@pellux/goodvibes-tui 0.19.27 → 0.19.29

package/src/input/handler-onboarding.ts

@@ -1,21 +1,14 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname } from 'node:path';
 import { createOAuthLocalListener } from '@pellux/goodvibes-sdk/platform/config/oauth-local-listener';
 import { beginOpenAICodexLogin, exchangeOpenAICodexCode } from '@pellux/goodvibes-sdk/platform/config/openai-codex-auth';
 import { openExternalUrl } from '@pellux/goodvibes-sdk/platform/utils/open-external';
 import { buildProviderAccountSnapshot } from '@pellux/goodvibes-sdk/platform/runtime/provider-accounts/registry';
-import { OnboardingWizardController, type OnboardingWizardAction } from './onboarding/onboarding-wizard.ts';
-import { applyOnboardingRequest, collectOnboardingSnapshot, getOnboardingCompletionMarkerPath, verifyOnboardingRequest } from '../runtime/onboarding/index.ts';
-import type { OnboardingApplyOperation, OnboardingApplyRequest, OnboardingShellPaths, OnboardingVerificationItem } from '../runtime/onboarding/index.ts';
+import { OnboardingWizardController, type OnboardingWizardAction, type OnboardingWizardApplyFeedback } from './onboarding/onboarding-wizard.ts';
+import { applyOnboardingRequest, collectOnboardingSnapshot, verifyOnboardingRequest } from '../runtime/onboarding/index.ts';
+import type { OnboardingApplyRequest, OnboardingVerificationItem } from '../runtime/onboarding/index.ts';
 import type { ModelPickerTarget } from './model-picker.ts';
 import { captureOnboardingWizardSnapshot, restoreOnboardingWizardSnapshot } from './handler-ui-state.ts';
 import type { InputHandler } from './handler.ts';
 
-interface CompletionMarkerSnapshot {
-  readonly path: string;
-  readonly previous: string | null;
-}
-
 export interface OnboardingRuntimePosture {
   readonly serviceEnabled: boolean;
   readonly serviceAutostart: boolean;
@@ -26,6 +19,15 @@ export interface OnboardingRuntimePosture {
   readonly remoteExposure: boolean;
 }
 
+interface OnboardingExternalServiceState {
+  readonly daemonRunning?: boolean;
+  readonly daemonPortInUse?: boolean;
+  readonly httpListenerRunning?: boolean;
+  readonly httpListenerPortInUse?: boolean;
+}
+
+type OnboardingRuntimeEndpoint = 'daemon' | 'httpListener';
+
 function extractAuthorizationCode(input: string): string | null {
   const trimmed = input.trim();
   if (!trimmed) return null;
@@ -38,54 +40,111 @@ function extractAuthorizationCode(input: string): string | null {
   }
 }
 
-function splitCompletionMarkerOperations(request: OnboardingApplyRequest): {
-  readonly settingsRequest: OnboardingApplyRequest;
-  readonly markerRequest: OnboardingApplyRequest;
-} {
-  const markerOperations = request.operations.filter((operation) => operation.kind === 'set-completion-marker');
-  const settingsOperations = request.operations.filter((operation) => operation.kind !== 'set-completion-marker');
-  return {
-    settingsRequest: { ...request, operations: settingsOperations },
-    markerRequest: { ...request, operations: markerOperations },
-  };
+function isLoopbackHostValue(value: string | null | undefined): boolean {
+  const normalized = (value ?? '').trim().toLowerCase();
+  if (normalized.length === 0) return false;
+  return normalized === 'localhost'
+    || normalized === '::1'
+    || normalized === '[::1]'
+    || normalized === '0:0:0:0:0:0:0:1'
+    || /^127(?:\.\d{1,3}){3}$/.test(normalized);
 }
 
