@geraldmaron/construct 1.0.0 → 1.0.2

package/lib/setup.mjs

@@ -1,20 +1,35 @@
 #!/usr/bin/env node
 /**
- * lib/setup.mjs — <one-line purpose>
+ * lib/setup.mjs — Interactive first-run setup wizard for Construct.
  *
- * <2–6 line summary.>
+ * Guides users through provider selection, API key entry, and model tier
+ * assignment. Writes the resulting config to ~/.cx/env and optionally to
+ * project-level .env. Invoked by `construct setup` and on first init.
  */
 
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { spawnSync } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 
 import { ensureUserConfigDir, getUserEnvPath, writeEnvValues } from './env-config.mjs';
+import { DEFAULT_WORKSPACE_PATH, WORKSPACE_DOCS_LANES } from './embed/config.mjs';
+import {
+  DEFAULT_DEPLOYMENT_MODE,
+  DEPLOYMENT_MODE_ENV_KEY,
+  getDeploymentMode,
+} from './deployment-mode.mjs';
 import { getCanonicalOpenCodeConfigPath, readOpenCodeConfig, writeOpenCodeConfig } from './opencode-config.mjs';
 import { syncFileStateToSql } from './storage/sync.mjs';
 import { createSqlClient, closeSqlClient } from './storage/backend.mjs';
-import { EMBEDDING_MODEL } from './storage/embeddings.mjs';
+import { getEmbeddingModelInfo, warmupEmbeddingModel } from './storage/embeddings-engine.mjs';
+import { restoreConstructDb } from './storage/postgres-backup.mjs';
+import { buildPressureGuardValues, installPressureGuardLaunchAgent, loadPressureGuardLaunchAgent } from './runtime-pressure.mjs';
+import {
+  isRemoteTelemetry,
+  startManagedServices,
+} from './services/telemetry-backend.mjs';
+import { consentToInstall } from './setup-prompts.mjs';
 
 const ROOT_DIR = path.resolve(import.meta.dirname, '..');
 const HOME = os.homedir();
@@ -35,9 +50,11 @@ What it does:
   - ensures OpenCode config exists
   - configures managed defaults for local vector retrieval
   - starts local Postgres with Docker when available
-  - wires Memory, GitHub, and Langfuse configuration
-  - runs construct sync
+  - checks required runtime tools and installs cm and cass when available
+  - wires Memory, GitHub, and telemetry configuration
+  - runs construct sync (which also regenerates AUTO docs regions)
   - runs construct doctor
+  - detects the project tech stack and writes .cx/project-profile.json
 
 Use --yes to run without prompts and accept detected environment defaults.`);
 }
@@ -66,20 +83,32 @@ export function defaultVectorIndexPath(homeDir = HOME) {
   return path.join(homeDir, '.construct', 'vector', 'index.json');
 }
 
-export function buildManagedSetupValues({ homeDir = HOME, env = process.env, databaseUrl = '' } = {}) {
+export async function buildManagedSetupValues({ homeDir = HOME, env = process.env, databaseUrl = '' } = {}) {
+  const modelInfo = await getEmbeddingModelInfo({ env });
+
+  // Local telemetry backend
   const values = {
-    CONSTRUCT_TRACE_BACKEND: env.CONSTRUCT_TRACE_BACKEND || 'langfuse',
-    LANGFUSE_BASEURL: env.LANGFUSE_BASEURL || 'https://cloud.langfuse.com',
+    CONSTRUCT_TRACE_BACKEND: env.CONSTRUCT_TRACE_BACKEND || 'remote',
     CONSTRUCT_VECTOR_INDEX_PATH: env.CONSTRUCT_VECTOR_INDEX_PATH || defaultVectorIndexPath(homeDir),
-    CONSTRUCT_VECTOR_MODEL: env.CONSTRUCT_VECTOR_MODEL || EMBEDDING_MODEL,
+    CONSTRUCT_VECTOR_MODEL: env.CONSTRUCT_VECTOR_MODEL || modelInfo.model,
+    ...buildPressureGuardValues({ env }),
   };
+  // Deployment mode is persisted in construct.config.json — setup never writes
+  // CONSTRUCT_DEPLOYMENT_MODE to ~/.construct/config.env. The env var is
+  // reserved for ephemeral runtime overrides (CI/scripts via `export …`).
+  // Forwarding it here pinned the env value and silently masked any JSON
+  // setter that ran later.
+  if (env[DEPLOYMENT_MODE_ENV_KEY] && getDeploymentMode(env) !== DEFAULT_DEPLOYMENT_MODE) {
+    values[DEPLOYMENT_MODE_ENV_KEY] = getDeploymentMode(env);
+  }
+
+  if (env.CONSTRUCT_TELEMETRY_URL) values.CONSTRUCT_TELEMETRY_URL = env.CONSTRUCT_TELEMETRY_URL;
+  if (env.CONSTRUCT_TELEMETRY_PUBLIC_KEY) values.CONSTRUCT_TELEMETRY_PUBLIC_KEY = env.CONSTRUCT_TELEMETRY_PUBLIC_KEY;
+  if (env.CONSTRUCT_TELEMETRY_SECRET_KEY) values.CONSTRUCT_TELEMETRY_SECRET_KEY = env.CONSTRUCT_TELEMETRY_SECRET_KEY;
 
