idlewatch 0.1.2 → 0.1.4

package/README.md

@@ -17,7 +17,7 @@ npx idlewatch quickstart
 npx idlewatch --dry-run
 ```
 
-`quickstart` runs a first-run setup wizard that writes a local env file and (for production mode) stores a locked-down copy of the service-account key under `~/.idlewatch/`. On hosts with Rust/Cargo available, quickstart launches a ratatui-powered onboarding flow first; otherwise it falls back to the text wizard.
+`quickstart` is the happy path: create an API key on idlewatch.com/api, run the wizard, pick a device name + metrics, and IdleWatch saves local config before sending a first sample. By default, quickstart will try to install Rust/Cargo automatically if needed so it can launch the ratatui onboarding flow. Use `idlewatch quickstart --no-tui` to skip the TUI and stay on the plain text setup path without installing Cargo.
 
 ## CLI options
 
@@ -49,26 +49,30 @@ Use `gpuSource` + `gpuConfidence` in dashboards to decide whether to trust value
 - `low`: constrained probe path
 - `none`: no usable sample for that sample window
 
-## Firebase wiring
+## Quickstart
 
-### Recommended: guided enrollment (external users)
+### Recommended: guided enrollment
 
 ```bash
 npx idlewatch quickstart
 ```
 
-The wizard supports:
-- **Production mode**: prompts for project id + service-account JSON file path, validates it, copies credentials to a local secure path (0600), and writes `FIREBASE_SERVICE_ACCOUNT_FILE=...`.
-- **Emulator mode**: writes `FIREBASE_PROJECT_ID` + `FIRESTORE_EMULATOR_HOST` only.
-- **Local-only mode**: writes no Firebase credentials.
+The wizard keeps setup small:
+- asks for a **device name**
+- asks for your **API key** from `idlewatch.com/api`
+- lets you choose which **metrics** to collect
+- saves local config to `~/.idlewatch/idlewatch.env`
+- sends a first sample so the device can link right away
 
-Then run a one-shot publish check:
+The saved config is auto-loaded on later runs, so you should not need to manually source the env file in normal use.
+
+Then run a one-shot publish check any time with:
 
 ```bash
 idlewatch --once
 ```
 
-The saved config is auto-loaded from `~/.idlewatch/idlewatch.env`, so you should not need to manually source the env file in normal use.
+## Advanced Firebase wiring
 
 ### Manual wiring
 

package/bin/idlewatch-agent.js

@@ -18,7 +18,7 @@ import { enrichWithOpenClawFleetTelemetry } from '../src/telemetry-mapping.js'
 import pkg from '../package.json' with { type: 'json' }
 
 function printHelp() {
-  console.log(`idlewatch\n\nUsage:\n  idlewatch [quickstart|configure|dashboard|run] [--dry-run] [--once] [--help]\n\nOptions:\n  quickstart  Run first-run setup TUI and save local IdleWatch config\n  configure   Alias for quickstart; reopen setup to change device name, API key, or metrics\n  dashboard   Launch local dashboard from local IdleWatch logs\n  run         Start the background collector using saved local config\n  --dry-run   Collect and print one telemetry sample, then exit without cloud/Firebase writes\n  --once      Collect and publish one telemetry sample, then exit\n  --help      Show this help message\n\nEnvironment:\n  IDLEWATCH_HOST                     Optional custom host label (default: hostname)\n  IDLEWATCH_INTERVAL_MS              Sampling interval in ms (default: 10000)\n  IDLEWATCH_LOCAL_LOG_PATH           Optional NDJSON file path for local sample durability\n  IDLEWATCH_DASHBOARD_PORT           Local dashboard HTTP port (default: 4373)\n  IDLEWATCH_OPENCLAW_USAGE           