@getrift/rift 0.0.0 → 0.1.0-beta.0

package/dist/src/cli/commands/onboard.js

@@ -0,0 +1,742 @@
+/**
+ * `rift onboard` — first-run wizard.
+ *
+ * Walks a friend from "fresh install + Voyage key in hand" to "first
+ * useful recall against their freshly-imported data". Step ordering
+ * matches Slice 4 in the friend-beta plan; each step is idempotent and
+ * `--yes` accepts every prompt's default.
+ *
+ * Flags worth pointing out:
+ *   --voyage-key <key>        non-interactive key entry
+ *   --voyage-label <label>    operator-supplied display label (no inference)
+ *   --enable-feedback-relay <url>
+ *                             opt into the Clem-side relay non-interactively
+ *   --import-export <path>    import an export inline; `--no-import-export`
+ *                             skips the prompt entirely
+ *   --reconfigure-voyage      Slice 6 recovery flow — skip everything
+ *                             except validate + write key + kickstart + smoke
+ *   --yes                     accept all defaults (used by install scripts)
+ *   --skip-capture            suppress the post-onboarding capture pass
+ *                             (useful in tests / CI dry-runs)
+ */
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import readline from "node:readline";
+import { Command } from "commander";
+import { CliError, createHttpClient, readToken, resolveBaseUrl, } from "../http-client.js";
+import { issueToken } from "../token.js";
+import { loadConfig } from "../../config/loader.js";
+import { defaultRiftEnvPath, loadRiftEnv, } from "../../runtime/rift-env.js";
+import { runLegacyMigration } from "../../runtime/legacy-migration.js";
+import { sanitizeProjectLabel } from "../../runtime/legacy-name-guard.js";
+import { validateVoyageKey } from "../../onboarding/voyage-validate.js";
+import { writeEnvFile } from "../../onboarding/env-file.js";
+import { kickstartDaemon, waitForHealth, } from "../../onboarding/daemon-control.js";
+import { runAutoCapture, resolveCodexCaptureDeps, } from "../../capture/auto-capture.js";
+import { CodexCliTriageProvider } from "../../capture/codex-cli-triage-provider.js";
+import { discoverClaudeCodeSessions } from "../../ingestion/parsers/claude-code-jsonl.js";
+import { discoverCodexSessions } from "../../ingestion/parsers/codex-jsonl.js";
+import { pollJob } from "../job-poller.js";
+import { isJobFailure } from "../output.js";
+const SUPPORTED_INGEST_EXTENSIONS = new Set([".json", ".zip"]);
+const DEFAULT_DATA_DIR = path.join(os.homedir(), "Library", "Application Support", "Rift", "data");
+// Inline import is intentionally narrow until Slice 3 lands the real
+// `rift import` flow with structural sniffing per source. ChatGPT exports
+// are the most common friend handoff and we route them straight through.
+const ONBOARD_INLINE_IMPORT_SOURCE = "chatgpt_web";
+export function makeOnboardCommand() {
+    return new Command("onboard")
+        .description("First-run wizard: validate Voyage key, capture, import, recall test")
+        .option("--voyage-key <key>", "Voyage API key (skips paste prompt)")
+        .option("--voyage-label <label>", "Operator-supplied display label for the Voyage project")
+        .option("--enable-feedback-relay <url>", "Opt into the Rift feedback relay non-interactively (URL required)")
+        .option("--no-feedback-relay", "Decline the feedback relay (local-only)")
+        .option("--import-export <path>", "Import an export inline (.json or .zip)")
+        .option("--no-import-export", "Skip the import-now prompt")
+        .option("--reconfigure-voyage", "Recovery flow: replace the Voyage key only", false)
+        .option("--yes", "Accept all defaults (non-interactive)", false)
+        .option("--skip-capture", "Skip the post-setup capture pass (test-only)", false)
+        .action(async (opts, cmd) => {
+        const globalOpts = cmd.optsWithGlobals();
+        try {
+            await runOnboard(opts, globalOpts);
+        }
+        catch (err) {
+            const msg = err instanceof CliError
+                ? err.message
+                : err instanceof Error
+                    ? err.message
+                    : String(err);
+            process.stderr.write(`onboard failed: ${msg}\n`);
+            process.exitCode = 1;
+        }
+    });
+}
+async function runOnboard(opts, globalOpts) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+        terminal: !!process.stdin.isTTY,
+    });
+    try {
+        if (opts.reconfigureVoyage) {
+            await reconfigureVoyageFlow(opts, globalOpts, rl);
+            return;
+        }
+        say("");
+        say("Rift — first-run setup");
+        say("─────────────────────");
+        // Step 1 — legacy migration (idempotent).