   const resolvedDatabaseUrl = databaseUrl || env.DATABASE_URL || '';
   if (resolvedDatabaseUrl) values.DATABASE_URL = resolvedDatabaseUrl;
   if (env.CONSTRUCT_VECTOR_URL) values.CONSTRUCT_VECTOR_URL = env.CONSTRUCT_VECTOR_URL;
-  if (env.LANGFUSE_PUBLIC_KEY) values.LANGFUSE_PUBLIC_KEY = env.LANGFUSE_PUBLIC_KEY;
-  if (env.LANGFUSE_SECRET_KEY) values.LANGFUSE_SECRET_KEY = env.LANGFUSE_SECRET_KEY;
-  if (env.LANGFUSE_PROJECT_ID) values.LANGFUSE_PROJECT_ID = env.LANGFUSE_PROJECT_ID;
   return values;
 }
 
@@ -92,7 +121,7 @@ export function writeLocalPostgresCompose(homeDir = HOME) {
   fs.mkdirSync(path.dirname(composePath), { recursive: true });
   const content = `services:
   postgres:
-    image: postgres:16-alpine
+    image: pgvector/pgvector:pg16
     container_name: construct-postgres
     restart: unless-stopped
     environment:
@@ -117,23 +146,198 @@ volumes:
 }
 
