@pellux/goodvibes-tui 0.19.25 → 0.19.27

package/src/cli/management-commands.ts

@@ -1,9 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import type { ConfigKey, GoodVibesConfig } from '../config/index.ts';
-import { CONFIG_SCHEMA } from '../config/index.ts';
 import { SecretsManager } from '../config/secrets.ts';
-import { createShellPathService } from '@pellux/goodvibes-sdk/platform/runtime/shell-paths';
 import { BUILTIN_SECRET_PROVIDER_SOURCES, describeSecretRef, isSecretRefInput, resolveSecretRef } from '@pellux/goodvibes-sdk/platform/config/secret-refs';
 import { getSubscriptionProviderConfig, listAvailableSubscriptionProviders } from '@pellux/goodvibes-sdk/platform/config/subscription-providers';
 import { beginOpenAICodexLogin, exchangeOpenAICodexCode } from '@pellux/goodvibes-sdk/platform/config/openai-codex-auth';
@@ -11,8 +8,9 @@ import { inspectProviderAuth } from '@pellux/goodvibes-sdk/platform/runtime/auth
 import { getOrCreateCompanionToken, buildCompanionConnectionInfo, encodeConnectionPayload, formatConnectionBlock } from '@pellux/goodvibes-sdk/platform/pairing/index';
 import { generateQrMatrix, renderQrToString } from '@pellux/goodvibes-sdk/platform/pairing/qr-generator';
 import { resolveRuntimeEndpointBinding } from './endpoints.ts';
+import { classifyBindPosture, isNetworkFacing } from './network-posture.ts';
 import type { CliCommandRuntime } from './management.ts';
-import { applyTargetEndpointFlagsOrDefault, enableEndpointLanDefault, enableServicePosture, extractAuthorizationCode, formatJsonOrText, getNestedValue, hasCommandFlag, isPresentConfigValue, openBrowser, probeTcp, readAuthPaths, runNonInteractiveAgent, SURFACE_CONFIGS, urlHostForBindHost, withRuntimeServices, yesNo } from './management.ts';
+import { extractAuthorizationCode, formatJsonOrText, hasCommandFlag, openBrowser, probeTcp, readAuthPaths, runNonInteractiveAgent, urlHostForBindHost, withRuntimeServices, yesNo } from './management.ts';
 
 export async function renderSubscriptions(runtime: CliCommandRuntime): Promise<string> {
   return await withRuntimeServices(runtime, async (services) => {
@@ -305,157 +303,71 @@ export async function handleTasks(runtime: CliCommandRuntime): Promise<string> {
   });
 }
 
