@oaklandzoo/ostup 0.7.0 → 0.9.0

package/src/bootstrap.mjs

@@ -0,0 +1,201 @@
+// bootstrap.mjs: in-CLI stage 2. Detect missing tools via tool-registry, explain in plain English,
+// confirm, install via exec.run (stdio: inherit so OS prompts reach the terminal), patch PATH,
+// verify, and continue. Stage 1 (install.sh / install.ps1) handles Node and Homebrew/winget; this
+// module never touches those — but it does check that brew/winget exist before attempting installs
+// that require them, so beginners who skipped stage 1 get a clear pointer back to it.
+import * as p from '@clack/prompts';
+import { execSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { detectAll, installCommandFor } from './tool-registry.mjs';
+import { run as exec } from './exec.mjs';
+
+const STAGE1_HINT = {
+  darwin: 'Mac installer: /bin/bash -c "$(curl -fsSL https://ostup-install.vercel.app/install.sh)"',
+  win32: 'Windows installer: irm https://ostup-install.vercel.app/install.ps1 | iex',
+  linux: 'On Linux, install Node 20+ from https://nodejs.org or your package manager, then re-run.',
+};
+
+function buildExplainer(missing) {
+  const items = missing.map((m, i) => `  ${i + 1}. ${m.tool.name.padEnd(14)} ${m.tool.blurb}`);
+  return [
+    '',
+    'ostup needs the following before it can build your site:',
+    '',
+    ...items,
+    '',
+  ].join('\n');
+}
+
+function describePlan(plan) {
+  if (plan.kind === 'manual') {
+    return `(manual) ${plan.url}${plan.note ? ` — ${plan.note}` : ''}`;
+  }
+  return `${plan.cmd} ${(plan.args || []).join(' ')}`;
+}
+
+function defaultHasOnPath(bin) {
+  try {
+    if (process.platform === 'win32') {
+      execSync(`where.exe ${bin}`, { stdio: ['ignore', 'pipe', 'ignore'] });
+    } else {
+      execSync(`command -v ${bin}`, { stdio: ['ignore', 'pipe', 'ignore'], shell: '/bin/bash' });
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function patchPathFor(plan) {
+  if (!plan.postPath || plan.postPath.length === 0) return;
+  const sep = process.platform === 'win32' ? ';' : ':';
+  const existing = (process.env.PATH || '').split(sep);
+  const toAdd = plan.postPath.filter((dir) => !existing.includes(dir));
+  if (toAdd.length === 0) return;
+  process.env.PATH = toAdd.join(sep) + sep + (process.env.PATH || '');
+}
+
+function checkInstallPrerequisites(missing, hasOnPath, platform) {
+  const reasons = [];
+  for (const m of missing) {
+    const plan = installCommandFor(m.tool, platform);
+    if (plan.kind === 'brew' && !hasOnPath('brew')) {
+      reasons.push({
+        tool: m.tool.name,
+        prereq: 'Homebrew',
+        hint: STAGE1_HINT.darwin,
+      });
+    }
+    if (plan.kind === 'winget' && !hasOnPath('winget')) {
+      reasons.push({
+        tool: m.tool.name,
+        prereq: 'WinGet (Microsoft App Installer)',
+        hint: 'Update App Installer from the Microsoft Store: ms-windows-store://pdp/?productid=9NBLGGH4NNS1',
+      });
+    }
+  }
+  // Dedupe by prereq
+  const seen = new Set();
+  return reasons.filter((r) => {
+    if (seen.has(r.prereq)) return false;
+    seen.add(r.prereq);
+    return true;
+  });
+}
+
+function printInstallPlan(missing, platform = process.platform) {
+  process.stdout.write('Install plan:\n');
+  for (const m of missing) {
+    const plan = installCommandFor(m.tool, platform);
+    process.stdout.write(`  ${m.tool.name}: ${describePlan(plan)}\n`);
+  }
+  process.stdout.write('\n');
+}
+
+export async function runBootstrap({
+  flags = {},
+  detect = detectAll,
+  hasOnPath = defaultHasOnPath,
+  platform = process.platform,
+} = {}) {
+  const { found, missing } = detect();
+  if (missing.length === 0) {
+    if (flags.bootstrapOnly) {
+      process.stdout.write('[bootstrap] all required tools present. Nothing to install.\n');
+    }
+    return { found, missing: [], installed: [], skipped: true };