-function snapshotCompletionMarkers(
-  shellPaths: OnboardingShellPaths,
-  operations: readonly OnboardingApplyOperation[],
-): readonly CompletionMarkerSnapshot[] {
-  return operations
-    .filter((operation) => operation.kind === 'set-completion-marker')
-    .map((operation) => {
-      const path = getOnboardingCompletionMarkerPath(shellPaths, operation.scope);
-      return {
-        path,
-        previous: existsSync(path) ? readFileSync(path, 'utf-8') : null,
-      };
-    });
+function onboardingVerificationStatusRank(item: OnboardingVerificationItem): number {
+  if (item.status === 'fail') return 3;
+  if (item.status === 'warn') return 2;
+  return 1;
 }
 
-function restoreCompletionMarkers(snapshots: readonly CompletionMarkerSnapshot[]): void {
-  for (const snapshot of snapshots) {
-    if (snapshot.previous === null) {
-      rmSync(snapshot.path, { force: true });
+function dedupeOnboardingVerificationItems(
+  items: readonly OnboardingVerificationItem[],
+): OnboardingVerificationItem[] {
+  const order: string[] = [];
+  const byId = new Map<string, OnboardingVerificationItem>();
+  for (const item of items) {
+    const existing = byId.get(item.id);
+    if (!existing) {
+      order.push(item.id);
+      byId.set(item.id, item);
       continue;
     }
-    mkdirSync(dirname(snapshot.path), { recursive: true });
-    writeFileSync(snapshot.path, snapshot.previous, 'utf-8');
+    if (onboardingVerificationStatusRank(item) > onboardingVerificationStatusRank(existing)) {
+      byId.set(item.id, item);
+    }
   }
+  return order.map((id) => byId.get(id)).filter((item): item is OnboardingVerificationItem => Boolean(item));
 }
 
-function isLoopbackHostValue(value: string | null | undefined): boolean {
-  const normalized = (value ?? '').trim().toLowerCase();
-  if (normalized.length === 0) return false;
-  return normalized === 'localhost'
-    || normalized === '::1'
-    || normalized === '[::1]'
-    || normalized === '0:0:0:0:0:0:0:1'
-    || /^127(?:\.\d{1,3}){3}$/.test(normalized);
+function formatOnboardingApplyCompletionMessage(items: readonly OnboardingVerificationItem[]): string {
+  const warnings = items.filter((item) => item.status === 'warn');
+  if (warnings.length === 0) return `Onboarding applied and verified ${items.length} item(s).`;
+  const passed = items.filter((item) => item.status === 'pass').length;
+  return [
+    `Onboarding settings applied. ${passed} verification item(s) passed; ${warnings.length} warning(s) need attention.`,
+    ...warnings.map((warning) => `  warning ${warning.id}: ${warning.message}`),
+  ].join('\n');
 }
 