-export async function handleSurfaces(runtime: CliCommandRuntime): Promise<string> {
-  const config = runtime.configManager;
-  const [sub = 'list', ...rest] = runtime.cli.commandArgs;
-  const target = rest[0];
-  if (sub === 'enable' || sub === 'disable') {
-    if (!target) return `Usage: goodvibes surfaces ${sub} <web|listener|control-plane|surfaceId>`;
-    const enabled = sub === 'enable';
-    if (target === 'web') {
-      runtime.configManager.setDynamic('web.enabled', enabled);
-      if (enabled) {
-        runtime.configManager.setDynamic('danger.daemon', true);
-        runtime.configManager.setDynamic('controlPlane.enabled', true);
-        const webError = applyTargetEndpointFlagsOrDefault(runtime, 'web');
-        if (webError) return webError;
-        const webBinding = resolveRuntimeEndpointBinding(runtime.configManager, 'web');
-        if (runtime.cli.flags.hostname !== undefined && webBinding.hostMode === 'local') {
-          runtime.configManager.setDynamic('controlPlane.hostMode', 'local');
-          runtime.configManager.setDynamic('controlPlane.host', '127.0.0.1');
-          runtime.configManager.setDynamic('controlPlane.allowRemote', false);
-        } else {
-          enableEndpointLanDefault(runtime.configManager, 'controlPlane');
-        }
-      }
-    }
-    else if (target === 'listener' || target === 'http-listener') {
-      runtime.configManager.setDynamic('danger.httpListener', enabled);
-      if (enabled) {
-        const listenerError = applyTargetEndpointFlagsOrDefault(runtime, 'httpListener');
-        if (listenerError) return listenerError;
-      }
-    }
-    else if (target === 'control-plane' || target === 'controlPlane') {
-      runtime.configManager.setDynamic('controlPlane.enabled', enabled);
-      runtime.configManager.setDynamic('danger.daemon', enabled);
-      if (enabled) {
-        const controlPlaneError = applyTargetEndpointFlagsOrDefault(runtime, 'controlPlane');
-        if (controlPlaneError) return controlPlaneError;
-      }
-    }
-    else if (SURFACE_CONFIGS.some(([id]) => id === target)) {
-      runtime.configManager.setDynamic(`surfaces.${target}.enabled` as ConfigKey, enabled);
-      if (enabled) {
-        runtime.configManager.setDynamic('danger.httpListener', true);
-        enableEndpointLanDefault(runtime.configManager, 'httpListener');
-      }
-    }
-    else return `Unknown surface: ${target}`;
-    if (enabled) {
-      enableServicePosture(runtime.configManager);
-    }
-    return `Surface ${enabled ? 'enabled' : 'disabled'}: ${target}`;
-  }
-  if (sub !== 'list' && sub !== 'status' && sub !== 'check' && sub !== 'show') {
-    return 'Usage: goodvibes surfaces [list|check|show <surfaceId>|enable <surfaceId>|disable <surfaceId>]';
-  }
-  const controlPlane = resolveRuntimeEndpointBinding(config, 'controlPlane');
-  const web = resolveRuntimeEndpointBinding(config, 'web');
-  const httpListener = resolveRuntimeEndpointBinding(config, 'httpListener');
-  const includeProbe = sub === 'check';
-  const [controlPlaneReachable, webReachable, listenerReachable] = includeProbe
-    ? await Promise.all([
-      probeTcp(controlPlane.host, controlPlane.port),
-      probeTcp(web.host, web.port),
-      probeTcp(httpListener.host, httpListener.port),
-    ])
-    : [undefined, undefined, undefined];
-  const externalSurfaces = SURFACE_CONFIGS.map(([id, label, requiredKeys]) => {
-    const enabled = config.get(`surfaces.${id}.enabled` as ConfigKey);
-    const missing = requiredKeys.filter((key) => !isPresentConfigValue(config.get(key as ConfigKey)));
-    return {
-      id,
-      label,
-      enabled,
-      ready: !enabled || missing.length === 0,
-      missing,
-    };
-  });
-  const filteredSurfaces = target ? externalSurfaces.filter((surface) => surface.id === target) : externalSurfaces;
-  if (target && filteredSurfaces.length === 0) return `Unknown surface: ${target}`;
-  const value = {
-    controlPlane: {
-      enabled: config.get('controlPlane.enabled'),
-      hostMode: controlPlane.hostMode,
-      configuredHost: controlPlane.configuredHost,
-      host: controlPlane.host,
-      port: controlPlane.port,
-      reachable: controlPlaneReachable,
-    },
-    web: {
-      enabled: config.get('web.enabled'),
-      hostMode: web.hostMode,
-      configuredHost: web.configuredHost,
-      host: web.host,
-      port: web.port,
-      reachable: webReachable,
-    },
-    httpListener: {
-      enabled: config.get('danger.httpListener'),
-      hostMode: httpListener.hostMode,
-      configuredHost: httpListener.configuredHost,
-      host: httpListener.host,
-      port: httpListener.port,
-      reachable: listenerReachable,
-    },
-    surfaces: filteredSurfaces,
+export interface ControlPlaneStatusResult {
+  readonly enabled: unknown;
+  readonly hostMode: string;
+  readonly configuredHost: string;
+  readonly host: string;
+  readonly port: number;
+  readonly posture: ReturnType<typeof classifyBindPosture>;
+  readonly reachable: boolean;
+  readonly auth: ReturnType<typeof readAuthPaths>;
+  readonly service: {
+    readonly enabled: unknown;
+    readonly autostart: unknown;
+    readonly restartOnFailure: unknown;
   };
-  return formatJsonOrText(runtime.cli)(value, [
-    'GoodVibes surfaces',
-    `  control-plane: ${yesNo(value.controlPlane.enabled)} (${value.controlPlane.hostMode} ${value.controlPlane.host}:${value.controlPlane.port})${includeProbe ? ` reachable=${yesNo(value.controlPlane.reachable)}` : ''}`,
-    `  web: ${yesNo(value.web.enabled)} (${value.web.hostMode} ${value.web.host}:${value.web.port})${includeProbe ? ` reachable=${yesNo(value.web.reachable)}` : ''}`,
-    `  http-listener: ${yesNo(value.httpListener.enabled)} (${value.httpListener.hostMode} ${value.httpListener.host}:${value.httpListener.port})${includeProbe ? ` reachable=${yesNo(value.httpListener.reachable)}` : ''}`,
-    '',
-    'External surfaces:',
-    ...value.surfaces.map((surface) => `  ${surface.label.padEnd(16)} enabled=${yesNo(surface.enabled)} ready=${yesNo(surface.ready)}${surface.enabled && surface.missing.length > 0 ? ` missing=${surface.missing.join(',')}` : ''}`),
-  ].join('\n'));
+  readonly issues: readonly string[];
 }
 
