@openrig/cli 0.6.6 → 0.6.8

package/dist/commands/setup.js

@@ -2,50 +2,24 @@ import { Command } from "commander";
 import { execSync } from "node:child_process";
 import { readFileSync, writeFileSync, existsSync, accessSync, constants, mkdirSync } from "node:fs";
 import path from "node:path";
+import { homedir } from "node:os";
+import { shellQuote } from "../cross-host-executor.js";
 import { fileURLToPath } from "node:url";
 import { parseDocument } from "yaml";
 import { runDoctorChecks } from "./doctor.js";
-import { formatDaemonHostForUrl } from "../client.js";
 import { ConfigStore } from "../config-store.js";
-import { CMUX_SETTINGS_DISCLOSURE_PATH, isCmuxSocketControlCompatible, readCmuxSocketControlModeFromText, resolveCmuxSettingsPath, upsertCmuxSocketControlMode, } from "../cmux-config.js";
 import { buildTmuxControlFailure, probeTmuxControl } from "../tmux-health.js";
-import { parse as parseToml } from "smol-toml";
-import { resolveCodexHome } from "../lib/codex-auth.js";
-export function selectCodexProviderAuth(configToml) {
-    if (configToml === null)
-        return { kind: "openai-login" };
-    let config;
-    try {
-        config = parseToml(configToml);
-    }
-    catch {
-        return { kind: "openai-login", unresolved: "config.toml could not be parsed" };
-    }
-    if (Object.hasOwn(config, "profile")) {
-        return { kind: "openai-login", unresolved: "config.toml selects a legacy profile, which is not resolved here" };
-    }
-    const providerId = config["model_provider"];
-    const providers = config["model_providers"];
-    if (typeof providerId !== "string" || !providers || typeof providers !== "object" || !Object.hasOwn(providers, providerId)) {
-        return { kind: "openai-login" };
-    }
-    const entry = providers[providerId];
-    if (!entry || typeof entry !== "object")
-        return { kind: "openai-login" };
-    const { requires_openai_auth: requiresOpenAiAuth, env_key: envKey } = entry;
-    if (requiresOpenAiAuth !== false || typeof envKey !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(envKey)) {
-        return { kind: "openai-login" };
-    }
-    return { kind: "env-key", providerId, envKey };
-}
+import { checkClaudeAuth, checkCodexAuth } from "../provider-auth.js";
+// Preserve the setup module's existing selector export.
+export { selectCodexProviderAuth } from "../provider-auth.js";
 const DEFAULT_COMMAND_TIMEOUT_MS = 30_000;
 const INSTALL_COMMAND_TIMEOUT_MS = 5 * 60_000;
-const CMUX_READY_ATTEMPTS = 5;
-const CMUX_READY_DELAY_MS = 1_000;
+const HERDR_INSTALL_COMMAND = "curl -fsSL https://herdr.dev/install.sh | sh";
 const CORE_STEP_IDS = [
     "brew",
     "tmux_install",
-    "cmux_install",
+    "herdr_install",
+    "ghostty_install",
     "claude_install",
     "claude_auth",
     "codex_install",
@@ -55,11 +29,9 @@ const CORE_STEP_IDS = [
 ];
 const FULL_EXTRA_STEP_IDS = ["jq_install", "gh_install"];
 const BREW_PLATFORM_SKIP = "Skipped: Homebrew setup path is only used on macOS.";
-const BREW_UNAVAILABLE_SKIP = "Skipped: Homebrew not available.";
-/** Steps the real run skips off macOS, with the message it gives (cmux is a macOS app installed via Homebrew). */
+/** Homebrew is only used by the macOS setup path. Herdr also installs on Linux. */
 const NON_DARWIN_DRY_RUN_SKIPS = {
     brew: BREW_PLATFORM_SKIP,
-    cmux_install: BREW_UNAVAILABLE_SKIP,
 };
 const BASE_RUNTIME_CONFIG_DISCLOSURE = [
     // OPR.0.4.8.2 agnostic rip-out: OpenRig no longer writes ~/.claude/settings.json — the global
@@ -74,7 +46,7 @@ const BASE_RUNTIME_CONFIG_DISCLOSURE = [
         scope: "project",
         runtime: "claude-code",
         path: ".claude/settings.local.json",
-        purpose: "Apply context-collector statusLine config and the acceptEdits floor fragment. OpenRig bakes NO allow/ask/deny permission policy — the harness-native permissions are the control surface.",