+  }
+
+  process.stdout.write(buildExplainer(missing));
+
+  // --no-install: print plan, exit 0 without changing anything.
+  if (flags.noInstall) {
+    printInstallPlan(missing, platform);
+    process.stdout.write('No changes made. Re-run without --no-install to actually install.\n');
+    return { found, missing, installed: [], deferred: 'no-install' };
+  }
+
+  // Manual-only missing tools (e.g. Node version mismatch): cannot auto-install here.
+  // Point the user at the stage-1 installer for their OS and bail.
+  const manualOnly = missing.filter((m) => installCommandFor(m.tool, platform).kind === 'manual');
+  if (manualOnly.length > 0) {
+    const lines = ['Some tools cannot be installed by ostup directly:'];
+    for (const m of manualOnly) {
+      const plan = installCommandFor(m.tool, platform);
+      lines.push(`  - ${m.tool.name}: ${plan.url}`);
+      if (plan.note) lines.push(`    ${plan.note}`);
+    }
+    lines.push('');
+    lines.push(STAGE1_HINT[platform] || STAGE1_HINT.linux);
+    lines.push('');
+    process.stdout.write(lines.join('\n') + '\n');
+    const err = new Error('Manual install required for: ' + manualOnly.map((m) => m.tool.name).join(', '));
+    err.code = 'UNSUPPORTED_OS_INSTALL';
+    throw err;
+  }
+
+  // Prerequisite check (brew on Mac, winget on Windows).
+  const prereqProblems = checkInstallPrerequisites(missing, hasOnPath, platform);
+  if (prereqProblems.length > 0) {
+    const lines = ['Cannot install — a prerequisite is missing on your machine:'];
+    for (const r of prereqProblems) {
+      lines.push(`  - ${r.prereq} (needed for ${r.tool})`);
+      lines.push(`    ${r.hint}`);
+    }
+    lines.push('');
+    process.stdout.write(lines.join('\n') + '\n');
+    const err = new Error('Bootstrap cannot run: ' + prereqProblems.map((r) => r.prereq).join(', ') + ' missing.');
+    err.code = 'BOOTSTRAP_FAILED';
+    throw err;
+  }
+
+  // Need a TTY for the confirm prompt unless --yes.
+  if (!flags.yes && !process.stdin.isTTY) {
+    const err = new Error('Cannot prompt to install: no terminal detected. Pass --no-install to print the plan, or --yes to auto-accept, or run in a terminal.');
+    err.code = 'NO_TTY_BOOTSTRAP';
+    throw err;
+  }
+
+  printInstallPlan(missing, platform);
+
+  if (!flags.yes) {
+    const ok = await p.confirm({ message: 'Install these now?' });
+    if (p.isCancel(ok) || ok === false) {
+      const err = new Error('Bootstrap declined. Re-run when ready, or install the tools manually.');
+      err.code = 'BOOTSTRAP_DECLINED';
+      throw err;
+    }
+  }
+
+  // Run installs sequentially. stdio: 'inherit' so sudo/UAC prompts, progress bars, and
+  // any interactive winget/brew confirmations reach the user's terminal.
+  const installed = [];
+  for (const m of missing) {
+    const plan = installCommandFor(m.tool, platform);
+    await exec(`bootstrap-${m.tool.id}`, plan.cmd, plan.args || [], {
+      stdio: 'inherit',
+      cwd: homedir(),
+    });
+    patchPathFor(plan);
+    installed.push(m.tool.id);
+  }
+
+  // Re-detect to verify the installs worked.
+  const second = detect();
+  if (second.missing.length > 0) {
+    const stillMissing = second.missing.map((m) => m.tool.name).join(', ');
+    const err = new Error(
+      `Bootstrap finished but these tools are still not detected: ${stillMissing}. ` +
+      `Open a new terminal and re-run, or check the run log for details.`
+    );
+    err.code = 'BOOTSTRAP_VERIFY_FAILED';
+    throw err;
+  }
+
+  process.stdout.write(`\n[bootstrap] installed ${installed.length} tool(s): ${installed.join(', ')}. Continuing.\n\n`);
+  return { found: second.found, missing: [], installed };
+}
+
+export async function runBootstrapStandalone({ flags = {} } = {}) {
+  return runBootstrap({ flags: { ...flags, bootstrapOnly: true } });
+}