+function getRuntimeEndpointBinding(
+  handler: InputHandler,
+  request: OnboardingApplyRequest,
+  endpoint: OnboardingRuntimeEndpoint,
+): { readonly label: string; readonly host: string; readonly port: number } {
+  const hostKey = endpoint === 'daemon' ? 'controlPlane.host' : 'httpListener.host';
+  const portKey = endpoint === 'daemon' ? 'controlPlane.port' : 'httpListener.port';
+  const fallbackHost = '127.0.0.1';
+  const fallbackPort = endpoint === 'daemon' ? 3421 : 3422;
+  const rawHost = handler.getOnboardingConfigValue(request, hostKey);
+  const rawPort = handler.getOnboardingConfigValue(request, portKey);
+  const parsedPort = typeof rawPort === 'number' ? rawPort : Number(rawPort);
+  return {
+    label: endpoint === 'daemon' ? 'GoodVibes daemon' : 'HTTP listener',
+    host: String(rawHost ?? fallbackHost),
+    port: Number.isFinite(parsedPort) ? parsedPort : fallbackPort,
+  };
+}
+
+function runtimePortDiagnostic(
+  binding: { readonly label: string; readonly host: string; readonly port: number },
+  portInUse: boolean | undefined,
+): string {
+  if (portInUse) {
+    return `The configured port ${binding.host}:${binding.port} is occupied after restart; another GoodVibes process, an overlapping restart, or another service may still own it.`;
+  }
+  return `No process is listening on ${binding.host}:${binding.port} after restart.`;
+}
+
+function formatRuntimeActiveFailureMessage(
+  handler: InputHandler,
+  request: OnboardingApplyRequest,
+  endpoint: OnboardingRuntimeEndpoint,
+  state: OnboardingExternalServiceState | undefined,
+): string {
+  const binding = getRuntimeEndpointBinding(handler, request, endpoint);
+  const portInUse = endpoint === 'daemon' ? state?.daemonPortInUse : state?.httpListenerPortInUse;
+  const impact = endpoint === 'daemon'
+    ? 'browser, LAN, and service-backed GoodVibes surfaces may be unavailable until the daemon is running there.'
+    : 'incoming webhooks and event surfaces will not receive traffic until the listener is running there.';
+  return `${binding.label} is enabled for ${binding.host}:${binding.port}, but onboarding could not confirm it is running in this TUI instance after restart. ${runtimePortDiagnostic(binding, portInUse)} Settings were saved; ${impact}`;
+}
+
+function formatRuntimeStoppedFailureMessage(
+  handler: InputHandler,
+  request: OnboardingApplyRequest,
+  endpoint: OnboardingRuntimeEndpoint,
+): string {
+  const binding = getRuntimeEndpointBinding(handler, request, endpoint);
+  const disabledSurface = endpoint === 'daemon' ? 'server-backed surfaces' : 'incoming event surfaces';
+  return `${binding.label} was disabled for ${disabledSurface}, but ${binding.host}:${binding.port} is still occupied. Settings were saved; another GoodVibes process or external service may still be running on that port.`;
+}
+
+function showOnboardingApplyFeedbackForHandler(handler: InputHandler, feedback: OnboardingWizardApplyFeedback): void {
+    handler.onboardingWizard.setApplyFeedback(feedback);
+    const reviewIndex = handler.onboardingWizard.steps.findIndex((step) => step.id === 'review');
+    if (reviewIndex >= 0) handler.onboardingWizard.setStep(reviewIndex);
+    handler.requestRender();
+  }
+
 export function clearOnboardingPendingModelPickerTargetForHandler(handler: InputHandler): void {
     handler.onboardingWizard.clearPendingModelPickerTarget();
   }
@@ -160,16 +219,17 @@ export async function handleOnboardingActionForHandler(handler: InputHandler, ac
     if (handler.onboardingApplyPending) return;
     const blockers = handler.onboardingWizard.getBlockingFieldLabels();
     if (blockers.length > 0) {
-      handler.commandContext?.print?.([
-        'Onboarding needs required confirmations before applying.',
-        ...blockers.map((label) => `  ${label}`),
-      ].join('\n'));
-      handler.requestRender();
+      showOnboardingApplyFeedbackForHandler(handler, {
+        severity: 'error',
+        title: 'Cannot apply yet',
+        summary: 'Fix these required or invalid fields, then apply again.',
+        messages: blockers,
+      });
       return;
     }
 
     const request = handler.onboardingWizard.buildApplyRequest();
-    const { settingsRequest, markerRequest } = splitCompletionMarkerOperations(request);
+    handler.onboardingWizard.clearApplyFeedback();
     const deps = {
       config: handler.uiServices.platform.configManager,
       secrets: handler.uiServices.platform.secretsManager,
@@ -179,61 +239,48 @@ export async function handleOnboardingActionForHandler(handler: InputHandler, ac
     };
     let appliedErrors: string[] = [];
     let verificationItems: readonly OnboardingVerificationItem[] = [];
+    let runtimeWarnings: readonly OnboardingVerificationItem[] = [];
     handler.onboardingApplyPending = true;
     try {
-      const settingsApplied = await applyOnboardingRequest(deps, settingsRequest);
-      const settingsVerification = await verifyOnboardingRequest(deps, settingsRequest);
-      verificationItems = settingsVerification.items;
-      appliedErrors = [
-        ...settingsApplied.errors.map((error) => `apply ${error.kind}: ${error.message}`),
-        ...settingsVerification.items
-          .filter((item) => item.status !== 'pass')
-          .map((item) => `verify ${item.id}: ${item.message}`),
-      ];
-
-      if (appliedErrors.length === 0) {
-        const activationVerification = await handler.restartOnboardingExternalServicesIfNeeded(request);
-        const runtimeVerification = [...activationVerification, ...handler.verifyOnboardingRuntimePosture(request)];
-        verificationItems = [...settingsVerification.items, ...runtimeVerification];
-        appliedErrors = runtimeVerification
+      const applied = await applyOnboardingRequest(deps, request);
+      if (applied.errors.length > 0) {
+        appliedErrors = applied.errors.map((error) => `apply ${error.kind}: ${error.message}`);
+      } else {
+        const verification = await verifyOnboardingRequest(deps, request);
+        verificationItems = verification.items;
+        appliedErrors = verification.items
           .filter((item) => item.status === 'fail')
           .map((item) => `verify ${item.id}: ${item.message}`);
       }
 
