@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/runtime/interaction-seams.ts

@@ -0,0 +1,109 @@
+// ---------------------------------------------------------------------------
+// interaction-seams.ts — the command-context interaction seams and the memory-
+// provenance UI controller, extracted from main.ts (file-size hygiene).
+//
+// The seams expose the in-process orchestrator's per-tool cancel and mid-turn
+// queue edit/delete, the power toggle/status, and the provenance-chip drill-in
+// to the command layer. The memory-provenance controller owns the "used N
+// memories" chip's state (the latest turn's metadata.memory.recordIds and the
+// expand flag), its per-turn capture, and its render.
+// ---------------------------------------------------------------------------
+
+import type { CommandContext } from '../input/command-registry.ts';
+import type { PowerManager } from '@pellux/goodvibes-sdk/platform/power';
+import type { Line } from '../types/grid.ts';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import { createCancelToolCall, type ToolCancelOrchestrator } from '../core/turn-cancellation.ts';
+import { powerSurfaceFromState } from '../core/power-status.ts';
+import { memoryRecordIdsFromTurn, readMemoryShowProvenance } from '../core/memory-provenance.ts';
+import { UIFactory } from '../renderer/ui-factory.ts';
+
+/** The orchestrator surface the interaction seams need. */
+export interface InteractionOrchestrator extends ToolCancelOrchestrator {
+  listQueuedMessages(): ReadonlyArray<{ id: string; queuedAt: number; text: string }>;
+  editQueuedMessage(id: string, text: string): boolean;
+  deleteQueuedMessage(id: string): boolean;
+}
+
+export interface InteractionSeamDeps {
+  readonly orchestrator: InteractionOrchestrator;
+  readonly powerManager: PowerManager;
+  /** Topology-aware power projection (the chip source): the DAEMON's state in adopted-external mode. Falls back to the local manager when absent. */
+  readonly readPowerSurface?: (() => ReturnType<typeof powerSurfaceFromState>) | undefined;
+  readonly render: () => void;
+  readonly notify: (message: string) => void;
+  readonly getActiveToolCallId: () => string | undefined;
+  readonly toggleMemoryProvenance: () => void;
+}
+
+/** Wire the per-tool cancel, queue edit/delete, power, and memory-provenance seams onto the command context. */
+export function wireInteractionSeams(cc: CommandContext, deps: InteractionSeamDeps): void {
+  cc.cancelToolCall = createCancelToolCall(deps.orchestrator, deps.getActiveToolCallId, () => {
+    deps.notify('[Tool] Cancelled the running tool call — the turn continues.');
+    deps.render();
+  });
+  cc.listQueuedMessages = () => deps.orchestrator.listQueuedMessages();
+  cc.editQueuedMessage = (id, text) => { const ok = deps.orchestrator.editQueuedMessage(id, text); if (ok) deps.render(); return ok; };
+  cc.deleteQueuedMessage = (id) => { const ok = deps.orchestrator.deleteQueuedMessage(id); if (ok) deps.render(); return ok; };
+  cc.toggleMemoryProvenance = deps.toggleMemoryProvenance;
+  cc.getPowerState = () => (deps.readPowerSurface ? deps.readPowerSurface() : powerSurfaceFromState(deps.powerManager.getState()));
+  cc.setKeepAwake = async (enabled) => { const next = powerSurfaceFromState(await deps.powerManager.setKeepAwake(enabled)); deps.render(); return next; };
+}
+
+/** The memory-provenance chip UI: per-turn capture, drill-in state, and render. */
+export interface MemoryProvenanceUi {
+  /** Toggle the drill-in expand state (Alt+M). */
+  toggle(): void;
+  /** Capture the memory record ids from a completed turn's payload (metadata.memory.recordIds). */
+  onTurnCompleted(evt: unknown): void;
+  /** The chip lines for the current turn — empty when the setting is off or the turn used no memories. */
+  renderChip(width: number, configManager: Pick<ConfigManager, 'get'>): Line[];
+}
+
+/** A resolved provenance record summary (null = the record is no longer available). */
+type ResolvedRecord = { readonly summary: string; readonly cls: string } | null;
+
+/**
+ * Create the memory-provenance chip controller (default OFF; reads nothing when
+ * off). When the drill-in is expanded it RESOLVES each memory record id to its
+ * summary through the memory spine (the same host-or-daemon access the recall
+ * commands use, so an adopted daemon resolves over the wire) — per-id and
+ * lazily, so one forgotten record never blanks the rest and a collapsed chip
+ * costs nothing. Mirrors the webui's provenance detail fetch.
+ */
+export function createMemoryProvenanceUi(deps: {
+  readonly render: () => void;
+  readonly memorySpine: { get(id: string): Promise<{ summary: string; cls: string } | null> };
+}): MemoryProvenanceUi {
+  let latestRecordIds: readonly string[] = [];
+  let expanded = false;
+  // id -> resolved record (null = not found). Absent = not yet fetched.
+  const resolved = new Map<string, ResolvedRecord>();
+  const inFlight = new Set<string>();
+
+  const resolveExpanded = (): void => {
+    for (const id of latestRecordIds) {
+      if (resolved.has(id) || inFlight.has(id)) continue;
+      inFlight.add(id);
+      void deps.memorySpine.get(id)
+        .then((record) => { resolved.set(id, record ? { summary: record.summary, cls: record.cls } : null); })
+        .catch(() => { resolved.set(id, null); })
+        .finally(() => { inFlight.delete(id); deps.render(); });
+    }
+  };
+
+  return {
+    toggle() {
+      expanded = !expanded;
+      if (expanded) resolveExpanded();
+      deps.render();
+    },
+    onTurnCompleted(evt) { latestRecordIds = memoryRecordIdsFromTurn(evt); expanded = false; },
+    renderChip(width, configManager) {
+      if (!readMemoryShowProvenance(configManager) || latestRecordIds.length === 0) return [];
+      if (expanded) resolveExpanded(); // lazy: fetch any still-unresolved ids (idempotent)
+      const entries = latestRecordIds.map((id) => ({ id, record: resolved.has(id) ? resolved.get(id) : undefined }));
+      return UIFactory.createMemoryProvenanceChip(width, latestRecordIds.length, entries, expanded);
+    },
+  };
+}