+        const dataDir = await ensureConfigAndDataDir(globalOpts.config, opts, rl);
+        say("");
+        say("Running legacy migration check…");
+        const migration = await runLegacyMigration({ dataDir });
+        if (migration.migratedCount > 0) {
+            say(`Migrated ${migration.migratedCount} legacy artifact(s).`);
+        }
+        else {
+            say("No legacy artifacts found.");
+        }
+        // Step 2 — Voyage key + validate + persist + kickstart + smoke.
+        say("");
+        say("Voyage API key");
+        const last4 = await collectAndPersistVoyageKey(opts, globalOpts, rl);
+        // Step 2b — sanitize + persist optional --voyage-label to config.json
+        // (backup first). Invalid labels are dropped without echoing the raw
+        // value, so a key-shaped, path-shaped, or legacy-name-shaped label
+        // can never leak through stdout or config.json.
+        const safeLabel = applyVoyageLabel(opts.voyageLabel, globalOpts.config, say);
+        // Step 3 — Codex CLI preflight.
+        say("");
+        say("Codex CLI preflight…");
+        const codexOk = await codexPreflight();
+        if (!codexOk) {
+            say("Codex CLI is not authenticated. Run: codex login");
+            say("(Auto-capture needs Codex CLI auth. Re-run rift onboard once codex login succeeds.)");
+            throw new CliError("Codex CLI preflight failed.", "validation");
+        }
+        say("Codex CLI ready.");
+        // Step 4 — discover sessions.
+        say("");
+        const claudeSessions = safeDiscover(() => discoverClaudeCodeSessions(path.join(os.homedir(), ".claude")));
+        const codexSessions = safeDiscover(() => discoverCodexSessions());
+        say(`Found ${claudeSessions} Claude Code session(s) and ${codexSessions} Codex CLI session(s).`);
+        // Step 5 — privacy + feedback opt-in.
+        say("");
+        say("Privacy");
+        sayPrivacyContract();
+        const feedback = await collectFeedbackPreference(opts, rl, dataDir);
+        if (feedback.enabled) {
+            say(`Feedback relay enabled (installation_id: ${feedback.installation_id}).`);
+        }
+        else {
+            say("Feedback relay off — feedback stays in local JSONL only.");
+        }
+        // Step 6 + 7 — watermark current sessions + run one capture pass.
+        let captureSaved = 0;
+        if (!opts.skipCapture) {
+            say("");
+            say("Running first capture pass (watermark + scan)…");
+            const captureResult = await runFirstCapturePass(globalOpts.config, dataDir);
+            captureSaved = captureResult.saved;
+        }
+        else {
+            say("Skipping capture pass (--skip-capture).");
+        }
+        // Step 8 — optional export import.
+        say("");
+        let importSucceeded = false;
+        if (!opts.noImportExport) {
+            const importPath = await collectImportPath(opts, rl);
+            if (importPath) {
+                const outcome = await runImport(importPath, globalOpts.config);
+                if (outcome.kind === "imported" || outcome.kind === "duplicate") {
+                    importSucceeded = true;
+                }
+            }
+            else {
+                say("Skipping import. Run rift import <path> --source <name> later.");
+            }
+        }
+        else {
+            say("Skipping import (--no-import-export).");
+        }
+        // Step 9 — first-recall verification.
+        // Onboarding declares "complete" only when (a) capture or import landed
+        // user data this run, AND (b) a recall query against the daemon returns
+        // at least one hit. Without (a), there is nothing to recall — calling
+        // it "complete" because /search returned 0 rows would be misleading.