OpenClaw usage lookup mode: auto|off (default: auto)\n  IDLEWATCH_OPENCLAW_PROBE_TIMEOUT_MS OpenClaw command timeout per probe in ms (default: 2500)\n  IDLEWATCH_OPENCLAW_PROBE_RETRIES   Extra OpenClaw probe sweep retries after first pass (default: 1)\n  IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES   Max per-command OpenClaw probe output capture in bytes before truncation (default: 2097152 / 2MB)\n  IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES_HARD_CAP  Hard cap for auto-retry output capture escalation (default: 16777216 / 16MB)\n  IDLEWATCH_USAGE_STALE_MS           Mark OpenClaw usage stale beyond this age in ms (default: max(interval*3,60000))\n  IDLEWATCH_USAGE_NEAR_STALE_MS      Mark OpenClaw usage as aging beyond this age in ms (default: floor((stale+grace)*0.85))\n  IDLEWATCH_USAGE_STALE_GRACE_MS     Extra grace window before status becomes stale (default: min(interval,10000))\n  IDLEWATCH_USAGE_REFRESH_REPROBES   Forced uncached reprobes when usage crosses stale threshold (default: 1)\n  IDLEWATCH_USAGE_REFRESH_DELAY_MS   Delay between forced stale-threshold reprobes in ms (default: 250)\n  IDLEWATCH_USAGE_REFRESH_ON_NEAR_STALE Trigger refresh when usage is near-stale: 1|0 (default: 1)\n  IDLEWATCH_USAGE_IDLE_AFTER_MS      Downgrade stale usage alerts to idle notice beyond this age in ms (default: 21600000)\n  IDLEWATCH_OPENCLAW_LAST_GOOD_MAX_AGE_MS  Reuse last successful usage snapshot after probe failures up to this age in ms\n  IDLEWATCH_OPENCLAW_LAST_GOOD_CACHE_PATH Persist/reuse last successful usage snapshot across restarts (default: ~/.idlewatch/cache/<host>-openclaw-last-good.json)\n  IDLEWATCH_REQUIRE_FIREBASE_WRITES  Require Firebase publish path in --once mode: 1|0 (default: 0)\n  FIREBASE_PROJECT_ID                Firebase project id\n  FIREBASE_SERVICE_ACCOUNT_FILE      Path to service account JSON file (preferred for production)\n  FIREBASE_SERVICE_ACCOUNT_JSON      Raw JSON service account (supported, less secure than file path)\n  FIREBASE_SERVICE_ACCOUNT_B64       Base64-encoded JSON service account (legacy)\n  FIRESTORE_EMULATOR_HOST            Optional Firestore emulator host; allows local writes without service-account creds\n  IDLEWATCH_CLOUD_INGEST_URL         Optional cloud ingest endpoint (e.g. https://idlewatch.com/api/ingest)\n  IDLEWATCH_CLOUD_API_KEY            Cloud API key from dashboard for device linking\n  IDLEWATCH_REQUIRE_CLOUD_WRITES     Require cloud publish path in --once mode: 1|0 (default: 0)\n`)
+  console.log(`idlewatch\n\nUsage:\n  idlewatch [quickstart|configure|dashboard|run] [--dry-run] [--once] [--help]\n\nOptions:\n  quickstart  Run first-run setup and save local IdleWatch config\n  configure   Alias for quickstart; reopen setup to change device name, API key, or metrics\n  dashboard   Launch local dashboard from local IdleWatch logs\n  run         Start the background collector using saved local config\n  --no-tui    Skip the Rust TUI and use plain text setup without installing Cargo\n  --dry-run   Collect and print one telemetry sample, then exit without remote writes\n  --once      Collect and publish one telemetry sample, then exit\n  --help      Show this help message\n\nQuickstart:\n  1. Create an API key on idlewatch.com/api\n  2. Run: idlewatch quickstart\n  3. Pick a device name and metrics\n  4. IdleWatch saves your local config and sends a first sample\n\nEnvironment:\n  IDLEWATCH_HOST                     Optional custom host label (default: hostname)\n  