bosun 0.36.2 → 0.36.4

package/setup.mjs

@@ -53,7 +53,7 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 
 const isNonInteractive =
   process.argv.includes("--non-interactive") || process.argv.includes("-y");
-const SETUP_TOTAL_STEPS = 10;
+const SETUP_TOTAL_STEPS = 9;
 
 // ── Zero-dependency terminal styling (replaces chalk) ────────────────────────
 const isTTY = process.stdout.isTTY;
@@ -1765,8 +1765,14 @@ function applyTelegramMiniAppDefaults(env, sourceEnv = process.env) {
     env.TELEGRAM_UI_PORT || sourceEnv.TELEGRAM_UI_PORT,
   );
 
+  // Default tunnel mode: if named tunnel credentials are present, use "named";
+  // otherwise fall back to "quick" so the UI works out-of-the-box without setup.
   if (!env.TELEGRAM_UI_TUNNEL && !sourceEnv.TELEGRAM_UI_TUNNEL) {
-    env.TELEGRAM_UI_TUNNEL = "named";
+    const hasNamedCreds = !!(
+      (env.CLOUDFLARE_TUNNEL_NAME || sourceEnv.CLOUDFLARE_TUNNEL_NAME) &&
+      (env.CLOUDFLARE_TUNNEL_CREDENTIALS || sourceEnv.CLOUDFLARE_TUNNEL_CREDENTIALS)
+    );
+    env.TELEGRAM_UI_TUNNEL = hasNamedCreds ? "named" : "quick";
   }
   if (!env.TELEGRAM_UI_ALLOW_UNSAFE && !sourceEnv.TELEGRAM_UI_ALLOW_UNSAFE) {
     env.TELEGRAM_UI_ALLOW_UNSAFE = "false";
@@ -1775,7 +1781,10 @@ function applyTelegramMiniAppDefaults(env, sourceEnv = process.env) {
     !env.TELEGRAM_UI_ALLOW_QUICK_TUNNEL_FALLBACK
     && !sourceEnv.TELEGRAM_UI_ALLOW_QUICK_TUNNEL_FALLBACK
   ) {
-    env.TELEGRAM_UI_ALLOW_QUICK_TUNNEL_FALLBACK = "false";
+    // Allow quick tunnel as fallback by default so named-tunnel failures don't
+    // silently kill the UI. Users who explicitly set "named" during --setup will
+    // have this set to "false" by the wizard if credentials were provided.
+    env.TELEGRAM_UI_ALLOW_QUICK_TUNNEL_FALLBACK = "true";
   }
   if (
     !env.TELEGRAM_UI_FALLBACK_AUTH_ENABLED
@@ -1923,7 +1932,7 @@ function normalizeSetupConfiguration({
     "auto",
   );
   env.VOICE_MODEL =
-    env.VOICE_MODEL || "gpt-4o-realtime-preview-2024-12-17";
+    env.VOICE_MODEL || "gpt-realtime-1.5";
   env.VOICE_VISION_MODEL =
     env.VOICE_VISION_MODEL || "gpt-4.1-mini";
   env.VOICE_ID = normalizeEnum(
@@ -1965,7 +1974,7 @@ function normalizeSetupConfiguration({
     env.PRIMARY_AGENT || "codex-sdk",
   );
   env.AZURE_OPENAI_REALTIME_DEPLOYMENT =
-    env.AZURE_OPENAI_REALTIME_DEPLOYMENT || "gpt-4o-realtime-preview";
+    env.AZURE_OPENAI_REALTIME_DEPLOYMENT || "gpt-realtime-1.5";
 
