@rizzmyrobot/mochi-cli 0.0.3 → 0.0.4

package/README.md

@@ -174,12 +174,12 @@ explicit-config live Telegram delivery and Bot API polling primitives, tests,
 and planning docs. The local V0 owner proof lives in
 [`docs/runtime/v0-manual-proof.md`](docs/runtime/v0-manual-proof.md).
 
-Mochi still does not publish player packages, host certification, open live HTTP
-ingress by default, expose public dashboard ingress, provide dashboard game
-control panels, run production Prom13us/Rizz play outside compatible-game
-contracts and server-validated proofs, support unsupported games, execute
-arbitrary live MCP tools, provide hosted accounts, or mutate game canon outside
-trusted game-owned validation.
+Mochi still does not publish preferred `@mochi/*` player packages, host
+certification, open live HTTP ingress by default, expose public dashboard
+ingress, provide dashboard game control panels, run production Prom13us/Rizz
+play outside compatible-game contracts and server-validated proofs, support
+unsupported games, execute arbitrary live MCP tools, provide hosted accounts, or
+mutate game canon outside trusted game-owned validation.
 
 Mochi uses the Apache-2.0 license. See `CONTRIBUTING.md`, `SECURITY.md`, and
 `PRIVACY.md` before opening public contributions, reporting vulnerabilities, or
@@ -192,28 +192,34 @@ as a default.
 
 ## Player Install
 
-Mochi is pre-alpha, and package publication is not live yet. The public player
-install path is npm/npx, not cloning the repository and running Bun. Until a
-release publishes trusted packages with provenance, treat these commands as the
-install-ready path under test rather than a live registry claim.
+Mochi is pre-alpha, and the fallback CLI package is registry-proven at
+`@rizzmyrobot/mochi-cli@0.0.3` by trusted publishing plus
+`npm view @rizzmyrobot/mochi-cli@0.0.3` proof. The public player install path is npm/npx,
+not cloning the repository and running Bun.
 
 Because `@mochi/*` npm ownership is not proven, the fallback package scope is
-the current public install target. The intended one-line player install is:
+the current public install target. The one-line player install is:
 
 ```bash
 npm install -g @rizzmyrobot/mochi-cli
 mochi onboard
 ```
 
-`mochi onboard` is the player first-run command. It shows provider choices,
-including MiniMax OAuth and Codex OAuth, and channel choices, including
-Telegram and Discord. MiniMax OAuth, OpenAI API-key refs, Telegram config,
-workspace seed files, local provider credential refs, and local Telegram token
-refs reuse the existing provider auth, configure, proof workspace seed,
-Telegram, Gateway, and secret-store packages. Codex OAuth is exposed as the
-external `codex login` path until Mochi has a Codex OAuth provider runtime.
-Discord is exposed as a product choice, but it does not accept or store Discord
-bot tokens until a Discord runtime package exists.
+`mochi onboard` is the player first-run command. In an interactive terminal it
+runs a real guided setup: choose MiniMax OAuth, OpenAI API key, or Codex OAuth;
+choose Telegram, Discord, or no channel; seed the proof workspace; write local
+runtime config refs; store local secrets; validate Telegram bot tokens with the
+Bot API `getMe` check; and print the exact `mochi talk` / `mochi telegram
+listen` proof commands to run next. Non-interactive `mochi onboard --guide`
+remains a no-write preview for CI, docs, and scripts.
+
+MiniMax OAuth, OpenAI API-key refs, Telegram config, workspace seed files,
+local provider credential refs, and local Telegram token refs reuse the existing
+provider auth, configure, proof workspace seed, Telegram, Gateway, and
+secret-store packages. Codex OAuth runs the external `codex login` path, but it
+is not yet a Mochi provider runtime for `mochi talk`. Discord is exposed as a
+product choice, but it does not accept or store Discord bot tokens until a
+Discord runtime package exists.
