@getrift/rift 0.1.0-beta.20 → 0.1.0-beta.22

package/dist/src/cli/commands/onboard.js

@@ -34,10 +34,10 @@ import { sanitizeProjectLabel } from "../../runtime/legacy-name-guard.js";
 import { validateVoyageKey } from "../../onboarding/voyage-validate.js";
 import { writeEnvFile } from "../../onboarding/env-file.js";
 import { kickstartDaemon, waitForHealth, } from "../../onboarding/daemon-control.js";
-import { runAutoCapture, resolveCodexCaptureDeps, } from "../../capture/auto-capture.js";
+import { runAutoCapture, resolveCodexCaptureDeps, resolveCursorCaptureDeps, } from "../../capture/auto-capture.js";
 import { appendAutoCaptureRunRecord, buildAutoCaptureRunRecord, } from "../../capture/observability.js";
-import { DEFAULT_AUTO_CAPTURE_SOURCES } from "../../capture/sources.js";
-import { CodexCliTriageProvider } from "../../capture/codex-cli-triage-provider.js";
+import { DEFAULT_AUTO_CAPTURE_SOURCES, CURSOR_CAPTURE_SOURCE, } from "../../capture/sources.js";
+import { createTriageProvider, resolveTriageProviderName, setConfiguredTriageProviderName, triageWorkerLabel, } from "../../capture/triage-provider-factory.js";
 import { discoverClaudeCodeSessions } from "../../ingestion/parsers/claude-code-jsonl.js";
 import { discoverCodexSessions } from "../../ingestion/parsers/codex-jsonl.js";
 import { sniffInboxSource } from "../../ingestion/inbox-core/source-sniffer.js";
@@ -89,11 +89,12 @@ export function makeOnboardCommand() {
         .option("--reconfigure-voyage", "Recovery flow: replace the Voyage key only", false)
         .option("--yes", "Accept all defaults (non-interactive)", false)
         .option("--skip-capture", "Skip the post-setup capture pass (test-only)", false)
-        .option("--no-codex-capture", "Skip the Codex CLI preflight + disable the capture pass for this run")
+        .option("--no-codex-capture", "Skip the triage-worker preflight + disable the capture pass for this run")
         .option("--with-claude-hook", "Install the Rift policy hook into Claude Code without prompting", false)
         .option("--no-claude-hook", "Skip the Claude Code policy-hook prompt entirely")
         .option("--enable-codex-enrichment", "Opt into Codex AI metadata enrichment (default: AI-free import + keyword search)", false)
-        .option("--enable-capture", "Opt into scheduled chat capture + its Codex preflight (default: capture off, zero Codex calls)", false)
+        .option("--enable-claude-enrichment", "Opt into Claude Code AI metadata enrichment (digests/compaction stay off until Claude digest support ships; mutually exclusive with --enable-codex-enrichment)", false)
+        .option("--enable-capture", "Opt into scheduled chat capture + its triage-worker preflight (Codex by default, or Claude Code via capture.triage.provider; default: capture off, zero AI-worker calls)", false)
         .action(async (opts, cmd) => {
         const globalOpts = cmd.optsWithGlobals();
         try {
@@ -119,6 +120,13 @@ export async function runOnboard(opts, globalOpts) {
         terminal: !!process.stdin.isTTY,
     });
     try {
+        // Fail fast, before any config write: the two enrichment opt-ins pick
+        // different metadata workers (Codex vs Claude), so passing both is an
+        // ambiguous request, not a mergeable one. Reject it up front rather than
+        // letting last-writer-wins silently decide which provider you got.
+        if (opts.enableCodexEnrichment === true && opts.enableClaudeEnrichment === true) {
+            throw new CliError("Pass only one of --enable-codex-enrichment or --enable-claude-enrichment — they select different metadata workers.", "validation");
+        }
         if (opts.reconfigureVoyage) {
             await reconfigureVoyageFlow(opts, globalOpts, rl);
             return;
@@ -152,6 +160,7 @@ export async function runOnboard(opts, globalOpts) {
         // AI-free import + keyword search (zero Codex calls). Only persisted when
         // the user explicitly passed --enable-codex-enrichment.
         applyCodexEnrichmentOptIn(opts.enableCodexEnrichment, globalOpts.config, say);
+        applyClaudeEnrichmentOptIn(opts.enableClaudeEnrichment, globalOpts.config, say);
         // Step 2d — optional opt-in to scheduled chat capture. Default off, so a
         // fresh install makes zero Codex calls. Auto-capture embeds each saved
         // conversation, so it requires a Voyage key; opting in without one would
@@ -190,7 +199,7 @@ export async function runOnboard(opts, globalOpts) {
                 throw new CliError(`Voyage smoke failed after daemon kickstart: ${refresh.reason}`, "server_error");
             }
         }
-        // Step 3 — Codex CLI preflight (capture lane only).