package/src/runtime/legacy-daemon-migration.ts

@@ -1,9 +1,17 @@
 /**
- * The legacy `goodvibes-daemon.service` detect/migrate engine, shared
+ * The `goodvibes-daemon.service` detect/migrate engine, shared
  * by the daemon CLI (`src/daemon/service-commands.ts`, the `migrate-service`
  * subcommand) and the interactive TUI's onboarding guided UX
  * (`src/input/handler-onboarding-daemon-adopt.ts`).
  *
+ * NAMING, load-bearing: this module's identifiers say "legacy" because the
+ * engine migrates AWAY from the `goodvibes-daemon.service` unit name toward
+ * the runtime-managed unit — but that same name is what scripts/install.sh
+ * actively creates for curl-installed hosts TODAY. It is a parallel,
+ * first-class install path, not an obsolete one. User-facing copy therefore
+ * describes it as "the install-script unit" and never labels it legacy or
+ * implies it should be removed unless the user is explicitly migrating.
+ *
  * This lives under `src/runtime/` — not `src/daemon/` — specifically so the
  * `input` layer can consume it directly: the architecture gate's
  * `input-no-entrypoints` rule forbids `src/input/**` from importing
@@ -250,13 +258,15 @@ export function resolveManagedUnitName(status: ManagedServiceStatus): string {
   return basename(status.path).replace(/\.(service|plist)$/, '');
 }
 
-/** Honest one-line disclosure of the legacy unit's presence/state plus a manual migration hint — never auto-acted-on. */
+/** Honest one-line disclosure of the install-script unit's presence/state plus a manual migration hint — never auto-acted-on. */
 export function legacyUnitNote(legacy: LegacyUnitInfo, trackedServiceName: string): string {
   const stateWord = legacy.active ? 'installed and RUNNING' : 'installed (not currently active)';
   return (
-    `note: a service under the legacy name ${LEGACY_SERVICE_UNIT_NAME}.service is ${stateWord} at ${legacy.path} — ` +
-    `this tool manages a different unit name (${trackedServiceName}.service) and will not touch the legacy one automatically. ` +
-    `Remove it yourself when ready: systemctl --user disable --now ${LEGACY_SERVICE_UNIT_NAME}.service && rm ${legacy.path} && systemctl --user daemon-reload`
+    `note: a separate service named ${LEGACY_SERVICE_UNIT_NAME}.service is ${stateWord} at ${legacy.path} — ` +
+    `that unit name is managed by the goodvibes install script (older installs used it too), while this tool manages ` +
+    `${trackedServiceName}.service and will not touch the other unit automatically. Keep whichever one you use; running ` +
+    `both would start two daemons competing for the same port. To retire the install-script unit in favor of this ` +
+    `tool's: systemctl --user disable --now ${LEGACY_SERVICE_UNIT_NAME}.service && rm ${legacy.path} && systemctl --user daemon-reload`
   );
 }
 