 
 npx follows the same fallback scope:
 
@@ -235,14 +241,16 @@ mochi onboard
 ```
 
 Current public install `gateway start/status/doctor` commands remain dry-run
-planning proofs. `mochi onboard` may write local workspace seed files, runtime
-config refs, and local secrets only when `--confirm` plus stdin secret flags are
-provided. It does not call providers, run OAuth token exchange, poll Telegram,
-send Telegram messages, connect Discord, connect games, submit production
-intents, or change game canon. The separate credentialed `talk` command can
-call a selected model provider for a local Mochi reply; contributor/runtime docs
-describe the local owner proof for credentialed provider and Telegram
-conversation, and the mock-game proof exercises a fixture provider response
+planning proofs. Interactive `mochi onboard` may write local workspace seed
+files, runtime config refs, and local secrets; MiniMax OAuth may open a browser,
+start a loopback callback server, and call the provider token endpoint; Telegram
+setup may call only the Bot API `getMe` validation endpoint. It does not call
+model providers, poll Telegram, send Telegram messages, connect Discord,
+connect games, submit production intents, or change game canon. The separate
+credentialed `talk` command can call a selected model provider for a local
+Mochi reply; contributor/runtime docs describe the local owner proof for
+credentialed provider and Telegram conversation, and the mock-game proof
+exercises a fixture provider response
 plus a trusted local adapter receipt.
 
 The local laptop Gateway install flow lives in

package/dist/index.js

@@ -21,6 +21,7 @@ import { lstatSync } from "fs";
 import { access, mkdir as mkdir6, readFile as readFile10, rename, rm as rm2, stat as stat3, writeFile as writeFile6 } from "fs/promises";
 import { createServer } from "http";
 import { dirname as dirname7, isAbsolute as isAbsolute4, join as join5, resolve as resolve4 } from "path";
+import { createInterface } from "readline";
 import { Database as Database13 } from "bun:sqlite";
 
 // node_modules/.bun/zod@4.4.3/node_modules/zod/v4/classic/external.js
@@ -51044,7 +51045,7 @@ function renderCliHelp() {
     "",
     "Commands:",
     "  init --dry-run [--profile local] [--workspace-root <path>] [--storage-path <path>] [--host 127.0.0.1] [--port 7332]",
-    "  onboard [--workspace-root <path>] [--provider minimax-oauth|codex-oauth|openai-api-key] [--model <model>] [--channel telegram|discord|none] [--owner <owner-id>] [--telegram-user-id <id>] [--credential-stdin] [--telegram-token-stdin] [--confirm] [--format text|json]",
+    "  onboard [--interactive|--guide] [--workspace-root <path>] [--provider minimax-oauth|codex-oauth|openai-api-key] [--model <model>] [--channel telegram|discord|none] [--owner <owner-id>] [--telegram-user-id <id>] [--credential-stdin] [--telegram-token-stdin] [--confirm] [--format text|json]",
     "  onboard bootstrap --dry-run [--fixture complete] [--decision-fixture approve-edit-reject]",
     "  onboard bootstrap --apply --confirm --workspace-root <path> --checkpoint-ref <ref> --fixture complete --decision-fixture approve-edit-reject",
     "  onboard play-contract --dry-run --fixture complete [--decision approve|reject|reset]",
@@ -58558,6 +58559,7 @@ function parseCliOnboardRootArgs(args = [], env = process.env) {
   let channel = "telegram";
   let ownerId;
   let telegramUserId;
+  let interactionMode = "auto";
   let confirm = false;
   let credentialStdin = false;
   let telegramTokenStdin = false;
@@ -58656,6 +58658,14 @@ function parseCliOnboardRootArgs(args = [], env = process.env) {
       confirm = true;
       continue;
     }
+    if (arg === "--interactive") {
+      interactionMode = "interactive";
+      continue;
+    }
+    if (arg === "--guide" || arg === "--dry-run" || arg === "--non-interactive") {
+      interactionMode = "guide";
+      continue;
+    }
     if (arg === "--credential-stdin") {
       credentialStdin = true;
       continue;
@@ -58710,6 +58720,7 @@ function parseCliOnboardRootArgs(args = [], env = process.env) {
       channel,