+        purpose: "Apply context-collector statusLine config and the acceptEdits floor fragment. The team and kernel launch defaults pass allow/ask lists per launch and save none; a selected Claude settings fragment can merge native settings, rules included; the harness-native permissions are the control surface.",
     },
     {
         scope: "project",
@@ -89,12 +61,6 @@ const BASE_RUNTIME_CONFIG_DISCLOSURE = [
         purpose: "Pre-trust managed workspaces and apply selected Codex config runtime-resource fragments.",
     },
 ];
-const DARWIN_RUNTIME_CONFIG_DISCLOSURE = {
-    scope: "global",
-    runtime: "cmux",
-    path: CMUX_SETTINGS_DISCLOSURE_PATH,
-    purpose: "Set cmux socket control to an OpenRig-compatible automation mode.",
-};
 export function defaultDeps() {
     return {
         exec: (cmd, opts) => execSync(cmd, {
@@ -116,89 +82,74 @@ export function defaultDeps() {
 function installCommand(deps, cmd) {
     return deps.exec(cmd, { timeoutMs: INSTALL_COMMAND_TIMEOUT_MS });
 }
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function waitForCmuxCapabilities(deps, attempts = CMUX_READY_ATTEMPTS) {
-    for (let index = 0; index < attempts; index += 1) {
+/** Probe without starting a server or taking over the installing terminal. */
+function findHerdrCommand(deps) {
+    const env = deps.env ?? process.env;
+    const installDir = env["HERDR_INSTALL_DIR"] ?? path.join(env["HOME"] ?? homedir(), ".local", "bin");
+    for (const command of ["herdr", shellQuote(path.join(installDir, "herdr"))]) {
         try {
-            deps.exec("cmux capabilities --json");
-            return true;
-        }
-        catch {
-            if (index < attempts - 1) {
-                await sleep(CMUX_READY_DELAY_MS);
-            }
+            deps.exec(`${command} --version`);
+            return command;
         }
+        catch { /* Try the installer's default path if it is not on PATH. */ }
     }
-    return false;
+    return null;
 }
-async function tryEnableCmuxControl(deps, platform) {
-    if (platform !== "darwin")
-        return false;
-    const settingsPath = resolveCmuxSettingsPath();
-    const settingsText = deps.readFile(settingsPath);
-    const currentMode = readCmuxSocketControlModeFromText(settingsText);
-    if (currentMode.error) {
-        return false;
+function installHerdr(deps, platform) {
+    if (platform !== "darwin" && platform !== "linux") {
+        return { id: "herdr_install", status: "skipped", message: "Automatic herdr installation is supported on macOS and Linux." };
     }
+    let command = findHerdrCommand(deps);
+    const present = command !== null;
     try {
-        deps.mkdirp?.(path.dirname(settingsPath));
-        const next = upsertCmuxSocketControlMode(settingsText, "automation");
-        if (next.changed) {
-            deps.writeFile(settingsPath, next.content);
-        }
-    }
-    catch {
-        return false;
-    }
-    const shellReady = await waitForCmuxCapabilities(deps, 1);
-    if (shellReady) {
-        try {
-            deps.exec("cmux reload-config");
+        if (!command) {
+            installCommand(deps, HERDR_INSTALL_COMMAND);
+            command = findHerdrCommand(deps);
+            if (!command)
+                throw new Error("The installer returned, but the herdr binary could not be verified.");
         }
-        catch {
-            // Best effort: if reload fails, the daemon-side verification will surface it honestly.
-        }
-        return waitForCmuxCapabilities(deps, 1);
-    }
-    try {
-        deps.exec("open -a /Applications/cmux.app");
+        return {
+            id: "herdr_install",
+            status: present ? "pass" : "applied",
+            message: `${present ? "Found" : "Installed"} herdr (${command}). No terminal or view was opened.`,
+            ...(command !== "herdr" ? { fixHint: `Use ${command} when opening the view, or add its directory to your shell PATH.` } : {}),
+        };
     }
-    catch {
-        // Best effort: cmux may already be running or the app open may be blocked; capability probe decides readiness.