-export async function renderListenerTest(runtime: CliCommandRuntime): Promise<string> {
-  const enabled = runtime.configManager.get('danger.httpListener');
-  const binding = resolveRuntimeEndpointBinding(runtime.configManager, 'httpListener');
-  const reachable = await probeTcp(binding.host, binding.port);
-  const value = { enabled, ...binding, reachable };
-  return formatJsonOrText(runtime.cli)(value, [
-    'GoodVibes listener test',
-    `  enabled: ${yesNo(enabled)}`,
-    `  endpoint: ${binding.hostMode} ${binding.host}:${binding.port}`,
-    `  reachable: ${yesNo(reachable)}`,
-  ].join('\n'));
-}
-
-export async function renderControlPlaneStatus(runtime: CliCommandRuntime): Promise<string> {
+export async function buildControlPlaneStatusResult(runtime: CliCommandRuntime): Promise<ControlPlaneStatusResult> {
   const binding = resolveRuntimeEndpointBinding(runtime.configManager, 'controlPlane');
-  const reachable = await probeTcp(binding.host, binding.port);
+  const enabled = runtime.configManager.get('controlPlane.enabled');
+  const reachable = enabled === true ? await probeTcp(binding.host, binding.port) : false;
   const auth = readAuthPaths(runtime);
-  const value = {
-    enabled: runtime.configManager.get('controlPlane.enabled'),
+  const service = {
+    enabled: runtime.configManager.get('service.enabled'),
+    autostart: runtime.configManager.get('service.autostart'),
+    restartOnFailure: runtime.configManager.get('service.restartOnFailure'),
+  };
+  const issues: string[] = [];
+  if (enabled === true && !reachable) issues.push(`Control plane is enabled but not reachable on ${binding.host}:${binding.port}.`);
+  if (enabled === true && service.enabled !== true) issues.push('Control plane is enabled but service mode is off.');
+  if (enabled === true && service.autostart !== true) issues.push('Control plane is enabled but service autostart is off.');
+  if (enabled === true && service.restartOnFailure !== true) issues.push('Control plane is enabled but service restart-on-failure is off.');
+  if (isNetworkFacing(enabled, binding) && !auth.userStorePresent) issues.push('Network-facing control plane has no local auth user store.');
+  if (isNetworkFacing(enabled, binding) && auth.bootstrapCredentialPresent) issues.push('Network-facing control plane still has a bootstrap credential file.');
+  return {
+    enabled,
     ...binding,
+    posture: classifyBindPosture(binding),
     reachable,
     auth,
+    service,
+    issues,
   };
+}
+
+export function formatControlPlaneStatus(runtime: CliCommandRuntime, value: ControlPlaneStatusResult): string {
   return formatJsonOrText(runtime.cli)(value, [
     'GoodVibes control-plane status',
     `  enabled: ${yesNo(value.enabled)}`,
-    `  bind: ${binding.hostMode} ${binding.host}:${binding.port}`,
-    `  reachable: ${yesNo(reachable)}`,
-    `  local auth users: ${auth.userStorePresent ? 'present' : 'missing'}`,
-    `  bootstrap credential: ${auth.bootstrapCredentialPresent ? 'present' : 'missing'}`,
-    `  operator tokens: ${auth.operatorTokenPresent ? 'present' : 'missing'}`,
+    `  bind: ${value.hostMode} ${value.host}:${value.port}`,
+    `  bind posture: ${value.posture.label}`,
+    `  reachable: ${yesNo(value.reachable)}`,
+    `  service: enabled=${yesNo(value.service.enabled)} autostart=${yesNo(value.service.autostart)} restartOnFailure=${yesNo(value.service.restartOnFailure)}`,
+    `  local auth users: ${value.auth.userStorePresent ? 'present' : 'missing'}`,
+    `  bootstrap credential: ${value.auth.bootstrapCredentialPresent ? 'present' : 'missing'}`,
+    `  operator tokens: ${value.auth.operatorTokenPresent ? 'present' : 'missing'}`,
+    value.issues.length === 0 ? '  readiness: ready' : '  readiness: needs attention',
+    ...value.issues.map((issue) => `    - ${issue}`),
   ].join('\n'));
 }
 