       ...ownerId?.trim() ? { ownerId: ownerId.trim() } : {},
       ...telegramUserId?.trim() ? { telegramUserId: telegramUserId.trim() } : {},
+      interactionMode,
       confirm,
       credentialStdin,
       telegramTokenStdin,
@@ -58822,7 +58833,504 @@ function cliOnboardStoresSecrets(payload) {
 function cliOnboardProviderCredentialRef(provider) {
   return provider === "minimax-oauth" ? "oauth:providers/minimax/default" : "secret:providers/openai/default";
 }
+function cliOnboardProviderId(provider) {
+  return provider === "minimax-oauth" ? "minimax" : "openai";
+}
+function cliOnboardProviderRefreshTokenRef(provider) {
+  return provider === "minimax-oauth" ? "secret:providers/minimax/oauth/refresh-token" : undefined;
+}
+function cliOnboardProviderDefaultModel(provider, env) {
+  if (env.MOCHI_MODEL?.trim()) {
+    return env.MOCHI_MODEL.trim();
+  }
+  if (provider === "minimax-oauth") {
+    return env.MOCHI_MINIMAX_MODEL?.trim() || "abab6.5s-chat";
+  }
+  if (provider === "openai-api-key") {
+    return env.MOCHI_OPENAI_MODEL?.trim() || "gpt-4.1-mini";
+  }
+  return;
+}
+function cliOnboardIsTty() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+function cliOnboardShouldRunInteractive(options) {
+  if (options.confirm || options.interactionMode === "guide") {
+    return false;
+  }
+  return options.interactionMode === "interactive" || cliOnboardIsTty();
+}
+function defaultCliOnboardReadLine(question) {
+  const readline = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  return new Promise((resolveAnswer) => {
+    readline.question(question, (answer) => {
+      readline.close();
+      resolveAnswer(answer);
+    });
+  });
+}
+function defaultCliOnboardReadSecret(question) {
+  if (!process.stdin.isTTY) {
+    return defaultCliOnboardReadLine(question);
+  }
+  return new Promise((resolveSecret, rejectSecret) => {
+    const input = process.stdin;
+    const output = process.stdout;
+    const rawInput = input;
+    const wasRaw = rawInput.isRaw === true;
+    let secret = "";
+    const cleanup = () => {
+      input.off("data", onData);
+      if (rawInput.setRawMode) {
+        rawInput.setRawMode(wasRaw);
+      }
+      input.pause();
+      output.write(`
+`);
+    };
+    const onData = (chunk) => {
+      const value = chunk.toString("utf8");
+      for (const char of value) {
+        if (char === "\x03") {
+          cleanup();
+          rejectSecret(new Error("Secret prompt interrupted."));
+          return;
+        }
+        if (char === "\r" || char === `
+`) {
+          cleanup();
+          resolveSecret(secret);
+          return;
+        }
+        if (char === "\b" || char === "\x7F") {
+          secret = secret.slice(0, -1);
+          continue;
+        }
+        secret += char;
+      }
+    };
+    output.write(question);
+    if (rawInput.setRawMode) {
+      rawInput.setRawMode(true);
+    }
+    input.resume();
+    input.on("data", onData);
+  });
+}
+function defaultCliOnboardPrompt() {
+  if (!cliOnboardIsTty()) {
+    return;
+  }
+  return {
+    readLine: defaultCliOnboardReadLine,
+    readSecret: defaultCliOnboardReadSecret
+  };
+}
+function parseCliOnboardInteractiveProvider(raw, fallback) {
+  const value = raw.trim().toLowerCase();
+  if (!value)
+    return fallback;
+  if (value === "1" || value === "minimax" || value === "minimax-oauth") {
+    return "minimax-oauth";
+  }
+  if (value === "2" || value === "openai" || value === "openai-api-key" || value === "openai api key") {
+    return "openai-api-key";
+  }
+  if (value === "3" || value === "codex" || value === "codex-oauth") {
+    return "codex-oauth";
+  }
+  return parseCliOnboardRootProvider(value);
+}
+function parseCliOnboardInteractiveChannel(raw, fallback) {
+  const value = raw.trim().toLowerCase();
+  if (!value)
+    return fallback;
+  if (value === "1" || value === "telegram") {
+    return "telegram";
+  }
+  if (value === "2" || value === "discord") {
+    return "discord";
+  }
+  if (value === "3" || value === "none" || value === "skip") {
+    return "none";
+  }
+  return parseCliOnboardRootChannel(value);
+}