IDLEWATCH_INTERVAL_MS              Sampling interval in ms (default: 10000)\n  IDLEWATCH_LOCAL_LOG_PATH           Optional NDJSON file path for local sample durability\n  IDLEWATCH_DASHBOARD_PORT           Local dashboard HTTP port (default: 4373)\n  IDLEWATCH_OPENCLAW_USAGE           OpenClaw usage lookup mode: auto|off (default: auto)\n  IDLEWATCH_OPENCLAW_PROBE_TIMEOUT_MS OpenClaw command timeout per probe in ms (default: 2500)\n  IDLEWATCH_OPENCLAW_PROBE_RETRIES   Extra OpenClaw probe sweep retries after first pass (default: 1)\n  IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES   Max per-command OpenClaw probe output capture in bytes before truncation (default: 2097152 / 2MB)\n  IDLEWATCH_OPENCLAW_MAX_OUTPUT_BYTES_HARD_CAP  Hard cap for auto-retry output capture escalation (default: 16777216 / 16MB)\n  IDLEWATCH_USAGE_STALE_MS           Mark OpenClaw usage stale beyond this age in ms (default: max(interval*3,60000))\n  IDLEWATCH_USAGE_NEAR_STALE_MS      Mark OpenClaw usage as aging beyond this age in ms (default: floor((stale+grace)*0.85))\n  IDLEWATCH_USAGE_STALE_GRACE_MS     Extra grace window before status becomes stale (default: min(interval,10000))\n  IDLEWATCH_USAGE_REFRESH_REPROBES   Forced uncached reprobes when usage crosses stale threshold (default: 1)\n  IDLEWATCH_USAGE_REFRESH_DELAY_MS   Delay between forced stale-threshold reprobes in ms (default: 250)\n  IDLEWATCH_USAGE_REFRESH_ON_NEAR_STALE Trigger refresh when usage is near-stale: 1|0 (default: 1)\n  IDLEWATCH_USAGE_IDLE_AFTER_MS      Downgrade stale usage alerts to idle notice beyond this age in ms (default: 21600000)\n  IDLEWATCH_OPENCLAW_LAST_GOOD_MAX_AGE_MS  Reuse last successful usage snapshot after probe failures up to this age in ms\n  IDLEWATCH_OPENCLAW_LAST_GOOD_CACHE_PATH Persist/reuse last successful usage snapshot across restarts (default: ~/.idlewatch/cache/<host>-openclaw-last-good.json)\n  IDLEWATCH_CLOUD_INGEST_URL         Optional cloud ingest endpoint (e.g. https://idlewatch.com/api/ingest)\n  IDLEWATCH_CLOUD_API_KEY            Cloud API key from idlewatch.com/api for device linking\n  IDLEWATCH_REQUIRE_CLOUD_WRITES     Require cloud publish path in --once mode: 1|0 (default: 0)\n\nAdvanced Firebase / emulator mode:\n  IDLEWATCH_REQUIRE_FIREBASE_WRITES  Require Firebase publish path in --once mode: 1|0 (default: 0)\n  FIREBASE_PROJECT_ID                Firebase project id\n  FIREBASE_SERVICE_ACCOUNT_FILE      Path to service account JSON file (preferred for production)\n  FIREBASE_SERVICE_ACCOUNT_JSON      Raw JSON service account (supported, less secure than file path)\n  FIREBASE_SERVICE_ACCOUNT_B64       Base64-encoded JSON service account (legacy)\n  FIRESTORE_EMULATOR_HOST            Optional Firestore emulator host; allows local writes without service-account creds\n`)
 }
 
 const require = createRequire(import.meta.url)
@@ -372,7 +372,7 @@ if (dashboardRequested) {
 
 if (quickstartRequested) {
   try {
-    const result = await runEnrollmentWizard()
+    const result = await runEnrollmentWizard({ noTui: args.has('--no-tui') })
 
     const enrolledEnv = parseEnvFileToObject(result.outputEnvFile)
     const onceRun = spawnSync(process.execPath, [process.argv[1], '--once'], {
@@ -391,7 +391,7 @@ if (quickstartRequested) {
 
     console.error(`⚠️ Setup is not finished yet. Mode=${result.mode} device=${result.deviceName} envFile=${result.outputEnvFile}`)
     console.error('The first required telemetry sample did not publish successfully, so this device may not be linked yet.')
