Sign in to CopilotKit first, and say why before macOS asks for a password to install Podman

CHANGELOG.md

@@ -10,6 +10,16 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
 
 ### OpenBot Desktop
 
+- **Sign-in comes first, and macOS asks for your password only after OpenBot says why.** On a new
+  Mac the Account step waited for Install to put Podman in before any browser sign-in opened, and
+  the "osascript wants to make changes" password box came up by itself over it. The CopilotKit
+  sign-in now opens in your browser as soon as the Account step opens: the CLI's sign-in needs no
+  engine, and only the license agreement waits for one. Podman downloads meanwhile. Once you're
+  signed in, the step says "OpenBot installs Podman, which runs OpenBot's back end on this
+  computer. macOS asks for your password once to install it." and the password box comes up only
+  when you choose Continue. It now says "OpenBot needs your password to install Podman, which runs
+  OpenBot's back end." Closing it without a password offers Continue again instead of stopping
+  Install. Windows and Linux install as before.
 - **A back end update that was stopped partway no longer breaks every later Start.** Quitting
   while the back end updated could leave it half updated, and every Start after that failed with
   "Local update-quiesce failed (exit 1)". OpenBot now lets an update finish once it has begun
@@ -20,11 +30,12 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
   fails. A failed update says the step it stopped at, and that your data is kept.
 - **The Account step says when it is waiting for Install to set up the engine.** On a new Mac it
   said "Checking your CopilotKit account…" for minutes while Install put Podman in, because the
-  sign-in check needs a running engine. It now says "OpenBot is setting up the software it runs on.
-  Your CopilotKit sign-in comes next.", with what Install is doing ("Installing Podman.",
-  "Preparing the engine machine.", "Starting the engine machine."). The desktop log says each change
-  once as `[account]`: what the CLI's preflight answered, the install step, how long the wait took
-  and what the sign-in check answered, and how long the browser sign-in took.
+  license agreement check needs a running engine. It now says "You're signed in. OpenBot is setting
+  up the software it runs on. The license agreement comes next.", with what Install is doing
+  ("Downloading Podman.", "Preparing the engine machine.", "Starting the engine machine."). The
+  desktop log says each change once as `[account]`: what the CLI's preflight answered, the install
+  step, how long the wait took and what the sign-in check answered, and how long the browser
+  sign-in took.
 - **Connecting an app from OpenBot Desktop brings you back to OpenBot Desktop.** The app's sign-in
   opens in your browser, and when it finished, the browser showed OpenBot in a new tab while the
   window behind it still had the app as not connected. The browser now shows a short "Back to

desktop/src-tauri/src/engine.rs

@@ -44,10 +44,14 @@ use serde::{Deserialize, Serialize};
 /// the system's password prompt for Podman's installer. Those windows come to the front over
 /// OpenBot's. The setup window then says the line on whichever screen the person is on, and OpenBot
 /// comes back to the front once that window is done with.
+///
+/// `asks` when the step waits for the person's go-ahead in OpenBot's own window before it raises
+/// such a prompt (`install::GoAhead`). The window explains what comes next, with one button.
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct StepLine {
     pub said: String,
     pub elsewhere: bool,
+    pub asks: bool,
 }
 
 impl StepLine {
@@ -56,6 +60,7 @@ impl StepLine {
         Self {
             said: said.into(),
             elsewhere: false,
+            asks: false,
         }
     }
 
@@ -64,6 +69,16 @@ impl StepLine {
         Self {
             said: said.into(),
             elsewhere: true,
+            asks: false,
+        }
+    }
+
+    /// A line about a step that waits for the person's go-ahead in OpenBot's window.
+    pub fn asks(said: impl Into<String>) -> Self {
+        Self {
+            said: said.into(),
+            elsewhere: false,
+            asks: true,
         }
     }
 }