   env.CODEX_MODEL_PROFILE = normalizeEnum(
     env.CODEX_MODEL_PROFILE,
@@ -3288,7 +3297,7 @@ async function main() {
       );
       env.VOICE_MODEL = await prompt.ask(
         "Realtime voice model",
-        process.env.VOICE_MODEL || "gpt-4o-realtime-preview-2024-12-17",
+        process.env.VOICE_MODEL || "gpt-realtime-1.5",
       );
       env.VOICE_VISION_MODEL = await prompt.ask(
         "Vision model for camera/screen analysis",
@@ -3323,7 +3332,7 @@ async function main() {
         );
         env.AZURE_OPENAI_REALTIME_DEPLOYMENT = await prompt.ask(
           "Azure Realtime deployment (AZURE_OPENAI_REALTIME_DEPLOYMENT)",
-          process.env.AZURE_OPENAI_REALTIME_DEPLOYMENT || "gpt-4o-realtime-preview",
+          process.env.AZURE_OPENAI_REALTIME_DEPLOYMENT || "gpt-realtime-1.5",
         );
       }
       if (env.VOICE_PROVIDER === "claude" && !env.ANTHROPIC_API_KEY) {
@@ -3579,6 +3588,154 @@ async function main() {
         }
       }
     }
+
+    // ── Sub-step 6b: Web UI / Telegram Mini App / Cloudflare Tunnel ──────────
+    const hasTelegramToken = !!(env.TELEGRAM_BOT_TOKEN || process.env.TELEGRAM_BOT_TOKEN);
+    if (hasTelegramToken) {
+      console.log();
+      console.log(chalk.bold("  Web UI & Telegram Mini App"));
+      console.log(
+        chalk.dim("  Bosun includes a browser-based dashboard that can open inside Telegram\n") +
+        chalk.dim("  as a Mini App. External HTTPS access is provided via a Cloudflare tunnel\n") +
+        chalk.dim("  (cloudflared). Without the tunnel, the UI is LAN-only.\n"),
+      );
+
+      const wantWebUi = await prompt.confirm(
+        "Enable browser Web UI / Telegram Mini App?",
+        true,
+      );
+
+      if (!wantWebUi) {
+        env.TELEGRAM_MINIAPP_ENABLED = "false";
+        env.TELEGRAM_UI_TUNNEL = "disabled";
+        info("Web UI disabled. Re-run setup or add TELEGRAM_MINIAPP_ENABLED=true to .env to enable later.");
+      } else {
+        env.TELEGRAM_MINIAPP_ENABLED = "true";
+        env.TELEGRAM_UI_PORT = normalizeTelegramUiPort(
+          env.TELEGRAM_UI_PORT || process.env.TELEGRAM_UI_PORT,
+        );
+        env.TELEGRAM_UI_ALLOW_UNSAFE = "false";
+
+        console.log();
+        const tunnelModeIdx = await prompt.choose(
+          "How should the Web UI be exposed externally?",
+          [
+            "Quick tunnel  — ephemeral trycloudflare.com URL (simplest, no account needed)",
+            "Named tunnel  — permanent custom URL (requires Cloudflare account + credentials)",
+            "LAN only      — local network access only, no public tunnel",
+          ],
+          0,
+        );
+
+        if (tunnelModeIdx === 0) {
+          // ── Quick tunnel ──────────────────────────────────────────────────
+          env.TELEGRAM_UI_TUNNEL = "quick";
+          env.TELEGRAM_UI_ALLOW_QUICK_TUNNEL_FALLBACK = "true";
+          info("✓ Quick tunnel selected — a trycloudflare.com URL will appear on startup.");
+          console.log(chalk.dim("  The URL changes on restart. Install cloudflared if not already present:"));
+          console.log(chalk.dim("    https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/"));
+
+        } else if (tunnelModeIdx === 1) {
+          // ── Named tunnel ──────────────────────────────────────────────────
+          env.TELEGRAM_UI_TUNNEL = "named";
+
+          console.log();
+          console.log(chalk.bold("  Named Tunnel Setup"));
+          console.log(
+            chalk.dim("  Prerequisites:\n") +
+            chalk.dim("    1. Cloudflare account with a registered domain\n") +
+            chalk.dim("    2. cloudflared CLI installed:\n") +
+            chalk.dim("         https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/\n") +
+            chalk.dim("    3. Run:  cloudflared tunnel login\n") +
+            chalk.dim("    4. Run:  cloudflared tunnel create <your-tunnel-name>\n") +
+            chalk.dim("    5. Copy the credentials JSON path shown (e.g. ~/.cloudflared/<uuid>.json)\n"),
+          );
+
+          const hasCredsReady = await prompt.confirm(