package/src/credential-prompts.mjs

@@ -1,6 +1,7 @@
 // credential-prompts.mjs: detect GitHub and Vercel credentials, prompt and persist only if missing.
 import * as p from '@clack/prompts';
 import { execSync } from 'node:child_process';
+import { run as exec } from './exec.mjs';
 
 export function checkGithubAuth({ env = process.env, runner = defaultCmdOk } = {}) {
   if (env.GH_TOKEN) return { ok: true, source: 'env-or-dotenv' };
@@ -80,21 +81,71 @@ export async function promptForVercelToken() {
   return typeof token === 'string' && token.trim() ? token.trim() : null;
 }
 
-export async function ensureCredentials({ stack = 'next' } = {}) {
+function binaryOnPath(bin) {
+  try {
+    execSync(`${bin} --version`, { stdio: ['ignore', 'ignore', 'ignore'] });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function chooseAuthMethod({ provider }) {
+  const choice = await p.select({
+    message: `${provider}: how would you like to sign in?`,
+    options: [
+      { value: 'browser', label: `Sign in to ${provider} in your browser (recommended)` },
+      { value: 'token', label: 'Paste a personal access token instead' },
+    ],
+    initialValue: 'browser',
+  });
+  if (p.isCancel(choice)) return 'token';
+  return choice;
+}
+
+async function attemptBrowserAuth({ provider }) {
+  try {
+    if (provider === 'GitHub') {
+      await exec('gh-auth', 'gh', ['auth', 'login', '--web', '-h', 'github.com'], { stdio: 'inherit' });
+    } else if (provider === 'Vercel') {
+      await exec('vercel-auth', 'vercel', ['login'], { stdio: 'inherit' });
+    }
+    return true;
+  } catch {
+    process.stdout.write(`${provider} browser sign-in did not complete. Falling back to token paste.\n`);
+    return false;
+  }
+}
+
+export async function ensureCredentials({ stack = 'next', flags = {} } = {}) {
   const collected = {};
 
   const gh = checkGithubAuth();
   if (gh.ok) {
     process.stdout.write(`GitHub: using existing auth (${gh.source}).\n`);
   } else {
-    const token = await promptForGithubToken();
-    if (!token) {
-      const err = new Error('GitHub credentials are required.');
-      err.code = 'NO_GH_CREDS';
-      throw err;
+    let signedIn = false;
+    if (binaryOnPath('gh')) {
+      const method = flags.yes ? 'browser' : await chooseAuthMethod({ provider: 'GitHub' });
+      if (method === 'browser') {
+        signedIn = await attemptBrowserAuth({ provider: 'GitHub' });
+        if (signedIn && checkGithubAuth().ok) {
+          process.stdout.write('GitHub: signed in via browser.\n');
+        } else {
+          signedIn = false;
+        }
+      }
+    }
+    if (!signedIn) {
+      const token = await promptForGithubToken();
+      if (!token) {
+        const err = new Error('GitHub credentials are required.');
+        err.code = 'NO_GH_CREDS';
+        throw err;
+      }
+      process.env.GH_TOKEN = token;
+      collected.GH_TOKEN = token;
     }
-    process.env.GH_TOKEN = token;
-    collected.GH_TOKEN = token;
   }
 