+    catch (err) {
+        return {
+            id: "herdr_install", status: "warn",
+            message: `Could not install or verify herdr: ${err.message}`,
+            reason: "The OpenRig view can use plain tmux without herdr. Existing cmux workflows remain available.",
+            fixHint: `Retry \`${HERDR_INSTALL_COMMAND}\`, or follow https://herdr.dev/docs/install/.`,
+        };
     }
-    return waitForCmuxCapabilities(deps);
 }
-function buildRuntimeConfigDisclosure(platform) {
-    return platform === "darwin"
-        ? [...BASE_RUNTIME_CONFIG_DISCLOSURE, DARWIN_RUNTIME_CONFIG_DISCLOSURE]
-        : [...BASE_RUNTIME_CONFIG_DISCLOSURE];
-}
-async function probeDaemonCmuxStatus(doctorDeps) {
-    const fetchFn = doctorDeps?.fetch;
-    if (!fetchFn)
-        return "skipped";
-    const config = doctorDeps.configStore.resolve();
-    const host = config.daemon.host;
-    const port = config.daemon.port;
-    try {
-        const healthRes = await fetchFn(`http://${formatDaemonHostForUrl(host)}:${port}/healthz`);
-        if (!healthRes.ok)
-            return "skipped";
-    }
-    catch {
-        return "skipped";
-    }
+/** The installing agent asks once; only an explicit Yes installs the optional Mac terminal. */
+function installGhostty(deps, platform, choice) {
+    const id = "ghostty_install";
+    if (platform !== "darwin")
+        return { id, status: "skipped", message: "The Ghostty offer is for macOS; existing Linux terminals remain available." };
+    if (choice === false)
+        return { id, status: "skipped", message: "Ghostty declined (--no-ghostty). Terminal.app remains available." };
+    const home = (deps.env ?? process.env)["HOME"] ?? homedir();
+    const locations = ["/Applications/Ghostty.app", path.join(home, "Applications/Ghostty.app")];
+    if (locations.some(deps.exists))
+        return { id, status: "pass", message: "Ghostty is already installed. No terminal was opened." };
+    if (choice !== true)
+        return {
+            id, status: "skipped",
+            message: "Installing agent: ask once, 'Install Ghostty for the OpenRig view?'",
+            fixHint: "On Yes, rerun rig setup with --ghostty, preserving earlier choices such as --no-herdr. On No, use --no-ghostty; Terminal.app remains available. The person types no command.",
+        };
     try {
-        const cmuxRes = await fetchFn(`http://${formatDaemonHostForUrl(host)}:${port}/api/adapters/cmux/status`);
-        if (!cmuxRes.ok || !cmuxRes.json)
-            return "unavailable";
-        const data = (await cmuxRes.json());
-        return data.available ? "available" : "unavailable";
+        installCommand(deps, "brew install --cask ghostty");
+        if (!locations.some(deps.exists))
+            throw new Error("The installer returned, but Ghostty.app was not found.");
+        return { id, status: "applied", message: "Installed Ghostty. No terminal was opened." };
     }
-    catch {
-        return "unavailable";
+    catch (err) {
+        return { id, status: "fail", message: `Could not install or verify Ghostty: ${err.message}`,
+            fixHint: "Check Homebrew and https://ghostty.org/docs/install/binary. Terminal.app remains available; no view was opened." };
     }
 }
 // Slice-03 Lane B (OPR.0.4.8) onboarding RECORD path. RULING-C (b4913ed4): the v1 onboarding menu
@@ -255,7 +206,7 @@ export function recordPermissionPolicyStep(deps, choice, specPath) {
             id: "policy_record",
             status: "fail",
             message: "No existing rig spec to record the policy into.",
-            reason: "The onboarding menu records a policy choice into an EXISTING spec only. A new install has no spec, so nothing is written — the usability floor holds by absence.",
+            reason: "The onboarding menu records a policy choice into an EXISTING spec only. A new install has no spec, so nothing is written — team seats keep the team default.",
             fixHint: "Point --spec at an existing rig.yaml (or a directory containing one), then re-run `rig setup --policy`.",
         };
     }
@@ -290,12 +241,18 @@ export function recordPermissionPolicyStep(deps, choice, specPath) {
 export async function runSetup(deps, opts) {
     const profile = opts.full ? "full" : "core";
     const platform = deps.platform ?? process.platform;
-    const runtimeConfig = buildRuntimeConfigDisclosure(platform);
+    const runtimeConfig = [...BASE_RUNTIME_CONFIG_DISCLOSURE];
     const stepIds = opts.full ? [...CORE_STEP_IDS, ...FULL_EXTRA_STEP_IDS] : [...CORE_STEP_IDS];
     const steps = [];
     if (opts.dryRun) {
         for (const id of stepIds) {
-            const platformSkip = platform !== "darwin" ? NON_DARWIN_DRY_RUN_SKIPS[id] : undefined;
+            const platformSkip = id === "herdr_install" && opts.herdr === false ? "Skipped: herdr installation declined (--no-herdr)."