-      if (appliedErrors.length === 0 && markerRequest.operations.length > 0) {
-        const markerSnapshots = snapshotCompletionMarkers(deps.shellPaths, markerRequest.operations);
-        const markerApplied = await applyOnboardingRequest(deps, markerRequest);
-        const finalVerification = await verifyOnboardingRequest(deps, request);
-        const runtimeVerification = handler.verifyOnboardingRuntimePosture(request);
-        verificationItems = [...finalVerification.items, ...runtimeVerification];
-        appliedErrors = [
-          ...markerApplied.errors.map((error) => `apply ${error.kind}: ${error.message}`),
-          ...finalVerification.items
-            .filter((item) => item.status !== 'pass')
-            .map((item) => `verify ${item.id}: ${item.message}`),
-          ...runtimeVerification
-            .filter((item) => item.status === 'fail')
-            .map((item) => `verify ${item.id}: ${item.message}`),
-        ];
-        if (appliedErrors.length > 0) restoreCompletionMarkers(markerSnapshots);
+      if (appliedErrors.length === 0) {
+        const activationVerification = await handler.restartOnboardingExternalServicesIfNeeded(request);
+        runtimeWarnings = dedupeOnboardingVerificationItems([...activationVerification, ...handler.verifyOnboardingRuntimePosture(request)]
+          .map((item): OnboardingVerificationItem => item.status === 'fail'
+            ? { ...item, status: 'warn' }
+            : item));
+        verificationItems = dedupeOnboardingVerificationItems([...verificationItems, ...runtimeWarnings]);
       }
     } catch (error) {
-      handler.commandContext?.print?.([
-        'Onboarding apply did not complete.',
-        `  ${error instanceof Error ? error.message : String(error)}`,
-      ].join('\n'));
-      handler.requestRender();
+      showOnboardingApplyFeedbackForHandler(handler, {
+        severity: 'error',
+        title: 'Apply failed',
+        summary: 'The wizard could not persist these settings. No service restart was attempted.',
+        messages: [error instanceof Error ? error.message : String(error)],
+      });
       return;
     } finally {
       handler.onboardingApplyPending = false;
+      handler.requestRender();
     }
 
     if (appliedErrors.length > 0) {
-      handler.commandContext?.print?.([
-        'Onboarding apply did not complete.',
-        ...appliedErrors.map((error) => `  ${error}`),
-      ].join('\n'));
-      handler.requestRender();
+      showOnboardingApplyFeedbackForHandler(handler, {
+        severity: 'error',
+        title: 'Apply did not complete',
+        summary: 'The settings were not fully applied. Review the messages below and try again.',
+        messages: appliedErrors,
+      });
       return;
     }
 
@@ -249,11 +296,7 @@ export async function handleOnboardingActionForHandler(handler: InputHandler, ac
       handler.indicatorFocused = returnFocus === 'indicator';
       handler.modalReturnFocus = 'prompt';
     }
-    const warnings = verificationItems.filter((item) => item.status === 'warn');
-    handler.commandContext?.print?.([
-      `Onboarding applied and verified ${verificationItems.length} item(s).`,
-      ...warnings.map((warning) => `  warning ${warning.id}: ${warning.message}`),
-    ].join('\n'));
+    handler.commandContext?.print?.(formatOnboardingApplyCompletionMessage(verificationItems));
     handler.requestRender();
   }
 