   if (stack !== 'none') {
@@ -102,14 +153,28 @@ export async function ensureCredentials({ stack = 'next' } = {}) {
     if (v.ok) {
       process.stdout.write(`Vercel: using existing auth (${v.source}).\n`);
     } else {
-      const token = await promptForVercelToken();
-      if (!token) {
-        const err = new Error('Vercel credentials are required for stack=' + stack + '.');
-        err.code = 'NO_VERCEL_CREDS';
-        throw err;
+      let signedIn = false;
+      if (binaryOnPath('vercel')) {
+        const method = flags.yes ? 'browser' : await chooseAuthMethod({ provider: 'Vercel' });
+        if (method === 'browser') {
+          signedIn = await attemptBrowserAuth({ provider: 'Vercel' });
+          if (signedIn && checkVercelAuth().ok) {
+            process.stdout.write('Vercel: signed in via browser.\n');
+          } else {
+            signedIn = false;
+          }
+        }
+      }
+      if (!signedIn) {
+        const token = await promptForVercelToken();
+        if (!token) {
+          const err = new Error('Vercel credentials are required for stack=' + stack + '.');
+          err.code = 'NO_VERCEL_CREDS';
+          throw err;
+        }
+        process.env.VERCEL_TOKEN = token;
+        collected.VERCEL_TOKEN = token;
       }
-      process.env.VERCEL_TOKEN = token;
-      collected.VERCEL_TOKEN = token;
     }
   }
 