+        say("");
+        const ingestedAny = captureSaved > 0 || importSucceeded;
+        say(`First-recall sanity check (capture saved ${captureSaved} · import ${importSucceeded ? "ok" : "none"})…`);
+        const recall = ingestedAny
+            ? await firstRecallCheck(globalOpts.config)
+            : { ok: false, reason: "no user data was captured or imported during onboarding" };
+        // Step 10 — next-action card.
+        say("");
+        say("─────────────────────");
+        for (const line of decideOnboardOutcome({ ingestedAny, recall }))
+            say(line);
+        say(`Voyage: key valid (last 4 …${last4})${safeLabel ? ` · label ${safeLabel}` : ""}`);
+        say("");
+    }
+    finally {
+        rl.close();
+    }
+}
+// ----- Step 1: config.json + data dir -----
+async function ensureConfigAndDataDir(configPath, opts, rl) {
+    const absoluteConfig = path.resolve(configPath);
+    if (fs.existsSync(absoluteConfig)) {
+        const config = loadConfig(absoluteConfig);
+        say(`Using existing config: ${absoluteConfig}`);
+        say(`Data dir: ${config.data_paths.data_dir}`);
+        return config.data_paths.data_dir;
+    }
+    const defaultDataDir = DEFAULT_DATA_DIR;
+    const dataDir = opts.yes
+        ? defaultDataDir
+        : (await ask(rl, `Data dir [${defaultDataDir}]: `, defaultDataDir)).trim() ||
+            defaultDataDir;
+    fs.mkdirSync(dataDir, { recursive: true });
+    const inboxDir = path.join(dataDir, "inbox");
+    fs.mkdirSync(inboxDir, { recursive: true });
+    const config = {
+        sources: [
+            {
+                path: inboxDir,
+                extraction: "cloud",
+                mode: "watch",
+                scope: "project",
+            },
+        ],
+        embedding: { provider: "voyage", model: "voyage-3-lite" },
+        data_paths: { data_dir: dataDir, jobs_dir: path.join(dataDir, "..", "jobs") },
+        rate_limit: { window_ms: 60_000, max_requests: 100 },
+        capture: { enabled: true, interval_seconds: 3600 },
+    };
+    fs.mkdirSync(path.dirname(absoluteConfig), { recursive: true });
+    fs.writeFileSync(absoluteConfig, JSON.stringify(config, null, 2) + "\n", {
+        encoding: "utf8",
+        mode: 0o644,
+    });
+    say(`Wrote default config: ${absoluteConfig}`);
+    say(`Data dir: ${dataDir}`);
+    // Trigger ensureDirectories.
+    loadConfig(absoluteConfig);
+    return dataDir;
+}
+// ----- Step 2a: persist --voyage-label to config.json -----
+/**
+ * Sanitize a raw `--voyage-label`, persist it when valid, and return the
+ * string the caller should use for display. Invalid labels are dropped
+ * with a generic notice that never echoes the raw value — so a
+ * key-shaped, path-shaped, or legacy-name-shaped label cannot leak
+ * through stdout or `config.json`. Returns `null` when the input was
+ * absent or rejected.
+ *
+ * Exported for orchestrator-level tests; `runOnboard` is the only
+ * production caller.
+ */
+export function applyVoyageLabel(rawLabel, configPath, emit) {
+    if (rawLabel === undefined)
+        return null;
+    const sanitized = sanitizeProjectLabel(rawLabel);
+    if (!sanitized) {
+        // Generic message: never echo the raw value. Anything we say here
+        // also has to land in the friend's terminal, so it must not name
+        // the rejected token.
+        emit("Ignoring --voyage-label: must be 1–32 chars of letters, digits, '-' or '_' " +
+            "(no paths, secrets, or legacy product names).");
+        return null;
+    }
+    persistVoyageLabel(configPath, sanitized);
+    emit(`Stored Voyage label: ${sanitized}`);
+    return sanitized;
+}
+/**
+ * Merge `voyage.project_label` into the config file. The file is
+ * backed up to `<file>.bak.<iso>` first so an interrupted write or a
+ * future operator typo can be undone. Display only — never sent to the
+ * relay, never inferred from the key bytes.