+                : id === "herdr_install" && !["darwin", "linux"].includes(platform) ? "Automatic herdr installation is supported on macOS and Linux."
+                    : id === "ghostty_install" ? (platform !== "darwin" ? "The Ghostty offer is for macOS."
+                        : opts.ghostty === false ? "Ghostty declined (--no-ghostty)."
+                            : opts.ghostty === true ? "Dry run: Ghostty installation would be attempted."
+                                : "Dry run: the installing agent offers Ghostty once; only Yes installs it.")
+                        : platform !== "darwin" ? NON_DARWIN_DRY_RUN_SKIPS[id] : undefined;
             steps.push({ id, status: "skipped", message: platformSkip ?? `Dry run: ${id} would be attempted.` });
         }
         if (opts.policy !== undefined) {
@@ -324,7 +281,7 @@ export async function runSetup(deps, opts) {
                 id: "brew",
                 status: "fail",
                 message: "Homebrew not found.",
-                reason: "Homebrew is required to install tmux and cmux on macOS.",
+                reason: "Homebrew is required to install tmux on macOS.",
                 fixHint: "Install Homebrew: https://brew.sh",
             });
         }
@@ -358,129 +315,11 @@ export async function runSetup(deps, opts) {
     else {
         steps.push({ id: "tmux_install", status: "pass", message: "tmux available." });
     }
-    // 3. cmux
-    const daemonCmuxBefore = await probeDaemonCmuxStatus(opts.doctorDeps);
-    if (await waitForCmuxCapabilities(deps, 1)) {
-        const socketMode = readCmuxSocketControlModeFromText(deps.readFile(resolveCmuxSettingsPath()));
-        if (platform === "darwin" && socketMode.error) {
-            steps.push({
-                id: "cmux_install",
-                status: "fail",
-                message: "cmux settings file is unreadable.",
-                reason: `OpenRig could not parse ${CMUX_SETTINGS_DISCLOSURE_PATH}: ${socketMode.error}`,
-                fixHint: "Repair or remove the cmux settings file, then rerun `rig setup`.",
-            });
-        }
-        else if (platform === "darwin" && !isCmuxSocketControlCompatible(socketMode.mode)) {
-            if (await tryEnableCmuxControl(deps, platform)) {
-                const daemonCmuxAfter = await probeDaemonCmuxStatus(opts.doctorDeps);
-                if (daemonCmuxAfter === "unavailable") {
-                    steps.push({
-                        id: "cmux_install",
-                        status: "fail",
-                        message: "OpenRig updated cmux settings, but the running daemon still cannot control cmux.",
-                        reason: "The cmux settings file is now compatible, so the remaining blocker is in the live daemon/cmux session state.",
-                        fixHint: "Restart the daemon with `rig daemon start`, then rerun `rig doctor` to confirm cmux daemon control.",
-                    });
-                }
-                else {
-                    steps.push({
-                        id: "cmux_install",
-                        status: "applied",
-                        message: "Normalized cmux socket control to automation mode in ~/.config/cmux/settings.json.",
-                    });
-                }
-            }
-            else {
-                steps.push({
-                    id: "cmux_install",
-                    status: "fail",
-                    message: "cmux shell control works, but OpenRig could not normalize cmux socket control.",
-                    reason: "OpenRig needs a compatible cmux socket control mode so the daemon can open CMUX surfaces reliably.",
-                    fixHint: `Set automation.socketControlMode to "automation" in ${CMUX_SETTINGS_DISCLOSURE_PATH}, then rerun \`rig setup\` or \`rig doctor\`.`,
-                });
-            }
-        }
-        else if (daemonCmuxBefore === "unavailable") {
-            steps.push({
-                id: "cmux_install",
-                status: "fail",
-                message: "cmux shell control works, but the running daemon still cannot control cmux.",