+        // Step 3 — triage-worker preflight (capture lane only).
         //
         // Capture is OFF by default (trust-first): a fresh install makes zero
         // Codex calls. The preflight below performs a real Codex triage call,
@@ -205,6 +214,27 @@ export async function runOnboard(opts, globalOpts) {
         // `--no-codex-capture` skips the preflight even when capture was enabled
         // (e.g. enable the daemon schedule but skip the one-shot).
         let captureDisabled = false;
+        // `codexUnavailable` is set ONLY when capture was enabled and the live
+        // Codex preflight actually failed — i.e. scheduled capture is configured
+        // on but cannot run until Codex is fixed. `--no-codex-capture` is NOT this
+        // case: it only skips the onboarding one-shot, leaving the daemon's
+        // scheduled capture to run normally. Keeping the two apart is what lets the
+        // import-prompt and summary copy stay honest instead of either over- or
+        // under-promising automatic capture.
+        let codexUnavailable = false;
+        // Resolve the configured triage worker so the preflight probes (and labels)
+        // the worker the daemon will actually use, and record it process-wide so
+        // the first-capture pass below inherits the same selection. Unreadable
+        // config falls back to codex_cli — byte-for-byte the prior default.
+        let triageWorkerName = "codex_cli";
+        try {
+            triageWorkerName = resolveTriageProviderName(loadConfig(path.resolve(globalOpts.config)));
+        }
+        catch {
+            triageWorkerName = "codex_cli";
+        }
+        setConfiguredTriageProviderName(triageWorkerName);
+        const workerLabel = triageWorkerLabel(triageWorkerName);
         if (!captureEnabled) {
             ui.step("skip", "Chat access", captureRequested
                 ? "capture needs a Voyage key — skipped"
@@ -216,21 +246,48 @@ export async function runOnboard(opts, globalOpts) {
             captureDisabled = true;
         }
         else {
-            const codexSpin = new ui.Spinner("Chat access").start();
-            const codexOk = await codexPreflight();
-            if (codexOk) {
-                codexSpin.succeed("Chat access", "ready · Codex CLI");
+            const preflightSpin = new ui.Spinner("Chat access").start();
+            const preflightOk = await triagePreflight(triageWorkerName);
+            if (preflightOk) {
+                preflightSpin.succeed("Chat access", `ready · ${workerLabel}`);
             }
             else {
-                codexSpin.fail("Chat access", "not ready · Codex CLI — auto-import off");
-                ui.note("To enable later: run `codex login`, then re-run `rift onboard`.");
+                preflightSpin.fail("Chat access", `not ready · ${workerLabel} — auto-import off`);
+                ui.note(triageWorkerName === "claude_code"
+                    ? "To enable later: run `claude` once and sign in, then re-run `rift onboard`."
+                    : "To enable later: run `codex login`, then re-run `rift onboard`.");
                 captureDisabled = true;
+                codexUnavailable = true;
             }
         }
+        // Will the daemon's scheduled auto-capture actually run going forward?
+        // Configured on (requested + Voyage key) AND Codex available. This is the
+        // signal the import prompt and the summary line must use — NOT bare
+        // `captureEnabled`, which is only "configured on" and stays true even after
+        // a failed Codex preflight already told the user auto-import is off.
+        const autoCaptureWillRun = captureEnabled && !codexUnavailable;
         // Step 4 — discover sessions.
         const claudeSessions = safeDiscover(() => discoverClaudeCodeSessions(path.join(os.homedir(), ".claude")));
         const codexSessions = safeDiscover(() => discoverCodexSessions());
         ui.step("ok", "Chat history", `${claudeSessions} Claude Code · ${codexSessions} Codex CLI`);
+        // Set the expectation honestly up front: auto-capture covers the CLI agents,
+        // not every AI app on the Mac. The Claude/ChatGPT desktop + web apps keep
+        // their history server-side, so those chats arrive via export → rift import.