+ *
+ * Defensively re-runs `sanitizeProjectLabel` even though the standard
+ * `applyVoyageLabel` caller has already validated: a future programmer
+ * who reaches for this export directly still cannot land an unsafe
+ * string in the file.
+ */
+export function persistVoyageLabel(configPath, label) {
+    const sanitized = sanitizeProjectLabel(label);
+    if (!sanitized) {
+        throw new CliError("Refusing to persist Voyage label: not a valid label " +
+            "(1–32 chars of letters, digits, '-' or '_'; no paths, secrets, or legacy names).", "validation");
+    }
+    const absolute = path.resolve(configPath);
+    if (!fs.existsSync(absolute)) {
+        // ensureConfigAndDataDir always writes config.json before this runs;
+        // a missing file here means the caller bypassed step 1.
+        throw new CliError(`Cannot persist Voyage label: config not found at ${absolute}`, "validation");
+    }
+    const raw = fs.readFileSync(absolute, "utf8");
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    fs.writeFileSync(`${absolute}.bak.${stamp}`, raw, { encoding: "utf8", mode: 0o600 });
+    const parsed = JSON.parse(raw);
+    const voyage = parsed["voyage"] ?? {};
+    voyage["project_label"] = sanitized;
+    parsed["voyage"] = voyage;
+    const tmp = `${absolute}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify(parsed, null, 2) + "\n", {
+        encoding: "utf8",
+        mode: 0o644,
+    });
+    fs.renameSync(tmp, absolute);
+}
+// ----- Step 2: Voyage key flow -----
+async function collectAndPersistVoyageKey(opts, globalOpts, rl) {
+    const key = await collectVoyageKey(opts, rl);
+    say("Validating with Voyage API…");
+    const validation = await validateVoyageKey({ apiKey: key });
+    if (!validation.ok) {
+        throw new CliError(`Voyage validation failed: ${validation.reason}`, "validation");
+    }
+    say(`Voyage key valid (last 4 …${validation.last4}).`);
+    const envPath = defaultRiftEnvPath();
+    const writeResult = writeEnvFile({ filePath: envPath, key: "VOYAGE_API_KEY", value: key });
+    say(writeResult.backedUp
+        ? "Wrote ~/.rift.env (existing file backed up)."
+        : "Wrote ~/.rift.env (mode 0600).");
+    // Refresh process.env so any subsequent in-process Voyage call sees it.
+    loadRiftEnv({ filePath: envPath });
+    const refresh = await daemonRefreshFlow(globalOpts);
+    // `not_configured` / `agent_not_loaded` are recoverable — the daemon
+    // simply isn't running yet (typical on fresh-Mac install before
+    // install.sh bootstraps the plist). Onboarding continues without the
+    // post-kickstart smoke; install.sh will pick it up.
+    if (!refresh.ok && refresh.kind !== "not_configured" && refresh.kind !== "agent_not_loaded") {
+        throw new CliError(`Voyage smoke failed after daemon kickstart: ${refresh.reason}`, "server_error");
+    }
+    return validation.last4;
+}
+async function collectVoyageKey(opts, rl) {
+    if (opts.voyageKey)
+        return opts.voyageKey.trim();
+    if (process.env["VOYAGE_API_KEY"])
+        return process.env["VOYAGE_API_KEY"].trim();
+    if (opts.yes) {
+        throw new CliError("--yes given but no Voyage key found (use --voyage-key or set VOYAGE_API_KEY).", "validation");
+    }
+    const answer = (await ask(rl, "Paste your Voyage API key: ")).trim();
+    if (answer.length === 0) {
+        throw new CliError("Voyage key is required.", "validation");
+    }
+    return answer;
+}
+/**
+ * Kickstart, wait for /health, confirm the respawned daemon process has
+ * VOYAGE_API_KEY loaded. The smoke is fully non-indexing — `/health`
+ * exposes `voyage_key_present` so we never write a row to LanceDB just to
+ * prove the daemon read its env file. That keeps first-recall results
+ * free of an "onboarding probe" hit that would otherwise satisfy the
+ * completion check without any real user data being present.