@@ -536,7 +579,7 @@ export async function restartOnboardingExternalServicesIfNeededForHandler(handle
         failures.push({
           id: 'runtime:daemon-active',
           status: 'fail',
-          message: 'The GoodVibes daemon did not start after applying onboarding settings.',
+          message: formatRuntimeActiveFailureMessage(handler, request, 'daemon', state),
           target: 'service',
         });
       }
@@ -544,7 +587,7 @@ export async function restartOnboardingExternalServicesIfNeededForHandler(handle
         failures.push({
           id: 'runtime:daemon-stopped',
           status: 'fail',
-          message: 'The GoodVibes daemon port is still occupied after onboarding disabled server-backed surfaces.',
+          message: formatRuntimeStoppedFailureMessage(handler, request, 'daemon'),
           target: 'service',
         });
       }
@@ -552,7 +595,7 @@ export async function restartOnboardingExternalServicesIfNeededForHandler(handle
         failures.push({
           id: 'runtime:http-listener-active',
           status: 'fail',
-          message: 'The HTTP listener did not start after applying onboarding settings.',
+          message: formatRuntimeActiveFailureMessage(handler, request, 'httpListener', state),
           target: 'service',
         });
       }
@@ -560,7 +603,7 @@ export async function restartOnboardingExternalServicesIfNeededForHandler(handle
         failures.push({
           id: 'runtime:http-listener-stopped',
           status: 'fail',
-          message: 'The HTTP listener port is still occupied after onboarding disabled incoming event surfaces.',
+          message: formatRuntimeStoppedFailureMessage(handler, request, 'httpListener'),
           target: 'service',
         });
       }
@@ -601,7 +644,7 @@ export function verifyOnboardingRuntimePostureForHandler(handler: InputHandler,
         stoppedItems.push({
           id: 'runtime:daemon-stopped',
           status: 'fail',
-          message: 'The GoodVibes daemon port is still occupied after onboarding disabled server-backed surfaces.',
+          message: formatRuntimeStoppedFailureMessage(handler, request, 'daemon'),
           target: 'service',
         });
       }
@@ -609,7 +652,7 @@ export function verifyOnboardingRuntimePostureForHandler(handler: InputHandler,
         stoppedItems.push({
           id: 'runtime:http-listener-stopped',
           status: 'fail',
-          message: 'The HTTP listener port is still occupied after onboarding disabled incoming event surfaces.',
+          message: formatRuntimeStoppedFailureMessage(handler, request, 'httpListener'),
           target: 'service',
         });
       }
@@ -625,7 +668,7 @@ export function verifyOnboardingRuntimePostureForHandler(handler: InputHandler,
     }
 
     const auth = handler.uiServices.platform.localUserAuthManager.inspect();
-    const hasAdmin = auth.users.some((user) => user.roles.includes('admin'));
+    const hasLocalAuth = auth.users.length > 0;
     const items: OnboardingVerificationItem[] = [];
 