+            "Do you have your tunnel credentials file ready?",
+            false,
+          );
+
+          if (hasCredsReady) {
+            env.CLOUDFLARE_TUNNEL_NAME = await prompt.ask(
+              "Tunnel name  (from: cloudflared tunnel create <name>)",
+              process.env.CLOUDFLARE_TUNNEL_NAME || "",
+            );
+            env.CLOUDFLARE_TUNNEL_CREDENTIALS = await prompt.ask(
+              "Credentials file path  (e.g. ~/.cloudflared/<uuid>.json)",
+              process.env.CLOUDFLARE_TUNNEL_CREDENTIALS || "",
+            );
+            env.CLOUDFLARE_BASE_DOMAIN = await prompt.ask(
+              "Your Cloudflare domain  (e.g. example.com — used for auto hostname)",
+              process.env.CLOUDFLARE_BASE_DOMAIN || "",
+            );
+
+            if (isAdvancedSetup) {
+              const explicitHostname = await prompt.ask(
+                "Custom hostname (leave blank for auto: bosun-<username>.<domain>)",
+                process.env.CLOUDFLARE_TUNNEL_HOSTNAME || "",
+              );
+              if (explicitHostname) {
+                env.CLOUDFLARE_TUNNEL_HOSTNAME = explicitHostname;
+              }
+
+              const cfApiToken = await prompt.ask(
+                "Cloudflare API token for DNS auto-sync (optional — leave blank to skip)",
+                process.env.CLOUDFLARE_API_TOKEN || "",
+              );
+              if (cfApiToken) {
+                env.CLOUDFLARE_API_TOKEN = cfApiToken;
+                env.CLOUDFLARE_DNS_SYNC_ENABLED = "true";
+                const cfZoneId = await prompt.ask(
+                  "Cloudflare Zone ID  (from your domain's Overview page)",
+                  process.env.CLOUDFLARE_ZONE_ID || "",
+                );
+                if (cfZoneId) env.CLOUDFLARE_ZONE_ID = cfZoneId;
+              }
+            }
+
+            const hasNameAndCreds = env.CLOUDFLARE_TUNNEL_NAME && env.CLOUDFLARE_TUNNEL_CREDENTIALS;
+            if (hasNameAndCreds) {
+              env.TELEGRAM_UI_ALLOW_QUICK_TUNNEL_FALLBACK = "false";
+              info("✓ Named tunnel configured.");
+              if (!env.CLOUDFLARE_BASE_DOMAIN && !process.env.CLOUDFLARE_BASE_DOMAIN) {
+                warn("No base domain set — hostname auto-resolution will fail. Set CLOUDFLARE_BASE_DOMAIN in .env.");
+              }
+            } else {
+              warn("Tunnel name or credentials path missing — enabling quick tunnel as fallback.");
+              warn("Add CLOUDFLARE_TUNNEL_NAME + CLOUDFLARE_TUNNEL_CREDENTIALS to .env to activate named tunnel.");
+              env.TELEGRAM_UI_ALLOW_QUICK_TUNNEL_FALLBACK = "true";
+            }
+          } else {
+            warn("No problem! Add these to .env when ready:");
+            console.log(chalk.cyan("  CLOUDFLARE_TUNNEL_NAME=<tunnel-name>"));
+            console.log(chalk.cyan("  CLOUDFLARE_TUNNEL_CREDENTIALS=~/.cloudflared/<uuid>.json"));
+            console.log(chalk.cyan("  CLOUDFLARE_BASE_DOMAIN=example.com"));
+            console.log();
+            warn("Enabling quick tunnel as fallback until named tunnel credentials are in .env.");
+            env.TELEGRAM_UI_ALLOW_QUICK_TUNNEL_FALLBACK = "true";
+          }
+
+        } else {
+          // ── LAN only ──────────────────────────────────────────────────────
+          env.TELEGRAM_UI_TUNNEL = "disabled";
+          const lanPort = env.TELEGRAM_UI_PORT || "3080";
+          info(`LAN-only mode — Web UI will be accessible at https://localhost:${lanPort}`);
+          info("Note: Telegram Mini App requires an external HTTPS URL and will not work in LAN-only mode.");
+          env.TELEGRAM_MINIAPP_ENABLED = "false";
+        }
+
+        if (isAdvancedSetup && tunnelModeIdx < 2) {
+          console.log();
+          const customPort = await prompt.ask(
+            "Web UI port",
+            String(env.TELEGRAM_UI_PORT || process.env.TELEGRAM_UI_PORT || "3080"),
+          );
+          env.TELEGRAM_UI_PORT = customPort || env.TELEGRAM_UI_PORT || "3080";
+        }
+      }
+    } // end sub-step 6b
+
     saveSetupSnapshot(6, "Telegram Notifications", env, configJson);
     } // end step 6
 