-                reason: "Current cmux settings already look compatible, so the remaining blocker is outside the cmux settings file OpenRig can repair automatically.",
-                fixHint: "Run `rig doctor` for the exact daemon cmux diagnosis, then restart the daemon after clearing the underlying blocker.",
-            });
-        }
-        else {
-            steps.push({ id: "cmux_install", status: "pass", message: "cmux available." });
-        }
-    }
-    else {
-        try {
-            deps.exec("cmux --help");
-            if (await tryEnableCmuxControl(deps, platform)) {
-                const daemonCmuxAfter = await probeDaemonCmuxStatus(opts.doctorDeps);
-                if (daemonCmuxAfter === "unavailable") {
-                    steps.push({
-                        id: "cmux_install",
-                        status: "fail",
-                        message: "OpenRig enabled cmux socket control, but the running daemon still cannot control cmux.",
-                        reason: "The cmux app and settings are now in place, so the remaining blocker is in the live daemon/cmux session state.",
-                        fixHint: "Restart the daemon with `rig daemon start`, then rerun `rig doctor` to confirm cmux daemon control.",
-                    });
-                }
-                else {
-                    steps.push({
-                        id: "cmux_install",
-                        status: "applied",
-                        message: "Enabled cmux socket control in ~/.config/cmux/settings.json.",
-                    });
-                }
-            }
-            else {
-                steps.push({
-                    id: "cmux_install",
-                    status: platform === "darwin" ? "fail" : "warn",
-                    message: "cmux installed but control unavailable.",
-                    reason: "Open CMUX workflows need cmux socket control to be enabled.",
-                    fixHint: platform === "darwin"
-                        ? `Set automation.socketControlMode to "automation" in ${CMUX_SETTINGS_DISCLOSURE_PATH}, then rerun \`rig setup\` or \`rig doctor\`.`
-                        : "Open cmux, approve any first-run prompts, and rerun `rig setup` or `rig doctor`.",
-                });
-            }
-        }
-        catch {
-            if (!brewOk) {
-                steps.push({ id: "cmux_install", status: "skipped", message: BREW_UNAVAILABLE_SKIP });
-            }
-            else {
-                try {
-                    installCommand(deps, "brew install --cask cmux");
-                    if (await tryEnableCmuxControl(deps, platform) || await waitForCmuxCapabilities(deps, 1)) {
-                        steps.push({ id: "cmux_install", status: "applied", message: "Installed cmux with Homebrew." });
-                    }
-                    else {
-                        steps.push({
-                            id: "cmux_install",
-                            status: platform === "darwin" ? "fail" : "warn",
-                            message: "Installed cmux, but control is still unavailable.",
-                            reason: "Open CMUX workflows need the cmux app to expose socket control after installation.",
-                            fixHint: "Open cmux, approve any first-run prompts, and rerun `rig setup` or `rig doctor`.",
-                        });
-                    }
-                }
-                catch (err) {
-                    steps.push({
-                        id: "cmux_install",
-                        status: "fail",
-                        message: `Failed to install cmux: ${err.message}`,
-                        reason: "Open CMUX workflows stay unavailable until the cmux app and CLI are installed.",
-                        fixHint: "Retry `brew install --cask cmux` after connectivity stabilizes, or install cmux manually.",
-                    });
-                }
-            }
-        }
-    }
-    // 4. tmux config
+    // 3. Herdr is the default view provider. Leave optional cmux installations untouched.