+export async function renderControlPlaneStatus(runtime: CliCommandRuntime): Promise<string> {
+  return formatControlPlaneStatus(runtime, await buildControlPlaneStatusResult(runtime));
+}
+
 export async function renderPairing(runtime: CliCommandRuntime): Promise<string> {
   const daemonHomeDir = join(runtime.homeDirectory, '.goodvibes', 'daemon');
   const tokenRecord = getOrCreateCompanionToken('tui', { daemonHomeDir });
@@ -471,68 +383,6 @@ export async function renderPairing(runtime: CliCommandRuntime): Promise<string>
   return [formatConnectionBlock(info, payload), '', qr].join('\n');
 }
 
-export async function handleBundle(runtime: CliCommandRuntime): Promise<string> {
-  const [sub = 'inspect', ...rest] = runtime.cli.commandArgs;
-  const shellPaths = createShellPathService({
-    workingDirectory: runtime.workingDirectory,
-    homeDirectory: runtime.homeDirectory,
-  });
-  if (sub === 'inspect') {
-    const path = rest[0];
-    if (!path) return 'Usage: goodvibes bundle inspect <path>';
-    const sourcePath = shellPaths.resolveWorkspacePath(path);
-    const parsed = JSON.parse(readFileSync(sourcePath, 'utf-8')) as Record<string, unknown>;
-    return [
-      'GoodVibes bundle',
-      `  type: ${String(parsed['type'] ?? 'unknown')}`,
-      `  version: ${String(parsed['version'] ?? 'unknown')}`,
-      `  path: ${sourcePath}`,
-      `  capturedAt: ${parsed['capturedAt'] ? new Date(Number(parsed['capturedAt'])).toISOString() : 'n/a'}`,
-      `  configKeys: ${parsed['config'] && typeof parsed['config'] === 'object' ? CONFIG_SCHEMA.filter((setting) => getNestedValue(parsed['config'], setting.key) !== undefined).length : 0}`,
-    ].join('\n');
-  }
-  if (sub === 'export') {
-    const outputPath = rest[0] ?? 'goodvibes-bundle.json';
-    const secrets = new SecretsManager({
-      projectRoot: runtime.workingDirectory,
-      globalHome: runtime.homeDirectory,
-      configManager: runtime.configManager,
-    });
-    const bundle = {
-      version: 1,
-      type: 'goodvibes.setup',
-      capturedAt: Date.now(),
-      workingDirectory: runtime.workingDirectory,
-      config: runtime.configManager.getRaw(),
-      secrets: await secrets.inspect(),
-      onboarding: {
-        projectMarker: existsSync(shellPaths.resolveProjectPath('tui', 'onboarding.json')),
-        userMarker: existsSync(shellPaths.resolveUserPath('tui', 'onboarding.json')),
-      },
-    };
-    const targetPath = shellPaths.resolveWorkspacePath(outputPath);
-    mkdirSync(dirname(targetPath), { recursive: true });
-    writeFileSync(targetPath, JSON.stringify(bundle, null, 2) + '\n', 'utf-8');
-    return `Bundle exported: ${targetPath}`;
-  }
-  if (sub === 'import') {
-    const path = rest[0];
-    if (!path) return 'Usage: goodvibes bundle import <path>';
-    const sourcePath = shellPaths.resolveWorkspacePath(path);
-    const parsed = JSON.parse(readFileSync(sourcePath, 'utf-8')) as { config?: GoodVibesConfig };
-    if (!parsed.config || typeof parsed.config !== 'object') return 'Bundle has no config object to import.';
-    let count = 0;
-    for (const setting of CONFIG_SCHEMA) {
-      const value = getNestedValue(parsed.config, setting.key);
-      if (value === undefined) continue;
-      runtime.configManager.setDynamic(setting.key, value);
-      count++;
-    }
-    return `Bundle imported: ${count} config value${count === 1 ? '' : 's'} applied.`;
-  }
-  return 'Usage: goodvibes bundle export [path]|inspect <path>|import <path>';
-}
-
 export async function renderRemote(runtime: CliCommandRuntime, label: 'remote' | 'bridge'): Promise<string> {
   return await withRuntimeServices(runtime, (services) => {
     const pools = services.remoteRunnerRegistry.listPools?.() ?? [];