+async function cliOnboardPromptValue(input) {
+  const suffix = input.defaultValue ? ` [${input.defaultValue}]` : "";
+  const question = `${input.question}${suffix}: `;
+  const raw = input.secret ? await input.prompt.readSecret(question) : await input.prompt.readLine(question);
+  return raw.trim() || input.defaultValue?.trim() || "";
+}
+function defaultCliOnboardExternalCommand() {
+  return (command, args) => new Promise((resolveCommand) => {
+    const child = spawn(command, [...args], { stdio: "inherit" });
+    child.on("error", () => resolveCommand({ exitCode: 127 }));
+    child.on("exit", (code) => resolveCommand({ exitCode: code ?? 1 }));
+  });
+}
+function cliOnboardSharedSecretStore(dependencies) {
+  return dependencies.secretStore ?? dependencies.providerAuth?.secretStore ?? dependencies.telegram?.secretStore;
+}
+function cliOnboardConfigureDependencies(dependencies, readSecret) {
+  const secretStore = cliOnboardSharedSecretStore(dependencies);
+  return {
+    ...secretStore ? { secretStore } : {},
+    readSecret
+  };
+}
+function cliOnboardProviderAuthDependencies(dependencies) {
+  const secretStore = cliOnboardSharedSecretStore(dependencies);
+  return {
+    ...dependencies.providerAuth,
+    ...secretStore ? { secretStore } : {}
+  };
+}
+function cliOnboardTelegramDependencies(dependencies) {
+  const secretStore = cliOnboardSharedSecretStore(dependencies);
+  return {
+    ...dependencies.telegram,
+    ...secretStore ? { secretStore } : {}
+  };
+}
+function cliOnboardSelectedRuntimeCommands(input) {
+  if (input.provider === "codex-oauth") {
+    return [
+      "No Mochi talk proof command exists for Codex OAuth yet; choose minimax-oauth or openai-api-key for the current Mochi runtime."
+    ];
+  }
+  const providerId = cliOnboardProviderId(input.provider);
+  const credentialRef = cliOnboardProviderCredentialRef(input.provider);
+  const refreshTokenRef = cliOnboardProviderRefreshTokenRef(input.provider);
+  return [
+    [
+      "mochi proof readiness",
+      `--workspace-root ${input.workspaceRoot}`,
+      `--provider ${providerId}`,
+      `--credential-ref ${credentialRef}`,
+      ...refreshTokenRef ? [`--refresh-token-ref ${refreshTokenRef}`] : [],
+      ...input.channel === "telegram" ? [
+        "--telegram-token-ref os:mochi/telegram/bot-token",
+        `--owner ${input.ownerId ?? "<owner-id>"}`,
+        `--telegram-user-id ${input.telegramUserId ?? "<telegram-user-id>"}`
+      ] : []
+    ].join(" "),
+    [
+      "mochi talk",
+      `--workspace-root ${input.workspaceRoot}`,
+      "--game mock-game",
+      `--provider ${providerId}`,
+      `--model ${input.model}`,
+      `--credential-ref ${credentialRef}`,
+      ...refreshTokenRef ? [`--refresh-token-ref ${refreshTokenRef}`] : [],
+      '--message "Hello Mochi. Answer in one short sentence."'
+    ].join(" "),
+    ...input.channel === "telegram" ? [
+      [
+        "mochi telegram listen",
+        `--workspace-root ${input.workspaceRoot}`,
+        "--game mock-game",
+        `--owner ${input.ownerId ?? "<owner-id>"}`,
+        `--telegram-user-id ${input.telegramUserId ?? "<telegram-user-id>"}`,
+        `--provider ${providerId}`,
+        `--model ${input.model}`,
+        `--credential-ref ${credentialRef}`,
+        ...refreshTokenRef ? [`--refresh-token-ref ${refreshTokenRef}`] : [],
+        "--telegram-token-ref os:mochi/telegram/bot-token",
+        "--poll-once"
+      ].join(" ")
+    ] : []
+  ];
+}
+async function createCliOnboardInteractivePayload(options, env = process.env, dependencies = {}) {
+  const prompt = dependencies.prompt ?? defaultCliOnboardPrompt();
+  const warnings = [
+    "Mochi onboard reuses provider auth, configure, proof workspace seed, Telegram, and Gateway runtime surfaces; it does not create parallel setup abstractions.",
+    "Raw provider keys, OAuth tokens, refresh tokens, Telegram bot tokens, and auth headers are never printed or written to workspace files.",
+    "Game connections and game actions remain server-authoritative; onboarding does not connect games, submit intents, or mutate game canon."