@@ -317,7 +327,7 @@ function assertUnitIsNotLegacy(status: ManagedServiceStatus, legacy: LegacyUnitI
   if (status.path === legacy.path || resolveManagedUnitName(status) === LEGACY_SERVICE_UNIT_NAME) {
     throw new Error(
       `refusing to ${action}: the resolved managed unit (${resolveManagedUnitName(status)} at ${status.path}) is the ` +
-        `legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit — this should already have been caught by the pre-flight ` +
+        `install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit — this should already have been caught by the pre-flight ` +
         'collision check in runLegacyDaemonMigration',
     );
   }
@@ -356,7 +366,7 @@ export async function runLegacyDaemonMigration(
         ok: false,
         exitCode: 1,
         lines: [
-          `migrate-service: no legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit was found, but something is already ` +
+          `migrate-service: no install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit was found, but something is already ` +
             `listening on ${params.host}:${params.port}.`,
           "That looks like a process this tool doesn't manage (for example, a manually-started `nohup` daemon) rather " +
             'than a systemd unit — there is nothing here to stop or disable, and this tool will not attempt to kill an ' +
@@ -371,7 +381,7 @@ export async function runLegacyDaemonMigration(
       ok: true,
       exitCode: 0,
       lines: [
-        `migrate-service: no legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit was found and ${params.host}:${params.port} ` +
+        `migrate-service: no install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit was found and ${params.host}:${params.port} ` +
           'is free — there is nothing to migrate.',
         `Run install-service to set up the managed ${resolvedUnitName}.service directly.`,
       ],
@@ -385,8 +395,8 @@ export async function runLegacyDaemonMigration(
       exitCode: 1,
       lines: [
         `migrate-service: this host's detected service platform is '${currentStatus.platform}', not systemd, but a ` +
-          `legacy unit file exists at ${legacy.path}.`,
-        'The legacy unit is systemd-specific and this tool only knows how to migrate a systemd legacy unit today — ' +
+          `unit file with the install-script name exists at ${legacy.path}.`,
+        'That unit is systemd-specific and this tool only knows how to migrate a systemd unit today — ' +
           'nothing was changed.',
       ],
       status: currentStatus,
@@ -409,9 +419,9 @@ export async function runLegacyDaemonMigration(
       exitCode: 1,
       lines: [
         `migrate-service aborted: this host's 'service.serviceName' config key resolves to '${resolvedUnitName}', which ` +
-          `is the exact legacy unit name (${LEGACY_SERVICE_UNIT_NAME}.service at ${legacy.path}) this migration is ` +
+          `is the exact install-script unit name (${LEGACY_SERVICE_UNIT_NAME}.service at ${legacy.path}) this migration is ` +
           'supposed to retire.',
-        'Installing or rolling back a unit under that name would overwrite or delete the legacy unit instead of ' +
+        'Installing or rolling back a unit under that name would overwrite or delete the install-script unit instead of ' +
           'managing a separate one, so nothing has been changed.',
         `Fix: set the 'service.serviceName' config key to something other than '${LEGACY_SERVICE_UNIT_NAME}' (for ` +