package/src/cli/management.ts

@@ -21,10 +21,14 @@ import { inspectProviderAuth } from '@pellux/goodvibes-sdk/platform/runtime/auth
 import { getOrCreateCompanionToken, buildCompanionConnectionInfo, encodeConnectionPayload, formatConnectionBlock } from '@pellux/goodvibes-sdk/platform/pairing/index';
 import { generateQrMatrix, renderQrToString } from '@pellux/goodvibes-sdk/platform/pairing/qr-generator';
 import type { GoodVibesCliParseResult } from './types.ts';
+import { classifyProviderSetup } from './provider-classification.ts';
 import { resolveRuntimeEndpointBinding } from './endpoints.ts';
 import { applyRuntimeEndpointFlagOverrides } from './config-overrides.ts';
 import type { RuntimeEndpointId } from './endpoints.ts';
-import { handleBundle, handleSecrets, handleSessions, handleSurfaces, handleTasks, renderControlPlaneStatus, renderListenerTest, renderPairing, renderRemote, renderSubscriptions, renderWeb } from './management-commands.ts';
+import { handleServiceCommand } from './service-command.ts';
+import { handleBundleCommand } from './bundle-command.ts';
+import { buildListenerTestResult, formatListenerTestResult, handleSurfacesCommand } from './surface-command.ts';
+import { buildControlPlaneStatusResult, formatControlPlaneStatus, handleSecrets, handleSessions, handleTasks, renderPairing, renderRemote, renderSubscriptions, renderWeb } from './management-commands.ts';
 
 export interface CliCommandRuntime {
   readonly cli: GoodVibesCliParseResult;
@@ -40,23 +44,6 @@ interface CliCommandResult {
 
 type Formatter = (value: unknown, text: string) => string;
 