+  ];
+  const blockers = [];
+  if (!prompt) {
+    const providerChoices2 = cliOnboardProviderChoices(options);
+    const channelChoices2 = cliOnboardChannelChoices(options);
+    return {
+      type: "mochi.cli.onboard_first_run",
+      ok: false,
+      confirmed: true,
+      workspaceRoot: options.workspaceRoot,
+      selected: {
+        provider: options.provider,
+        channel: options.channel,
+        model: options.model ?? null
+      },
+      providerChoices: providerChoices2,
+      channelChoices: channelChoices2,
+      setup: {},
+      sideEffects: {
+        writesWorkspaceFiles: false,
+        writesRuntimeConfig: false,
+        storesLocalSecrets: false,
+        opensBrowser: false,
+        startsLocalCallbackServer: false,
+        runsExternalCodexLogin: false,
+        callsProviderTokenEndpoint: false,
+        callsTelegramGetMeEndpoint: false,
+        callsModelProvider: false,
+        pollsTelegram: false,
+        sendsTelegram: false,
+        connectsDiscord: false,
+        connectsGames: false,
+        submitsActions: false,
+        mutatesGameCanon: false,
+        secretsDisplayed: false
+      },
+      blockers: [
+        "Interactive onboard requires a TTY. Use `mochi onboard --guide` for a no-write preview or pass `--confirm` with stdin flags for scripted setup."
+      ],
+      nextCommands: ["mochi onboard --guide", "mochi onboard --confirm --help"],
+      warnings
+    };
+  }
+  const workspaceRoot = await cliOnboardPromptValue({
+    prompt,
+    question: "Workspace root",
+    defaultValue: options.workspaceRoot
+  });
+  const providerAnswer = await prompt.readLine("Choose AI provider: 1) MiniMax OAuth  2) OpenAI API key  3) Codex OAuth [1]: ");
+  const provider = parseCliOnboardInteractiveProvider(providerAnswer, options.provider);
+  if (!provider) {
+    blockers.push("Unsupported provider choice. Choose MiniMax OAuth, OpenAI API key, or Codex OAuth.");
+  }
+  const selectedProvider = provider ?? options.provider;
+  const model = selectedProvider === "codex-oauth" ? options.model ?? null : await cliOnboardPromptValue({
+    prompt,
+    question: "Model",
+    defaultValue: options.model ?? cliOnboardProviderDefaultModel(selectedProvider, env)
+  });
+  if (selectedProvider !== "codex-oauth" && !model) {
+    blockers.push("Model is required for Mochi talk.");
+  }
+  const workspaceSeed = await createCliProofWorkspaceSeedPayload({
+    workspaceRoot,
+    game: cliProofWorkspaceSeedDefaultGame(),
+    dryRun: false,
+    confirm: true,
+    journalDate: options.now.slice(0, 10),
+    format: "json"
+  });
+  let providerConfig;
+  let providerAuth;
+  let codexLogin;
+  if (selectedProvider === "minimax-oauth") {
+    const defaults = cliProviderOauthAuthChoices["minimax-global-oauth"];
+    const clientId = await cliOnboardPromptValue({
+      prompt,
+      question: "MiniMax OAuth client ID",
+      defaultValue: env.MOCHI_MINIMAX_OAUTH_CLIENT_ID?.trim()
+    });
+    if (!clientId) {
+      blockers.push("MiniMax OAuth client ID is required.");
+    } else if (model) {
+      providerAuth = await createCliProviderAuthPayload({
+        command: "oauth_login",
+        providerId: defaults.providerId,
+        authChoice: defaults.authChoice,
+        authorizationEndpoint: defaults.authorizationEndpoint,
+        tokenEndpoint: defaults.tokenEndpoint,
+        clientId,
+        redirectUri: defaults.redirectUri,
+        scopes: defaults.scopes,
+        accessTokenRef: defaults.accessTokenRef,
+        refreshTokenRef: defaults.refreshTokenRef,
+        workspaceRoot,
+        model,
+        baseUrl: defaults.baseUrl,
+        openBrowser: true,
+        timeoutMs: 120000,
+        state: `mochi-${randomUUID()}`,
+        format: "json",
+        now: options.now
+      }, env, cliOnboardProviderAuthDependencies(dependencies));
+      if (!providerAuth.ok) {
+        blockers.push(`MiniMax OAuth login failed: ${providerAuth.exchange?.publicSummary ?? "provider auth did not complete"}`);
+      }
+    }
+  }
+  if (selectedProvider === "openai-api-key") {
+    const apiKey = await cliOnboardPromptValue({
+      prompt,
+      question: "OpenAI API key",
+      secret: true