           `example, the default '${trackedServiceName}') and re-run migrate-service.`,
@@ -429,7 +439,7 @@ export async function runLegacyDaemonMigration(
         'migrate-service (dry run — re-run with confirmation to execute): this would',
         `  1. install and start the new ${resolvedUnitName}.service unit`,
         '  2. verify it comes up healthy (a fresh, honest systemd is-active check)',
-        `  3. only if that succeeds, stop, disable, and remove the legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit ` +
+        `  3. only if that succeeds, stop, disable, and remove the install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit ` +
           'and run `systemctl --user daemon-reload`',
         'Nothing has been changed. Nothing is migrated automatically — re-run with explicit confirmation ' +
           "(the CLI's -y/--yes flag) to execute this plan.",
@@ -452,7 +462,7 @@ export async function runLegacyDaemonMigration(
       exitCode: 1,
       lines: [
         `migrate-service aborted: could not write the new ${resolvedUnitName}.service unit (${installed.actionError}).`,
-        `The legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit was never touched.`,
+        `The install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit was never touched.`,
       ],
       status: installed,
     };
@@ -473,7 +483,7 @@ export async function runLegacyDaemonMigration(
         `migrate-service aborted: the new ${resolvedUnitName}.service unit did not come up healthy` +
           (started.actionError ? ` (${started.actionError}).` : '.'),
         rollbackNote,
-        `The legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit was never touched and should still be running as before.`,
+        `The install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit was never touched and should still be running as before.`,
       ],
       status: healthCheck,
     };
@@ -496,20 +506,20 @@ export async function runLegacyDaemonMigration(
   const lines = [`migrated: the new ${resolvedUnitName}.service unit is installed, enabled, and running.`];
   if ((stopResult.status ?? 1) !== 0) {
     lines.push(
-      `note: stopping the legacy unit reported a non-zero exit (${stopResult.stderr ?? stopResult.stdout ?? 'no output'}); ` +
+      `note: stopping the install-script unit reported a non-zero exit (${stopResult.stderr ?? stopResult.stdout ?? 'no output'}); ` +
         'it may already have been stopped.',
     );
   }
   if ((disableResult.status ?? 1) !== 0) {
     lines.push(
-      `note: disabling the legacy unit reported a non-zero exit (${disableResult.stderr ?? disableResult.stdout ?? 'no output'}); ` +
+      `note: disabling the install-script unit reported a non-zero exit (${disableResult.stderr ?? disableResult.stdout ?? 'no output'}); ` +
         'it may already have been disabled.',
     );
   }
   if (removeError) {
-    lines.push(`note: could not remove the legacy unit file at ${legacy.path}: ${removeError} — remove it by hand.`);
+    lines.push(`note: could not remove the install-script unit file at ${legacy.path}: ${removeError} — remove it by hand.`);
   } else {
-    lines.push(`the legacy ${LEGACY_SERVICE_UNIT_NAME}.service unit has been stopped, disabled, and removed.`);
+    lines.push(`the install-script ${LEGACY_SERVICE_UNIT_NAME}.service unit has been stopped, disabled, and removed.`);
   }
   lines.push('ran `systemctl --user daemon-reload`.');
   return { ok: true, exitCode: 0, lines, status: healthCheck };