+    steps.push(opts.herdr === false
+        ? { id: "herdr_install", status: "skipped", message: "Skipped: herdr installation declined (--no-herdr)." }
+        : installHerdr(deps, platform));
+    steps.push(installGhostty(deps, platform, opts.ghostty));
     // 4. Claude Code runtime
     let claudeInstalled = false;
     try {
@@ -505,29 +344,8 @@ export async function runSetup(deps, opts) {
             });
         }
     }
-    if (claudeInstalled) {
-        try {
-            deps.exec("claude auth status");
-            steps.push({ id: "claude_auth", status: "pass", message: "Claude Code authentication available." });
-        }
-        catch (err) {
-            steps.push({
-                id: "claude_auth",
-                status: "fail",
-                message: `Claude Code is installed but not ready to launch: ${err.message}`,
-                reason: "Claude Code seats cannot launch until the Claude CLI is logged in and usable.",
-                fixHint: "Run `claude auth login` or open `claude` once to complete authentication, then rerun `rig setup`.",
-            });
-        }
-    }
-    else {
-        steps.push({
-            id: "claude_auth",
-            status: "skipped",
-            message: "Skipped: Claude Code is not installed.",
-            reason: "Authentication cannot be checked until the Claude Code CLI is installed.",
-        });
-    }
+    const { name: claudeName, fix: claudeFix, ...claudeAuth } = checkClaudeAuth(deps, claudeInstalled);
+    steps.push({ id: claudeName, ...claudeAuth, ...(claudeFix ? { fixHint: claudeFix } : {}) });
     // 5. Codex runtime
     let codexInstalled = false;
     try {
@@ -552,52 +370,8 @@ export async function runSetup(deps, opts) {
             });
         }
     }
-    if (codexInstalled) {
-        const env = deps.env ?? process.env;
-        const codexAuth = selectCodexProviderAuth(deps.readFile(path.join(resolveCodexHome(env).codexHome, "config.toml")));
-        if (codexAuth.kind === "env-key") {
-            if (env[codexAuth.envKey]?.trim()) {
-                steps.push({
-                    id: "codex_auth",
-                    status: "pass",
-                    message: `Codex provider "${codexAuth.providerId}" does not use an OpenAI login, and its credential variable ${codexAuth.envKey} is set. This confirms a local credential is available, not that the provider accepts it or that managed seats receive it.`,
-                });
-            }
-            else {
-                steps.push({
-                    id: "codex_auth",
-                    status: "fail",
-                    message: `Codex provider "${codexAuth.providerId}" needs ${codexAuth.envKey}, which is not set in this environment.`,
-                    reason: "Codex seats using this provider cannot authenticate without that variable.",
-                    fixHint: `Export ${codexAuth.envKey} in the environment that runs rig setup and the OpenRig daemon, then rerun \`rig setup\`.`,
-                });
-            }
-        }
-        else {
-            try {
-                deps.exec("codex login status");
-                steps.push({ id: "codex_auth", status: "pass", message: "Codex authentication available." });
-            }
-            catch (err) {
-                const unresolved = codexAuth.unresolved ? ` (${codexAuth.unresolved}, so the OpenAI login was checked)` : "";
-                steps.push({
-                    id: "codex_auth",
-                    status: "fail",
-                    message: `Codex is installed but not ready to launch${unresolved}: ${err.message}`,
-                    reason: "Codex seats cannot launch until the Codex CLI is logged in and usable.",
-                    fixHint: "Run `codex login` and complete authentication, then rerun `rig setup`.",
-                });
-            }
-        }
-    }
-    else {
-        steps.push({
-            id: "codex_auth",
-            status: "skipped",
-            message: "Skipped: Codex is not installed.",
-            reason: "Authentication cannot be checked until the Codex CLI is installed.",
-        });
-    }
+    const { name: codexName, fix: codexFix, ...codexAuth } = checkCodexAuth(deps, codexInstalled);
+    steps.push({ id: codexName, ...codexAuth, ...(codexFix ? { fixHint: codexFix } : {}) });
     // 6. tmux config
     const TMUX_CONF = `${process.env["HOME"] ?? "~"}/.tmux.conf`;
     const MANAGED_MARKER = "# OpenRig managed block";
@@ -662,7 +436,14 @@ export async function runSetup(deps, opts) {
     let verification;
     if (!opts.dryRun && opts.doctorDeps) {
         const doctorDeps = opts.doctorDeps;
-        const doctor = runDoctorChecks(doctorDeps);
+        // Reuse the post-install facts above; do not repeat login probes during verification.