+        // `ui.detail` (legible, not dimmed) because this is trust-critical copy.
+        //
+        // The CLI-agent line is gated on `autoCaptureWillRun`: "captured
+        // automatically" is only true once capture is enabled AND the worker
+        // preflight passed. On a default/off or not-ready install (we just printed
+        // "capture off"/"not ready" above) we describe ELIGIBILITY instead, so the
+        // block never contradicts the gate it sits under.
+        const cliAgentsLine = autoCaptureWillRun
+            ? "  • Claude Code + Codex CLI — captured automatically\n"
+            : "  • Claude Code + Codex CLI — eligible for auto-capture once capture is enabled and chat access is ready\n";
+        ui.detail("Auto-capture covers your terminal AI agents — not every AI app on your Mac:\n" +
+            cliAgentsLine +
+            "  • Cursor — only if you turn it on (add cursor_composer to capture.sources)\n" +
+            "  • Claude Desktop / ChatGPT / web chats — NOT automatic; export them, then:\n" +
+            "      rift import <file> --source claude_web   (or chatgpt_web)");
         // Step 5 — beta opt-in (stay connected: news, pricing, feedback).
         const feedback = await collectFeedbackPreference(opts, dataDir, rl);
         if (feedback.email) {
@@ -246,6 +303,7 @@ export async function runOnboard(opts, globalOpts) {
         await maybeInstallClaudeCodeHook(opts, rl);
         // Step 6 + 7 — watermark current sessions + run one capture pass.
         let captureSaved = 0;
+        let captureRan = false;
         if (opts.skipCapture) {
             ui.step("skip", "Chat import", "skipped (--skip-capture)");
         }
@@ -262,6 +320,7 @@ export async function runOnboard(opts, globalOpts) {
             ui.step("skip", "Chat import", "skipped (capture not enabled)");
         }
         else {
+            captureRan = true;
             const captureResult = await runFirstCapturePass(globalOpts.config, dataDir);
             captureSaved = captureResult.saved;
             // Per A-1.1/C-1.3: a token-issuance failure during capture-pass
@@ -275,12 +334,18 @@ export async function runOnboard(opts, globalOpts) {
         }
         // Step 8 — optional export import.
         let importSucceeded = false;
+        let importAttempted = false;
         if (isOff(opts, "importExport", "noImportExport")) {
             ui.step("skip", "File import", "skipped (--no-import-export)");
         }
         else {
-            const importPath = await collectImportPath(opts, rl);
+            const importPath = await collectImportPath(opts, rl, {
+                willRun: autoCaptureWillRun,
+                configured: captureEnabled,
+                workerLabel,
+            });
             if (importPath) {
+                importAttempted = true;
                 const outcome = await runImport(importPath, globalOpts.config);
                 if (outcome.kind === "imported" || outcome.kind === "duplicate") {
                     importSucceeded = true;
@@ -291,30 +356,46 @@ export async function runOnboard(opts, globalOpts) {
             }
         }
         // Step 9 — first-recall verification.
-        // Onboarding declares "complete" only when (a) capture or import landed
-        // user data this run, AND (b) a recall query against the daemon returns
-        // at least one hit. Without (a), there is nothing to recall — calling
-        // it "complete" because /search returned 0 rows would be misleading.
+        // A recall check only makes sense once this run actually landed user data.
+        // When nothing was imported or captured (the default, deliberate path), we
+        // skip the search check rather than start a spinner and FAIL it — failing a
+        // check the user opted out of is what made a clean setup feel broken.
         const ingestedAny = captureSaved > 0 || importSucceeded;
-        const recallSpin = new ui.Spinner("Search check").start();
-        const recall = ingestedAny
-            ? await firstRecallCheck(globalOpts.config)
-            : { ok: false, reason: "no user data was captured or imported during onboarding" };
-        if (recall.ok && recall.hits > 0) {
-            recallSpin.succeed("Search check", `found ${recall.hits} result(s)`);
-        }
-        else if (recall.ok) {
-            // 0 hits is NOT success — decideOnboardOutcome treats it as incomplete.
