@pellux/goodvibes-agent 0.1.0

package/src/cli/status.ts

@@ -0,0 +1,383 @@
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { OnboardingCheckMarkersState } from '../runtime/onboarding/index.ts';
+import { resolveRuntimeEndpointBinding } from './endpoints.ts';
+import { isNetworkFacing } from './network-posture.ts';
+import type { GoodVibesCliOutputFormat } from './types.ts';
+import type { CliServicePosture } from './service-posture.ts';
+import { getProviderIdFromModel } from '../config/provider-model.ts';
+
+export interface CliStatusOptions {
+  readonly configManager: Pick<ConfigManager, 'get'>;
+  readonly workingDirectory: string;
+  readonly homeDirectory: string;
+  readonly onboardingMarkers?: OnboardingCheckMarkersState;
+  readonly auth?: CliAuthStatus;
+  readonly service?: CliServicePosture;
+  readonly doctor?: boolean;
+  readonly outputFormat?: GoodVibesCliOutputFormat;
+}
+
+export interface CliAuthStatus {
+  readonly userStorePath: string;
+  readonly userStorePresent: boolean;
+  readonly bootstrapCredentialPath: string;
+  readonly bootstrapCredentialPresent: boolean;
+  readonly operatorTokenPath: string;
+  readonly operatorTokenPresent: boolean;
+}
+
+export interface CliDoctorFinding {
+  readonly id: string;
+  readonly area: 'auth' | 'network' | 'onboarding' | 'security' | 'service' | 'secrets';
+  readonly severity: 'warning' | 'risk';
+  readonly summary: string;
+  readonly cause: string;
+  readonly impact: string;
+  readonly action: string;
+}
+
+export interface CliStatusSnapshot {
+  readonly title: 'GoodVibes Agent status' | 'GoodVibes Agent doctor';
+  readonly workingDirectory: string;
+  readonly homeDirectory: string;
+  readonly provider: {
+    readonly provider: string;
+    readonly model: string;
+    readonly reasoning: string;
+  };
+  readonly auth: {
+    readonly permissionMode: unknown;
+    readonly permissionLabel: string;
+    readonly secretPolicy: unknown;
+    readonly secretPolicyLabel: string;
+    readonly localUsers: CliAuthStatus | null;
+  };
+  readonly service: {
+    readonly enabled: unknown;
+    readonly autostart: unknown;
+    readonly restartOnFailure: unknown;
+    readonly lifecycle?: CliServicePosture;
+  };
+  readonly surfaces: {
+    readonly controlPlane: ReturnType<typeof resolveRuntimeEndpointBinding> & { readonly enabled: unknown };
+    readonly httpListener: ReturnType<typeof resolveRuntimeEndpointBinding> & { readonly enabled: unknown };
+    readonly web: ReturnType<typeof resolveRuntimeEndpointBinding> & { readonly enabled: unknown };
+  };
+  readonly onboarding: {
+    readonly checked: boolean;
+    readonly scope: string;
+    readonly updatedAt: number | null;
+  };
+  readonly findings: readonly CliDoctorFinding[];
+}
+
+function yesNo(value: unknown): string {
+  return value === true ? 'yes' : 'no';
+}
+
+function permissionModeLabel(mode: unknown): string {
+  if (mode === 'prompt') return 'Ask before powerful actions';
+  if (mode === 'allow-all') return 'Allow everything';
+  if (mode === 'custom') return 'Custom rules';
+  return String(mode ?? 'unknown');
+}
+
+function secretPolicyLabel(policy: unknown): string {
+  if (policy === 'preferred_secure') return 'Use secure storage when available';
+  if (policy === 'require_secure') return 'Require secure storage';
+  if (policy === 'plaintext_allowed') return 'Allow plaintext storage';
+  return String(policy ?? 'unknown');
+}
+
+function bindLine(label: string, enabled: unknown, binding: { readonly hostMode: string; readonly host: string; readonly port: number }): string {
+  return `  ${label}: ${yesNo(enabled)} (${binding.hostMode} ${binding.host}:${binding.port})`;
+}
+
+export function buildCliDoctorFindings(options: CliStatusOptions): readonly CliDoctorFinding[] {
+  const config = options.configManager;
+  const serviceEnabled = config.get('service.enabled') === true;
+  const serviceAutostart = config.get('service.autostart') === true;
+  const restartOnFailure = config.get('service.restartOnFailure') === true;