@@ -5277,74 +5434,142 @@ async function main() {
     saveSetupSnapshot(8, "Optional Channels", env, configJson);
     } // end step 8
 
-    // ── Step 9: Desktop Shortcut ──────────────────────────
+    // ── Step 9: Running Mode ──────────────────────────────
     if (resumeFromStep > 9) {
       info(`Skipping step 9 (restored from previous run).`);
     } else {
-    headingStepWithSnapshot(9, "Desktop Shortcut");
+    headingStepWithSnapshot(9, "Running Mode");
 
+    const {
+      getStartupStatus,
+      getStartupMethodName,
+    } = await import("./startup-service.mjs");
     const {
       getDesktopShortcutStatus,
       getDesktopShortcutMethodName,
+      resolveElectronLauncher,
     } = await import("./desktop-shortcut.mjs");
-    const currentDesktopShortcut = getDesktopShortcutStatus();
+
+    const currentStartup = getStartupStatus();
+    const methodName = getStartupMethodName();
     const desktopMethod = getDesktopShortcutMethodName();
+    const shortcutSupported = desktopMethod !== "unsupported";
+    const currentShortcut = getDesktopShortcutStatus();
+    const electronLauncher = resolveElectronLauncher();
+    const hasElectron = Boolean(electronLauncher?.executable);
+
+    let skipRunningModeConfig = false;
+    const alreadyConfigured = currentStartup.installed || currentShortcut.installed;
+    if (alreadyConfigured) {
+      if (currentStartup.installed) {
+        info(`Background service already registered (${currentStartup.method}).`);
+      }
+      if (currentShortcut.installed) {
+        info(`Desktop shortcut already installed (${currentShortcut.method}).`);
+      }
+      const change = await prompt.confirm("Change the running mode?", false);
+      if (!change) {
+        env._DESKTOP_SHORTCUT = "skip";
+        env._STARTUP_SERVICE = "skip";
+        env.BOSUN_SENTINEL_AUTO_START = env.BOSUN_SENTINEL_AUTO_START || "false";
+        env._RUNNING_MODE = "skip";
+        env._START_AFTER_SETUP = "0";
+        env._OPEN_PORTAL_AFTER_SETUP = "0";
+        skipRunningModeConfig = true;
+      }
+    }
 