-            recallSpin.warn("Search check", "no results yet — index is fresh, try a query shortly");
+        const ingestAttempted = captureRan || importAttempted;
+        let recall;
+        if (!ingestedAny) {
+            ui.step("skip", "Search check", "nothing imported yet — skipped");
+            recall = { ok: false, reason: "nothing imported yet" };
         }
         else {
-            recallSpin.fail("Search check", recall.reason);
+            const recallSpin = new ui.Spinner("Search check").start();
+            recall = await firstRecallCheck(globalOpts.config);
+            if (recall.ok && recall.hits > 0) {
+                recallSpin.succeed("Search check", `found ${recall.hits} result(s)`);
+            }
+            else if (recall.ok) {
+                recallSpin.warn("Search check", "no results yet — index is fresh, try a query shortly");
+            }
+            else {
+                recallSpin.fail("Search check", recall.reason);
+            }
         }
         // Step 10 — next-action card.
-        const card = decideOnboardOutcome({ ingestedAny, recall });
+        const card = decideOnboardOutcome({ ingestedAny, recall, ingestAttempted });
         card.push(ui.pc.dim(last4 !== null
             ? `Voyage: key valid (last 4 …${last4})${safeLabel ? ` · label ${safeLabel}` : ""}`
             : "Search: keyword-only (no embedding key) — add one later for semantic search"));
+        // One-line "what's on/off" so the friend leaves knowing whether Rift keeps
+        // itself fed. Three honest states: ready (configured + worker available),
+        // configured-but-not-ready (preflight failed — don't claim it's running),
+        // and off (the default). Capture is off by default (zero-egress default).
+        card.push(ui.pc.dim(autoCaptureWillRun
+            ? "Auto-capture: on — new chats are captured on a schedule."
+            : captureEnabled
+                ? `Auto-capture: configured on, but not ready — ${workerLabel} isn't available (${triageWorkerName === "claude_code"
+                    ? "run `claude` and sign in"
+                    : "run `codex login`"}).`
+                : "Auto-capture: off — enable with: rift onboard --enable-capture"));
         ui.box(card);
         ui.line("");
     }
@@ -446,8 +527,10 @@ export function persistVoyageLabel(configPath, label) {
  * Persist the Codex AI-metadata-enrichment opt-in into config.json. Default
  * onboarding leaves `enrichment.ai_metadata = false` (AI-free import + keyword
  * search, zero Codex calls). When the user passes `--enable-codex-enrichment`,
- * this flips it to true so the daemon/worker select the Codex-backed extractor.
- * Backs the file up first, mirroring `persistVoyageLabel`.
+ * this flips it to true AND pins `enrichment.metadata.provider = "codex_cli"` so
+ * the daemon/worker select the Codex-backed extractor — overriding any prior
+ * `claude_code` pin rather than silently leaving Claude selected. Backs the file
+ * up first, mirroring `persistVoyageLabel`.
  *
  * Exported for orchestrator-level tests; `runOnboard` is the only production
  * caller. Returns true when the flag was set and persisted, false otherwise.
@@ -465,6 +548,55 @@ export function applyCodexEnrichmentOptIn(enable, configPath, emit) {
     const parsed = JSON.parse(raw);
     const enrichment = parsed["enrichment"] ?? {};
     enrichment["ai_metadata"] = true;
+    // Pin the metadata worker to Codex explicitly. Setting only `ai_metadata`
+    // would leave a pre-existing `metadata.provider = "claude_code"` in place, so
+    // "use Codex" would silently keep routing metadata through Claude (and keep
+    // digests off). Codex opt-in must win the provider selection, not just the gate.
+    const metadata = enrichment["metadata"] ?? {};
+    metadata["provider"] = "codex_cli";
+    enrichment["metadata"] = metadata;
+    parsed["enrichment"] = enrichment;
+    const tmp = `${absolute}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, JSON.stringify(parsed, null, 2) + "\n", {
+        encoding: "utf8",
+        mode: 0o644,
+    });
+    fs.renameSync(tmp, absolute);
+    emit("Codex AI metadata enrichment enabled (enrichment.ai_metadata = true, metadata.provider = codex_cli).");
+    return true;
+}
+/**
+ * Persist the Claude-Code AI-metadata-enrichment opt-in into config.json. Like
+ * `applyCodexEnrichmentOptIn` it flips `enrichment.ai_metadata = true`, but it
+ * ALSO pins `enrichment.metadata.provider = "claude_code"` so the daemon/worker
+ * route metadata through the `claude` CLI instead of Codex. Backs the file up
+ * first, mirroring the Codex opt-in. Callers must reject the combination of
+ * both enrichment flags before reaching here (see `runOnboard`).