+ */
+async function daemonRefreshFlow(globalOpts) {
+    const baseUrl = safeResolveBaseUrl(globalOpts.config);
+    if (!baseUrl) {
+        say("Daemon not configured yet — skipping kickstart. Bootstrap via install.sh, then re-run rift onboard.");
+        return { ok: false, reason: "daemon not configured", kind: "not_configured" };
+    }
+    const kick = await kickstartDaemon();
+    if (kick.status === "agent_not_loaded") {
+        say(kick.hint);
+        return { ok: false, reason: kick.hint ?? "agent not loaded", kind: "agent_not_loaded" };
+    }
+    if (kick.status === "failed") {
+        return {
+            ok: false,
+            reason: kick.hint ?? "kickstart failed",
+            kind: "kickstart_failed",
+        };
+    }
+    say("Daemon kickstarted.");
+    const health = await waitForHealth({ baseUrl });
+    if (!health.ok) {
+        return { ok: false, reason: health.reason, kind: "health_failed" };
+    }
+    say(`Daemon healthy (uptime ${health.uptimeSeconds}s).`);
+    if (!health.voyageKeyPresent) {
+        return {
+            ok: false,
+            reason: "Daemon /health reports voyage_key_present=false after kickstart.",
+            kind: "smoke_failed",
+        };
+    }
+    say("Cloud embedding live (daemon loaded VOYAGE_API_KEY).");
+    return { ok: true, kickstarted: true };
+}
+// ----- Token helpers -----
+async function ensureToken(configPath) {
+    const existing = await readToken();
+    if (existing)
+        return existing;
+    try {
+        const { token } = await issueToken(path.resolve(configPath));
+        // Mirror to ~/.rift/token so subsequent CLI calls don't depend on Keychain.
+        const tokenPath = path.join(os.homedir(), ".rift", "token");
+        fs.mkdirSync(path.dirname(tokenPath), { recursive: true });
+        fs.writeFileSync(tokenPath, token + "\n", { encoding: "utf8", mode: 0o600 });
+        fs.chmodSync(tokenPath, 0o600);
+        return token;
+    }
+    catch {
+        return null;
+    }
+}
+// ----- Step 3: Codex preflight -----
+async function codexPreflight() {
+    try {
+        await new CodexCliTriageProvider({ timeoutMs: 120_000 }).triage({
+            content: "User: Rift onboarding preflight.\n\nAssistant: Ready.",
+            source: "codex_cli",
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function collectFeedbackPreference(opts, rl, dataDir) {
+    let enabled = false;
+    let url;
+    if (opts.enableFeedbackRelay) {
+        enabled = true;
+        url = opts.enableFeedbackRelay;
+    }
+    else if (opts.noFeedbackRelay || opts.yes) {
+        enabled = false;
+    }
+    else {
+        const answer = (await ask(rl, "Opt into the Rift feedback relay? [y/N]: ", "n"))
+            .trim()
+            .toLowerCase();
+        enabled = answer === "y" || answer === "yes";
+        if (enabled) {
+            url = (await ask(rl, "Relay URL: ")).trim();
+            if (!url) {
+                say("No URL supplied — keeping relay off.");
+                enabled = false;
+                url = undefined;
+            }
+        }
+    }
+    const cfg = enabled && url
+        ? { enabled: true, url, installation_id: crypto.randomUUID() }
+        : { enabled: false };
+    fs.mkdirSync(dataDir, { recursive: true });
+    const sidecar = path.join(dataDir, "feedback-config.json");
+    fs.writeFileSync(sidecar, JSON.stringify(cfg, null, 2) + "\n", {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    fs.chmodSync(sidecar, 0o600);
+    return cfg;
+}
+// ----- Step 6 + 7: capture pass -----
+export async function runFirstCapturePass(configPath, dataDir) {
+    const baseUrl = safeResolveBaseUrl(configPath);
+    if (!baseUrl) {
+        say("Daemon not reachable — skipping capture pass.");
+        return { saved: 0, reviewed: 0 };
+    }
+    const token = await ensureToken(configPath);
+    if (!token) {
+        say("No auth token — skipping capture pass.");
+        return { saved: 0, reviewed: 0 };
+    }
+    const client = createHttpClient({ baseUrl, token });
+    let codexCaptureDeps = {};
+    try {
+        const { loadConfig } = await import("../../config/loader.js");
+        codexCaptureDeps = resolveCodexCaptureDeps(loadConfig(configPath));
+    }
+    catch {
+        codexCaptureDeps = {};