+  const daemonEnabled = config.get('danger.daemon') === true;
+  const listenerEnabled = config.get('danger.httpListener') === true;
+  const webEnabled = config.get('web.enabled') === true;
+  const controlPlaneEnabled = config.get('controlPlane.enabled') === true;
+  const controlPlaneBinding = resolveRuntimeEndpointBinding(config, 'controlPlane');
+  const httpListenerBinding = resolveRuntimeEndpointBinding(config, 'httpListener');
+  const webBinding = resolveRuntimeEndpointBinding(config, 'web');
+  const permissionMode = config.get('permissions.mode');
+  const secretPolicy = config.get('storage.secretPolicy');
+  const marker = options.onboardingMarkers?.effective;
+  const serverBackedEnabled = daemonEnabled || controlPlaneEnabled || listenerEnabled || webEnabled;
+  const networkFacingSurfaces = [
+    ['control plane', controlPlaneEnabled, controlPlaneBinding],
+    ['HTTP listener', listenerEnabled, httpListenerBinding],
+    ['web surface', webEnabled, webBinding],
+  ].filter(([, enabled, binding]) => isNetworkFacing(enabled, binding as typeof controlPlaneBinding));
+
+  const findings: CliDoctorFinding[] = [];
+
+  if (serverBackedEnabled && !serviceEnabled) {
+    findings.push({
+      id: 'service-disabled-for-server-surfaces',
+      area: 'service',
+      severity: 'warning',
+      summary: 'Server-backed surfaces are enabled but service mode is off.',
+      cause: 'One or more daemon, control-plane, listener, or web settings are enabled while service.enabled is false.',
+      impact: 'The configured surfaces may not start automatically or survive restarts.',
+      action: 'Enable service mode or disable the server-backed surfaces you do not want.',
+    });
+  }
+
+  if (serviceEnabled && !serviceAutostart) {
+    findings.push({
+      id: 'service-autostart-disabled',
+      area: 'service',
+      severity: 'warning',
+      summary: 'Service mode is enabled but autostart is off.',
+      cause: 'service.enabled is true and service.autostart is false.',
+      impact: 'The external GoodVibes daemon may not be available after login or reboot even though service mode is selected.',
+      action: 'Enable service.autostart if the daemon/listener/web surfaces should stay available.',
+    });
+  }
+
+  if (serviceEnabled && !restartOnFailure) {
+    findings.push({
+      id: 'service-restart-disabled',
+      area: 'service',
+      severity: 'warning',
+      summary: 'Service restart-on-failure is off.',
+      cause: 'service.enabled is true and service.restartOnFailure is false.',
+      impact: 'A crashed daemon or listener may stay down until manually restarted.',
+      action: 'Enable service.restartOnFailure for durable daemon/listener operation.',
+    });
+  }
+
+  if (options.service) {
+    for (const issue of options.service.issues) {
+      if (findings.some((finding) => finding.summary === issue)) continue;
+      findings.push({
+        id: `service-lifecycle-${findings.length}`,
+        area: 'service',
+        severity: 'warning',
+        summary: issue,
+        cause: 'The service lifecycle inspection found a mismatch between configured service/surface state and observed host state.',
+        impact: 'Daemon, control-plane, listener, or web availability may not match the configuration.',
+        action: 'Run goodvibes-agent service check, then manage the daemon from GoodVibes TUI or your daemon host tooling.',
+      });
+    }
+  }
+
+  if (!marker?.exists) {
+    findings.push({
+      id: 'onboarding-incomplete',
+      area: 'onboarding',
+      severity: 'warning',
+      summary: 'Onboarding has not been shown for this user.',
+      cause: 'No global user onboarding check marker was found.',
+      impact: 'Important service, network, provider, auth, or permission choices may still be implicit defaults.',
+      action: 'Run /onboarding in GoodVibes Agent or goodvibes-agent onboarding status to review setup state.',
+    });
+  }
+
+  if (networkFacingSurfaces.length > 0 && options.auth?.userStorePresent !== true) {
+    findings.push({