-export const SURFACE_CONFIGS = [
-  ['slack', 'Slack', ['surfaces.slack.signingSecret', 'surfaces.slack.botToken']],
-  ['discord', 'Discord', ['surfaces.discord.publicKey', 'surfaces.discord.botToken', 'surfaces.discord.applicationId']],
-  ['telegram', 'Telegram', ['surfaces.telegram.botToken']],
-  ['webhook', 'Webhook', ['surfaces.webhook.secret']],
-  ['ntfy', 'ntfy', ['surfaces.ntfy.baseUrl', 'surfaces.ntfy.topic']],
-  ['googleChat', 'Google Chat', ['surfaces.googleChat.webhookUrl']],
-  ['signal', 'Signal', ['surfaces.signal.bridgeUrl', 'surfaces.signal.account']],
-  ['whatsapp', 'WhatsApp', ['surfaces.whatsapp.accessToken', 'surfaces.whatsapp.phoneNumberId']],
-  ['imessage', 'iMessage', ['surfaces.imessage.bridgeUrl', 'surfaces.imessage.account']],
-  ['msteams', 'Microsoft Teams', ['surfaces.msteams.appId', 'surfaces.msteams.appPassword']],
-  ['bluebubbles', 'BlueBubbles', ['surfaces.bluebubbles.serverUrl', 'surfaces.bluebubbles.password']],
-  ['mattermost', 'Mattermost', ['surfaces.mattermost.baseUrl', 'surfaces.mattermost.botToken']],
-  ['matrix', 'Matrix', ['surfaces.matrix.homeserverUrl', 'surfaces.matrix.accessToken', 'surfaces.matrix.userId']],
-] as const;
-
-
 export function yesNo(value: unknown): string {
   return value === true ? 'yes' : 'no';
 }
@@ -424,9 +411,16 @@ async function renderProviders(runtime: CliCommandRuntime): Promise<string> {
       if (!provider) return 'Usage: goodvibes providers inspect <provider>';
       const snapshot = snapshots.find((candidate) => candidate.providerId === provider);
       if (!snapshot) return `No provider found: ${provider}`;
-      return formatJsonOrText(runtime.cli)(snapshot, [
+      const setup = classifyProviderSetup({
+        providerId: snapshot.providerId,
+        authMode: snapshot.runtime.auth?.mode,
+        configured: snapshot.runtime.auth?.configured ?? true,
+        modelCount: snapshot.modelCount,
+      });
+      return formatJsonOrText(runtime.cli)({ ...snapshot, setup }, [
         `Provider ${snapshot.providerId}`,
         `  active: ${yesNo(snapshot.active)}`,
+        `  setup: ${setup.setupLabel}`,
         `  configured: ${yesNo(snapshot.runtime.auth?.configured ?? true)}`,
         `  via: ${snapshot.runtime.auth?.mode ?? 'unknown'}`,
         `  models: ${snapshot.modelCount}`,
@@ -435,6 +429,12 @@ async function renderProviders(runtime: CliCommandRuntime): Promise<string> {
     }
     if (sub !== 'list') return 'Usage: goodvibes providers [list|current|inspect <provider>|use <provider> [modelRegistryKey]]';
     const value = snapshots.map((snapshot) => ({
+      ...classifyProviderSetup({
+        providerId: snapshot.providerId,
+        authMode: snapshot.runtime.auth?.mode,
+        configured: snapshot.runtime.auth?.configured ?? true,
+        modelCount: snapshot.modelCount,
+      }),
       provider: snapshot.providerId,
       active: snapshot.active,
       configured: snapshot.runtime.auth?.configured ?? true,
@@ -446,7 +446,7 @@ async function renderProviders(runtime: CliCommandRuntime): Promise<string> {
     return formatJsonOrText(runtime.cli)(value, [
       'GoodVibes providers',
       ...value.map((provider) =>
-        `  ${provider.current ? '*' : ' '} ${provider.provider.padEnd(18)} configured=${yesNo(provider.configured)} via=${provider.configuredVia ?? 'n/a'} models=${provider.models} ${provider.detail ?? ''}`.trimEnd(),
+        `  ${provider.current ? '*' : ' '} ${provider.provider.padEnd(18)} setup=${provider.setupClass} configured=${yesNo(provider.configured)} via=${provider.configuredVia ?? 'n/a'} models=${provider.models} ${provider.detail ?? ''}`.trimEnd(),
       ),
     ].join('\n'));
   });
@@ -456,19 +456,35 @@ async function renderModels(runtime: CliCommandRuntime): Promise<string> {
   return await withRuntimeServices(runtime, async (services) => {
     const [subOrFilter, ...rest] = runtime.cli.commandArgs;
     const current = services.providerRegistry.getCurrentModel().registryKey;
+    const providerSnapshots = await listProviderRuntimeSnapshots(services.providerRegistry);
+    const classifyModelProvider = (providerId: string) => {
+      const snapshot = providerSnapshots.find((candidate) => candidate.providerId === providerId);
+      return classifyProviderSetup({
+        providerId,
+        authMode: snapshot?.runtime.auth?.mode,
+        configured: snapshot?.runtime.auth?.configured,
+        modelCount: snapshot?.modelCount,
+      });
+    };
     if (subOrFilter === 'current') {
       const model = services.providerRegistry.getCurrentModel();
+      const setup = classifyModelProvider(model.provider);
+      const providerSnapshot = providerSnapshots.find((candidate) => candidate.providerId === model.provider);
       const value = {
         registryKey: model.registryKey,
         provider: model.provider,
         id: model.id,
         displayName: model.displayName,
         contextWindow: services.providerRegistry.getContextWindowForModel(model),
+        providerConfigured: providerSnapshot?.runtime.auth?.configured ?? true,
+        setup,
       };
       return formatJsonOrText(runtime.cli)(value, [
         'GoodVibes current model',
         `  model: ${model.registryKey}`,
         `  provider: ${model.provider}`,
+        `  setup: ${setup.setupLabel}`,
+        `  provider configured: ${yesNo(value.providerConfigured)}`,
         `  context: ${value.contextWindow.toLocaleString()}`,
       ].join('\n'));
     }
@@ -519,6 +535,7 @@ async function renderModels(runtime: CliCommandRuntime): Promise<string> {
     const value = models.map((model) => ({
       registryKey: model.registryKey,
       provider: model.provider,
+      ...classifyModelProvider(model.provider),
       id: model.id,
       displayName: model.displayName,
       contextWindow: services.providerRegistry.getContextWindowForModel(model),
@@ -526,7 +543,7 @@ async function renderModels(runtime: CliCommandRuntime): Promise<string> {
     }));
     return formatJsonOrText(runtime.cli)(value, [
       `GoodVibes models${filter ? ` (${filter})` : ''}`,
-      ...value.map((model) => `  ${model.current ? '*' : ' '} ${model.registryKey.padEnd(42)} ctx=${model.contextWindow.toLocaleString()} ${model.displayName}`),
+      ...value.map((model) => `  ${model.current ? '*' : ' '} ${model.registryKey.padEnd(42)} setup=${model.setupClass} ctx=${model.contextWindow.toLocaleString()} ${model.displayName}`),
     ].join('\n'));
   });
 }
@@ -622,6 +639,11 @@ export async function handleGoodVibesCliCommand(runtime: CliCommandRuntime): Pro
       case 'web':
         console.log(renderWeb(runtime));
         return { handled: true, exitCode: 0 };
+      case 'service': {
+        const result = await handleServiceCommand(runtime);
+        console.log(result.output);
+        return { handled: true, exitCode: result.exitCode };
+      }
       case 'providers': {
         const output = await renderProviders(runtime);
         console.log(output);
@@ -659,23 +681,27 @@ export async function handleGoodVibesCliCommand(runtime: CliCommandRuntime): Pro
         return { handled: true, exitCode: exitCodeForText(output) };
       }
       case 'surfaces': {
-        const output = await handleSurfaces(runtime);
-        console.log(output);
-        return { handled: true, exitCode: exitCodeForText(output) };
+        const result = await handleSurfacesCommand(runtime);
+        console.log(result.output);
+        return { handled: true, exitCode: result.exitCode };
+      }
+      case 'listener': {
+        const result = await buildListenerTestResult(runtime);
+        console.log(formatListenerTestResult(runtime, result));
+        return { handled: true, exitCode: result.issues.length > 0 ? 1 : 0 };
+      }
+      case 'control-plane': {
+        const result = await buildControlPlaneStatusResult(runtime);
+        console.log(formatControlPlaneStatus(runtime, result));
+        return { handled: true, exitCode: result.issues.length > 0 ? 1 : 0 };
       }
-      case 'listener':
-        console.log(await renderListenerTest(runtime));
-        return { handled: true, exitCode: 0 };
-      case 'control-plane':
-        console.log(await renderControlPlaneStatus(runtime));
-        return { handled: true, exitCode: 0 };
       case 'pair':
         console.log(await renderPairing(runtime));
         return { handled: true, exitCode: 0 };
       case 'bundle': {
-        const output = await handleBundle(runtime);
-        console.log(output);
-        return { handled: true, exitCode: exitCodeForText(output) };
+        const result = await handleBundleCommand(runtime);
+        console.log(result.output);
+        return { handled: true, exitCode: result.exitCode };
       }
       case 'remote':
         console.log(await renderRemote(runtime, 'remote'));