+        const providerChecks = steps
+            .filter((step) => ["claude_install", "claude_auth", "codex_install", "codex_auth"].includes(step.id))
+            .map(({ id, status, fixHint, ...check }) => ({
+            name: id, status: status === "applied" ? "pass" : status,
+            ...check, ...(fixHint ? { fix: fixHint } : {}),
+        }));
+        const doctor = runDoctorChecks(doctorDeps, providerChecks);
         const asyncResults = await Promise.all(doctor.asyncChecks);
         const allDoctorChecks = [...doctor.checks, ...asyncResults];
         verification = {
@@ -725,19 +506,20 @@ export function goldenPathNextSteps() {
         "  3. rig status                       Read the kernel boot state; rig ps --nodes --rig kernel checks its seats",
         "     Started is not ready. The view may open while agents finish starting; report their actual state",
         "     For an existing kernel or blocked startup: rig context get reference/getting-started.md#incomplete-setup-and-restart",
-        "  4. Installing agent: ask 'Open the OpenRig view now?'",
-        "     Yes: open a NEW space using installed herdr, else cmux, else the guide's exact new-terminal command",
-        "     rig terminal open saved:kernel --provider herdr --json (TUI | advisor | operator; no YAML edit)",
+        "  4. Show the person OpenRig: open the OpenRig TUI and operator for them now. Say so first; it's the next step, not a question",
+        "     It opens a NEW terminal tab/window, or a space in their current Herdr, and preserves this terminal",
+        "     rig terminal open saved:kernel --window --json (TUI and operator, advisor on its own tab; herdr, otherwise plain tmux)",
         "     rig context get reference/getting-started.md#open-the-kernel-conversations",
-        "     No: give the command to open it later. Over SSH: give the exact connection/attach command",
+        "     If they said not now: give the command to open it later. Over headless SSH: ask the person to open a new terminal/tab and give the exact connection/attach command",
+        "     Herdr needs a terminal the person can see; switching the shared TUI to :terminals does not open one",
         "     No, SSH and headless use are fine background outcomes; do not report an unseen window as opened",
-        "     For herdr, open or attach the actual session and check the visible view; CLI success alone is not proof",
-        "     Keep the current terminal and existing spaces intact; opening this view needs no new provider install",
-        "     rig tui --shared is the team dashboard, not the operator's conversation",
-        "     If the view cannot open, relay the printed operator.agent attach command unchanged, in full",
-        "     If no command is printed, find operator.agent with rig ps --nodes --rig kernel --json",
-        "     Use its canonicalSessionName in: env -u TMUX tmux attach-session -t '=<canonicalSessionName>'",
-        "     Give the person that command with the name filled in, to run in a new terminal on the kernel host",
+        "     On a desktop, no copying or typing for the person; check the result notes, not just CLI success",
+        "     On a Mac, offer Ghostty once: on Yes run rig setup --ghostty; preserve earlier choices such as --no-herdr",
+        "     On No use --no-ghostty; Terminal.app remains available",
+        "     Setup installs herdr by default; use --no-herdr if the person declines. Plain tmux remains available",
+        "     Only if the window cannot open: rig tui --shared is the dashboard-only fallback, not the operator's conversation",
+        "     If opening fails, inspect any new surface before retrying; report the error and finish the local action",
+        "     Do not replace a failed desktop action with commands for the person to copy or type",
         "  5. Installing agent: ask the person's goal and project folder, then hand them to the ready operator",
         "     Find operator.agent with rig ps --nodes --rig kernel --json; use its canonicalSessionName with rig send",
         "     Send the goal and folder, or have the person type them in the operator pane; show where it answers",
@@ -765,13 +547,17 @@ export function goldenPathNextSteps() {
  * skip-line phrasing, NO pre-selected default, and `Standard` carries the ⭐ recommendation marker.
  * REGISTER RULE (pm-lead): factual + version-neutral — never "treacherous"/editorializing/
  * founder-internal wording. Recording is a thought, never a gate — `rig up` always works bare.
+ * 0.6.7: the question, the deliberate-none line and the skip line now state the team launch default
+ * (#893) that ships with 0.6.6, matching docs/reference/getting-started.md and the
+ * applying-a-permission-policy skill. The labels, marker and register are unchanged.