+      id: 'network-surface-without-local-users',
+      area: 'auth',
+      severity: 'risk',
+      summary: 'Network-facing surfaces are enabled before local users are configured.',
+      cause: `${networkFacingSurfaces.map(([name]) => name).join(', ')} are LAN/custom-bound, but no local auth user store was found.`,
+      impact: 'Remote access paths may be unusable or unsafe until local admin auth is configured.',
+      action: 'Create/verify a local admin user before exposing GoodVibes on the network.',
+    });
+  }
+
+  if (networkFacingSurfaces.length > 0 && options.auth?.bootstrapCredentialPresent === true) {
+    findings.push({
+      id: 'network-surface-with-bootstrap-credential',
+      area: 'auth',
+      severity: 'risk',
+      summary: 'A bootstrap credential is still present while network-facing surfaces are enabled.',
+      cause: `${networkFacingSurfaces.map(([name]) => name).join(', ')} are LAN/custom-bound and auth-bootstrap.txt exists.`,
+      impact: 'Bootstrap credentials should be treated as temporary setup material, not long-lived network access credentials.',
+      action: 'Replace bootstrap auth with a named admin user and retire the bootstrap credential.',
+    });
+  }
+
+  if (permissionMode === 'allow-all') {
+    findings.push({
+      id: 'allow-all-permissions',
+      area: 'security',
+      severity: 'risk',
+      summary: 'Allow everything permission mode is active.',
+      cause: 'permissions.mode is allow-all.',
+      impact: 'Powerful write, edit, network, and execution tools can run without a Human-in-the-Loop (HITL) approval prompt.',
+      action: 'Use Ask before powerful actions or Custom rules unless this is an intentionally trusted environment.',
+    });
+  }
+
+  if (secretPolicy === 'plaintext_allowed') {
+    findings.push({
+      id: 'plaintext-secrets-allowed',
+      area: 'secrets',
+      severity: 'risk',
+      summary: 'Plaintext secret storage is allowed.',
+      cause: 'storage.secretPolicy is plaintext_allowed.',
+      impact: 'Provider keys and surface tokens may be stored without secure backend protection.',
+      action: 'Use Require secure storage or Use secure storage when available for normal operation.',
+    });
+  }
+
+  if (listenerEnabled && isNetworkFacing(listenerEnabled, httpListenerBinding)) {
+    findings.push({
+      id: 'network-http-listener-enabled',
+      area: 'network',
+      severity: 'warning',
+      summary: 'The HTTP listener is reachable beyond loopback.',
+      cause: `HTTP listener is enabled on ${httpListenerBinding.host}:${httpListenerBinding.port} with ${httpListenerBinding.hostMode} binding.`,
+      impact: 'External tools and devices may be able to reach incoming event endpoints.',
+      action: 'Keep listener secrets/signature checks configured for every enabled webhook surface.',
+    });
+  }
+
+  return findings;
+}
+
+export function buildCliStatusSnapshot(options: CliStatusOptions): CliStatusSnapshot {
+  const config = options.configManager;
+  const controlPlaneBinding = resolveRuntimeEndpointBinding(config, 'controlPlane');
+  const httpListenerBinding = resolveRuntimeEndpointBinding(config, 'httpListener');
+  const webBinding = resolveRuntimeEndpointBinding(config, 'web');
+  const marker = options.onboardingMarkers?.effective;
+  const findings = buildCliDoctorFindings(options);
+  return {
+    title: options.doctor ? 'GoodVibes Agent doctor' : 'GoodVibes Agent status',
+    workingDirectory: options.workingDirectory,
+    homeDirectory: options.homeDirectory,
+    provider: {
+      provider: getProviderIdFromModel(config.get('provider.model')),
+      model: String(config.get('provider.model')),
+      reasoning: String(config.get('provider.reasoningEffort')),
+    },
+    auth: {
+      permissionMode: config.get('permissions.mode'),
+      permissionLabel: permissionModeLabel(config.get('permissions.mode')),
+      secretPolicy: config.get('storage.secretPolicy'),
+      secretPolicyLabel: secretPolicyLabel(config.get('storage.secretPolicy')),