-    if (desktopMethod === "unsupported") {
-      info("Desktop shortcut not supported on this OS.");
-      env._DESKTOP_SHORTCUT = "0";
-    } else if (currentDesktopShortcut.installed) {
-      info(`Desktop shortcut already installed (${currentDesktopShortcut.method}).`);
-      const reinstall = await prompt.confirm(
-        "Re-install desktop shortcut?",
-        false,
-      );
-      env._DESKTOP_SHORTCUT = reinstall ? "1" : "skip";
-    } else {
+    if (!skipRunningModeConfig) {
+      console.log();
+      console.log(chalk.bold("  How should Bosun run on this machine?"));
+      console.log();
+      console.log(chalk.cyan("  0  ·  Manual"));
+      console.log(chalk.dim("       Start bosun yourself from a terminal whenever you need it."));
+      console.log(chalk.dim("       Best for: CI servers, development, occasional use, SSH hosts."));
+      console.log();
       console.log(
-        chalk.dim(`  Add a desktop shortcut using ${desktopMethod}.`),
+        chalk.cyan("  1  ·  Quick Launch") +
+        (shortcutSupported
+          ? chalk.dim(`  (${desktopMethod})`)
+          : chalk.dim("  — shortcut unavailable on this OS")),
       );
-      const enableDesktopShortcut = await prompt.confirm(
-        "Create desktop shortcut for Bosun Portal?",
-        true,
+      console.log(chalk.dim("       Adds a desktop shortcut for one-click launch of the Bosun portal."));
+      console.log(chalk.dim("       Bosun does not start automatically — you open it when you need it."));
+      console.log();
+      console.log(chalk.cyan("  2  ·  Background Service") + chalk.dim("  ← recommended"));
+      console.log(chalk.dim(`       Registers with ${methodName} to auto-start at login.`));
+      console.log(chalk.dim("       Starts silently in the background. If it crashes, the OS restarts it."));
+      console.log(chalk.dim("       Creates a desktop shortcut to open the portal UI anytime."));
+      console.log();
+      console.log(chalk.cyan("  3  ·  Sentinel Mode") + chalk.dim("  (maximum uptime)"));
+      console.log(chalk.dim("       Like Background Service, plus a Node-level watchdog that"));
+      console.log(chalk.dim("       continuously monitors Bosun and revives it if it becomes unresponsive."));
+      console.log(chalk.dim("       Ideal for always-on teams who depend on zero downtime."));
+      console.log();
+
+      const defaultModeIdx = 2;
+      const modeIdx = await prompt.choose(
+        "Select running mode:",
+        [
+          "Manual           — run from terminal when needed",
+          "Quick Launch     — desktop shortcut, no auto-start",
+          "Background       — auto-start at login via OS service (auto-restart on crash)",
+          "Sentinel         — background + Node watchdog for maximum uptime",
+        ],
+        defaultModeIdx,
       );
-      env._DESKTOP_SHORTCUT = enableDesktopShortcut ? "1" : "0";
-    }
-    saveSetupSnapshot(9, "Desktop Shortcut", env, configJson);
-    } // end step 9
 
-    // ── Step 10: Startup Service ───────────────────────────
-    headingStepWithSnapshot(10, "Startup Service");
+      if (modeIdx === 0) {
+        // Manual: no shortcut, no service
+        env._DESKTOP_SHORTCUT = "0";
+        env._STARTUP_SERVICE = "0";
+        env.BOSUN_SENTINEL_AUTO_START = "false";
+      } else if (modeIdx === 1) {
+        // Quick Launch: shortcut only
+        env._DESKTOP_SHORTCUT = shortcutSupported ? "1" : "0";
+        env._STARTUP_SERVICE = "0";
+        env.BOSUN_SENTINEL_AUTO_START = "false";
+      } else if (modeIdx === 2) {
+        // Background Service: OS-managed auto-start + shortcut
+        env._DESKTOP_SHORTCUT = shortcutSupported ? "1" : "0";
+        env._STARTUP_SERVICE = "1";
+        env.BOSUN_SENTINEL_AUTO_START = "false";
+      } else {
+        // Sentinel Mode: background + sentinel watchdog + shortcut
+        env._DESKTOP_SHORTCUT = shortcutSupported ? "1" : "0";
+        env._STARTUP_SERVICE = "1";
+        env.BOSUN_SENTINEL_AUTO_START = "true";
+      }
 
-    const { getStartupStatus, getStartupMethodName } =
-      await import("./startup-service.mjs");
-    const currentStartup = getStartupStatus();
-    const methodName = getStartupMethodName();
+      env._RUNNING_MODE = String(modeIdx);
 