+ *
+ * Discloses the one capability this does NOT turn on: there is no Claude digest
+ * worker yet and we will not silently borrow Codex for it, so digests/
+ * compaction stay off until a dedicated digest-provider slice ships. Saying so
+ * here prevents a silent capability loss for a user who switches to Claude.
+ *
+ * Exported for orchestrator-level tests; `runOnboard` is the only production
+ * caller. Returns true when the flag was set and persisted, false otherwise.
+ */
+export function applyClaudeEnrichmentOptIn(enable, configPath, emit) {
+    if (enable !== true)
+        return false;
+    const absolute = path.resolve(configPath);
+    if (!fs.existsSync(absolute)) {
+        throw new CliError(`Cannot persist enrichment opt-in: config not found at ${absolute}`, "validation");
+    }
+    const raw = fs.readFileSync(absolute, "utf8");
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    fs.writeFileSync(`${absolute}.bak.${stamp}`, raw, { encoding: "utf8", mode: 0o600 });
+    const parsed = JSON.parse(raw);
+    const enrichment = parsed["enrichment"] ?? {};
+    enrichment["ai_metadata"] = true;
+    const metadata = enrichment["metadata"] ?? {};
+    metadata["provider"] = "claude_code";
+    enrichment["metadata"] = metadata;
     parsed["enrichment"] = enrichment;
     const tmp = `${absolute}.tmp.${process.pid}`;
     fs.writeFileSync(tmp, JSON.stringify(parsed, null, 2) + "\n", {
@@ -472,7 +604,7 @@ export function applyCodexEnrichmentOptIn(enable, configPath, emit) {
         mode: 0o644,
     });
     fs.renameSync(tmp, absolute);
-    emit("Codex AI metadata enrichment enabled (enrichment.ai_metadata = true).");
+    emit("Claude metadata enrichment enabled. Digests/compaction stay off until Claude digest support ships.");
     return true;
 }
 /**
@@ -704,12 +836,18 @@ export function describeTokenFailure(reason) {
     }
     return "re-run `rift onboard`. If the failure repeats, run `rift feedback --kind=broke --with-status` to ship a diagnostic bundle.";
 }
-// ----- Step 3: Codex preflight -----
-async function codexPreflight() {
+// ----- Step 3: triage-worker preflight -----
+/**
+ * Live triage probe for the CONFIGURED worker (Codex CLI by default, or Claude
+ * Code when `capture.triage.provider = claude_code`). Routing through the
+ * factory — not a hardcoded CodexCliTriageProvider — is what stops a Claude
+ * Code user who deliberately picked `claude_code` from being failed by a Codex
+ * probe they never asked for.
+ */
+async function triagePreflight(name) {
     try {
-        await new CodexCliTriageProvider({ timeoutMs: 120_000 }).triage({
+        await createTriageProvider(name, { timeoutMs: 120_000 }).triage({
             content: "User: Rift onboarding preflight.\n\nAssistant: Ready.",
-            source: "codex_cli",
         });
         return true;
     }
@@ -763,7 +901,17 @@ export async function collectFeedbackPreference(opts, dataDir, rl, store = macRe
         !opts.enableFeedbackRelay &&
         !opts.yes &&
         process.stdin.isTTY) {
-        const pasted = (await ask(rl, "Paste a Rift invite code to enable feedback (Enter to skip): ")).trim();
+        // Most friends will NOT have an invite code — make that the obvious,
+        // pressure-free default so the bare prompt doesn't read as "something is
+        // missing". An invite only turns on the direct feedback relay; the email
+        // ask below (and `rift feedback`) work without it.
+        ui.detail([
+            "Feedback channel (optional)",
+            "• Have an invite code from Clem? Paste it to turn on the direct feedback relay.",
+            "• No code? Just press Enter — this is optional, and most people skip it.",
+            "• Either way you can send feedback any time with `rift feedback`.",
+        ].join("\n"));
+        const pasted = (await ask(rl, "Invite code from Clem (or press Enter to skip): ")).trim();
         if (pasted) {
             try {
                 const invite = parseInvite(pasted);
@@ -1029,15 +1177,38 @@ export async function runFirstCapturePass(configPath, dataDir) {
     const token = tokenResult.token;
     const client = createHttpClient({ baseUrl, token });
     let codexCaptureDeps = {};
+    let cursorCaptureDeps = {};
+    // Onboarding is a config-driven capture path, so it must honor the Cursor
+    // opt-in exactly like the daemon: if `cursor_composer` is in
+    // `config.capture.sources`, this first pass authorizes Cursor discovery +
+    // persistence WITHOUT the env flags (which exist only for ad-hoc dogfood
+    // runs). Without this, onboarding would record cursor_composer in its ledger
+    // row yet runAutoCapture would treat Cursor as disabled — capturing nothing.