+      localUsers: options.auth ?? null,
+    },
+    service: {
+      enabled: config.get('service.enabled'),
+      autostart: config.get('service.autostart'),
+      restartOnFailure: config.get('service.restartOnFailure'),
+      ...(options.service ? { lifecycle: options.service } : {}),
+    },
+    surfaces: {
+      controlPlane: { enabled: config.get('controlPlane.enabled'), ...controlPlaneBinding },
+      httpListener: { enabled: config.get('danger.httpListener'), ...httpListenerBinding },
+      web: { enabled: config.get('web.enabled'), ...webBinding },
+    },
+    onboarding: {
+      checked: Boolean(marker?.exists),
+      scope: marker?.scope ?? 'none',
+      updatedAt: marker?.payload?.updatedAt ?? null,
+    },
+    findings,
+  };
+}
+
+export function renderCliStatus(options: CliStatusOptions): string {
+  const config = options.configManager;
+  const snapshot = buildCliStatusSnapshot(options);
+  const serviceEnabled = snapshot.service.enabled;
+  const serviceAutostart = snapshot.service.autostart;
+  const restartOnFailure = snapshot.service.restartOnFailure;
+  const controlPlaneEnabled = snapshot.surfaces.controlPlane.enabled;
+  const listenerEnabled = snapshot.surfaces.httpListener.enabled;
+  const webEnabled = snapshot.surfaces.web.enabled;
+  const controlPlaneBinding = snapshot.surfaces.controlPlane;
+  const httpListenerBinding = snapshot.surfaces.httpListener;
+  const webBinding = snapshot.surfaces.web;
+  const marker = options.onboardingMarkers?.effective;
+  const findings = snapshot.findings;
+
+  if (options.outputFormat === 'json') return JSON.stringify(snapshot, null, 2);
+
+  const lines = [
+    snapshot.title,
+    `  workingDir: ${options.workingDirectory}`,
+    `  homeDir: ${options.homeDirectory}`,
+    '',
+    'Provider:',
+    `  provider: ${getProviderIdFromModel(config.get('provider.model'))}`,
+    `  model: ${String(config.get('provider.model'))}`,
+    `  reasoning: ${String(config.get('provider.reasoningEffort'))}`,
+    '',
+    'Auth:',
+    `  permissions: ${permissionModeLabel(config.get('permissions.mode'))} (${String(config.get('permissions.mode'))})`,
+    `  secretPolicy: ${secretPolicyLabel(config.get('storage.secretPolicy'))} (${String(config.get('storage.secretPolicy'))})`,
+    options.auth
+      ? `  localUsers: ${options.auth.userStorePresent ? 'present' : 'missing'} (${options.auth.userStorePath})`
+      : '  localUsers: unknown',
+    options.auth
+      ? `  bootstrapCredential: ${options.auth.bootstrapCredentialPresent ? 'present' : 'missing'} (${options.auth.bootstrapCredentialPath})`
+      : '  bootstrapCredential: unknown',
+    options.auth
+      ? `  operatorTokens: ${options.auth.operatorTokenPresent ? 'present' : 'missing'} (${options.auth.operatorTokenPath})`
+      : '  operatorTokens: unknown',
+    '',
+    'Service:',
+    `  enabled: ${yesNo(serviceEnabled)}`,
+    `  autostart: ${yesNo(serviceAutostart)}`,
+    `  restartOnFailure: ${yesNo(restartOnFailure)}`,
+    ...(options.service ? [
+      `  platform: ${options.service.managed.platform}`,
+      `  installed: ${yesNo(options.service.managed.installed)}`,
+      `  running: ${yesNo(options.service.managed.running)}`,
+      `  pid: ${options.service.managed.pid ?? 'n/a'}`,
+      `  definition: ${options.service.managed.path}`,
+      `  log: ${options.service.log.path ?? 'n/a'} (${options.service.log.exists ? 'present' : 'missing'})`,
+    ] : []),
+    '',
+    'Surfaces:',
+    bindLine('controlPlane', controlPlaneEnabled, controlPlaneBinding),
+    bindLine('httpListener', listenerEnabled, httpListenerBinding),
+    bindLine('web', webEnabled, webBinding),
+    '',
+    'Onboarding:',
+    `  checked: ${marker?.exists ? 'yes' : 'no'}`,
+    `  scope: ${marker?.scope ?? 'none'}`,
+    `  updatedAt: ${marker?.payload ? new Date(marker.payload.updatedAt).toISOString() : 'n/a'}`,
+  ];
+
+  if (options.doctor) {
+    lines.push('', 'Warnings:');
+    if (findings.length === 0) {
+      lines.push('  none');
+    } else {
