+          );
+      }
+      await (options.sleep ?? sleep)(3000, undefined, { signal: options.signal });
+    }
+    stdout.write(
+      "Setup is not ready yet. Run totem login again to resume securely; inspect totem status for any saved profile.\n",
+    );
+    return 1;
+  } finally {
+    connection.close?.();
+  }
 }
 export async function postinstallMain(env = process.env) {
   if (env.TOTEM_AUTO_START === "0" || env.CI) return 0;