     items.push({
@@ -638,19 +681,19 @@ export function verifyOnboardingRuntimePostureForHandler(handler: InputHandler,
     });
     items.push({
       id: 'runtime:auth-posture',
-      status: hasAdmin && !auth.bootstrapCredentialPresent ? 'pass' : 'fail',
-      message: hasAdmin && !auth.bootstrapCredentialPresent
-        ? 'Local admin auth is configured and bootstrap credentials are not present.'
-        : 'Network-capable surfaces require local admin auth with no bootstrap credential file.',
+      status: hasLocalAuth && !auth.bootstrapCredentialPresent ? 'pass' : 'fail',
+      message: hasLocalAuth && !auth.bootstrapCredentialPresent
+        ? 'Local auth is configured and bootstrap credentials are not present.'
+        : 'Network-capable surfaces require local auth with no bootstrap credential file.',
       target: 'auth',
     });
     if (posture.remoteExposure) {
       items.push({
         id: 'runtime:remote-auth-gate',
-        status: hasAdmin ? 'pass' : 'fail',
-        message: hasAdmin
-          ? 'Remote-capable bind settings have local admin auth available.'
-          : 'Remote-capable bind settings cannot be applied without local admin auth.',
+        status: hasLocalAuth ? 'pass' : 'fail',
+        message: hasLocalAuth
+          ? 'Remote-capable bind settings have local auth available.'
+          : 'Remote-capable bind settings cannot be applied without local auth.',
         target: 'auth',
       });
     }
@@ -661,7 +704,7 @@ export function verifyOnboardingRuntimePostureForHandler(handler: InputHandler,
         status: externalState?.daemonRunning ? 'pass' : 'fail',
         message: externalState?.daemonRunning
           ? 'The GoodVibes daemon is running with the applied onboarding settings.'
-          : 'The GoodVibes daemon is not running after onboarding apply.',
+          : formatRuntimeActiveFailureMessage(handler, request, 'daemon', externalState),
         target: 'service',
       });
     }
@@ -669,7 +712,7 @@ export function verifyOnboardingRuntimePostureForHandler(handler: InputHandler,
       items.push({
         id: 'runtime:daemon-stopped',
         status: 'fail',
-        message: 'The GoodVibes daemon port is still occupied after onboarding disabled server-backed surfaces.',
+        message: formatRuntimeStoppedFailureMessage(handler, request, 'daemon'),
         target: 'service',
       });
     }
@@ -679,7 +722,7 @@ export function verifyOnboardingRuntimePostureForHandler(handler: InputHandler,
         status: externalState?.httpListenerRunning ? 'pass' : 'fail',
         message: externalState?.httpListenerRunning
           ? 'The HTTP listener is running with the applied onboarding settings.'
-          : 'The HTTP listener is not running after onboarding apply.',
+          : formatRuntimeActiveFailureMessage(handler, request, 'httpListener', externalState),
         target: 'service',
       });
     }
@@ -687,7 +730,7 @@ export function verifyOnboardingRuntimePostureForHandler(handler: InputHandler,
       items.push({
         id: 'runtime:http-listener-stopped',
         status: 'fail',
-        message: 'The HTTP listener port is still occupied after onboarding disabled incoming event surfaces.',
+        message: formatRuntimeStoppedFailureMessage(handler, request, 'httpListener'),
         target: 'service',
       });
     }

package/src/input/handler.ts

@@ -31,7 +31,7 @@ import { OnboardingWizardController, type OnboardingWizardAction, type Onboardin
 import {
   applyOnboardingRequest,
   collectOnboardingSnapshot,
-  getOnboardingCompletionMarkerPath,
+  getOnboardingCheckMarkerPath,
   verifyOnboardingRequest,
 } from '../runtime/onboarding/index.ts';
 import type {

package/src/input/onboarding/handler-onboarding-routes.ts

@@ -28,6 +28,20 @@ function activateSelection(state: OnboardingRouteState): void {
   if (action !== null) state.onAction?.(action);
 }
 
+function isEnterKey(token: InputToken): boolean {
+  return token.type === 'key' && (token.logicalName === 'enter' || token.logicalName === 'return');
+}
+
+function getKeyTextInput(token: Extract<InputToken, { type: 'key' }>): string | null {
+  if (token.ctrl || token.meta) return null;
+  if (token.logicalName === 'space') return ' ';
+  if (token.logicalName.length !== 1) return null;
+  if (token.shift && token.logicalName >= 'a' && token.logicalName <= 'z') {
+    return token.logicalName.toUpperCase();
+  }
+  return token.logicalName;
+}
+
 export function handleOnboardingWizardToken(state: OnboardingRouteState, token: InputToken): boolean {
   if (!state.onboardingWizard.active) return false;
 