  */
 export function permissionPolicyMenuLines() {
     return [
-        "Before team launch, your agent asks once (reuse an existing explicit choice):",
-        "  Allow your agents to run OpenRig commands without repeated permission prompts?",
-        "  Yes — recommended / No — keep prompts. No answer leaves settings unchanged too.",
-        "  Includes all rig verbs, lifecycle/config changes and launching processes; not global YOLO or authority to invent work.",
+        "Before team launch, your agent recommends keeping the team default (reuse an existing explicit choice):",
+        "  Claude team seats with no policy or explicit seat choice run ordinary rig commands, project reads and common tests without prompts; lifecycle commands such as rig up and rig down still ask.",
+        "  Only if you want more, it offers once: Remember these selected OpenRig commands in your native settings for this project?",
+        "  Yes / No — keep the team default. No answer leaves settings unchanged too.",
+        "  A remembered allowance can cover all rig verbs, but Claude team seats still ask before lifecycle commands; not global YOLO or authority to invent work.",
         "  Personal project scope unless you explicitly choose user-wide sessions. On Yes, the agent adds native rules, preserving stricter rules.",
         "  Procedure: rig context get skills/applying-a-permission-policy/SKILL.md",
         "  Undo: ask your agent to remove only the OpenRig command allowances added by this setup.",
@@ -783,12 +569,12 @@ export function permissionPolicyMenuLines() {
         "    Standard  ⭐      The recommended balanced built-in policy.",
         "    Open              The least restrictive built-in policy.",
         "  YOLO Mode           The full-bypass built-in policy.",
-        "  No policy — deliberate choice (recorded)",
+        "  No policy — deliberate choice (recorded): the floor, without the team allowances",
         "",
-        "  If you skip: OpenRig sets nothing — the usability floor only",
+        "  If you skip: nothing is recorded; team seats launch with the team default unless a seat choice or named Codex profile applies",
         "",
         "  To record a choice into an existing spec:",
-        "    rig setup --policy <locked|standard|open|yolo|none> --spec <path>",
+        "    rig setup --policy <locked|standard|open|yolo|auto|none> --spec <path>",
     ];
 }
 export function setupCommand(depsOverride) {
@@ -797,12 +583,15 @@ export function setupCommand(depsOverride) {
         .option("--dry-run", "Show the plan without making changes")
         .option("--json", "Machine-readable JSON output")
         .option("--full", "Install broader operator workstation tools")
+        .option("--no-herdr", "Skip the default herdr installation; the OpenRig view can use plain tmux")
+        .option("--ghostty", "Install Ghostty on macOS after the person accepts the offer")
+        .option("--no-ghostty", "Decline Ghostty; Terminal.app remains available on macOS")
         .option("--policy <name>", `Record a deliberate permission-policy choice into an existing spec (${POLICY_CHOICES.join("|")})`)
         .option("--spec <path>", "Existing rig spec (file or directory) to record the --policy choice into")
         .action(async (opts) => {
         const deps = depsOverride ?? defaultDeps();
         const doctorDeps = opts.dryRun ? undefined : buildDefaultDoctorDeps(deps);
-        const result = await runSetup(deps, { dryRun: opts.dryRun, full: opts.full, policy: opts.policy, specPath: opts.spec, doctorDeps });
+        const result = await runSetup(deps, { dryRun: opts.dryRun, full: opts.full, policy: opts.policy, specPath: opts.spec, herdr: opts.herdr, ghostty: opts.ghostty, doctorDeps });
         if (opts.json) {
             console.log(JSON.stringify({ ...result, nextSteps: goldenPathNextSteps() }, null, 2));
             if (!opts.dryRun && !result.ready)
@@ -840,7 +629,7 @@ export function setupCommand(depsOverride) {
                     console.log(`    Fix: ${step.fixHint}`);
             }
             console.log("Only the harnesses selected for your project need a login; an unused harness does not.");
-            console.log("Run `rig doctor` for system checks; it does not check harness logins.");
+            console.log("Run `rig doctor` to recheck the system and provider authentication.");
         }
         // Keep the conversation route available even after a dry run or incomplete setup,
         // before the optional menu so a short output read still includes the handoff.