 function runQuiet(command, args, { env = process.env, spawn = spawnSync } = {}) {
-  return spawn(command, args, {
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'pipe'],
+  const result = spawn(command, args, {
     env,
+    stdio: 'ignore',
   });
+  return result;
+}
+
+async function runAsyncQuiet(command, args, { env = process.env, spawn = spawn } = {}) {
+  return new Promise((resolve) => {
+    const timeout = setTimeout(() => {
+      resolve({ status: -1, signal: 'SIGTERM' }); // treat timeout as error
+    }, 5000);
+    const child = spawn(command, args, {
+      env,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (data) => { stdout += data.toString(); });
+    child.stderr.on('data', (data) => { stderr += data.toString(); });
+    child.on('close', (code, signal) => {
+      clearTimeout(timeout);
+      resolve({ status: code || 0, signal, stdout, stderr });
+    });
+  });
+}
+
+export function commandExists(command, { env = process.env, spawn = spawnSync } = {}) {
+  const checker = process.platform === 'win32' ? 'where' : 'which';
+  return runQuiet(checker, [command], { env, spawn }).status === 0;
+}
+
+function summarizeSpawnFailure(result, fallback) {
+  return (result.stderr || result.stdout || fallback).trim().split('\n')[0];
+}
+
+export function ensureCmInstalled({ env = process.env, spawn = spawnSync } = {}) {
+  if (commandExists('cm', { env, spawn })) {
+    return { status: 'available', message: 'cm already installed.' };
+  }
+
+  if (commandExists('brew', { env, spawn })) {
+    const result = runQuiet('brew', ['install', 'dicklesworthstone/tap/cm'], { env, spawn });
+    if (result.status === 0 && commandExists('cm', { env, spawn })) {
+      return { status: 'installed', message: 'Installed cm via Homebrew.' };
+    }
+    return {
+      status: 'failed',
+      message: summarizeSpawnFailure(result, 'brew install failed'),
+      installCommand: 'brew install dicklesworthstone/tap/cm',
+    };
+  }
+
+  return {
+    status: 'missing',
+    message: 'Homebrew not available.',
+    installCommand: 'brew install dicklesworthstone/tap/cm',
+  };
+}
+
+// Version 0.3.0 has a known issue where the FTS-rebuild loop can OOM on large corpora and fail to converge.
+// Version 0.4.0 resolves this. Below this version, we fail closed to avoid the problem.
+const CASS_MIN_VERSION = '0.4.0';
+
+function parseSemver(s) {
+  const m = String(s || '').match(/(\d+)\.(\d+)\.(\d+)/);
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+
+function semverGte(a, b) {
+  const x = parseSemver(a);
+  const y = parseSemver(b);
+  if (!x || !y) return false;
+  for (let i = 0; i < 3; i++) {
+    if (x[i] > y[i]) return true;
+    if (x[i] < y[i]) return false;
+  }
+  return true;
+}
+
+function getCassVersion({ env, spawn }) {
+  const result = runQuiet('cass', ['--version'], { env, spawn });
+  if (result.status !== 0) return null;
+  const match = String(result.stdout || '').match(/cass\s+(\d+\.\d+\.\d+)/);
+  return match ? match[1] : null;
+}
+
+export function ensureCassInstalled({ env = process.env, spawn = spawnSync } = {}) {
+  if (commandExists('cass', { env, spawn })) {
+    const version = getCassVersion({ env, spawn });
+    if (version && semverGte(version, CASS_MIN_VERSION)) {
+      return { status: 'available', message: `cass ${version} already installed.` };
+    }
+    return {
+      status: 'outdated',
+      message: `cass ${version || 'unknown'} is older than required ${CASS_MIN_VERSION}. Older versions hit a frankensqlite FTS-rebuild OOM loop on large session corpora (upstream #168, #186, #110, #155).`,
+      installCommand: 'brew upgrade dicklesworthstone/tap/cass || brew install dicklesworthstone/tap/cass',
+    };
+  }
+
+  if (commandExists('brew', { env, spawn })) {
+    const result = runQuiet('brew', ['install', 'dicklesworthstone/tap/cass'], { env, spawn });
+    if (result.status === 0 && commandExists('cass', { env, spawn })) {
+      runQuiet('cass', ['index'], { env, spawn });
+      return { status: 'installed', message: 'Installed cass via Homebrew and ran cass index.' };
+    }
+    return {
+      status: 'failed',
+      message: summarizeSpawnFailure(result, 'brew install failed'),
+      installCommand: 'brew install dicklesworthstone/tap/cass && cass index',
+    };
+  }
+
+  if (commandExists('cargo', { env, spawn })) {
+    const result = runQuiet('cargo', ['install', 'cass'], { env, spawn });
+    if (result.status === 0 && commandExists('cass', { env, spawn })) {
+      runQuiet('cass', ['index'], { env, spawn });
+      return { status: 'installed', message: 'Installed cass via cargo and ran cass index.' };
+    }
+    return {
+      status: 'failed',
+      message: summarizeSpawnFailure(result, 'cargo install failed'),
+      installCommand: 'cargo install cass && cass index',
+    };
+  }
+
+  return {
+    status: 'missing',
+    message: 'Neither Homebrew nor cargo available.',
+    installCommand: 'brew install dicklesworthstone/tap/cass && cass index',
+  };
+}
+
+/**
+ * Platform-aware install hint shown when Docker isn't on PATH. Mirrors
+ * what `supabase start` / `prisma init` print: don't auto-install, but
+ * point at the canonical option for the user's OS so they have a one-line
+ * command to copy.
+ */
+export function dockerInstallHint(platform = process.platform) {
+  if (platform === 'darwin') {
+    return 'Install Docker Desktop (https://www.docker.com/products/docker-desktop) or a lighter alternative like OrbStack (`brew install orbstack`) or Colima (`brew install colima && colima start`).';
+  }
+  if (platform === 'win32') {
+    return 'Install Docker Desktop for Windows (https://www.docker.com/products/docker-desktop).';
+  }
+  return 'Install Docker Engine (https://docs.docker.com/engine/install/) — your distribution likely has a `docker` package (apt/dnf/pacman).';
 }
 
 export function detectDockerCompose({ env = process.env, spawn = spawnSync } = {}) {
-  const docker = runQuiet('docker', ['info'], { env, spawn });
-  if (docker.status !== 0) return null;
-  const compose = runQuiet('docker', ['compose', 'version'], { env, spawn });
-  if (compose.status === 0) return { command: 'docker', argsPrefix: ['compose'] };
-  const dockerCompose = runQuiet('docker-compose', ['version'], { env, spawn });
-  if (dockerCompose.status === 0) return { command: 'docker-compose', argsPrefix: [] };
+  // Use a timeout wrapper so we don't block forever if Docker daemon is hung/missing
+  const timeoutWrap = (fn) => {
+    let timedOut = false;
+    const timer = setTimeout(() => { timedOut = true; }, 5000);
+    try {
+      const result = fn();
+      clearTimeout(timer);
+      return timedOut ? null : result;
+    } catch {
+      clearTimeout(timer);
+      return null;
+    }
+  };
+
+  const docker = timeoutWrap(() => runQuiet('docker', ['info'], { env, spawn }));
+  if (!docker || docker.status !== 0) return null;
+  const compose = timeoutWrap(() => runQuiet('docker', ['compose', 'version'], { env, spawn }));
+  if (compose && compose.status === 0) return { command: 'docker', argsPrefix: ['compose'] };
+  const dockerCompose = timeoutWrap(() => runQuiet('docker-compose', ['version'], { env, spawn }));
+  if (dockerCompose && dockerCompose.status === 0) return { command: 'docker-compose', argsPrefix: [] };
   return null;
 }
 