package/src/doctor.mjs

@@ -0,0 +1,188 @@
+// doctor.mjs: self-diagnosis subcommand. Runs preflight + auth checks + permissions + reports.
+
+import { existsSync } from 'node:fs';
+import { execSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join, resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { detectAll, installCommandFor } from './tool-registry.mjs';
+import { checkGithubAuth, checkVercelAuth } from './credential-prompts.mjs';
+
+function runOk(cmd) {
+  try {
+    execSync(cmd, { stdio: ['ignore', 'pipe', 'ignore'] });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function runCapture(cmd) {
+  try {
+    return execSync(cmd, { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
+  } catch {
+    return null;
+  }
+}
+
+export async function runDoctor() {
+  const findings = [];
+  let okCount = 0;
+  let failCount = 0;
+  let warnCount = 0;
+
+  function report(level, label, detail) {
+    findings.push({ level, label, detail });
+    if (level === 'ok') okCount++;
+    else if (level === 'fail') failCount++;
+    else warnCount++;
+  }
+
+  // === Tool detection (shared with bootstrap) ===
+  const detection = detectAll();
+  for (const f of detection.found) {
+    report('ok', f.tool.name.toLowerCase().replace(/\s+/g, '-'), f.version);
+  }
+  for (const m of detection.missing) {
+    const plan = installCommandFor(m.tool);
+    const planStr = plan.kind === 'manual'
+      ? plan.url
+      : `${plan.cmd} ${(plan.args || []).join(' ')}`;
+    const detail = m.reason === 'version-too-old'
+      ? `${m.detected} too old; need ${m.tool.detect.minMajor}+. Fix: ${planStr}`
+      : `not installed. Fix: ${planStr}`;
+    report('fail', m.tool.name.toLowerCase().replace(/\s+/g, '-'), detail);
+  }
+
+  // === Git config ===
+  const gitName = runCapture('git config --global user.name');
+  const gitEmail = runCapture('git config --global user.email');
+  if (gitName && gitEmail) {
+    report('ok', 'git config', `${gitName} <${gitEmail}>`);
+  } else {
+    report('fail', 'git config', 'user.name or user.email not set; commits will fail. Run: git config --global user.name "Your Name" && git config --global user.email you@example.com');
+  }
+
+  // === GitHub auth ===
+  const gh = checkGithubAuth();
+  if (gh.ok) {
+    const ghUser = runCapture('gh api user --jq .login') || '(unknown)';
+    report('ok', 'gh auth', `authenticated as ${ghUser} (source: ${gh.source})`);
+    // Check scopes
+    const scopes = runCapture('gh auth status 2>&1 | grep -oE "Token scopes:.*"');
+    if (scopes) {
+      report('ok', 'gh scopes', scopes.replace('Token scopes:', '').trim());
+      if (!scopes.includes('delete_repo')) {
+        report('warn', 'gh delete_repo scope', 'missing; synthetic test cleanup will require manual deletion. Run: gh auth refresh -h github.com -s delete_repo');
+      }
+    }
+  } else {
+    report('fail', 'gh auth', 'not authenticated; run: gh auth login');
+  }
+
+  // === Vercel auth ===
+  const v = checkVercelAuth();
+  if (v.ok) {
+    const vUser = runCapture('vercel whoami');
+    report('ok', 'vercel auth', `authenticated as ${vUser || '(unknown)'} (source: ${v.source})`);
+
+    // Detect personal-account-as-scope risk
+    const teams = runCapture('vercel teams ls 2>&1 | grep -E "^✔|^\\*" | head -5');
+    if (teams) {
+      report('ok', 'vercel teams', teams.replace(/\n/g, '; '));
+    }
+  } else {
+    report('fail', 'vercel auth', 'not authenticated; run: vercel login');
+  }
+
+  // === Vercel AI Gateway key (optional but needed for /generate-image) ===
+  if (process.env.VERCEL_AI_GATEWAY_KEY) {
+    report('ok', 'VERCEL_AI_GATEWAY_KEY', 'present (image generation enabled)');
+  } else {