package/src/cli/network-posture.ts

@@ -0,0 +1,46 @@
+import type { RuntimeEndpointBinding } from './endpoints.ts';
+
+export type BindPostureKind = 'local' | 'local-network' | 'custom-network';
+
+export interface BindPosture {
+  readonly kind: BindPostureKind;
+  readonly label: string;
+  readonly networkFacing: boolean;
+}
+
+export function isLoopbackHost(host: string): boolean {
+  const normalized = host.trim().toLowerCase();
+  return normalized === 'localhost'
+    || normalized === '::1'
+    || normalized === '0:0:0:0:0:0:0:1'
+    || normalized.startsWith('127.');
+}
+
+export function classifyBindPosture(binding: Pick<RuntimeEndpointBinding, 'hostMode' | 'host'>): BindPosture {
+  if (binding.hostMode === 'local' || isLoopbackHost(binding.host)) {
+    return {
+      kind: 'local',
+      label: 'Local only',
+      networkFacing: false,
+    };
+  }
+  if (binding.hostMode === 'network' || binding.host === '0.0.0.0' || binding.host === '::') {
+    return {
+      kind: 'local-network',
+      label: 'Local Network',
+      networkFacing: true,
+    };
+  }
+  return {
+    kind: 'custom-network',
+    label: 'Custom network',
+    networkFacing: true,
+  };
+}
+
+export function isNetworkFacing(
+  enabled: unknown,
+  binding: Pick<RuntimeEndpointBinding, 'hostMode' | 'host'>,
+): boolean {
+  return enabled === true && classifyBindPosture(binding).networkFacing;
+}