+// Duplicated from service-manager.spawnDetached to avoid the import cycle
+// setup ↔ service-manager (service-manager already imports detectDockerCompose
+// from setup, so the reverse path can't exist).
+
+function spawnDetachedForSetup(command, args, homeDir, logFile, options = {}) {
+  const logDir = path.join(homeDir, '.construct', 'runtime');
+  fs.mkdirSync(logDir, { recursive: true });
+  const logPath = path.join(logDir, logFile);
+  const fd = fs.openSync(logPath, 'a');
+  const child = spawn(command, args, {
+    detached: true,
+    stdio: ['ignore', fd, fd],
+    cwd: options.cwd,
+    env: options.env,
+  });
+  child.unref();
+  return { child, logPath };
+}
+
 export function startManagedPostgres({ homeDir = HOME, env = process.env, spawn = spawnSync } = {}) {
   const composeRunner = detectDockerCompose({ env, spawn });
   if (!composeRunner) {
@@ -215,6 +419,46 @@ function ensureOpenCodeConfig() {
   return getCanonicalOpenCodeConfigPath();
 }
 
+// Wire core.hooksPath to .beads/hooks so the tracked hook scripts (ECC
+// secret-scan, Construct policy gates, BEADS dispatcher) actually fire on
+// git commit/push. Without this, .beads/hooks/* are inert — present in the
+// repo but never executed by git. Idempotent: leaves a user-set value alone
+// rather than clobbering it.
+
+function ensureGitHooksPath({ cwd = process.cwd() } = {}) {
+  const hooksDir = path.join(cwd, '.beads', 'hooks');
+  if (!fs.existsSync(path.join(hooksDir, 'pre-commit'))) {
+    return { status: 'skipped', reason: 'no .beads/hooks/pre-commit in this directory' };
+  }
+  const inGit = spawnSync('git', ['rev-parse', '--is-inside-work-tree'], { cwd, stdio: 'pipe', encoding: 'utf8' });
+  if (inGit.status !== 0) {
+    return { status: 'skipped', reason: 'not a git working tree' };
+  }
+  const current = spawnSync('git', ['config', '--get', 'core.hooksPath'], { cwd, stdio: 'pipe', encoding: 'utf8' });
+  const currentValue = current.status === 0 ? (current.stdout || '').trim() : '';
+  const desired = '.beads/hooks';
+  if (currentValue === desired) {
+    return { status: 'ok', message: 'core.hooksPath already wired to .beads/hooks' };
+  }
+  if (currentValue && currentValue !== desired) {
+    return {
+      status: 'warning',
+      message: `core.hooksPath is set to '${currentValue}'. Leaving alone — set to '.beads/hooks' to activate Construct policy gates.`,
+    };
+  }
+  const result = spawnSync('git', ['config', 'core.hooksPath', desired], { cwd, stdio: 'pipe', encoding: 'utf8' });
+  if (result.status !== 0) {
+    return {
+      status: 'error',
+      message: `failed to set core.hooksPath: ${(result.stderr || '').trim() || 'unknown error'}`,
+    };
+  }
+  return {
+    status: 'set',
+    message: `core.hooksPath set to .beads/hooks (activates pre-commit secret-scan + Construct policy gates + beads dispatcher)`,
+  };
+}
+
 export async function runSetup({ rootDir = ROOT_DIR, args = [], homeDir = HOME } = {}) {
   const argSet = new Set(args);
   const isYes = argSet.has('--yes');
@@ -235,30 +479,157 @@ export async function runSetup({ rootDir = ROOT_DIR, args = [], homeDir = HOME }
   console.log(`OpenCode config: ${opencodePath}`);
   warnIfGlobalCommandIsUnavailable();
 