+    }
+    try {
+        const report = await runAutoCapture({
+            dataDir,
+            ...codexCaptureDeps,
+            saveFn: async (saveOpts) => {
+                const { data } = await client.post("/save", {
+                    source: saveOpts.source,
+                    summary: saveOpts.summary,
+                    content: saveOpts.content,
+                    topics: saveOpts.topics,
+                    domain: saveOpts.domain,
+                    idempotency_key: saveOpts.idempotency_key,
+                    ...(saveOpts.replace_idempotency_key
+                        ? { replace_idempotency_key: saveOpts.replace_idempotency_key }
+                        : {}),
+                });
+                const resp = data;
+                if (resp.duplicate)
+                    return;
+                const result = await pollJob({ get: client.get.bind(client), jobId: resp.job_id });
+                if (isJobFailure(result.job, result.timedOut)) {
+                    throw new Error(`Save job failed: ${result.job.error ?? "unknown"}`);
+                }
+            },
+        });
+        say(`Capture: discovered ${report.total_discovered}, new ${report.new_conversations}, saved ${report.saved}, review ${report.review}, errors ${report.errors}.`);
+        return { saved: report.saved, reviewed: report.review };
+    }
+    catch (err) {
+        say(`Capture pass error (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+        return { saved: 0, reviewed: 0 };
+    }
+}
+// ----- Step 8: import -----
+async function collectImportPath(opts, rl) {
+    if (opts.importExport)
+        return opts.importExport;
+    if (opts.yes)
+        return null;
+    const answer = (await ask(rl, "Drop a path to a ChatGPT/Claude/Grok/Gemini export to import now (or `skip`): ", "skip")).trim();
+    if (!answer || answer.toLowerCase() === "skip")
+        return null;
+    return answer;
+}
+/**
+ * Inline import is intentionally narrow: ChatGPT exports only.
+ * Friends importing Claude / Grok / Gemini exports during onboarding
+ * are pointed at the standalone `rift import <path> --source <name>`
+ * command (Slice 3), which adds structural sniffing per source.
+ */
+async function runImport(filePath, configPath) {
+    const absolute = path.resolve(filePath);
+    if (!fs.existsSync(absolute)) {
+        say(`Import file not found: ${absolute}`);
+        return { kind: "skipped", reason: "file not found" };
+    }
+    const ext = path.extname(absolute).toLowerCase();
+    if (!SUPPORTED_INGEST_EXTENSIONS.has(ext)) {
+        say(`Unsupported file extension "${ext}". Allowed: .json, .zip.`);
+        return { kind: "skipped", reason: "unsupported extension" };
+    }
+    const baseUrl = safeResolveBaseUrl(configPath);
+    const token = await ensureToken(configPath);
+    if (!baseUrl || !token) {
+        say("Daemon not reachable — cannot import.");
+        return { kind: "skipped", reason: "daemon not reachable" };
+    }
+    const client = createHttpClient({ baseUrl, token });
+    const buf = fs.readFileSync(absolute);
+    const form = new FormData();
+    form.append("source", ONBOARD_INLINE_IMPORT_SOURCE);
+    form.append("file", new Blob([buf]), path.basename(absolute));
+    say(`Importing ${path.basename(absolute)} as ${ONBOARD_INLINE_IMPORT_SOURCE}…`);
+    say("(For Claude/Grok/Gemini exports, run: rift import <path> --source <name>)");
+    const { data } = await client.postMultipart("/ingest", form);
+    const resp = data;
+    if (resp.duplicate) {
+        say(`Import already submitted (job ${resp.job_id}).`);
+        return { kind: "duplicate", jobId: resp.job_id };
+    }
+    const result = await pollJob({ get: client.get.bind(client), jobId: resp.job_id });
+    if (isJobFailure(result.job, result.timedOut)) {
+        const reason = result.job.error ?? "unknown";
+        say(`Import failed: ${reason}`);
+        return { kind: "failed", reason };
+    }
+    say(`Import complete (job ${resp.job_id}).`);
+    return { kind: "imported", jobId: resp.job_id };
+}
+/**
+ * Pure outcome decision for the next-action card. Onboarding is only
+ * "complete" when this run actually ingested user data AND a recall
+ * query against the freshly-ingested data returned at least one hit.