+    });
+    if (!apiKey) {
+      blockers.push("OpenAI API key is required.");
+    } else if (model) {
+      providerConfig = await createCliConfigurePayload({
+        command: "provider",
+        workspaceRoot,
+        providerId: "openai",
+        model,
+        credentialRef: "secret:providers/openai/default",
+        credentialStdin: true,
+        now: options.now,
+        format: "json"
+      }, env, cliOnboardConfigureDependencies(dependencies, () => apiKey));
+      if (!providerConfig.ok) {
+        blockers.push("OpenAI provider configure failed; inspect stored secret status and retry.");
+      }
+    }
+  }
+  if (selectedProvider === "codex-oauth") {
+    const runExternalCommand = dependencies.runExternalCommand ?? defaultCliOnboardExternalCommand();
+    codexLogin = {
+      attempted: true,
+      ...await runExternalCommand("codex", ["login"])
+    };
+    if (codexLogin.exitCode !== 0) {
+      blockers.push("Codex OAuth login failed or the codex CLI is not installed.");
+    }
+    blockers.push("Codex OAuth can log in through `codex login`, but Mochi has no Codex OAuth provider runtime yet; choose MiniMax OAuth or OpenAI API key for `mochi talk` today.");
+  }
+  const channelAnswer = await prompt.readLine("Choose chat channel: 1) Telegram bot token  2) Discord bot token  3) None [1]: ");
+  const channel = parseCliOnboardInteractiveChannel(channelAnswer, options.channel);
+  if (!channel) {
+    blockers.push("Unsupported chat channel choice. Choose Telegram, Discord, or none.");
+  }
+  const selectedChannel = channel ?? options.channel;
+  let ownerId = options.ownerId;
+  let telegramUserId = options.telegramUserId;
+  let telegramConfig;
+  let telegramValidation;
+  if (selectedChannel === "telegram") {
+    ownerId = await cliOnboardPromptValue({
+      prompt,
+      question: "Owner ID",
+      defaultValue: ownerId ?? "owner-main"
+    });
+    telegramUserId = await cliOnboardPromptValue({
+      prompt,
+      question: "Telegram numeric user ID",
+      defaultValue: telegramUserId
+    });
+    const botToken = await cliOnboardPromptValue({
+      prompt,
+      question: "Telegram bot token from BotFather",
+      secret: true
+    });
+    if (!ownerId) {
+      blockers.push("Owner ID is required for Telegram.");
+    }
+    if (!telegramUserId) {
+      blockers.push("Telegram numeric user ID is required for Telegram.");
+    }
+    if (!botToken) {
+      blockers.push("Telegram bot token is required.");
+    }
+    if (ownerId && telegramUserId && botToken) {
+      telegramConfig = await createCliConfigurePayload({
+        command: "telegram",
+        workspaceRoot,
+        ownerId,
+        telegramUserId,
+        botTokenRef: "os:mochi/telegram/bot-token",
+        botTokenStdin: true,
+        liveDeliveryEnabled: true,
+        allowedTelegramUserIds: [telegramUserId],
+        now: options.now,
+        format: "json"
+      }, env, cliOnboardConfigureDependencies(dependencies, () => botToken));
+      if (!telegramConfig.ok) {
+        blockers.push("Telegram configure failed; inspect stored secret status and retry.");
+      } else {
+        telegramValidation = await createCliTelegramValidatePayload({
+          workspaceRoot,
+          telegramTokenRef: "os:mochi/telegram/bot-token",
+          now: options.now,
+          format: "json"
+        }, env, cliOnboardTelegramDependencies(dependencies));
+        if (!telegramValidation.ok) {
+          blockers.push(`Telegram validation failed: ${telegramValidation.blockers[0] ?? "Bot API getMe did not validate the token."}`);
+        }
+      }
+    }
+  }
+  if (selectedChannel === "discord") {
+    blockers.push("Discord is a visible onboarding channel choice, but Mochi has no Discord runtime package yet, so no Discord token was accepted or stored.");
+  }
+  const providerChoices = cliOnboardProviderChoices({
+    ...options,
+    workspaceRoot,
+    provider: selectedProvider,
+    ...typeof model === "string" && model ? { model } : {}
+  });
+  const channelChoices = cliOnboardChannelChoices({
+    ...options,
+    workspaceRoot,
+    channel: selectedChannel,
+    ...ownerId ? { ownerId } : {},