-  const serviceResult = isYes && !skipDocker && !process.env.DATABASE_URL
-    ? startManagedPostgres({ homeDir, env: process.env })
-    : { status: 'skipped', databaseUrl: process.env.DATABASE_URL || '', message: skipDocker ? 'Docker service setup skipped by flag.' : 'Using existing DATABASE_URL if configured.' };
+  const cmInstall = ensureCmInstalled({ env: process.env });
+  if (cmInstall.status === 'installed') {
+    console.log('Memory CLI: installed cm via Homebrew');
+  } else if (cmInstall.status === 'available') {
+    console.log('Memory CLI: cm available');
+  } else {
+    console.log(`Memory CLI: ${cmInstall.message}`);
+    if (cmInstall.installCommand) console.log(`  Install with: ${cmInstall.installCommand}`);
+  }
+
+  const cassInstall = ensureCassInstalled({ env: process.env });
+  if (cassInstall.status === 'installed') {
+    console.log(`Session search: ${cassInstall.message}`);
+  } else if (cassInstall.status === 'available') {
+    console.log('Session search: cass available');
+  } else {
+    console.log(`Session search: ${cassInstall.message}`);
+    if (cassInstall.installCommand) console.log(`  Install with: ${cassInstall.installCommand}`);
+  }
+
+  // Local Postgres — consent-driven. Interactive default-yes; --yes accepts
+  // without prompting. Skipped when --no-docker, when DATABASE_URL is already
+  // set (caller has an external DB), or when user declines.
+
+  const dockerRunner = detectDockerCompose();
+  const dockerAvailable = !skipDocker && Boolean(dockerRunner);
+  let serviceResult = {
+    status: 'skipped',
+    databaseUrl: process.env.DATABASE_URL || '',
+    message: skipDocker ? 'Docker service setup skipped by flag.' : 'Docker not detected — skipping local Postgres.',
+  };
+
+  if (dockerAvailable) {
+    const pgConsent = await consentToInstall({
+      name: 'postgres',
+      isYes,
+      alreadyConfigured: Boolean(process.env.DATABASE_URL),
+      alreadyConfiguredNote: 'DATABASE_URL already set — using external database.',
+      envPath,
+    });
+    if (pgConsent.decision) {
+      writeLocalPostgresCompose(homeDir);
+      serviceResult = startManagedPostgres({ homeDir, env: process.env });
+      console.log(`Postgres: ${serviceResult.status === 'ok' ? 'started locally' : serviceResult.message}`);
+    } else {
+      console.log(`Postgres: skipped (${pgConsent.note})`);
+    }
+  } else if (skipDocker) {
+    console.log('Postgres: skipped (--no-docker)');
+  } else {
+    console.log('Postgres: skipped (Docker not detected — local Postgres unavailable)');
+    console.log(`  ${dockerInstallHint()}`);
+  }
+
+  // Local telemetry backend — starts Postgres via services/docker-compose.yml.
+  // Skipped automatically when CONSTRUCT_TELEMETRY_URL points to a remote instance.
+
+  let telemetryResult = { status: 'skipped', note: 'Docker not available' };
+  if (dockerAvailable) {
+    const svcConsent = await consentToInstall({
+      name: 'telemetry',
+      isYes,
+      alreadyConfigured: isRemoteTelemetry(process.env.CONSTRUCT_TELEMETRY_URL || ''),
+      alreadyConfiguredNote: 'CONSTRUCT_TELEMETRY_URL points to a remote instance — local stack not started.',
+      envPath,
+    });
+    if (svcConsent.decision) {
+      try {
+        telemetryResult = await startManagedServices({
+          rootDir,
+          homeDir,
+          env: process.env,
+          composeRunner: dockerRunner,
+          spawnDetached: spawnDetachedForSetup,
+        });
+        console.log(`Telemetry: ${telemetryResult.status} — ${telemetryResult.note || ''}`);
+      } catch (err) {
+        telemetryResult = { status: 'error', note: err?.message || 'spin-up failed' };
+        console.log(`Telemetry: error — ${telemetryResult.note}`);
+      }
+    } else {
+      telemetryResult = { status: 'skipped', note: svcConsent.note };
+      console.log(`Telemetry: skipped (${svcConsent.note})`);
+    }
+  }
 