+      for (const finding of findings) {
+        lines.push(
+          `  - [${finding.severity}:${finding.area}:${finding.id}] ${finding.summary}`,
+          `    cause: ${finding.cause}`,
+          `    impact: ${finding.impact}`,
+          `    action: ${finding.action}`,
+        );
+      }
+    }
+  }
+
+  return lines.join('\n');
+}
+
+export function renderOnboardingCliStatus(options: CliStatusOptions): string {
+  const marker = options.onboardingMarkers?.effective;
+  return [
+    'GoodVibes onboarding status',
+    `  checked: ${marker?.exists ? 'yes' : 'no'}`,
+    `  scope: ${marker?.scope ?? 'none'}`,
+    `  source: ${marker?.payload?.source ?? 'n/a'}`,
+    `  mode: ${marker?.payload?.mode ?? 'n/a'}`,
+    `  updatedAt: ${marker?.payload ? new Date(marker.payload.updatedAt).toISOString() : 'n/a'}`,
+    `  workingDir: ${options.workingDirectory}`,
+  ].join('\n');
+}

package/src/cli/surface-command.ts

@@ -0,0 +1,247 @@
+import type { ConfigKey } from '../config/index.ts';
+import {
+  GOODVIBES_NTFY_AGENT_TOPIC,
+  GOODVIBES_NTFY_CHAT_TOPIC,
+  GOODVIBES_NTFY_REMOTE_TOPIC,
+  resolveGoodVibesNtfyTopics,
+} from '@pellux/goodvibes-sdk/platform/integrations';
+import { getMissingSurfaceFeatureFlags } from '../runtime/surface-feature-flags.ts';
+import { resolveRuntimeEndpointBinding } from './endpoints.ts';
+import { classifyBindPosture, isNetworkFacing } from './network-posture.ts';
+import type { CliCommandRuntime } from './management.ts';
+import {
+  formatJsonOrText,
+  isPresentConfigValue,
+  probeTcp,
+  readAuthPaths,
+  yesNo,
+} from './management.ts';
+
+export const SURFACE_CONFIGS = [
+  ['slack', 'Slack', ['surfaces.slack.signingSecret', 'surfaces.slack.botToken']],
+  ['discord', 'Discord', ['surfaces.discord.publicKey', 'surfaces.discord.botToken', 'surfaces.discord.applicationId']],
+  ['telegram', 'Telegram', ['surfaces.telegram.botToken']],
+  ['webhook', 'Webhook', ['surfaces.webhook.secret']],
+  ['ntfy', 'ntfy', ['surfaces.ntfy.baseUrl']],
+  ['googleChat', 'Google Chat', ['surfaces.googleChat.webhookUrl']],
+  ['signal', 'Signal', ['surfaces.signal.bridgeUrl', 'surfaces.signal.account']],
+  ['whatsapp', 'WhatsApp', ['surfaces.whatsapp.accessToken', 'surfaces.whatsapp.phoneNumberId']],
+  ['imessage', 'iMessage', ['surfaces.imessage.bridgeUrl', 'surfaces.imessage.account']],
+  ['msteams', 'Microsoft Teams', ['surfaces.msteams.appId', 'surfaces.msteams.appPassword']],
+  ['bluebubbles', 'BlueBubbles', ['surfaces.bluebubbles.serverUrl', 'surfaces.bluebubbles.password']],
+  ['mattermost', 'Mattermost', ['surfaces.mattermost.baseUrl', 'surfaces.mattermost.botToken']],
+  ['matrix', 'Matrix', ['surfaces.matrix.homeserverUrl', 'surfaces.matrix.accessToken', 'surfaces.matrix.userId']],
+] as const;
+
+export async function handleSurfacesCommand(runtime: CliCommandRuntime): Promise<{ readonly output: string; readonly exitCode: number }> {
+  const config = runtime.configManager;
+  const [sub = 'list', ...rest] = runtime.cli.commandArgs;
+  const target = rest[0];
+  if (sub === 'enable' || sub === 'disable') {
+    if (!target) return { output: `Usage: goodvibes-agent surfaces ${sub} <web|listener|control-plane|surfaceId>`, exitCode: 2 };
+    const text = [
+      'GoodVibes Agent does not mutate daemon, listener, web, or channel surface posture.',
+      'Configure those surfaces from GoodVibes TUI or the externally managed daemon host, then use `goodvibes-agent surfaces check` for read-only diagnostics.',
+    ].join(' ');
+    return {
+      output: formatJsonOrText(runtime.cli)({
+        ok: false,
+        kind: 'daemon_lifecycle_external',
+        action: `surfaces.${sub}`,
+        target,
+        error: text,
+      }, text),
+      exitCode: 2,
+    };
+  }
+  if (sub !== 'list' && sub !== 'status' && sub !== 'check' && sub !== 'show') {
+    return { output: 'Usage: goodvibes-agent surfaces [list|check|show <surfaceId>]', exitCode: 2 };
+  }
+  const controlPlane = resolveRuntimeEndpointBinding(config, 'controlPlane');