+    ...telegramUserId ? { telegramUserId } : {}
+  });
+  const nextCommands = [
+    ...cliOnboardInstallCommands(),
+    ...cliOnboardSelectedRuntimeCommands({
+      workspaceRoot,
+      provider: selectedProvider,
+      model: typeof model === "string" && model ? model : "<model>",
+      channel: selectedChannel,
+      ...ownerId ? { ownerId } : {},
+      ...telegramUserId ? { telegramUserId } : {}
+    })
+  ];
+  return {
+    type: "mochi.cli.onboard_first_run",
+    ok: blockers.length === 0,
+    confirmed: true,
+    workspaceRoot,
+    selected: {
+      provider: selectedProvider,
+      channel: selectedChannel,
+      model: typeof model === "string" && model ? model : null
+    },
+    providerChoices,
+    channelChoices,
+    setup: {
+      workspaceSeed,
+      ...providerConfig ? { providerConfig } : {},
+      ...providerAuth ? { providerAuth } : {},
+      ...telegramConfig ? { telegramConfig } : {},
+      ...telegramValidation ? { telegramValidation } : {},
+      ...codexLogin ? { codexLogin } : {}
+    },
+    sideEffects: {
+      writesWorkspaceFiles: workspaceSeed.sideEffects.writesFiles,
+      writesRuntimeConfig: cliOnboardConfigWrites(providerConfig) || providerAuth?.sideEffects.writesRuntimeConfig === true || cliOnboardConfigWrites(telegramConfig),
+      storesLocalSecrets: cliOnboardStoresSecrets(providerConfig) || providerAuth?.sideEffects.storesLocalSecrets === true || cliOnboardStoresSecrets(telegramConfig),
+      opensBrowser: providerAuth?.sideEffects.opensBrowser === true,
+      startsLocalCallbackServer: providerAuth?.sideEffects.startsLocalCallbackServer === true,
+      runsExternalCodexLogin: codexLogin?.attempted === true,
+      callsProviderTokenEndpoint: providerAuth?.sideEffects.callsProviderTokenEndpoint === true,
+      callsTelegramGetMeEndpoint: telegramValidation?.sideEffects.callsTelegramGetMeEndpoint === true,
+      callsModelProvider: false,
+      pollsTelegram: false,
+      sendsTelegram: false,
+      connectsDiscord: false,
+      connectsGames: false,
+      submitsActions: false,
+      mutatesGameCanon: false,
+      secretsDisplayed: false
+    },
+    blockers,
+    nextCommands: [...new Set(nextCommands)],
+    warnings
+  };
+}
 async function createCliOnboardRootPayload(options, env = process.env, dependencies = {}) {
+  if (cliOnboardShouldRunInteractive(options)) {
+    return createCliOnboardInteractivePayload(options, env, dependencies);
+  }
   const blockers = [];
   const warnings = [
     "Mochi onboard reuses provider auth, configure, proof workspace seed, Telegram, and Gateway runtime surfaces; it does not create parallel setup abstractions.",
@@ -58920,36 +59428,18 @@ async function createCliOnboardRootPayload(options, env = process.env, dependenc
   const providerChoice = providerChoices.find((choice) => choice.id === options.provider);
   const channelChoice = channelChoices.find((choice) => choice.id === options.channel);
   const providerRuntimeImplemented = options.provider !== "codex-oauth";
-  const selectedCredentialRef = providerRuntimeImplemented ? cliOnboardProviderCredentialRef(options.provider) : undefined;
-  const model = cliOnboardModel(options);
   const nextCommands = [
     ...cliOnboardInstallCommands(),
     ...providerChoice?.nextCommands ?? [],
     ...channelChoice?.nextCommands ?? [],
-    ...providerRuntimeImplemented && selectedCredentialRef ? [
-      [
-        "mochi proof readiness",
-        `--workspace-root ${options.workspaceRoot}`,
-        `--provider ${options.provider === "minimax-oauth" ? "minimax" : "openai"}`,
-        `--credential-ref ${selectedCredentialRef}`,
-        ...options.channel === "telegram" ? [
-          "--telegram-token-ref os:mochi/telegram/bot-token",
-          "--owner <owner-id>",
-          "--telegram-user-id <telegram-user-id>"
-        ] : []
-      ].join(" "),
-      [
-        "mochi talk",
-        `--workspace-root ${options.workspaceRoot}`,
-        "--game mock-game",
-        `--provider ${options.provider === "minimax-oauth" ? "minimax" : "openai"}`,
-        `--model ${model}`,
-        `--credential-ref ${selectedCredentialRef}`,
-        '--message "Hello Mochi. Answer in one short sentence."'
