@pellux/goodvibes-tui 1.16.1 → 1.17.0

package/src/runtime/onboarding/fast-path.ts

@@ -7,15 +7,24 @@
  *   - If a provider API key is already configured (env / secrets), skip
  *     onboarding entirely — write the check marker and drop straight into a
  *     working session. ZERO steps.
- *   - Otherwise ask exactly one question: start now on the free default model,
- *     or run the full guided setup. Dismissing (Esc) starts now — so it is
- *     always skippable.
+ *   - Otherwise ask exactly one question: start now on the default model, or
+ *     run the full guided setup. Dismissing (Esc) starts now — so it is
+ *     always skippable. The start-now copy is GENERATED from the default
+ *     model's registered auth state (buildOnboardingModelCopy), so a
+ *     "no API key needed" promise can only render when the provider is
+ *     genuinely keyless-ready.
  *
  * The full wizard remains one keystroke away (the "Full guided setup" choice,
  * or `/onboarding` at any time). If the command context can't answer whether a
  * provider is configured (e.g. a headless/test surface), we fall back to the
  * classic behavior of opening the wizard, so nothing regresses.
  */
+import {
+  buildOnboardingModelCopy,
+  resolveDefaultModelReadiness,
+  type ModelProviderSource,
+  type OnboardingModelCopy,
+} from '@pellux/goodvibes-sdk/platform/providers';
 import type { CommandContext } from '../../input/command-registry.ts';
 import type { SelectionItem } from '../../input/selection-modal.ts';
 import { writeOnboardingCheckMarker } from './markers.ts';
@@ -43,6 +52,27 @@ function readConfiguredProviderIds(commandContext: CommandContext): string[] | n
 
 const MARKER_OPTIONS: WriteOnboardingCheckMarkerOptions = { source: 'command' };
 
+/**
+ * Copy for the "start now" choice, GENERATED from the default model's live
+ * registration state (never hand-written): a "no API key needed" promise can
+ * only appear when the provider's own auth state proves keyless readiness.
+ * Surfaces that cannot answer (no registry / no getForModel) resolve to the
+ * honest 'unresolvable' copy rather than a fabricated keyless claim.
+ */
+function resolveStartCopy(commandContext: CommandContext): OnboardingModelCopy {
+  const modelKey = String(commandContext.platform?.config?.provider?.model ?? '').trim();
+  const registry = commandContext.provider?.providerRegistry;
+  const source: ModelProviderSource =
+    registry && typeof (registry as Partial<ModelProviderSource>).getForModel === 'function'
+      ? registry
+      : {
+          getForModel: () => {
+            throw new Error('provider registry unavailable on this surface');
+          },
+        };
+  return buildOnboardingModelCopy(resolveDefaultModelReadiness(source, modelKey));
+}
+
 /**
  * Run the fast-path first-run flow. Returns nothing; side effects (wizard open,
  * marker write, modal) happen through the injected deps.
@@ -68,8 +98,9 @@ export function startOnboardingFastPath(deps: OnboardingFastPathDeps): void {
     return;
   }
 
+  const startCopy = resolveStartCopy(commandContext);
   const items: SelectionItem[] = [
-    { id: 'start-now', label: 'Start now', detail: 'Use the free default model — no API key needed', primaryAction: 'select' },
+    { id: 'start-now', label: startCopy.headline, detail: startCopy.detail, primaryAction: 'select' },
     { id: 'full-setup', label: 'Full guided setup', detail: 'Choose provider, model, channels, and more', primaryAction: 'select' },
   ];
   commandContext.openSelection(
@@ -82,10 +113,12 @@ export function startOnboardingFastPath(deps: OnboardingFastPathDeps): void {
         return;
       }
       // Start now (or dismissed): mark first-run done and drop into a working
-      // session on the free default model.
+      // session on the default model. The status line reuses the generated
+      // copy so it can never promise keyless readiness the registration
+      // state does not prove.
       writeOnboardingCheckMarker(shellPaths, MARKER_OPTIONS);
       commandContext.print?.(
-        'You\'re on the free default model. Add a provider key anytime with /provider, or run /onboarding for full setup.',
+        `${startCopy.detail}. Add a provider key anytime with /provider, or run /onboarding for full setup.`,
       );
       render();
     },