-    if (currentStartup.installed) {
-      info(`Startup service already installed via ${currentStartup.method}.`);
-      const reinstall = await prompt.confirm(
-        "Re-install startup service?",
-        false,
-      );
-      env._STARTUP_SERVICE = reinstall ? "1" : "skip";
-    } else {
-      console.log(
-        chalk.dim(
-          `  Auto-start bosun when you log in using ${methodName}.`,
-        ),
-      );
-      console.log(
-        chalk.dim(
-          "  It will run in daemon mode (background) with auto-restart on failure.",
-        ),
-      );
-      const enableStartup = await prompt.confirm(
-        "Enable auto-start on login?",
-        true,
-      );
-      env._STARTUP_SERVICE = enableStartup ? "1" : "0";
+      // ── Post-setup launch options (background/sentinel modes only) ────
+      if (modeIdx >= 2) {
+        console.log();
+        console.log(chalk.dim("  Bosun will auto-start on your next login."));
+        const startNow = await prompt.confirm(
+          "Start Bosun in the background right after setup completes?",
+          true,
+        );
+        env._START_AFTER_SETUP = startNow ? "1" : "0";
+        if (startNow && hasElectron) {
+          const openPortal = await prompt.confirm(
+            "Also open the Bosun desktop portal once Bosun has started?",
+            false,
+          );
+          env._OPEN_PORTAL_AFTER_SETUP = openPortal ? "1" : "0";
+        } else {
+          env._OPEN_PORTAL_AFTER_SETUP = "0";
+        }
+      } else {
+        env._START_AFTER_SETUP = "0";
+        env._OPEN_PORTAL_AFTER_SETUP = "0";
+      }
     }
+
+    saveSetupSnapshot(9, "Running Mode", env, configJson);
+    } // end step 9
+
   } finally {
     prompt.close();
   }
@@ -5424,7 +5649,7 @@ async function runNonInteractive({
   env.VOICE_ENABLED = process.env.VOICE_ENABLED || "true";
   env.VOICE_PROVIDER = process.env.VOICE_PROVIDER || "auto";
   env.VOICE_MODEL =
-    process.env.VOICE_MODEL || "gpt-4o-realtime-preview-2024-12-17";
+    process.env.VOICE_MODEL || "gpt-realtime-1.5";
   env.VOICE_VISION_MODEL = process.env.VOICE_VISION_MODEL || "gpt-4.1-mini";
   env.OPENAI_REALTIME_API_KEY = process.env.OPENAI_REALTIME_API_KEY || "";
   env.AZURE_OPENAI_REALTIME_ENDPOINT =
@@ -5432,7 +5657,7 @@ async function runNonInteractive({
   env.AZURE_OPENAI_REALTIME_API_KEY =
     process.env.AZURE_OPENAI_REALTIME_API_KEY || "";
   env.AZURE_OPENAI_REALTIME_DEPLOYMENT =
-    process.env.AZURE_OPENAI_REALTIME_DEPLOYMENT || "gpt-4o-realtime-preview";
+    process.env.AZURE_OPENAI_REALTIME_DEPLOYMENT || "gpt-realtime-1.5";
   env.VOICE_ID = process.env.VOICE_ID || "alloy";
   env.VOICE_TURN_DETECTION = process.env.VOICE_TURN_DETECTION || "server_vad";
   env.VOICE_FALLBACK_MODE = process.env.VOICE_FALLBACK_MODE || "browser";
@@ -5624,27 +5849,52 @@ async function runNonInteractive({
   };
   printHookScaffoldSummary(hookResult);
 