+    let cursorConfigEnabled = false;
     let enabledSources = DEFAULT_AUTO_CAPTURE_SOURCES;
+    // Worker name for the honest preflight-failed warning below (defaults to the
+    // codex_cli label until config resolves).
+    let captureWorkerLabel = triageWorkerLabel("codex_cli");
     try {
         const { loadConfig } = await import("../../config/loader.js");
         const cfg = loadConfig(configPath);
+        // Route this first capture pass through the configured triage worker —
+        // runAutoCapture builds its provider from the process-wide configured name,
+        // so without this a claude_code user's onboarding pass would silently fall
+        // back to Codex. (Step 3 already set it; re-assert here so this function is
+        // correct independent of call order.)
+        const captureWorkerName = resolveTriageProviderName(cfg);
+        setConfiguredTriageProviderName(captureWorkerName);
+        captureWorkerLabel = triageWorkerLabel(captureWorkerName);
         codexCaptureDeps = resolveCodexCaptureDeps(cfg);
+        cursorCaptureDeps = resolveCursorCaptureDeps(cfg);
+        cursorConfigEnabled = cfg.capture.sources.includes(CURSOR_CAPTURE_SOURCE);
         enabledSources = cfg.capture.sources;
     }
     catch {
         codexCaptureDeps = {};
+        cursorCaptureDeps = {};
+        cursorConfigEnabled = false;
     }
     const startedAt = new Date();
     const captureSpin = new ui.Spinner("Chat import").start();
@@ -1052,6 +1223,8 @@ export async function runFirstCapturePass(configPath, dataDir) {
             // ledger that says one thing while capture did another.
             sources: enabledSources,
             ...codexCaptureDeps,
+            ...cursorCaptureDeps,
+            cursorConfigEnabled,
             saveFn: async (saveOpts) => {
                 const { data } = await client.post("/save", {
                     source: saveOpts.source,
@@ -1094,12 +1267,12 @@ export async function runFirstCapturePass(configPath, dataDir) {
                 : String(observabilityErr)}\n`);
         }
         const base = `${report.saved} added · ${report.review} to review`;
-        // A preflight failure (Codex health probe) carries 0 per-session errors,
-        // so an `errors > 0` check alone would `succeed()` on a run where triage
-        // never ran — telling a friend everything's fine when it isn't. Treat a
-        // failed probe as a warning too, and surface why.
+        // A preflight failure (triage-worker health probe) carries 0 per-session
+        // errors, so an `errors > 0` check alone would `succeed()` on a run where
+        // triage never ran — telling a friend everything's fine when it isn't.
+        // Treat a failed probe as a warning too, and surface why.
         if (!report.preflight_ok) {
-            captureSpin.warn("Chat import", `${base} · Codex preflight failed${report.preflight_error ? ` (${report.preflight_error})` : ""}`);
+            captureSpin.warn("Chat import", `${base} · ${captureWorkerLabel} preflight failed${report.preflight_error ? ` (${report.preflight_error})` : ""}`);
         }
         else if (report.errors > 0) {
             captureSpin.warn("Chat import", `${base} · ${report.errors} error(s)`);
@@ -1115,7 +1288,7 @@ export async function runFirstCapturePass(configPath, dataDir) {
     }
 }
 // ----- Step 8: import -----
-async function collectImportPath(opts, rl) {
+async function collectImportPath(opts, rl, capture) {
     // opts.importExport is `string | false | undefined` — Commander writes
     // `false` when `--no-import-export` was passed, but the caller already
     // short-circuits in that case. Only a non-empty string is a real path.
@@ -1129,11 +1302,23 @@ async function collectImportPath(opts, rl) {
     // user who has never exported a chat archive shouldn't hit a bare
     // "Drop a path" prompt. The source-sniffer below still fail-fasts a
     // non-ChatGPT export, but the friend learns the boundary earlier here.
+    //
+    // The "skipping is fine" reassurance MUST match what will actually happen.
+    // Auto-capture is OFF by default, AND can be configured-on-but-not-running
+    // when the triage-worker preflight failed — promising "new chats get captured
+    // automatically" in either case is the exact trust break this flow removes.