+  const web = resolveRuntimeEndpointBinding(config, 'web');
+  const httpListener = resolveRuntimeEndpointBinding(config, 'httpListener');
+  const includeProbe = sub === 'check';
+  const targetExternalSurface = target && SURFACE_CONFIGS.some(([id]) => id === target);
+  const shouldProbeControlPlane = includeProbe && !target;
+  const shouldProbeWeb = includeProbe && !target;
+  const shouldProbeListener = includeProbe && (!target || targetExternalSurface);
+  const [controlPlaneReachable, webReachable, listenerReachable] = includeProbe
+    ? await Promise.all([
+      shouldProbeControlPlane ? probeTcp(controlPlane.host, controlPlane.port) : Promise.resolve(undefined),
+      shouldProbeWeb ? probeTcp(web.host, web.port) : Promise.resolve(undefined),
+      shouldProbeListener ? probeTcp(httpListener.host, httpListener.port) : Promise.resolve(undefined),
+    ])
+    : [undefined, undefined, undefined];
+  const externalSurfaces = SURFACE_CONFIGS.map(([id, label, requiredKeys]) => {
+    const enabled = config.get(`surfaces.${id}.enabled` as ConfigKey);
+    const missing = requiredKeys.filter((key) => !isPresentConfigValue(config.get(key as ConfigKey)));
+    const missingFeatureFlags = enabled === true ? getMissingSurfaceFeatureFlags(config, id) : [];
+    return {
+      id,
+      label,
+      enabled,
+      ready: !enabled || (missing.length === 0 && missingFeatureFlags.length === 0),
+      missing,
+      missingFeatureFlags,
+    };
+  });
+  const filteredSurfaces = target ? externalSurfaces.filter((surface) => surface.id === target) : externalSurfaces;
+  if (target && filteredSurfaces.length === 0) return { output: `Unknown surface: ${target}`, exitCode: 1 };
+  const ntfyTopics = resolveGoodVibesNtfyTopics({
+    chatTopic: String(config.get('surfaces.ntfy.chatTopic' as ConfigKey) || GOODVIBES_NTFY_CHAT_TOPIC),
+    agentTopic: String(config.get('surfaces.ntfy.agentTopic' as ConfigKey) || GOODVIBES_NTFY_AGENT_TOPIC),
+    remoteTopic: String(config.get('surfaces.ntfy.remoteTopic' as ConfigKey) || GOODVIBES_NTFY_REMOTE_TOPIC),
+  });
+  const readinessIssues: string[] = [];
+  if (shouldProbeControlPlane && config.get('controlPlane.enabled') === true && !controlPlaneReachable) {
+    readinessIssues.push(`Control plane is enabled but not reachable on ${controlPlane.host}:${controlPlane.port}.`);
+  }
+  if (shouldProbeWeb && config.get('web.enabled') === true && !webReachable) {
+    readinessIssues.push(`Web surface is enabled but not reachable on ${web.host}:${web.port}.`);
+  }
+  if (shouldProbeListener && config.get('danger.httpListener') === true && !listenerReachable) {
+    readinessIssues.push(`HTTP listener is enabled but not reachable on ${httpListener.host}:${httpListener.port}.`);
+  }
+  for (const surface of filteredSurfaces) {
+    if (surface.enabled !== true) continue;
+    if (config.get('danger.httpListener') !== true) {
+      readinessIssues.push(`${surface.label} is enabled but the HTTP listener is disabled.`);
+    }
+    if (surface.missing.length > 0) {
+      readinessIssues.push(`${surface.label} is enabled but missing ${surface.missing.join(', ')}.`);
+    }
+    if (surface.missingFeatureFlags.length > 0) {
+      readinessIssues.push(`${surface.label} is enabled but feature gates are disabled: ${surface.missingFeatureFlags.join(', ')}.`);
+    }
+  }
+  const value = {
+    controlPlane: {
+      enabled: config.get('controlPlane.enabled'),
+      hostMode: controlPlane.hostMode,
+      configuredHost: controlPlane.configuredHost,
+      host: controlPlane.host,
+      port: controlPlane.port,
+      reachable: controlPlaneReachable,
+    },
+    web: {
+      enabled: config.get('web.enabled'),
+      hostMode: web.hostMode,
+      configuredHost: web.configuredHost,
+      host: web.host,
+      port: web.port,
+      reachable: webReachable,
+    },
+    httpListener: {
+      enabled: config.get('danger.httpListener'),
+      hostMode: httpListener.hostMode,
+      configuredHost: httpListener.configuredHost,
+      host: httpListener.host,