package/src/runtime/memory-fold.ts

@@ -21,7 +21,7 @@ export async function foldTuiLegacyMemory(
 ): Promise<MemoryFoldReport> {
   const legacyTuiProject = join(workingDirectory, '.goodvibes', 'tui', 'memory.sqlite');
   const sources: LegacyMemorySource[] = [
-    { label: `tui:${workingDirectory} (pre-E6)`, dbPath: legacyTuiProject },
+    { label: `tui:${workingDirectory} (legacy per-project store)`, dbPath: legacyTuiProject },
   ];
   return foldMemoryStores(memoryStore, sources, { embeddingRegistry: memoryEmbeddingRegistry });
 }

package/src/runtime/notification-dispatch.ts

@@ -0,0 +1,110 @@
+/**
+ * Notification dispatch — the production wiring that finally gives the
+ * panel_only notification target a live producer.
+ *
+ * The SDK's NotificationRouter decides where each domain notification goes
+ * (conversation / status_bar / panel_only) and collapses bursts and batches.
+ * Nothing in the running app routed real notifications before this: the
+ * panel_only feed (panels/notifications-feed.ts) and its panel existed with no
+ * upstream. This module builds the router, records every panel_only decision
+ * (including burst-collapsed ones) into the shared feed, and bridges the
+ * runtime event bus so real domain events become notifications.
+ */
+
+import { createNotificationRouter, type NotificationRouter } from '@pellux/goodvibes-sdk/platform/runtime/ui';
+import type { Notification, RoutingDecision, RuntimeEventBus, RuntimeEventDomain } from '@/runtime/index.ts';
+import type { ConfigManager } from '../config/index.ts';
+import { getSharedNotificationFeed, type PanelNotificationFeed } from '../panels/notifications-feed.ts';
+
+export interface NotificationDispatcher {
+  /** Route a notification; a panel_only (or burst-collapsed) decision lands in the feed. Returns the decision. */
+  dispatch(notification: Notification): RoutingDecision;
+  /** Surface batch-held notifications (call on a timer / when quiet-typing ends). */
+  flush(): void;
+  readonly router: NotificationRouter;
+}
+
+/**
+ * The runtime event domains whose events surface as operational notifications.
+ * Deliberately a curated set of user-relevant, completion/attention-shaped
+ * domains — not every domain — so the panel reflects meaningful operational
+ * activity rather than raw event churn. The router's per-domain verbosity and
+ * burst/batch policies still collapse floods within these.
+ */
+export const NOTIFICATION_BRIDGE_DOMAINS: readonly RuntimeEventDomain[] = [
+  'agents',
+  'tasks',
+  'workflows',
+  'automation',
+  'deliveries',
+  'security',
+];
+
+/** Turn an UPPER_SNAKE event type into a short human title ("AGENT_COMPLETED" → "Agent completed"). */
+export function humanizeEventType(type: string): string {
+  const words = type.toLowerCase().split(/[_\s]+/).filter(Boolean);
+  if (words.length === 0) return type;
+  return words.map((word, index) => (index === 0 ? word[0]!.toUpperCase() + word.slice(1) : word)).join(' ');
+}
+
+/** Derive a notification severity from an event type — errors/failures warn, the rest are informational. */
+export function levelForEventType(type: string): Notification['level'] {
+  const upper = type.toUpperCase();
+  if (/(FAILED|ERROR|CRASH|DENIED|BLOCKED)/.test(upper)) return 'warning';
+  if (/(CRITICAL|FATAL|BREACH)/.test(upper)) return 'critical';
+  return 'info';
+}
+
+export function createNotificationDispatcher(
+  configManager: Pick<ConfigManager, 'get'>,
+  feed: PanelNotificationFeed = getSharedNotificationFeed(),
+): NotificationDispatcher {
+  const router = createNotificationRouter(undefined, undefined, configManager);
+  const recordIfPanel = (notification: Notification, decision: RoutingDecision): void => {
+    if (decision.suppressed) return;
+    if (decision.target === 'panel_only') feed.record(notification, decision);
+  };
+  return {
+    router,
+    dispatch(notification) {
+      const decision = router.route(notification);
+      recordIfPanel(notification, decision);
+      return decision;
+    },
+    flush() {
+      for (const { notification } of router.flush()) {
+        // A flushed batch head surfaces as a batch-collapsed panel entry; the
+        // feed folds all sharing this batch key into one running-count row.
+        feed.record(notification, {
+          target: 'panel_only',
+          reasonCode: 'batch_window_collapsed',
+          batchKey: `${notification.domain}:${notification.level}`,
+        });
+      }
+    },
+  };
+}
+
+/**
+ * Bridge the runtime event bus to the dispatcher: each event in a curated
+ * domain becomes a notification and is routed. Returns an unsubscribe function
+ * that detaches every domain listener.
+ */
+export function wireRuntimeNotificationBridge(
+  runtimeBus: RuntimeEventBus,
+  dispatcher: Pick<NotificationDispatcher, 'dispatch'>,
+  domains: readonly RuntimeEventDomain[] = NOTIFICATION_BRIDGE_DOMAINS,
+): () => void {
+  const unsubscribes = domains.map((domain) =>
+    runtimeBus.onDomain(domain, (envelope) => {
+      dispatcher.dispatch({
+        id: envelope.traceId ?? `${domain}-${envelope.type}-${envelope.ts}`,
+        domain,
+        level: levelForEventType(envelope.type),
+        title: humanizeEventType(envelope.type),
+        timestamp: envelope.ts,
+      });
+    }),
+  );
+  return () => { for (const unsubscribe of unsubscribes) unsubscribe(); };
+}