package/src/cli/package-verification.ts

@@ -0,0 +1,119 @@
+import { execSync } from 'node:child_process';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+export interface PackageCliBinVerification {
+  readonly command: 'goodvibes' | 'goodvibes-daemon';
+  readonly target: string;
+  readonly exists: boolean;
+  readonly executable: boolean;
+  readonly hasLocalPlatformBuildFallback: boolean;
+  readonly hasLocalBuildFallback: boolean;
+  readonly hasVendoredBinaryFallback: boolean;
+  readonly hasSourceFallback: boolean;
+}
+
+export interface PackageCliVerificationReport {
+  readonly packageName: string;
+  readonly version: string;
+  readonly bins: readonly PackageCliBinVerification[];
+  readonly tarball: {
+    readonly entryCount: number;
+    readonly unpackedSize: number;
+    readonly requiredPathsPresent: readonly string[];
+    readonly forbiddenPaths: readonly string[];
+  };
+  readonly issues: readonly string[];
+}
+
+const REQUIRED_BIN_COMMANDS = ['goodvibes', 'goodvibes-daemon'] as const;
+const REQUIRED_TARBALL_PATHS = [
+  'README.md',
+  'CHANGELOG.md',
+  'package.json',
+  'src/main.ts',
+  'src/daemon/cli.ts',
+  'bin/goodvibes',
+  'bin/goodvibes-daemon',
+  'scripts/postinstall.js',
+  '.goodvibes/GOODVIBES.md',
+] as const;
+const FORBIDDEN_TARBALL_PREFIXES = ['.github/', 'src/test/', 'src/.test/', '.goodvibes/memory/', 'vendor/'] as const;
+
+function readPackageJson(root: string): Record<string, unknown> {
+  return JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8')) as Record<string, unknown>;
+}
+
+function hasExecutableBit(path: string): boolean {
+  return existsSync(path) && (statSync(path).mode & 0o111) !== 0;
+}
+
+function verifyBin(root: string, command: typeof REQUIRED_BIN_COMMANDS[number], target: string | undefined): PackageCliBinVerification {
+  const binPath = target ? join(root, target) : '';
+  const source = target && existsSync(binPath) ? readFileSync(binPath, 'utf-8') : '';
+  const expectedLocalBuild = command === 'goodvibes' ? "dist', 'goodvibes'" : "dist', 'goodvibes-daemon'";
+  const expectedSource = command === 'goodvibes' ? "src', 'main.ts'" : "src', 'daemon', 'cli.ts'";
+  return {
+    command,
+    target: target ?? '',
+    exists: Boolean(target) && existsSync(binPath),
+    executable: Boolean(target) && hasExecutableBit(binPath),
+    hasLocalPlatformBuildFallback: source.includes("dist', artifactName"),
+    hasLocalBuildFallback: source.includes(expectedLocalBuild),
+    hasVendoredBinaryFallback: source.includes('vendor'),
+    hasSourceFallback: source.includes(expectedSource) && source.includes("'bun'"),
+  };
+}
+
+function npmPackDryRun(root: string): { readonly files: readonly string[]; readonly entryCount: number; readonly unpackedSize: number } {
+  const raw = execSync('npm pack --json --dry-run', {
+    cwd: root,
+    encoding: 'utf-8',
+    stdio: ['ignore', 'pipe', 'inherit'],
+  });
+  const [packResult] = JSON.parse(raw) as Array<{ files?: Array<{ path?: string }>; entryCount?: number; unpackedSize?: number }>;
+  return {
+    files: Array.isArray(packResult?.files) ? packResult.files.map((entry) => String(entry.path ?? '')) : [],
+    entryCount: Number(packResult?.entryCount ?? 0),
+    unpackedSize: Number(packResult?.unpackedSize ?? 0),
+  };
+}
+
+export function verifyPackageCliInstall(root: string): PackageCliVerificationReport {
+  const pkg = readPackageJson(root);
+  const bin = pkg.bin && typeof pkg.bin === 'object' ? pkg.bin as Record<string, string | undefined> : {};
+  const bins = REQUIRED_BIN_COMMANDS.map((command) => verifyBin(root, command, bin[command]));
+  const pack = npmPackDryRun(root);
+  const requiredPathsPresent = REQUIRED_TARBALL_PATHS.filter((path) => pack.files.includes(path));
+  const forbiddenPaths = pack.files.filter((path) => FORBIDDEN_TARBALL_PREFIXES.some((prefix) => path.startsWith(prefix)));
+  const issues: string[] = [];
+
+  for (const item of bins) {
+    if (!item.target) issues.push(`package.json bin is missing ${item.command}.`);
+    if (!item.exists) issues.push(`bin target does not exist: ${item.command} -> ${item.target}`);
+    if (!item.executable) issues.push(`bin target is not executable: ${item.command} -> ${item.target}`);
+    if (!item.hasLocalPlatformBuildFallback) issues.push(`bin target lacks local platform dist fallback: ${item.command}`);
+    if (!item.hasLocalBuildFallback) issues.push(`bin target lacks local dist fallback: ${item.command}`);
+    if (!item.hasVendoredBinaryFallback) issues.push(`bin target lacks vendored binary fallback: ${item.command}`);
+    if (!item.hasSourceFallback) issues.push(`bin target lacks Bun source fallback: ${item.command}`);
+  }
+  for (const path of REQUIRED_TARBALL_PATHS) {
+    if (!pack.files.includes(path)) issues.push(`npm tarball missing required path: ${path}`);
+  }
+  for (const path of forbiddenPaths) {
+    issues.push(`npm tarball includes forbidden path: ${path}`);
+  }
+
+  return {
+    packageName: String(pkg.name ?? ''),
+    version: String(pkg.version ?? ''),
+    bins,
+    tarball: {
+      entryCount: pack.entryCount,
+      unpackedSize: pack.unpackedSize,
+      requiredPathsPresent,
+      forbiddenPaths,
+    },
+    issues,
+  };
+}

package/src/cli/parser.ts

@@ -15,6 +15,8 @@ const COMMAND_ALIASES: Readonly<Record<string, GoodVibesCliCommand>> = {
   daemon: 'serve',
   server: 'serve',
   web: 'web',
+  service: 'service',
+  services: 'service',
   status: 'status',
   doctor: 'doctor',
   onboarding: 'onboarding',