-      ].join(" ")
-    ] : [
-      "No Mochi talk proof command exists for Codex OAuth yet; choose minimax-oauth or openai-api-key for the current Mochi runtime."
-    ]
+    ...cliOnboardSelectedRuntimeCommands({
+      workspaceRoot: options.workspaceRoot,
+      provider: providerRuntimeImplemented ? options.provider : "codex-oauth",
+      model: cliOnboardModel(options),
+      channel: options.channel,
+      ...options.ownerId ? { ownerId: options.ownerId } : {},
+      ...options.telegramUserId ? { telegramUserId: options.telegramUserId } : {}
+    })
   ];
   const fatalBlockers = blockers.filter((blocker) => blocker.startsWith("Missing ") || blocker.startsWith("Provider configure failed") || blocker.startsWith("Telegram configure failed"));
   return {
@@ -58973,7 +59463,11 @@ async function createCliOnboardRootPayload(options, env = process.env, dependenc
       writesWorkspaceFiles: workspaceSeed?.sideEffects.writesFiles ?? false,
       writesRuntimeConfig: cliOnboardConfigWrites(providerConfig) || cliOnboardConfigWrites(telegramConfig),
       storesLocalSecrets: cliOnboardStoresSecrets(providerConfig) || cliOnboardStoresSecrets(telegramConfig),
+      opensBrowser: false,
+      startsLocalCallbackServer: false,
+      runsExternalCodexLogin: false,
       callsProviderTokenEndpoint: false,
+      callsTelegramGetMeEndpoint: false,
       callsModelProvider: false,
       pollsTelegram: false,
       sendsTelegram: false,
@@ -59009,13 +59503,20 @@ function renderCliOnboardRootText(payload) {
     "configured artifacts:",
     `- workspace seed applied: ${payload.setup.workspaceSeed?.mode === "applied"}`,
     `- provider config written: ${cliOnboardConfigWrites(payload.setup.providerConfig)}`,
+    `- provider oauth login: ${payload.setup.providerAuth?.ok === true}`,
     `- telegram config written: ${cliOnboardConfigWrites(payload.setup.telegramConfig)}`,
+    `- telegram validation: ${payload.setup.telegramValidation ? payload.setup.telegramValidation.ok ? "valid" : "blocked" : "not-run"}`,
+    `- codex login ran: ${payload.setup.codexLogin?.attempted === true}`,
     "",
     "bounds:",
     `- workspace files written: ${payload.sideEffects.writesWorkspaceFiles}`,
     `- runtime config written: ${payload.sideEffects.writesRuntimeConfig}`,
     `- local secrets stored: ${payload.sideEffects.storesLocalSecrets}`,
+    `- browser opened: ${payload.sideEffects.opensBrowser}`,
+    `- local callback server started: ${payload.sideEffects.startsLocalCallbackServer}`,
+    `- external codex login ran: ${payload.sideEffects.runsExternalCodexLogin}`,
     `- provider token endpoint called: ${payload.sideEffects.callsProviderTokenEndpoint}`,
+    `- telegram getMe called: ${payload.sideEffects.callsTelegramGetMeEndpoint}`,
     `- model provider called: ${payload.sideEffects.callsModelProvider}`,
     `- telegram polled: ${payload.sideEffects.pollsTelegram}`,
     `- telegram sent: ${payload.sideEffects.sendsTelegram}`,
@@ -60060,7 +60561,11 @@ async function runCli(args = Bun.argv.slice(2), writeLine = console.log, env = p
   }
   if (command === "onboard") {
     if (!args[1] || args[1].startsWith("--")) {
-      const result = await renderCliOnboardRoot(args.slice(1), env, dependencies.onboard);
+      const result = await renderCliOnboardRoot(args.slice(1), env, {
+        ...dependencies.onboard,
+        ...dependencies.providerAuth ? { providerAuth: dependencies.providerAuth } : {},
+        ...dependencies.telegram ? { telegram: dependencies.telegram } : {}
+      });
       writeLine(result.text);
       if (result.exitCode !== 0) {
         writeLine(renderCliHelp());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rizzmyrobot/mochi-cli",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "type": "module",
   "license": "Apache-2.0",
   "repository": {