-  // Startup service: respect STARTUP_SERVICE env in non-interactive mode
-  if (parseBooleanEnvValue(process.env.STARTUP_SERVICE, false)) {
-    env._STARTUP_SERVICE = "1";
-  } else if (
-    process.env.STARTUP_SERVICE !== undefined &&
-    !parseBooleanEnvValue(process.env.STARTUP_SERVICE, true)
-  ) {
-    env._STARTUP_SERVICE = "0";
-  }
-  // else: don't set — writeConfigFiles will skip silently
-
-  // Desktop shortcut: respect DESKTOP_SHORTCUT env in non-interactive mode
-  const desktopShortcutEnv =
-    process.env.DESKTOP_SHORTCUT ?? process.env.BOSUN_DESKTOP_SHORTCUT;
-  if (parseBooleanEnvValue(desktopShortcutEnv, false)) {
-    env._DESKTOP_SHORTCUT = "1";
-  } else if (
-    desktopShortcutEnv !== undefined &&
-    !parseBooleanEnvValue(desktopShortcutEnv, true)
-  ) {
-    env._DESKTOP_SHORTCUT = "0";
+  // Running mode: RUNNING_MODE=0|1|2|3 sets startup+shortcut+sentinel together.
+  // 0=Manual  1=Quick Launch (shortcut only)  2=Background Service  3=Sentinel
+  // Individual STARTUP_SERVICE / DESKTOP_SHORTCUT env vars still work as legacy overrides.
+  const runningModeRaw = process.env.RUNNING_MODE ?? process.env.BOSUN_RUNNING_MODE;
+  if (runningModeRaw !== undefined) {
+    const modeIdx = parseInt(runningModeRaw, 10);
+    if (modeIdx === 0) {
+      env._DESKTOP_SHORTCUT = "0";
+      env._STARTUP_SERVICE = "0";
+      env.BOSUN_SENTINEL_AUTO_START = env.BOSUN_SENTINEL_AUTO_START || "false";
+    } else if (modeIdx === 1) {
+      env._DESKTOP_SHORTCUT = "1";
+      env._STARTUP_SERVICE = "0";
+      env.BOSUN_SENTINEL_AUTO_START = env.BOSUN_SENTINEL_AUTO_START || "false";
+    } else if (modeIdx === 2) {
+      env._DESKTOP_SHORTCUT = "1";
+      env._STARTUP_SERVICE = "1";
+      env.BOSUN_SENTINEL_AUTO_START = env.BOSUN_SENTINEL_AUTO_START || "false";
+    } else if (modeIdx === 3) {
+      env._DESKTOP_SHORTCUT = "1";
+      env._STARTUP_SERVICE = "1";
+      env.BOSUN_SENTINEL_AUTO_START = "true";
+    }
+  } else {
+    // Legacy: individual env vars still supported
+    if (parseBooleanEnvValue(process.env.STARTUP_SERVICE, false)) {
+      env._STARTUP_SERVICE = "1";
+    } else if (
+      process.env.STARTUP_SERVICE !== undefined &&
+      !parseBooleanEnvValue(process.env.STARTUP_SERVICE, true)
+    ) {
+      env._STARTUP_SERVICE = "0";
+    }
+    // else: don't set — writeConfigFiles will skip silently
+
+    // Desktop shortcut: respect DESKTOP_SHORTCUT env in non-interactive mode
+    const desktopShortcutEnv =
+      process.env.DESKTOP_SHORTCUT ?? process.env.BOSUN_DESKTOP_SHORTCUT;
+    if (parseBooleanEnvValue(desktopShortcutEnv, false)) {
+      env._DESKTOP_SHORTCUT = "1";
+    } else if (
+      desktopShortcutEnv !== undefined &&
+      !parseBooleanEnvValue(desktopShortcutEnv, true)
+    ) {
+      env._DESKTOP_SHORTCUT = "0";
+    }
   }
 
   if (
@@ -5916,10 +6166,53 @@ async function writeConfigFiles({ env, configJson, repoRoot, configDir }) {
     }
   } else if (env._STARTUP_SERVICE === "0") {
     info(
-      "Startup service skipped — enable anytime: bosun --enable-startup",
+      "Startup service skipped — enable anytime: bosun --setup",
     );
   }
 
+  // ── Start Bosun Now ────────────────────────────────────
+  if (env._START_AFTER_SETUP === "1") {
+    heading("Starting Bosun");
+    try {
+      const { spawn: _spawn } = await import("child_process");
+      const cliPath = resolve(__dirname, "cli.mjs");
+      const daemonChild = _spawn(
+        process.execPath,
+        [cliPath, "--daemon"],
+        {
+          detached: true,
+          stdio: "ignore",
+          cwd: __dirname,
+          windowsHide: true,
+        },
+      );
+      daemonChild.unref();
+      success("Bosun started in background (daemon mode)");
+      info("Check status:  bosun --daemon-status");
+      info("View logs:     bosun --logs");
+      if (env._OPEN_PORTAL_AFTER_SETUP === "1") {
+        const { resolveElectronLauncher: _getLauncher } =
+          await import("./desktop-shortcut.mjs");
+        const launcher = _getLauncher();
+        if (launcher?.executable) {
+          const portalChild = _spawn(
+            launcher.executable,
+            launcher.args || [],
+            { detached: true, stdio: "ignore", windowsHide: false },
+          );
+          portalChild.unref();
+          success("Bosun portal is opening...");
+        } else {
+          warn("Electron not found — portal launch skipped.");
+          info("Open the portal manually: bosun --desktop");
+        }
+      }
+    } catch (err) {
+      warn(`Could not start Bosun: ${err.message}`);
+      info("Start manually: bosun --daemon");
+    }
+  }
+
   // ── Summary ────────────────────────────────────────────
   console.log("");
   console.log(
@@ -5985,7 +6278,7 @@ async function writeConfigFiles({ env, configJson, repoRoot, configDir }) {
   console.log(chalk.green("    bosun --setup"));
   console.log(chalk.dim("    Re-run this wizard anytime\n"));
   console.log(chalk.green("    bosun --enable-startup"));
-  console.log(chalk.dim("    Register auto-start on login\n"));
+  console.log(chalk.dim("    Register auto-start on login (or use bosun --setup for the full wizard)\n"));
   console.log(chalk.green("    bosun --help"));
   console.log(chalk.dim("    See all options & env vars\n"));
 }