+    report('warn', 'VERCEL_AI_GATEWAY_KEY', 'not set; /generate-image will fail until set. Get key at https://vercel.com/dashboard/ai-gateway');
+  }
+
+  // === Chrome for screenshot verification ===
+  const chromeMac = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome';
+  if (existsSync(chromeMac)) {
+    report('ok', 'chrome', 'present (visual verification supported per CLAUDE.md Part 19)');
+  } else if (runOk('which chromium 2>/dev/null') || runOk('which google-chrome 2>/dev/null')) {
+    report('ok', 'chrome', 'chromium or google-chrome on PATH');
+  } else {
+    report('warn', 'chrome', 'no Chrome detected; visual verification per CLAUDE.md Part 19 will not work. Install from https://www.google.com/chrome/');
+  }
+
+  // === Disk space in home dir ===
+  const dfHome = runCapture(`df -k ${homedir()} | tail -1 | awk '{print $4}'`);
+  if (dfHome) {
+    const kbFree = parseInt(dfHome, 10);
+    if (Number.isFinite(kbFree) && kbFree < 1024 * 1024) {
+      // less than 1 GB free
+      report('warn', 'disk space', `${(kbFree / 1024).toFixed(0)} MB free in ${homedir()}; scaffolds may fail (npm install needs ~500 MB)`);
+    } else {
+      report('ok', 'disk space', `${(kbFree / 1024 / 1024).toFixed(1)} GB free in ${homedir()}`);
+    }
+  }
+
+  // === Memory dir creatable ===
+  const memTest = join(homedir(), '.claude', 'projects', '__ostup_doctor_test__', 'memory');
+  try {
+    const { mkdir, rm } = await import('node:fs/promises');
+    await mkdir(memTest, { recursive: true });
+    await rm(memTest, { recursive: true, force: true });
+    report('ok', 'memory dir', 'can create ~/.claude/projects/<project>/memory at scaffold time');
+  } catch (err) {
+    report('fail', 'memory dir', `cannot create ~/.claude/projects/__ostup_doctor_test__/memory: ${err.message}`);
+  }
+
+  // === Log dir creatable ===
+  try {
+    const { mkdir } = await import('node:fs/promises');
+    await mkdir(join(homedir(), '.ostup', 'logs'), { recursive: true });
+    report('ok', 'log dir', `~/.ostup/logs/ writable (run logs land here)`);
+  } catch (err) {
+    report('fail', 'log dir', `cannot create ~/.ostup/logs/: ${err.message}`);
+  }
+
+  // === npm version (we don't call `npm bin` anymore, but warn on very old npm) ===
+  const npmVer = runCapture('npm --version');
+  if (npmVer) {
+    const major = parseInt(npmVer.split('.')[0], 10);
+    if (major < 9) {
+      report('warn', 'npm version', `${npmVer} is old; recommend npm 9+. Run: npm install -g npm@latest`);
+    } else {
+      report('ok', 'npm', npmVer);
+    }
+  }
+
+  // === ostup tarball install location (sanity) ===
+  const pkgRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+  report('ok', 'ostup install', pkgRoot);
+
+  return { findings, okCount, warnCount, failCount };
+}
+
+export function printDoctorReport({ findings, okCount, warnCount, failCount }) {
+  const lines = [];
+  lines.push('');
+  lines.push('=====================================');
+  lines.push('  ostup doctor: self-diagnosis');
+  lines.push('=====================================');
+  lines.push('');
+  for (const f of findings) {
+    const sym = f.level === 'ok' ? '  OK  ' : f.level === 'warn' ? ' WARN ' : ' FAIL ';
+    lines.push(`[${sym}] ${f.label.padEnd(28)} ${f.detail || ''}`);
+  }
+  lines.push('');
+  lines.push(`Summary: ${okCount} OK, ${warnCount} WARN, ${failCount} FAIL`);
+  lines.push('');
+  if (failCount > 0) {
+    lines.push('Fix the FAILs before running `ostup init`. WARNs are optional.');
+  } else if (warnCount > 0) {
+    lines.push('No blockers. WARNs are optional improvements.');
+  } else {
+    lines.push('Everything clean. Ready to scaffold.');
+  }
+  lines.push('');
+  return lines.join('\n');
+}