   fs.mkdirSync(path.dirname(defaultVectorIndexPath(homeDir)), { recursive: true });
-  const managedValues = buildManagedSetupValues({
+
+  // Pre-warm the embedding model so the first agent query doesn't stall on
+  // a one-time ONNX download. Same pattern as `supabase start` pre-pulling
+  // images and `playwright install` pre-fetching browsers — make the wait
+  // visible during setup, not during user-facing work. Best-effort: a
+  // download failure here degrades gracefully via the engine's hash fallback
+  // and is non-fatal to setup.
+
+  try {
+    const warm = await warmupEmbeddingModel({ env: process.env });
+    if (warm.degraded) {
+      console.log(`Embeddings: degraded fallback (${warm.fallbackReason || 'model unavailable'}) — semantic search will use the hashing backend`);
+    } else {
+      console.log(`Embeddings: ${warm.model} ready (${warm.dimensions}d, warmed in ${warm.durationMs}ms)`);
+    }
+  } catch (err) {
+    console.log(`Embeddings: warmup skipped (${err?.message || 'unknown error'}) — model will load on first use`);
+  }
+
+  const hooksResult = ensureGitHooksPath({ cwd: process.cwd() });
+  if (hooksResult.status === 'set') console.log(`Git hooks: ${hooksResult.message}`);
+  else if (hooksResult.status === 'ok') console.log('Git hooks: wired');
+  else if (hooksResult.status === 'warning') console.log(`Git hooks: ${hooksResult.message}`);
+  else if (hooksResult.status === 'error') console.log(`Git hooks: ${hooksResult.message}`);
+
+  // Ensure workspace directory with docs lanes exists
+  ensureWorkspace(homeDir);
+
+  const managedValues = await buildManagedSetupValues({
     homeDir,
     env: process.env,
     databaseUrl: serviceResult.databaseUrl,
   });
   writeEnvValues(envPath, managedValues);
+  let pressureGuardAgent = null;
+  let pressureGuardLoad = null;
+  if (process.platform === 'darwin') {
+    pressureGuardAgent = installPressureGuardLaunchAgent({
+      homeDir,
+      rootDir,
+      intervalSeconds: Number(managedValues.CONSTRUCT_PRESSURE_GUARD_INTERVAL_SECONDS || 300),
+      nodePath: process.execPath,
+    });
+    pressureGuardLoad = loadPressureGuardLaunchAgent({ plistPath: pressureGuardAgent.plistPath });
+  }
 
   if (isYes) {
     console.log('\nManaged setup:');
+    console.log(`  Deployment mode: ${getDeploymentMode(env) || DEFAULT_DEPLOYMENT_MODE} (set in construct.config.json — runtime env override available via ${DEPLOYMENT_MODE_ENV_KEY})`);
     console.log(`  Vector index: ${managedValues.CONSTRUCT_VECTOR_INDEX_PATH}`);
     console.log(`  Vector model: ${managedValues.CONSTRUCT_VECTOR_MODEL}`);
     console.log(`  Trace backend: ${managedValues.CONSTRUCT_TRACE_BACKEND}`);
-    console.log(`  Langfuse URL: ${managedValues.LANGFUSE_BASEURL}`);
+    if (managedValues.CONSTRUCT_TELEMETRY_URL) console.log(`  Trace URL: ${managedValues.CONSTRUCT_TELEMETRY_URL}`);
+    console.log(`  Pressure guard: every ${managedValues.CONSTRUCT_PRESSURE_GUARD_INTERVAL_SECONDS}s, swap threshold ${managedValues.CONSTRUCT_PRESSURE_GUARD_SWAP_GB} GiB`);
     if (serviceResult.status === 'ok') {
       console.log(`  Postgres: ${serviceResult.databaseUrl}`);
       console.log(`  Compose file: ${serviceResult.composePath}`);
     } else {
       console.log(`  Postgres: ${serviceResult.message}`);
     }
+    if (pressureGuardAgent?.plistPath) {
+      console.log(`  LaunchAgent: ${pressureGuardAgent.plistPath}`);
+      console.log(`  LaunchAgent load: ${pressureGuardLoad?.loaded ? 'active' : pressureGuardLoad?.reason || 'pending manual load'}`);
+    }
 