+ * Smoke is non-indexing (see daemonRefreshFlow), so any hit is real
+ * user data, not a leftover probe.
+ */
+export function decideOnboardOutcome(input) {
+    const { ingestedAny, recall } = input;
+    if (ingestedAny && recall.ok && recall.hits > 0) {
+        return [
+            `Setup complete — recall returned ${recall.hits} result(s) from your data.`,
+            "Next: rift mcp install --client=claude-desktop",
+        ];
+    }
+    if (!ingestedAny) {
+        return [
+            "Setup incomplete — no user data was captured or imported during onboarding.",
+            "Next: drop an export at the prompt above and re-run rift onboard,",
+            "      or run: rift import <path> --source <name>",
+        ];
+    }
+    if (recall.ok) {
+        return [
+            "Setup partially complete — capture+import succeeded but search returned 0 hits.",
+            "Next: rift feedback --kind=broke --with-status \"first-recall returned 0\"",
+        ];
+    }
+    return [
+        `Setup partially complete — recall check failed: ${recall.reason}`,
+        "Next: rift status   (then: rift feedback --kind=broke --with-status)",
+    ];
+}
+// ----- Step 9: first-recall verification -----
+async function firstRecallCheck(configPath) {
+    const baseUrl = safeResolveBaseUrl(configPath);
+    const token = await ensureToken(configPath);
+    if (!baseUrl || !token) {
+        return { ok: false, reason: "daemon not reachable" };
+    }
+    const client = createHttpClient({ baseUrl, token });
+    // Generic, content-bearing query — likely to land on captured CLI
+    // sessions or imported chat exports without targeting any onboarding
+    // marker. The smoke is non-indexing (see daemonRefreshFlow), so any
+    // hit returned here is real user data, not a leftover probe.
+    try {
+        const { data } = await client.post("/search", {
+            query: "recent conversation",
+            scope: "all",
+            top_k: 10,
+        });
+        const body = data;
+        const hits = (body.results?.length ?? body.hits?.length ?? 0);
+        return { ok: true, hits };
+    }
+    catch (err) {
+        return { ok: false, reason: err instanceof Error ? err.message : String(err) };
+    }
+}
+// ----- Slice 6: --reconfigure-voyage -----
+/**
+ * Reconfigure the Voyage key. ALL of (kickstart succeeds, /health 200,
+ * smoke `voyage_key_present=true`) must pass; any failure rolls back the
+ * env file AND restores the previous in-process VOYAGE_API_KEY so a
+ * caller is never left with a half-replaced credential. `agent_not_loaded`
+ * counts as a failure here (unlike initial onboard) because reconfigure
+ * is, by definition, called against a daemon that should already be
+ * running — if the launchd label is gone, we don't trust the new key.
+ */
+async function reconfigureVoyageFlow(opts, globalOpts, rl) {
+    say("Reconfiguring Voyage key…");
+    const key = await collectVoyageKey(opts, rl);
+    await performVoyageReconfigure({
+        key,
+        envPath: defaultRiftEnvPath(),
+        refresh: () => daemonRefreshFlow(globalOpts),
+    });
+}
+/**
+ * Core reconfigure logic, extracted so tests can drive every failure
+ * branch (validate fail, kickstart agent_not_loaded, /health fail,
+ * voyage_key_present=false) without spinning up a real daemon.