package/src/exec.mjs

@@ -1,5 +1,6 @@
 // exec.mjs: uniform shell call wrapper with logging, dry-run capture, and step-aware error formatting.
 import { execa } from 'execa';
+import { traceStep, getLogPath } from './tracer.mjs';
 
 const HINTS = {
   'gh repo create': 'Confirm the repo name is not already taken under this owner.',
@@ -56,19 +57,55 @@ export async function run(step, cmd, args = [], opts = {}) {
     return { stdout: '', stderr: '', exitCode: 0, dryRun: true };
   }
   if (!_quiet) process.stdout.write(`[${step}] start: ${display}\n`);
+  const start = Date.now();
   try {
-    return await _runner(cmd, args, { ...opts });
+    const result = await _runner(cmd, args, { ...opts });
+    const duration = Date.now() - start;
+    await traceStep({
+      step, cmd, args,
+      stdout: result?.stdout || '',
+      stderr: result?.stderr || '',
+      exitCode: result?.exitCode || 0,
+      durationMs: duration,
+    });
+    return result;
   } catch (err) {
-    const stderr = (err && (err.stderr || err.shortMessage || err.message) || '').toString().trim();
-    process.stderr.write(
-      [
-        `[${step}] FAIL`,
-        `  Command: ${display}`,
-        `  Stderr:  ${stderr || '(empty)'}`,
-        `  Fix:     ${hintFor(cmd, args)}`,
-        'Exit 1.',
-      ].join('\n') + '\n'
-    );
+    const duration = Date.now() - start;
+    const stdout = (err && err.stdout || '').toString();
+    const stderr = (err && err.stderr || '').toString();
+    const message = (err && (err.shortMessage || err.message) || '').toString().trim();
+
+    // Capture both stdout AND stderr (was stderr-only). Some tools (vercel, gh) output errors to stdout.
+    const stdoutTail = stdout.split('\n').slice(-15).join('\n').trim();
+    const stderrTail = stderr.split('\n').slice(-15).join('\n').trim();
+    const logPath = getLogPath();
+
+    const lines = [`[${step}] FAIL`, `  Command: ${display}`];
+    if (stderrTail) {
+      lines.push(`  Stderr (last 15 lines):`);
+      for (const l of stderrTail.split('\n')) lines.push(`    ${l}`);
+    }
+    if (stdoutTail) {
+      lines.push(`  Stdout (last 15 lines):`);
+      for (const l of stdoutTail.split('\n')) lines.push(`    ${l}`);
+    }
+    if (!stderrTail && !stdoutTail && message) {
+      lines.push(`  Error: ${message}`);
+    }
+    lines.push(`  Fix:     ${hintFor(cmd, args)}`);
+    if (logPath) {
+      lines.push(`  Log:     ${logPath}`);
+    }
+    lines.push('Exit 1.');
+    process.stderr.write(lines.join('\n') + '\n');
+
+    await traceStep({
+      step, cmd, args,
+      stdout, stderr,
+      exitCode: err?.exitCode || 1,
+      durationMs: duration,
+    });
+
     const e = new Error(`step ${step} failed`);
     e.code = 'STEP_FAILED';
     e.step = step;

package/src/mvp-flow.mjs

@@ -5,6 +5,7 @@ import { homedir } from 'node:os';
 import { resolve, join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { preflightOrExit } from './preflight.mjs';
+import { runBootstrap } from './bootstrap.mjs';
 import { runProjectPrompts, printSummary as printAnswersSummary, confirmProceed } from './project-prompts.mjs';
 import { ensureCredentials } from './credential-prompts.mjs';
 import { maybeScaffoldStack } from './steps/next-app.mjs';
@@ -34,6 +35,10 @@ export async function runMvp({ flags = {}, cwd = process.cwd() } = {}) {
     throw err;
   }
 
+  if (!flags.skipBootstrap) {
+    await runBootstrap({ flags });
+  }
+
   preflightOrExit();
 
   let brief = null;
@@ -79,7 +84,7 @@ export async function runMvp({ flags = {}, cwd = process.cwd() } = {}) {
     }
   }
 
-  const creds = await ensureCredentials({ stack: answers.stack });
+  const creds = await ensureCredentials({ stack: answers.stack, flags });
 
   const targetDir = resolve(cwd, answers.projectName);
   await ensureFreshTarget(targetDir, flags.force);

package/src/preflight.mjs

@@ -1,12 +1,9 @@
 // preflight.mjs: verify required binaries (node, git, gh, vercel) are installed.
+// CHECKS now comes from tool-registry.mjs — single source of truth shared with bootstrap and doctor.
 import { execSync } from 'node:child_process';
+import { CHECKS as REGISTRY_CHECKS } from './tool-registry.mjs';
 
-export const CHECKS = [
-  { name: 'Node',       cmd: ['node', '--version'],   fix: 'Install Node 20+ from https://nodejs.org', minNodeMajor: 20 },
-  { name: 'Git',        cmd: ['git', '--version'],    fix: 'Install git from https://git-scm.com' },
-  { name: 'GitHub CLI', cmd: ['gh', '--version'],     fix: 'Install: brew install gh' },
-  { name: 'Vercel CLI', cmd: ['vercel', '--version'], fix: 'Install: npm i -g vercel' },
-];
+export const CHECKS = REGISTRY_CHECKS;
 
 function defaultRunner(cmd) {
   return execSync(cmd.join(' '), { stdio: ['ignore', 'pipe', 'ignore'] }).toString();