package/src/runtime/onboarding/apply.ts

@@ -2,7 +2,6 @@ import { existsSync, readFileSync, unlinkSync } from 'node:fs';
 import { atomicWriteFileSync } from '../../config/atomic-write.ts';
 import { isSecretRefInput } from '@pellux/goodvibes-sdk/platform/config';
 import { CONFIG_SCHEMA, DEFAULT_CONFIG } from '../../config/index.ts';
-import type { FeatureFlagConfigKey } from '../surface-feature-flags.ts';
 import {
   getOnboardingRuntimeStatePath,
   readOnboardingRuntimeState,
@@ -133,39 +132,14 @@ function isMalformedGoodVibesSecretReferenceValue(value: string): boolean {
   return normalized.startsWith('goodvibes://') && !isGoodVibesSecretReferenceValue(normalized);
 }
 
-function isFeatureFlagConfigKey(key: string): key is FeatureFlagConfigKey {
-  return key === 'featureFlags' || key.startsWith('featureFlags.');
-}
-
-function validateFeatureFlagConfigValue(operation: Extract<OnboardingApplyOperation, { kind: 'set-config' }>): boolean {
-  if (!isFeatureFlagConfigKey(operation.key)) return false;
-
-  if (operation.key === 'featureFlags') {
-    if (!isPlainObject(operation.value)) throw new Error('featureFlags expects an object value.');
-    for (const [flagId, state] of Object.entries(operation.value)) {
-      if (flagId.trim().length === 0) throw new Error('featureFlags cannot contain an empty feature id.');
-      if (state !== 'enabled' && state !== 'disabled') {
-        throw new Error(`featureFlags.${flagId} expects enabled or disabled.`);
-      }
-    }
-    return true;
-  }
-
-  const flagId = operation.key.slice('featureFlags.'.length);
-  if (flagId.trim().length === 0) throw new Error('featureFlags requires a feature id.');
-  if (operation.value !== 'enabled' && operation.value !== 'disabled') {
-    throw new Error(`Config key ${operation.key} expects enabled or disabled.`);
-  }
-  return true;
-}
-
 function validateConfigValue(operation: Extract<OnboardingApplyOperation, { kind: 'set-config' }>): void {
   if (typeof operation.value === 'string' && isMalformedGoodVibesSecretReferenceValue(operation.value)) {
     throw new Error(`Config key ${operation.key} only accepts goodvibes://secrets/... secret references.`);
   }
 
-  if (validateFeatureFlagConfigValue(operation)) return;
-
+  // Feature enablement arrives as plain domain settings writes (e.g.
+  // sandbox.enabled, controlPlane.gateway), validated by the schema path below
+  // like any other key — there is no separate enablement namespace.
   const schema = CONFIG_SCHEMA.find((entry) => entry.key === operation.key);
   if (!schema) {
     const defaultValue = operation.key.split('.').reduce<unknown>((cursor, part) => (

package/src/runtime/onboarding/fast-path.ts

@@ -7,15 +7,24 @@
  *   - If a provider API key is already configured (env / secrets), skip
  *     onboarding entirely — write the check marker and drop straight into a
  *     working session. ZERO steps.
- *   - Otherwise ask exactly one question: start now on the free default model,
- *     or run the full guided setup. Dismissing (Esc) starts now — so it is
- *     always skippable.
+ *   - Otherwise ask exactly one question: start now on the default model, or
+ *     run the full guided setup. Dismissing (Esc) starts now — so it is
+ *     always skippable. The start-now copy is GENERATED from the default
+ *     model's registered auth state (buildOnboardingModelCopy), so a
+ *     "no API key needed" promise can only render when the provider is
+ *     genuinely keyless-ready.
  *
  * The full wizard remains one keystroke away (the "Full guided setup" choice,
  * or `/onboarding` at any time). If the command context can't answer whether a
  * provider is configured (e.g. a headless/test surface), we fall back to the
  * classic behavior of opening the wizard, so nothing regresses.
  */
+import {
+  buildOnboardingModelCopy,
+  resolveDefaultModelReadiness,
+  type ModelProviderSource,
+  type OnboardingModelCopy,
+} from '@pellux/goodvibes-sdk/platform/providers';
 import type { CommandContext } from '../../input/command-registry.ts';
 import type { SelectionItem } from '../../input/selection-modal.ts';
 import { writeOnboardingCheckMarker } from './markers.ts';
@@ -43,6 +52,27 @@ function readConfiguredProviderIds(commandContext: CommandContext): string[] | n
 
 const MARKER_OPTIONS: WriteOnboardingCheckMarkerOptions = { source: 'command' };
 