     const sqlClient = createSqlClient({ ...process.env, ...managedValues });
     if (sqlClient) {
@@ -271,12 +642,50 @@ export async function runSetup({ rootDir = ROOT_DIR, args = [], homeDir = HOME }
           await waitForSqlReady({ ...process.env, ...managedValues });
         }
         readyClient = createSqlClient({ ...process.env, ...managedValues });
-        const migration = await import('node:fs/promises').then((fs) => fs.readFile(new URL('../db/migrations/001_init.sql', import.meta.url), 'utf8'));
+        const migration = await import('node:fs/promises').then((fs) => fs.readFile(new URL('../db/schema/001_init.sql', import.meta.url), 'utf8'));
         await readyClient.unsafe(migration);
         console.log('\nPostgres schema initialized.');
+
+        // Restore data from the most recent stash (if any) before syncing.
+        if (serviceResult.status === 'ok') {
+          const restore = restoreConstructDb({ homeDir });
+          if (restore.status === 'restored') {
+            console.log(`Construct DB restored from stash: ${restore.stashPath}`);
+          } else if (restore.status === 'no-stash') {
+            console.log('No stash found — starting with empty construct DB.');
+          } else if (restore.status !== 'no-stash') {
+            console.log(`Construct DB restore: ${restore.status}`);
+          }
+        }
+
         const syncResult = await syncFileStateToSql(rootDir, { env: { ...process.env, ...managedValues }, project: 'construct' });
         console.log(`Hybrid storage sync: ${syncResult.status}`);
         if (syncResult.embeddingModel) console.log(`Embedding model: ${syncResult.embeddingModel}`);
+
+        // When setup runs inside a downstream project (cwd is not the
+        // Construct package itself), seed the vector index from the
+        // project's existing docs / AGENTS / plan so the agent has
+        // context to compare new intake against from day one. No-op
+        // when there's nothing project-like in cwd.
+
+        const projectCwd = process.cwd();
+        const isDownstreamProject = projectCwd !== rootDir && (
+          fs.existsSync(path.join(projectCwd, 'docs')) ||
+          fs.existsSync(path.join(projectCwd, 'AGENTS.md')) ||
+          fs.existsSync(path.join(projectCwd, 'package.json'))
+        );
+        if (isDownstreamProject) {
+          try {
+            const projectName = path.basename(projectCwd);
+            const projectSync = await syncFileStateToSql(projectCwd, {
+              env: { ...process.env, ...managedValues },
+              project: projectName,
+            });
+            console.log(`Project corpus indexed: ${projectName} (${projectSync.documentsSynced || 0} docs, ${projectSync.embeddingsSynced || 0} embeddings) — agent can now compare new intake against existing material.`);
+          } catch (err) {
+            console.log(`Project corpus index skipped: ${err?.message || 'unknown error'} — run \`construct ingest\` later to seed manually.`);
+          }
+        }
       } catch (error) {
         console.log(`Hybrid storage init failed: ${error?.message || 'unknown error'}`);
       } finally {
@@ -289,22 +698,82 @@ export async function runSetup({ rootDir = ROOT_DIR, args = [], homeDir = HOME }
   if (isYes) {
     runConstruct(['mcp', 'add', 'memory', '--auto'], { optional: true });
     runConstruct(['mcp', 'add', 'github', '--auto'], { optional: true });
-    if (!managedValues.LANGFUSE_PUBLIC_KEY || !managedValues.LANGFUSE_SECRET_KEY) {
-      console.log('\nLangfuse is prewired but needs account credentials:');
-      console.log('  Set LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY in ~/.construct/config.env');
-      console.log('  Set these in ~/.construct/config.env or run: cd langfuse && docker compose up -d');
-    }
-
   } else {
     console.log('\nManaged defaults written:');
+    console.log(`  Deployment mode: ${getDeploymentMode(env) || DEFAULT_DEPLOYMENT_MODE} (set in construct.config.json — runtime env override available via ${DEPLOYMENT_MODE_ENV_KEY})`);
     console.log(`  Vector index: ${managedValues.CONSTRUCT_VECTOR_INDEX_PATH}`);
-    console.log(`  Trace backend: ${managedValues.CONSTRUCT_TRACE_BACKEND} (${managedValues.LANGFUSE_BASEURL})`);
+    console.log(`  Trace backend: ${managedValues.CONSTRUCT_TRACE_BACKEND}${managedValues.CONSTRUCT_TELEMETRY_URL ? ` (${managedValues.CONSTRUCT_TELEMETRY_URL})` : ''}`);
+    console.log(`  Pressure guard: swap ${managedValues.CONSTRUCT_PRESSURE_GUARD_SWAP_GB} GiB, opencode max ${managedValues.CONSTRUCT_PRESSURE_GUARD_MAX_OPENCODE}`);
     console.log('\nFor unattended setup, including local Postgres when Docker is running:');
     console.log('  construct setup --yes');
   }
 