+      port: httpListener.port,
+      reachable: listenerReachable,
+    },
+    surfaces: filteredSurfaces,
+    readinessIssues,
+  };
+  const output = formatJsonOrText(runtime.cli)(value, [
+    'GoodVibes Agent surfaces',
+    `  control-plane: ${yesNo(value.controlPlane.enabled)} (${value.controlPlane.hostMode} ${value.controlPlane.host}:${value.controlPlane.port})${includeProbe ? ` reachable=${yesNo(value.controlPlane.reachable)}` : ''}`,
+    `  web: ${yesNo(value.web.enabled)} (${value.web.hostMode} ${value.web.host}:${value.web.port})${includeProbe ? ` reachable=${yesNo(value.web.reachable)}` : ''}`,
+    `  http-listener: ${yesNo(value.httpListener.enabled)} (${value.httpListener.hostMode} ${value.httpListener.host}:${value.httpListener.port})${includeProbe ? ` reachable=${yesNo(value.httpListener.reachable)}` : ''}`,
+    '',
+    'External surfaces:',
+    ...value.surfaces.map((surface) => `  ${surface.label.padEnd(16)} enabled=${yesNo(surface.enabled)} ready=${yesNo(surface.ready)}${surface.enabled && surface.missing.length > 0 ? ` missing=${surface.missing.join(',')}` : ''}${surface.enabled && surface.missingFeatureFlags.length > 0 ? ` featureGates=${surface.missingFeatureFlags.join(',')}` : ''}`),
+    ...(filteredSurfaces.some((surface) => surface.id === 'ntfy') ? [
+      '',
+      'ntfy inbound topics:',
+      `  chat: ${ntfyTopics.chatTopic}`,
+      `  agent: ${ntfyTopics.agentTopic}`,
+      `  daemon-only remote: ${ntfyTopics.remoteTopic}`,
+      `  default delivery topic: ${String(config.get('surfaces.ntfy.topic') || '(none)')}`,
+    ] : []),
+    ...(includeProbe ? [
+      readinessIssues.length === 0 ? 'Readiness: ready' : 'Readiness: needs attention',
+      ...readinessIssues.map((issue) => `  - ${issue}`),
+    ] : []),
+  ].join('\n'));
+  return { output, exitCode: includeProbe && readinessIssues.length > 0 ? 1 : 0 };
+}
+
+export interface ListenerTestResult {
+  readonly enabled: unknown;
+  readonly hostMode: string;
+  readonly configuredHost: string;
+  readonly host: string;
+  readonly port: number;
+  readonly posture: ReturnType<typeof classifyBindPosture>;
+  readonly reachable: boolean;
+  readonly service: {
+    readonly enabled: unknown;
+    readonly autostart: unknown;
+    readonly restartOnFailure: unknown;
+  };
+  readonly auth: ReturnType<typeof readAuthPaths>;
+  readonly surfaces: readonly {
+    readonly id: string;
+    readonly label: string;
+    readonly enabled: unknown;
+    readonly ready: boolean;
+    readonly missing: readonly string[];
+    readonly missingFeatureFlags: readonly string[];
+  }[];
+  readonly issues: readonly string[];
+}
+
+export async function buildListenerTestResult(runtime: CliCommandRuntime): Promise<ListenerTestResult> {
+  const enabled = runtime.configManager.get('danger.httpListener');
+  const binding = resolveRuntimeEndpointBinding(runtime.configManager, 'httpListener');
+  const posture = classifyBindPosture(binding);
+  const reachable = enabled === true ? await probeTcp(binding.host, binding.port) : false;
+  const auth = readAuthPaths(runtime);
+  const service = {
+    enabled: runtime.configManager.get('service.enabled'),
+    autostart: runtime.configManager.get('service.autostart'),
+    restartOnFailure: runtime.configManager.get('service.restartOnFailure'),
+  };
+  const surfaces = SURFACE_CONFIGS.map(([id, label, requiredKeys]) => {
+    const surfaceEnabled = runtime.configManager.get(`surfaces.${id}.enabled` as ConfigKey);
+    const missing = requiredKeys.filter((key) => !isPresentConfigValue(runtime.configManager.get(key as ConfigKey)));
+    const missingFeatureFlags = surfaceEnabled === true ? getMissingSurfaceFeatureFlags(runtime.configManager, id) : [];
+    return {
+      id,
+      label,
+      enabled: surfaceEnabled,
+      ready: surfaceEnabled !== true || (missing.length === 0 && missingFeatureFlags.length === 0),
+      missing,
+      missingFeatureFlags,
+    };
+  }).filter((surface) => surface.enabled === true);
+  const issues: string[] = [];