+ *
+ * Contract: ALL of {validate ok, daemonRefresh ok} must succeed; any
+ * failure rolls back the env file AND restores the previous in-process
+ * VOYAGE_API_KEY. agent_not_loaded counts as a failure here — the call
+ * site only invokes this when the daemon should already be running.
+ */
+export async function performVoyageReconfigure(deps) {
+    const validate = deps.validate ?? validateVoyageKey;
+    const write = deps.write ?? writeEnvFile;
+    const loadEnv = deps.loadEnv ?? loadRiftEnv;
+    const emit = deps.emit ?? say;
+    const validation = await validate({ apiKey: deps.key });
+    if (!validation.ok) {
+        throw new CliError(`Voyage validation failed: ${validation.reason}`, "validation");
+    }
+    emit(`Voyage key valid (last 4 …${validation.last4}).`);
+    const previousInProcessKey = process.env["VOYAGE_API_KEY"];
+    const writeResult = write({
+        filePath: deps.envPath,
+        key: "VOYAGE_API_KEY",
+        value: deps.key,
+    });
+    loadEnv({ filePath: deps.envPath });
+    const refresh = await deps.refresh();
+    if (refresh.ok) {
+        emit(`Voyage reconfigured (last 4 …${validation.last4}).`);
+        return;
+    }
+    rollbackVoyageEnv(deps.envPath, writeResult, previousInProcessKey);
+    throw new CliError(`Reconfigure failed — restored previous Voyage key (reason: ${refresh.reason}).`, "server_error");
+}
+/**
+ * Restore a Voyage env file + in-process VOYAGE_API_KEY after a failed
+ * write. Exported for testing — `reconfigureVoyageFlow` is the only
+ * production caller. When `writeResult.backedUp` is true, the prior
+ * env-file contents are copied back at mode 0600; when false (no prior
+ * file existed), the file we just wrote is removed so we don't leave
+ * a key paired with a now-rejected daemon respawn.
+ */
+export function rollbackVoyageEnv(envPath, writeResult, previousInProcessKey) {
+    // 1. Env file.
+    if (writeResult.backedUp && writeResult.backupPath) {
+        try {
+            fs.copyFileSync(writeResult.backupPath, envPath);
+            fs.chmodSync(envPath, 0o600);
+        }
+        catch {
+            say("Reconfigure rollback: env-file restore failed — ping Clem for recovery.");
+        }
+    }
+    else {
+        // No prior env file — best effort: drop the line we just wrote so we
+        // don't leave a key paired with a now-rejected daemon respawn.
+        try {
+            fs.rmSync(envPath, { force: true });
+        }
+        catch {
+            // Best-effort.
+        }
+    }
+    // 2. In-process VOYAGE_API_KEY — restore prior value or delete.
+    if (typeof previousInProcessKey === "string" && previousInProcessKey.length > 0) {
+        process.env["VOYAGE_API_KEY"] = previousInProcessKey;
+    }
+    else {
+        delete process.env["VOYAGE_API_KEY"];
+    }
+}
+// ----- Helpers -----
+function ask(rl, question, fallback) {
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            resolve(answer || fallback || "");
+        });
+    });
+}
+function say(line) {
+    process.stdout.write(line + "\n");
+}
+function sayPrivacyContract() {
+    say([
+        "  • Conversation content stays local (LanceDB + raw transcripts).",
+        "  • Content snippets leave the machine for embedding only (Voyage AI).",
+        "  • The Voyage key sits in ~/.rift.env (mode 0600). Never logged, never sent to Clem.",
+        "  • Feedback is stored locally as JSONL. Relay is opt-in: explicit notes only,",
+        "    plus daemon health booleans — no paths, no content, no key bytes.",
+        "  • Full contract: docs/feedback/PRIVACY.md",
+    ].join("\n"));
+}
+function safeDiscover(fn) {
+    try {
+        return fn().length;
+    }
+    catch {
+        return 0;
+    }
+}
+function safeResolveBaseUrl(configPath) {
+    try {
+        return resolveBaseUrl(configPath);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=onboard.js.map