   runConstruct(['sync']);
   runConstruct(['doctor']);
+
+  // Profile the CWD so per-host skill filtering layers downstream have
+  // a cached, host-agnostic signal to work from. Non-fatal on failure.
+  try {
+    const { detectProjectProfile, writeProfile } = await import('./project-profile.mjs');
+    const profile = detectProjectProfile(process.cwd());
+    if (profile.tags.length > 0) {
+      const profilePath = writeProfile(profile, process.cwd());
+      console.log(`\nProject profile: ${profile.tags.join(', ')}`);
+      console.log(`  Saved to ${profilePath}`);
+      console.log(`  Run \`construct skills scope\` to see which installed skills apply to this project.`);
+    }
+  } catch { /* best effort */ }
+
+  // ── Summary panel ────────────────────────────────────────────────────────
+  const setupTs = new Date().toISOString().slice(0, 19).replace(/[:.]/g, '-');
+  const setupLogPath = path.join(HOME, '.cx', `setup-${setupTs}.log`);
+  try {
+    fs.mkdirSync(path.dirname(setupLogPath), { recursive: true });
+    const logLines = [
+      `Construct setup completed ${new Date().toISOString()}`,
+      `Config: ${getUserEnvPath(HOME)}`,
+      `OpenCode: ${getCanonicalOpenCodeConfigPath(HOME)}`,
+    ];
+    if (managedValues?.DATABASE_URL) {
+      logLines.push(`Database: ${managedValues.DATABASE_URL.replace(/:\/\/[^@]+@/, '://<credentials>@')}`);
+    }
+    fs.writeFileSync(setupLogPath, logLines.join('\n') + '\n');
+  } catch { /* best effort */ }
+
+  console.log('\n────────────────────────────────────');
+  console.log('Setup complete.');
+
+  // Local-service summary — surfaces running local services. Same pattern
+  // as `supabase start`, which prints all local URLs + keys after spin-up.
+
+  const hasLocalTelemetry = telemetryResult?.status === 'started' || telemetryResult?.status === 'degraded';
+  const hasLocalPostgres = serviceResult?.status === 'ok' && serviceResult?.databaseUrl?.includes('127.0.0.1');
+  const vectorBackend = hasLocalPostgres
+    ? { label: 'Postgres + pgvector', detail: `${serviceResult.databaseUrl} (384d embeddings, ${managedValues.CONSTRUCT_VECTOR_MODEL})` }
+    : { label: 'JSON fallback', detail: `${managedValues.CONSTRUCT_VECTOR_INDEX_PATH} (${managedValues.CONSTRUCT_VECTOR_MODEL})` };
+
+  console.log('\nLocal services:');
+  if (hasLocalTelemetry) {
+    console.log(`  Telemetry:   ${telemetryResult.note || 'started'}`);
+  } else {
+    console.log(`  Telemetry:   not started`);
+  }
+  if (hasLocalPostgres) {
+    console.log(`  Postgres:    ${serviceResult.databaseUrl}`);
+  } else if (process.env.DATABASE_URL) {
+    console.log(`  Postgres:    external (${process.env.DATABASE_URL.replace(/:\/\/[^@]+@/, '://<credentials>@')})`);
+  } else {
+    console.log(`  Postgres:    not running — vector retrieval will use JSON fallback`);
+  }
+  console.log(`  Vector:      ${vectorBackend.label}`);
+  console.log(`    ${vectorBackend.detail}`);
+  console.log('  Credentials are saved to ~/.construct/config.env for later reference.');
+
+  console.log('\nNext steps:');
+  console.log('  construct provider add github     # Connect GitHub repository data');
+  console.log('  construct doctor                  # Verify all systems');
+  console.log('  construct evals retrieval         # Baseline retrieval quality');
+  console.log(`\nSetup log: ${setupLogPath}`);
 }
 
 function ensureUserConfig(homeDir = HOME) {
@@ -314,6 +783,24 @@ function ensureUserConfig(homeDir = HOME) {
   return envPath;
 }
 
+/**
+ * Create ~/.construct/workspace/ with the standard docs lane structure.
+ * Fallback target for embed output that isn't repo-specific.
+ */
+export function ensureWorkspace(homeDir = HOME) {
+  const wsPath = path.join(homeDir, '.construct', 'workspace');
+  const docsPath = path.join(wsPath, 'docs');
+  for (const lane of WORKSPACE_DOCS_LANES) {
+    fs.mkdirSync(path.join(docsPath, lane), { recursive: true });
+  }
+  // Ensure top-level workspace files exist
+  const snapshotPath = path.join(wsPath, 'snapshot.md');
+  if (!fs.existsSync(snapshotPath)) fs.writeFileSync(snapshotPath, '# Snapshot\n\nNo snapshot yet.\n');
+  const roadmapPath = path.join(wsPath, 'roadmap.md');
+  if (!fs.existsSync(roadmapPath)) fs.writeFileSync(roadmapPath, '# Roadmap\n\nNo roadmap generated yet.\n');
+  return wsPath;
+}
+
 if (import.meta.url === `file://${process.argv[1]}`) {
   runSetup({ args: process.argv.slice(2) });
 }