package/startup-service.mjs

@@ -474,6 +474,18 @@ function generateLaunchdPlist({ daemon = true } = {}) {
 
   const argsXml = args.map((a) => `        <string>${a}</string>`).join("\n");
 
+  // Include Homebrew paths for both Apple Silicon (/opt/homebrew) and Intel (/usr/local)
+  const pathValue = [
+    `${home}/.local/bin`,
+    "/opt/homebrew/bin",
+    "/opt/homebrew/sbin",
+    "/usr/local/bin",
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin",
+  ].join(":");
+
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -495,12 +507,16 @@ ${argsXml}
     </dict>
     <key>ThrottleInterval</key>
     <integer>30</integer>
+    <key>AbandonProcessGroup</key>
+    <true/>
     <key>EnvironmentVariables</key>
     <dict>
         <key>PATH</key>
-        <string>${home}/.local/bin:/usr/local/bin:/usr/bin:/bin</string>
+        <string>${pathValue}</string>
         <key>HOME</key>
         <string>${home}</string>
+        <key>NODE_ENV</key>
+        <string>production</string>
     </dict>
     <key>StandardOutPath</key>
     <string>${logDir}/startup.log</string>
@@ -515,16 +531,36 @@ async function installMacOS(options = {}) {
   const plistContent = generateLaunchdPlist(options);
 
   try {
-    // Unload existing agent if present
+    // Unload/bootout existing agent if present
     try {
-      execSync(`launchctl unload "${plistPath}"`, { stdio: "ignore" });
+      // Try modern bootout first (macOS 10.11+), fall back to legacy unload
+      const uid = process.getuid?.() ?? "";
+      if (uid !== "") {
+        execSync(`launchctl bootout gui/${uid} "${plistPath}" 2>/dev/null || launchctl unload "${plistPath}" 2>/dev/null`, { stdio: "ignore", shell: true });
+      } else {
+        execSync(`launchctl unload "${plistPath}"`, { stdio: "ignore" });
+      }
     } catch {
-      /* ok */
+      /* ok — agent may not be loaded */
     }
 
     mkdirSync(dirname(plistPath), { recursive: true });
     writeFileSync(plistPath, plistContent, "utf8");
-    execSync(`launchctl load "${plistPath}"`, { stdio: "pipe" });
+
+    // Prefer modern bootstrap domain (macOS 10.11+); fall back to legacy load
+    let loaded = false;
+    try {
+      const uid = process.getuid?.() ?? "";
+      if (uid !== "") {
+        execSync(`launchctl bootstrap gui/${uid} "${plistPath}"`, { stdio: "pipe" });
+        loaded = true;
+      }
+    } catch {
+      /* fall through to legacy load */
+    }
+    if (!loaded) {
+      execSync(`launchctl load "${plistPath}"`, { stdio: "pipe" });
+    }
 
     return {
       success: true,
@@ -595,7 +631,16 @@ async function removeMacOS() {
   const plistPath = getLaunchdPlistPath();
   try {
     try {
-      execSync(`launchctl unload "${plistPath}"`, { stdio: "ignore" });
+      // Prefer modern bootout; fall back to legacy unload
+      const uid = process.getuid?.() ?? "";
+      if (uid !== "") {
+        execSync(
+          `launchctl bootout gui/${uid} "${plistPath}" 2>/dev/null || launchctl unload "${plistPath}" 2>/dev/null`,
+          { stdio: "ignore", shell: true },
+        );
+      } else {
+        execSync(`launchctl unload "${plistPath}"`, { stdio: "ignore" });
+      }
     } catch {
       /* ok */
     }