package/src/runtime/onboarding/provider-key-capture.ts

@@ -0,0 +1,126 @@
+/**
+ * Provider-agnostic key capture for onboarding.
+ *
+ * The onboarding wizard offers an API-key field for every provider the registry
+ * knows accepts a key — derived from each provider's registration-time auth
+ * state (describeAuthState), never a hardcoded vendor list. This module holds
+ * the two shared pieces that keep the wizard step and the apply step in lockstep:
+ *
+ *  1. enrichProviderAccountsSnapshot — stamps each provider-account record with
+ *     the secrets-store key it reads its API key from (its declared auth env
+ *     var), read live from the provider registry.
+ *  2. deriveProviderKeyCaptureTargets / providerKeyFieldId — the single source
+ *     of truth for which providers get a key field and how those fields are
+ *     named, used by both the field builder and the apply writer.
+ */
+
+import type { LLMProvider } from '@pellux/goodvibes-sdk/platform/providers';
+import type {
+  OnboardingProviderAccountRecord,
+  OnboardingProviderAccountsSnapshot,
+} from './types.ts';
+
+/** Minimal provider lookup the enrichment needs (structural for testing). */
+export interface ProviderKeyRegistryLike {
+  tryGet(name: string): LLMProvider | undefined;
+}
+
+/** Read a provider's declared API-key env var, or undefined when it accepts none. */
+export function readProviderApiKeyEnvVar(
+  registry: ProviderKeyRegistryLike,
+  providerId: string,
+): string | undefined {
+  let provider: LLMProvider | undefined;
+  try {
+    provider = registry.tryGet(providerId);
+  } catch {
+    provider = undefined;
+  }
+  const envVars = provider?.describeAuthState?.().authEnvVars;
+  return envVars && envVars.length > 0 ? envVars[0] : undefined;
+}
+
+/**
+ * Return an equivalent snapshot with each provider record stamped with the
+ * secrets-store key it accepts an API key under (from live registration truth).
+ * Records for keyless / subscription-only providers keep apiKeyEnvVar absent.
+ */
+export function enrichProviderAccountsSnapshot(
+  snapshot: OnboardingProviderAccountsSnapshot,
+  registry: ProviderKeyRegistryLike,
+): OnboardingProviderAccountsSnapshot {
+  return {
+    ...snapshot,
+    providers: snapshot.providers.map((record) => {
+      const apiKeyEnvVar = readProviderApiKeyEnvVar(registry, record.providerId);
+      return apiKeyEnvVar ? { ...record, apiKeyEnvVar } : record;
+    }),
+  };
+}
+
+/** A provider that onboarding can offer an API-key field for. */
+export interface ProviderKeyCaptureTarget {
+  readonly providerId: string;
+  readonly apiKeyEnvVar: string;
+  readonly configured: boolean;
+}
+
+/**
+ * The providers onboarding offers an API-key field for: every registered
+ * provider that declares an api-key route AND carries a resolved auth env var.
+ * Ordered by provider id so the wizard renders deterministically.
+ */
+export function deriveProviderKeyCaptureTargets(
+  providers: readonly OnboardingProviderAccountRecord[] | undefined,
+): ProviderKeyCaptureTarget[] {
+  if (!providers) return [];
+  return providers
+    .filter((record) => record.apiKeyEnvVar && record.availableRoutes.includes('api-key'))
+    .map((record) => ({
+      providerId: record.providerId,
+      apiKeyEnvVar: record.apiKeyEnvVar as string,
+      configured: record.configured,
+    }))
+    .sort((a, b) => a.providerId.localeCompare(b.providerId));
+}
+
+/** The wizard field id that captures a given provider's API key. */
+export function providerKeyFieldId(providerId: string): string {
+  return `providers.api-key.${providerId}`;
+}
+
+/** A subscription-capable provider and its current subscription posture. */
+export interface SubscriptionStatusTarget {
+  readonly providerId: string;
+  readonly active: boolean;
+  readonly pending: boolean;
+}
+
+/**
+ * The providers onboarding shows a subscription-status row for: every provider
+ * that declares a subscription route (registration truth), plus any provider
+ * with an active or pending subscription session — so a live session is never
+ * hidden just because its account record was absent. Ordered by provider id.
+ */
+export function deriveSubscriptionStatusTargets(
+  providers: readonly OnboardingProviderAccountRecord[] | undefined,
+  activeProviderIds: readonly string[],
+  pendingProviderIds: readonly string[],
+): SubscriptionStatusTarget[] {
+  const active = new Set(activeProviderIds);
+  const pending = new Set(pendingProviderIds);
+  const ids = new Set<string>();
+  for (const record of providers ?? []) {
+    if (record.availableRoutes.includes('subscription')) ids.add(record.providerId);
+  }
+  for (const id of active) ids.add(id);
+  for (const id of pending) ids.add(id);
+  return [...ids]
+    .sort((a, b) => a.localeCompare(b))
+    .map((providerId) => ({ providerId, active: active.has(providerId), pending: pending.has(providerId) }));
+}
+
+/** The wizard field id of a provider's subscription-status row. */
+export function subscriptionStatusFieldId(providerId: string): string {
+  return `providers.subscription.${providerId}`;
+}