+  if (enabled !== true) issues.push('HTTP listener is disabled.');
+  if (enabled === true && service.enabled !== true) issues.push('HTTP listener is enabled but service mode is off.');
+  if (enabled === true && service.autostart !== true) issues.push('HTTP listener is enabled but service autostart is off.');
+  if (enabled === true && service.restartOnFailure !== true) issues.push('HTTP listener is enabled but service restart-on-failure is off.');
+  if (isNetworkFacing(enabled, binding) && !auth.userStorePresent) issues.push('Network-facing listener has no local auth user store.');
+  if (isNetworkFacing(enabled, binding) && auth.bootstrapCredentialPresent) issues.push('Network-facing listener still has a bootstrap credential file.');
+  for (const surface of surfaces) {
+    if (surface.missing.length > 0) issues.push(`${surface.label} is enabled but missing ${surface.missing.join(', ')}.`);
+    if (surface.missingFeatureFlags.length > 0) issues.push(`${surface.label} is enabled but feature gates are disabled: ${surface.missingFeatureFlags.join(', ')}.`);
+  }
+  return { enabled, ...binding, posture, reachable, service, auth, surfaces, issues };
+}
+
+export function formatListenerTestResult(runtime: CliCommandRuntime, value: ListenerTestResult): string {
+  return formatJsonOrText(runtime.cli)(value, [
+    'GoodVibes Agent listener test',
+    `  enabled: ${yesNo(value.enabled)}`,
+    `  endpoint: ${value.hostMode} ${value.host}:${value.port}`,
+    `  bind posture: ${value.posture.label}`,
+    `  reachable: ${yesNo(value.reachable)}`,
+    `  service: enabled=${yesNo(value.service.enabled)} autostart=${yesNo(value.service.autostart)} restartOnFailure=${yesNo(value.service.restartOnFailure)}`,
+    `  local auth users: ${value.auth.userStorePresent ? 'present' : 'missing'}`,
+    `  bootstrap credential: ${value.auth.bootstrapCredentialPresent ? 'present' : 'missing'}`,
+    value.surfaces.length === 0 ? '  enabled webhook surfaces: none' : '  enabled webhook surfaces:',
+    ...value.surfaces.map((surface) => `    ${surface.label}: ready=${yesNo(surface.ready)}${surface.missing.length > 0 ? ` missing=${surface.missing.join(',')}` : ''}${surface.missingFeatureFlags.length > 0 ? ` featureGates=${surface.missingFeatureFlags.join(',')}` : ''}`),
+    value.issues.length === 0 ? '  readiness: ready' : '  readiness: needs attention',
+    ...value.issues.map((issue) => `    - ${issue}`),
+  ].join('\n'));
+}

package/src/cli/tui-startup.ts

@@ -0,0 +1,32 @@
+import type { CommandContext, CommandRegistry } from '../input/command-registry.ts';
+import type { InputHandler } from '../input/handler.ts';
+import { readOnboardingCheckMarker } from '../runtime/onboarding/index.ts';
+import type { GoodVibesCliParseResult } from './types.ts';
+
+export function applyInitialTuiCliState(options: {
+  readonly cli: GoodVibesCliParseResult;
+  readonly input: InputHandler;
+  readonly commandRegistry: CommandRegistry;
+  readonly commandContext: CommandContext;
+  readonly shellPaths: Parameters<typeof readOnboardingCheckMarker>[0];
+  readonly render: () => void;
+}): void {
+  const { cli, input, commandRegistry, commandContext, shellPaths, render } = options;
+  const globalOnboardingMarker = readOnboardingCheckMarker(shellPaths, 'user');
+  if (cli.command === 'onboarding') {
+    input.openOnboardingWizard({ mode: 'edit', reset: true });
+  } else if (cli.command === 'sessions' && cli.commandArgs[0] === 'resume') {
+    const target = cli.commandArgs.slice(1).join(' ').trim();
+    if (target) {
+      void commandRegistry.execute('session', ['resume', target], commandContext).then(() => render());
+    }
+  } else if (!globalOnboardingMarker.exists) {
+    input.openOnboardingWizard({ mode: 'new', reset: true });
+  }
+
+  const seededPrompt = cli.flags.prompt ?? (cli.rawCommand === undefined && cli.positionals.length > 0 ? cli.positionals.join(' ') : undefined);
+  if (seededPrompt) {
+    input.prompt = seededPrompt;
+    input.cursorPos = seededPrompt.length;
+  }
+}