@@ -48,12 +62,15 @@ export function handleOnboardingWizardToken(state: OnboardingRouteState, token:
     }
 
     if (editing) {
-      if (token.logicalName === 'enter') {
+      if (isEnterKey(token)) {
         state.onboardingWizard.commitEdit();
+      } else if ((token.ctrl && token.logicalName === 'u') || token.logicalName === 'delete') {
+        state.onboardingWizard.clearEditingValue();
       } else if (token.logicalName === 'backspace') {
         state.onboardingWizard.editBackspace();
-      } else if (token.logicalName === 'space') {
-        state.onboardingWizard.editChar(' ');
+      } else {
+        const textInput = getKeyTextInput(token);
+        if (textInput !== null) state.onboardingWizard.editChar(textInput);
       }
     } else if (token.logicalName === 'left') {
       state.onboardingWizard.prevStep();
@@ -74,22 +91,25 @@ export function handleOnboardingWizardToken(state: OnboardingRouteState, token:
       state.onboardingWizard.selectFirst(visibleFields);
     } else if (token.logicalName === 'end') {
       state.onboardingWizard.selectLast(visibleFields);
-    } else if (token.logicalName === 'enter' || token.logicalName === 'space') {
-      activateSelection(state);
-    } else if (token.logicalName === 'backspace') {
-      state.onboardingWizard.editBackspace();
+    } else {
+      const textInput = getKeyTextInput(token);
+      if (textInput !== null && state.onboardingWizard.beginSelectedTextInput(textInput)) {
+        state.requestRender();
+        return true;
+      }
+      if (isEnterKey(token) || token.logicalName === 'space') {
+        activateSelection(state);
+      } else if ((token.ctrl && token.logicalName === 'u') || token.logicalName === 'delete') {
+        state.onboardingWizard.clearSelectedTextField();
+      } else if (token.logicalName === 'backspace') {
+        state.onboardingWizard.editBackspace();
+      }
     }
   } else if (token.type === 'text') {
     if (editing) {
       state.onboardingWizard.editChar(token.value);
-    } else if (token.value === 'h') {
-      state.onboardingWizard.prevStep();
-    } else if (token.value === 'l') {
-      state.onboardingWizard.nextStep();
-    } else if (token.value === 'k') {
-      state.onboardingWizard.moveSelection(-1, visibleFields);
-    } else if (token.value === 'j') {
-      state.onboardingWizard.moveSelection(1, visibleFields);
+    } else if (state.onboardingWizard.beginSelectedTextInput(token.value)) {
+      // Direct typing into selected inputs behaves like a real form field.
     } else if (token.value === ' ') {
       activateSelection(state);
     } else if (/^[1-9]$/.test(token.value)) {

package/src/input/onboarding/onboarding-wizard-apply.ts

@@ -1,5 +1,11 @@
 import type { OnboardingAcknowledgementTarget, OnboardingApplyOperation, OnboardingApplyRequest } from '../../runtime/onboarding/index.ts';
-import { EXTERNAL_SURFACE_SPECS } from './onboarding-wizard-external-surfaces.ts';
+import { getServerSurfaceFeatureFlags } from '../../runtime/surface-feature-flags.ts';
+import {
+  EXTERNAL_SURFACE_SPECS,
+  getExternalSurfaceAutoStartDefaultValue,
+  getExternalSurfaceAutoStartFieldId,
+  isExternalSurfaceSelectedByDefault,
+} from './onboarding-wizard-external-surfaces.ts';
 import { buildGoodVibesSecretKey, buildGoodVibesSecretRef, isLoopbackAddress, isSecretReferenceValue } from './onboarding-wizard-helpers.ts';
 import type { OnboardingWizardController } from './onboarding-wizard.ts';
 
@@ -8,6 +14,7 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
     const hasServers = controller.hasServerCapabilitiesSelected();
     const browserAccess = controller.shouldEnableBrowserSurface();
     const httpListener = controller.shouldEnableHttpListener();
+    const httpListenerNetworkFields = controller.shouldExposeHttpListenerNetworkFields();
     const controlPlaneRemote = controller.shouldExposeControlPlaneNetwork();
     const networkMode = controller.getStringFieldValue('network.mode', controller.runtimeDerived.step1_5NetworkMode);
     const customNetwork = hasServers && networkMode === 'custom';
@@ -18,6 +25,9 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
     ): void => {
       operations.push({ kind: 'set-config', key, value });
     };
+    const enableFeatureFlags = (flagIds: readonly string[]): void => {
+      for (const flagId of flagIds) setConfig(`featureFlags.${flagId}`, 'enabled');
+    };
     const acknowledge = (target: OnboardingAcknowledgementTarget, fieldId: string): void => {
       operations.push({
         kind: 'acknowledge',
@@ -50,11 +60,13 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
       setConfig(key, buildGoodVibesSecretRef(secretKey));
     };
 