+/**
+ * Copy for the "start now" choice, GENERATED from the default model's live
+ * registration state (never hand-written): a "no API key needed" promise can
+ * only appear when the provider's own auth state proves keyless readiness.
+ * Surfaces that cannot answer (no registry / no getForModel) resolve to the
+ * honest 'unresolvable' copy rather than a fabricated keyless claim.
+ */
+function resolveStartCopy(commandContext: CommandContext): OnboardingModelCopy {
+  const modelKey = String(commandContext.platform?.config?.provider?.model ?? '').trim();
+  const registry = commandContext.provider?.providerRegistry;
+  const source: ModelProviderSource =
+    registry && typeof (registry as Partial<ModelProviderSource>).getForModel === 'function'
+      ? registry
+      : {
+          getForModel: () => {
+            throw new Error('provider registry unavailable on this surface');
+          },
+        };
+  return buildOnboardingModelCopy(resolveDefaultModelReadiness(source, modelKey));
+}
+
 /**
  * Run the fast-path first-run flow. Returns nothing; side effects (wizard open,
  * marker write, modal) happen through the injected deps.
@@ -68,8 +98,9 @@ export function startOnboardingFastPath(deps: OnboardingFastPathDeps): void {
     return;
   }
 
+  const startCopy = resolveStartCopy(commandContext);
   const items: SelectionItem[] = [
-    { id: 'start-now', label: 'Start now', detail: 'Use the free default model — no API key needed', primaryAction: 'select' },
+    { id: 'start-now', label: startCopy.headline, detail: startCopy.detail, primaryAction: 'select' },
     { id: 'full-setup', label: 'Full guided setup', detail: 'Choose provider, model, channels, and more', primaryAction: 'select' },
   ];
   commandContext.openSelection(
@@ -82,10 +113,12 @@ export function startOnboardingFastPath(deps: OnboardingFastPathDeps): void {
         return;
       }
       // Start now (or dismissed): mark first-run done and drop into a working
-      // session on the free default model.
+      // session on the default model. The status line reuses the generated
+      // copy so it can never promise keyless readiness the registration
+      // state does not prove.
       writeOnboardingCheckMarker(shellPaths, MARKER_OPTIONS);
       commandContext.print?.(
-        'You\'re on the free default model. Add a provider key anytime with /provider, or run /onboarding for full setup.',
+        `${startCopy.detail}. Add a provider key anytime with /provider, or run /onboarding for full setup.`,
       );
       render();
     },