+    // Only promise it when capture will genuinely run; otherwise point at the
+    // real next step (fix the triage worker if configured, or enable it if off).
+    const whySkip = capture.willRun
+        ? "skipping is fine — new chats get captured automatically."
+        : capture.configured
+            ? `skipping is fine — import later with \`rift import\` (auto-capture is on but won't run until ${capture.workerLabel} is ready — see above).`
+            : "skipping is fine — import later with `rift import`, or turn on auto-capture with `rift onboard --enable-capture`.";
     ui.detail([
         "Import past chats (optional)",
         "• What: the file path to a ChatGPT data export (a .zip or .json on your Mac), e.g. ~/Downloads/chatgpt-export.zip.",
         "• Where: chatgpt.com → Settings → Data controls → Export data, then unzip nothing — just drop the downloaded file's path here.",
-        "• Why: this seeds Rift with your existing ChatGPT history so search works on day one; skipping is fine — new chats get captured automatically.",
+        `• Why: this seeds Rift with your existing ChatGPT history so search works on day one; ${whySkip}`,
         "• Other tools: Claude/Grok/Gemini exports aren't imported here. Run them later with: rift import <path> --source claude_web|grok_web|gemini_web",
     ].join("\n"));
     const answer = (await ask(rl, "Path to a ChatGPT export to import now (or `skip`): ", "skip")).trim();
@@ -1196,14 +1381,22 @@ async function runImport(filePath, configPath) {
     return { kind: "imported", jobId: resp.job_id };
 }
 /**
- * Pure outcome decision for the next-action card. Onboarding is only
- * "complete" when this run actually ingested user data AND a recall
- * query against the freshly-ingested data returned at least one hit.
- * Smoke is non-indexing (see daemonRefreshFlow), so any hit is real
- * user data, not a leftover probe.
+ * Pure outcome decision for the next-action card.
+ *
+ * "Complete + verified" needs both: this run ingested user data AND a recall
+ * query returned a hit (smoke is non-indexing — see daemonRefreshFlow — so a
+ * hit is real user data, not a leftover probe).
+ *
+ * But an EMPTY archive is not a failure. By default capture is OFF (zero-Codex
+ * trust default) and import is optional, so a friend who simply presses Enter
+ * past the import prompt has finished a valid setup — they just have nothing to
+ * recall yet. That case (`ingestAttempted === false`) is reported as DONE, not
+ * "incomplete". We only flag a retry when an ingest was actually attempted and
+ * still added nothing.
  */
 export function decideOnboardOutcome(input) {
     const { ingestedAny, recall } = input;
+    const ingestAttempted = input.ingestAttempted ?? false;
     if (ingestedAny && recall.ok && recall.hits > 0) {
         return [
             `Setup complete — recall returned ${recall.hits} result(s) from your data.`,
@@ -1211,10 +1404,19 @@ export function decideOnboardOutcome(input) {
         ];
     }
     if (!ingestedAny) {
+        if (!ingestAttempted) {
+            // Deliberate empty setup — a finished, valid state, not a failure.
+            return [
+                "Setup complete — nothing imported yet.",
+                "Import later: rift import <path> --source <name>",
+                "Next: rift mcp install --client=claude-desktop",
+            ];
+        }
+        // An ingest ran but landed nothing — honest, calm retry guidance.
         return [
-            "Setup incomplete — no user data was captured or imported during onboarding.",
-            "Next: drop an export at the prompt above and re-run rift onboard,",
-            "      or run: rift import <path> --source <name>",
+            "Setup ready — but capture/import added nothing this run.",
+            "Try: rift import <path> --source <name>",
+            "If it repeats: rift feedback --kind=broke --with-status",
         ];
     }
     if (recall.ok) {
@@ -1377,7 +1579,8 @@ function say(line) {
 function sayPrivacyContract() {
     ui.detail([
         "• Conversation content stays local (LanceDB + raw transcripts).",
-        "• Content snippets leave the machine for embedding only (Voyage AI).",
+        "• Indexed conversation text — and your search queries — leave the machine",
+        "  for embedding only when a Voyage key is configured (Voyage AI).",
         "• The Voyage key sits in ~/.rift.env (mode 0600), is sent only to Voyage,",
         "  and is never logged or sent to Clem.",
         "• Feedback is stored locally as JSONL. Relay is opt-in: explicit notes only,",