package/src/runtime/onboarding/snapshot.ts

@@ -43,7 +43,6 @@ function buildConfigSnapshot(
     network: config.getCategory('network'),
     surfaces: config.getCategory('surfaces'),
     service: config.getCategory('service'),
-    featureFlags: config.getCategory('featureFlags'),
     batch: config.getCategory('batch'),
     cloudflare: config.getCategory('cloudflare'),
   };

package/src/runtime/onboarding/types.ts

@@ -1,6 +1,5 @@
 import type { ConfigManager, ConfigKey, GoodVibesConfig } from '../../config/index.ts';
 import type { SecretsManager, SecretRecord, SecretStorageReview } from '../../config/secrets.ts';
-import type { FeatureFlagConfigKey } from '../surface-feature-flags.ts';
 import type { LocalAuthSnapshot, UserAuthManager } from '@pellux/goodvibes-sdk/platform/security';
 import type { ShellPathService } from '@/runtime/index.ts';
 import type {
@@ -46,7 +45,6 @@ export interface OnboardingConfigSnapshot {
   readonly network: GoodVibesConfig['network'];
   readonly surfaces: GoodVibesConfig['surfaces'];
   readonly service: GoodVibesConfig['service'];
-  readonly featureFlags: GoodVibesConfig['featureFlags'];
   readonly batch: GoodVibesConfig['batch'];
   readonly cloudflare: GoodVibesConfig['cloudflare'];
 }
@@ -157,6 +155,14 @@ export interface OnboardingProviderAccountRecord {
   readonly availableRoutes: readonly string[];
   readonly activeRoute: string;
   readonly authFreshness: string;
+  /**
+   * The secrets-store key this provider reads its API key from — its declared
+   * auth env var, read from the live provider's registration-time auth state.
+   * Present only for providers that accept an API key; absent for keyless /
+   * subscription-only providers. Used to offer provider-agnostic key entry in
+   * onboarding, and as the storage key when the entered value is saved.
+   */
+  readonly apiKeyEnvVar?: string;
 }
 
 export interface OnboardingProviderAccountsSnapshot {
@@ -267,7 +273,7 @@ export interface OnboardingStepDerivationState {
 export type OnboardingApplyOperation =
   | {
       readonly kind: 'set-config';
-      readonly key: ConfigKey | FeatureFlagConfigKey;
+      readonly key: ConfigKey;
       readonly value: unknown;
       readonly scope?: 'global' | 'project';
     }

package/src/runtime/provider-fallback.ts

@@ -0,0 +1,55 @@
+/**
+ * provider-fallback.ts — the pre-catalog fallback registration for the
+ * configured model, extracted verbatim from services.ts (file-size hygiene):
+ * before the model catalog cache has loaded, the configured provider:model is
+ * registered with SDK family-aware context-window inference so the meter and
+ * compaction denominator agree with the post-catalog window.
+ */
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import { inferFallbackContextWindow, type ModelDefinition, type ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+
+function buildFallbackModelDefinition(provider: string, modelId: string): ModelDefinition {
+  const providerLower = provider.toLowerCase();
+  const isReasoningProvider = providerLower.includes('openai')
+    || providerLower.includes('anthropic')
+    || providerLower.includes('gemini')
+    || providerLower.includes('google');
+
+  return {
+    id: modelId,
+    provider,
+    registryKey: `${provider}:${modelId}`,
+    displayName: modelId,
+    description: 'Configured model available before the model catalog cache has loaded.',
+    capabilities: {
+      toolCalling: true,
+      codeEditing: true,
+      reasoning: isReasoningProvider,
+      multimodal: isReasoningProvider,
+    },
+    contextWindow: inferFallbackContextWindow(provider, modelId),
+    contextWindowProvenance: 'fallback',
+    selectable: true,
+    tier: 'standard',
+    ...(isReasoningProvider ? { reasoningEffort: ['instant', 'low', 'medium', 'high'] } : {}),
+  };
+}
+
+export function ensureConfiguredModelIsRoutable(providerRegistry: ProviderRegistry, configManager: ConfigManager): void {
+  const configuredModel = String(configManager.get('provider.model') ?? '').trim();
+  if (!configuredModel.includes(':')) return;
+  if (providerRegistry.listModels().some((model) => model.registryKey === configuredModel)) return;
+
+  const [providerId, ...modelParts] = configuredModel.split(':');
+  const modelId = modelParts.join(':').trim();
+  if (!providerId || !modelId) return;
+
+  const provider = providerRegistry.tryGet(providerId);
+  if (!provider) return;
+
+  providerRegistry.registerRuntimeProvider({
+    provider,
+    replace: true,
+    models: [buildFallbackModelDefinition(providerId, modelId)],
+  });
+}