-    if (controller.requiresAuthBootstrap()) {
+    const requestedAdminPassword = controller.getStringFieldValue('accounts.admin-password', '');
+    const shouldEnsureAuthUser = controller.requiresAuthBootstrap() || requestedAdminPassword.length > 0;
+    if (shouldEnsureAuthUser) {
       operations.push({
         kind: 'ensure-auth-user',
         username: controller.getStringFieldValue('accounts.admin-username', controller.getDefaultAdminUsername()),
-        password: controller.getStringFieldValue('accounts.admin-password', ''),
+        password: requestedAdminPassword,
         roles: ['admin'],
         createSession: true,
         retireBootstrapCredential: controller.hasBootstrapCredentialPresent(),
@@ -73,7 +85,7 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
       addNetworkOperations(controller, operations, customNetwork, {
         controlPlane: hasServers,
         controlPlaneRemote,
-        httpListener,
+        httpListener: httpListenerNetworkFields,
         web: browserAccess,
       });
     } else {
@@ -100,11 +112,21 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
     setSecret('OPENAI_API_KEY', controller.getStringFieldValue('providers.openai-api-key', ''));
 
     const externalIntegrations = controller.isCapabilitySelected('external-integrations');
+    const enabledExternalSurfaceIds: string[] = [];
     for (const surface of EXTERNAL_SURFACE_SPECS) {
-      const enabled = externalIntegrations
-        && controller.getBooleanFieldValue(surface.enabledFieldId, surface.defaultEnabled(controller.runtimeSnapshot));
-      setConfig(surface.enabledConfigKey, enabled);
-      if (!enabled) continue;
+      const selected = externalIntegrations
+        && controller.getBooleanFieldValue(
+          surface.enabledFieldId,
+          isExternalSurfaceSelectedByDefault(surface, controller.runtimeSnapshot),
+        );
+      const autoStart = selected
+        && controller.getStringFieldValue(
+          getExternalSurfaceAutoStartFieldId(surface),
+          getExternalSurfaceAutoStartDefaultValue(surface, controller.runtimeSnapshot),
+        ) === 'yes';
+      setConfig(surface.enabledConfigKey, autoStart);
+      if (!selected) continue;
+      enabledExternalSurfaceIds.push(surface.id);
 
       for (const setupField of surface.fields) {
         const fallback = setupField.defaultValue(controller.runtimeSnapshot);
@@ -126,28 +148,16 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
         else setConfig(setupField.configKey, value);
       }
     }
+    enableFeatureFlags(getServerSurfaceFeatureFlags({
+      serverBacked: hasServers,
+      web: browserAccess,
+      externalSurfaces: enabledExternalSurfaceIds,
+    }));
 
     acknowledge('providers', 'providers.reviewed');
     acknowledge('subscriptions', 'accounts.subscriptions');
     acknowledge('auth', 'accounts.auth');
 
-    if (controller.getBooleanFieldValue('review.project-marker', true)) {
-      operations.push({
-        kind: 'set-completion-marker',
-        scope: 'project',
-        completed: true,
-        payload: { source: 'wizard', mode: controller.mode },
-      });
-    }
-    if (controller.getBooleanFieldValue('review.user-marker', controller.defaultReviewUserMarker())) {
-      operations.push({
-        kind: 'set-completion-marker',
-        scope: 'user',
-        completed: true,
-        payload: { source: 'wizard', mode: controller.mode },
-      });
-    }
-
     return {
       mode: controller.mode,
       source: 'wizard',