package/src/runtime/onboarding/provider-key-capture.ts

@@ -0,0 +1,126 @@
+/**
+ * Provider-agnostic key capture for onboarding.
+ *
+ * The onboarding wizard offers an API-key field for every provider the registry
+ * knows accepts a key — derived from each provider's registration-time auth
+ * state (describeAuthState), never a hardcoded vendor list. This module holds
+ * the two shared pieces that keep the wizard step and the apply step in lockstep:
+ *
+ *  1. enrichProviderAccountsSnapshot — stamps each provider-account record with
+ *     the secrets-store key it reads its API key from (its declared auth env
+ *     var), read live from the provider registry.
+ *  2. deriveProviderKeyCaptureTargets / providerKeyFieldId — the single source
+ *     of truth for which providers get a key field and how those fields are
+ *     named, used by both the field builder and the apply writer.
+ */
+
+import type { LLMProvider } from '@pellux/goodvibes-sdk/platform/providers';
+import type {
+  OnboardingProviderAccountRecord,
+  OnboardingProviderAccountsSnapshot,
+} from './types.ts';
+
+/** Minimal provider lookup the enrichment needs (structural for testing). */
+export interface ProviderKeyRegistryLike {
+  tryGet(name: string): LLMProvider | undefined;
+}
+
+/** Read a provider's declared API-key env var, or undefined when it accepts none. */
+export function readProviderApiKeyEnvVar(
+  registry: ProviderKeyRegistryLike,
+  providerId: string,
+): string | undefined {
+  let provider: LLMProvider | undefined;
+  try {
+    provider = registry.tryGet(providerId);
+  } catch {
+    provider = undefined;
+  }
+  const envVars = provider?.describeAuthState?.().authEnvVars;
+  return envVars && envVars.length > 0 ? envVars[0] : undefined;
+}
+
+/**
+ * Return an equivalent snapshot with each provider record stamped with the
+ * secrets-store key it accepts an API key under (from live registration truth).
+ * Records for keyless / subscription-only providers keep apiKeyEnvVar absent.
+ */
+export function enrichProviderAccountsSnapshot(
+  snapshot: OnboardingProviderAccountsSnapshot,
+  registry: ProviderKeyRegistryLike,
+): OnboardingProviderAccountsSnapshot {
+  return {
+    ...snapshot,
+    providers: snapshot.providers.map((record) => {
+      const apiKeyEnvVar = readProviderApiKeyEnvVar(registry, record.providerId);
+      return apiKeyEnvVar ? { ...record, apiKeyEnvVar } : record;
+    }),
+  };
+}
+
+/** A provider that onboarding can offer an API-key field for. */
+export interface ProviderKeyCaptureTarget {
+  readonly providerId: string;
+  readonly apiKeyEnvVar: string;
+  readonly configured: boolean;
+}
+
+/**
+ * The providers onboarding offers an API-key field for: every registered
+ * provider that declares an api-key route AND carries a resolved auth env var.
+ * Ordered by provider id so the wizard renders deterministically.
+ */
+export function deriveProviderKeyCaptureTargets(
+  providers: readonly OnboardingProviderAccountRecord[] | undefined,
+): ProviderKeyCaptureTarget[] {
+  if (!providers) return [];
+  return providers
+    .filter((record) => record.apiKeyEnvVar && record.availableRoutes.includes('api-key'))
+    .map((record) => ({
+      providerId: record.providerId,
+      apiKeyEnvVar: record.apiKeyEnvVar as string,
+      configured: record.configured,
+    }))
+    .sort((a, b) => a.providerId.localeCompare(b.providerId));
+}
+
+/** The wizard field id that captures a given provider's API key. */
+export function providerKeyFieldId(providerId: string): string {
+  return `providers.api-key.${providerId}`;
+}
+
+/** A subscription-capable provider and its current subscription posture. */
+export interface SubscriptionStatusTarget {
+  readonly providerId: string;
+  readonly active: boolean;
+  readonly pending: boolean;
+}
+
+/**
+ * The providers onboarding shows a subscription-status row for: every provider
+ * that declares a subscription route (registration truth), plus any provider
+ * with an active or pending subscription session — so a live session is never
+ * hidden just because its account record was absent. Ordered by provider id.
+ */
+export function deriveSubscriptionStatusTargets(
+  providers: readonly OnboardingProviderAccountRecord[] | undefined,
+  activeProviderIds: readonly string[],
+  pendingProviderIds: readonly string[],
+): SubscriptionStatusTarget[] {
+  const active = new Set(activeProviderIds);
+  const pending = new Set(pendingProviderIds);
+  const ids = new Set<string>();
+  for (const record of providers ?? []) {
+    if (record.availableRoutes.includes('subscription')) ids.add(record.providerId);
+  }
+  for (const id of active) ids.add(id);
+  for (const id of pending) ids.add(id);
+  return [...ids]
+    .sort((a, b) => a.localeCompare(b))
+    .map((providerId) => ({ providerId, active: active.has(providerId), pending: pending.has(providerId) }));
+}
+
+/** The wizard field id of a provider's subscription-status row. */
+export function subscriptionStatusFieldId(providerId: string): string {
+  return `providers.subscription.${providerId}`;
+}

package/src/runtime/onboarding/snapshot.ts

@@ -43,7 +43,6 @@ function buildConfigSnapshot(
     network: config.getCategory('network'),
     surfaces: config.getCategory('surfaces'),
     service: config.getCategory('service'),
-    featureFlags: config.getCategory('featureFlags'),
     batch: config.getCategory('batch'),
     cloudflare: config.getCategory('cloudflare'),
   };