package/src/runtime/provider-optimizer-wiring.ts

@@ -0,0 +1,55 @@
+/**
+ * provider-optimizer-wiring — bind the provider optimizer to its capability
+ * gate and seed its persisted routing mode at startup.
+ *
+ * Mirrors the SDK composition root's provider-optimizer-wiring module (which
+ * the SDK does not export through a public seam) so this repo's composition
+ * fork cannot drift from it silently: the optimizer is constructed dark, the
+ * gate subscription flips it live, and provider.optimizerMode seeds the mode.
+ */
+
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { ProviderOptimizer } from '@pellux/goodvibes-sdk/platform/providers';
+import type { FeatureFlagManager } from '@/runtime/index.ts';
+
+export function bindProviderOptimizerFeatureFlag(
+  featureFlags: Pick<FeatureFlagManager, 'isEnabled' | 'subscribe'>,
+  providerOptimizer: Pick<ProviderOptimizer, 'setEnabled'>,
+): () => void {
+  providerOptimizer.setEnabled(featureFlags.isEnabled('provider-optimizer'));
+  return featureFlags.subscribe((flagId, state) => {
+    if (flagId === 'provider-optimizer') {
+      providerOptimizer.setEnabled(state === 'enabled');
+    }
+  });
+}
+
+/**
+ * Apply the persistent provider-optimizer routing mode from config at startup.
+ * provider.optimizerMode 'off' keeps the optimizer inactive (its gate derives
+ * from the same key); this only seeds the mode/pin so an operator can persist
+ * "auto" or a pinned model without re-issuing a /provider command each
+ * session. Runtime pin/unpin/setMode still override for the live session.
+ */
+export function applyProviderOptimizerConfigMode(
+  configManager: Pick<ConfigManager, 'get'>,
+  providerOptimizer: Pick<ProviderOptimizer, 'setMode' | 'pin'>,
+): void {
+  const mode = configManager.get('provider.optimizerMode');
+  if (mode === 'off') {
+    providerOptimizer.setMode('manual'); // inert baseline while inactive
+    return;
+  }
+  if (mode === 'pinned') {
+    const pinned = configManager.get('provider.optimizerPinnedModel').trim();
+    const sep = pinned.indexOf(':');
+    if (sep > 0 && sep < pinned.length - 1) {
+      providerOptimizer.pin(pinned.slice(0, sep), pinned.slice(sep + 1));
+    } else {
+      // Pinned mode requested without a valid provider-qualified model — stay manual.
+      providerOptimizer.setMode('manual');
+    }
+  } else {
+    providerOptimizer.setMode(mode);
+  }
+}

package/src/runtime/release-artifacts.ts

@@ -1,109 +1,25 @@
 /**
- * Shared release-artifact naming and checksum-verification logic.
- *
- * This is the one place that knows the release asset naming convention
- * (`goodvibes[-daemon]-{platform}-{arch}`) and how to verify a downloaded
- * artifact against SHA256SUMS.txt. Two callers share it and must stay in
- * lockstep:
+ * Release-artifact naming and checksum verification — re-exported from the
+ * SDK's canonical update policy module (platform/runtime/self-update), which
+ * was hoisted from this file's semantics. One mechanism everywhere: the
+ * asset naming convention (`goodvibes[-daemon]-{platform}-{arch}`), the
+ * sqlite-vec addon naming, and the "no manifest entry is as fatal as a
+ * mismatch" verification rule now have a single owner. Consumers that must
+ * stay in lockstep:
  *   - scripts/postinstall.js (npm install-time binary download)
- *   - src/input/commands/update-runtime.ts (the /update command's self-update)
- *
- * A downloaded artifact with NO entry in the checksum manifest is just as
- * unverified as one with a mismatching entry — verifyChecksum() throws in
- * both cases, never silently skips.
+ *   - src/input/commands/update-runtime.ts (the /update self-update)
+ *   - scripts/install.sh (the shell installer; mirrors the same names)
  */
-import { createHash } from 'node:crypto';
-
-export const CHECKSUM_MANIFEST_NAME = 'SHA256SUMS.txt';
+export {
+  CHECKSUM_MANIFEST_NAME,
+  parseChecksumFile,
+  resolveArtifactNames,
+  resolveSqliteVecAsset,
+  sha256,
+  verifyChecksum,
+  type ReleaseArtifactNames,
+  type SqliteVecAsset,
+} from '@pellux/goodvibes-sdk/platform/runtime/self-update';
 
 export type SupportedPlatform = 'linux' | 'darwin';
 export type SupportedArch = 'x64' | 'arm64';
-
-export interface ReleaseArtifactNames {
-  readonly app: string;
-  readonly daemon: string;
-}
-
-/** Release-asset platform tag as used in artifact filenames ("linux" | "macos"). */
-const PLATFORM_TAGS: Record<SupportedPlatform, string> = {
-  linux: 'linux',
-  darwin: 'macos',
-};
-
-export function resolveArtifactNames(platform: string, arch: string): ReleaseArtifactNames | null {
-  const platformTag = PLATFORM_TAGS[platform as SupportedPlatform];
-  if (!platformTag || (arch !== 'x64' && arch !== 'arm64')) {
-    return null;
-  }
-  const suffix = `${platformTag}-${arch}`;
-  return {
-    app: `goodvibes-${suffix}`,
-    daemon: `goodvibes-daemon-${suffix}`,
-  };
-}
-
-export interface SqliteVecAsset {
-  /** Release asset filename, e.g. `sqlite-vec-linux-x64.so`. */
-  readonly assetName: string;
-  /** Directory name the SDK loader resolves, e.g. `sqlite-vec-linux-x64`. */
-  readonly dirName: string;
-  /** File the loader opens inside that directory, e.g. `vec0.so`. */
-  readonly fileName: string;
-}
-
-/**
- * Names the sqlite-vec native addon for a platform/arch. Unlike the binaries
- * (whose release tag maps darwin→"macos"), the addon keeps the Node-style
- * platform tag ("linux" | "darwin") because that is exactly what the SDK's
- * loader resolves at `<execDir>/lib/sqlite-vec-<process.platform>-<process.arch>/vec0.<suffix>`.
- * The scripts/install.sh installer and the release workflow name the asset the
- * same way; all three must stay in lockstep.
- */
-export function resolveSqliteVecAsset(platform: string, arch: string): SqliteVecAsset | null {
-  if ((platform !== 'linux' && platform !== 'darwin') || (arch !== 'x64' && arch !== 'arm64')) {
-    return null;
-  }
-  const suffix = platform === 'darwin' ? 'dylib' : 'so';
-  const dirName = `sqlite-vec-${platform}-${arch}`;
-  return {
-    assetName: `${dirName}.${suffix}`,
-    dirName,
-    fileName: `vec0.${suffix}`,
-  };
-}
-
-export function sha256(buffer: Buffer | Uint8Array): string {
-  return createHash('sha256').update(buffer).digest('hex');
-}
-
-export function parseChecksumFile(contents: string): Map<string, string> {
-  const checksums = new Map<string, string>();
-  for (const rawLine of contents.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (!line) continue;
-    const match = line.match(/^([a-f0-9]{64})\s+\*?(.+)$/i);
-    if (!match) continue;
-    checksums.set(match[2], match[1].toLowerCase());
-  }
-  return checksums;
-}
-
-/**
- * Verify a downloaded artifact's checksum against the parsed manifest.
- * An artifact with no entry in the manifest is a hard failure, identical
- * in severity to a mismatching entry — never treated as "unverifiable, so
- * skip the check". Throws naming the artifact and the manifest.
- */
-export function verifyChecksum(
-  artifactName: string,
-  actual: string,
-  expected: string | undefined,
-  manifestName: string = CHECKSUM_MANIFEST_NAME,
-): void {
-  if (expected === undefined) {
-    throw new Error(`no checksum entry for ${artifactName} in ${manifestName} — refusing to install an unverified binary`);
-  }
-  if (expected !== actual) {
-    throw new Error(`checksum mismatch for ${artifactName}: expected ${expected}, got ${actual}`);
-  }
-}

package/src/runtime/resume-notice.ts

@@ -1,7 +1,7 @@
 /**
  * resume-notice.ts — the boot-time "previous session found" transcript notice.
  *
- * UX-D item 1: a supervision-journey audit of 1.7.0 found that the TUI
+ * item 1: a supervision-journey audit of 1.7.0 found that the TUI
  * accumulates rich resumable state on disk (a saved conversation, workspace
  * checkpoints, WRFC chain history) but never surfaces any of it at startup —
  * an operator has no way to know it exists short of already knowing the