-    console.error(`Retry with: idlewatch --once`)
+    console.error(`Retry with: set -a; source "${result.outputEnvFile}"; set +a && idlewatch --once`)
     console.error('Or rerun: idlewatch quickstart')
     process.exit(onceRun.status ?? 1)
   } catch (err) {
@@ -626,7 +626,7 @@ if (firebaseConfigError) {
 
 if (!appReady && !(CLOUD_INGEST_URL && CLOUD_API_KEY)) {
   console.error(
-    'Firebase is not configured. Running without Firebase writes. Set FIREBASE_PROJECT_ID + FIREBASE_SERVICE_ACCOUNT_FILE (preferred, or FIREBASE_SERVICE_ACCOUNT_JSON / FIREBASE_SERVICE_ACCOUNT_B64), use FIREBASE_PROJECT_ID + FIRESTORE_EMULATOR_HOST for emulator writes, or configure cloud ingest via idlewatch setup.'
+    'Firebase is not configured. Running without Firebase writes. Set FIREBASE_PROJECT_ID + FIREBASE_SERVICE_ACCOUNT_FILE (preferred, or FIREBASE_SERVICE_ACCOUNT_JSON / FIREBASE_SERVICE_ACCOUNT_B64), use FIREBASE_PROJECT_ID + FIRESTORE_EMULATOR_HOST for emulator writes, or run idlewatch quickstart to link cloud ingest.'
   )
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "idlewatch",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Host telemetry collector for IdleWatch",
   "type": "module",
   "files": [

package/scripts/validate-onboarding.mjs

@@ -2,7 +2,7 @@ import fs from 'node:fs'
 import http from 'node:http'
 import os from 'node:os'
 import path from 'node:path'
-import { spawnSync } from 'node:child_process'
+import { spawn } from 'node:child_process'
 
 const repoRoot = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..')
 const binPath = path.join(repoRoot, 'bin', 'idlewatch-agent.js')
@@ -34,30 +34,47 @@ await new Promise((resolve, reject) => {
 const address = server.address()
 const cloudIngestUrl = `http://127.0.0.1:${address.port}/api/ingest`
 
+function runQuickstart(env) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [binPath, 'quickstart'], {
+      env,
+      stdio: ['ignore', 'pipe', 'pipe']
+    })
+
+    let stdout = ''
+    let stderr = ''
+    child.stdout.on('data', (chunk) => {
+      stdout += chunk
+    })
+    child.stderr.on('data', (chunk) => {
+      stderr += chunk
+    })
+    child.on('error', reject)
+    child.on('close', (code) => resolve({ code, stdout, stderr }))
+  })
+}
+
 try {
   const envOut = path.join(tmpRoot, 'generated.env')
   const configDir = path.join(tmpRoot, 'config')
   const localLogPath = path.join(configDir, 'logs', 'validator-box-metrics.ndjson')
   const lastGoodCachePath = path.join(configDir, 'cache', 'validator-box-openclaw-last-good.json')
 
-  const run = spawnSync(process.execPath, [binPath, 'quickstart'], {
-    env: {
-      ...process.env,
-      IDLEWATCH_ENROLL_NON_INTERACTIVE: '1',
-      IDLEWATCH_ENROLL_MODE: 'production',
-      IDLEWATCH_CLOUD_API_KEY: 'iwk_abcdefghijklmnopqrstuvwxyz123456',
-      IDLEWATCH_CLOUD_INGEST_URL: cloudIngestUrl,
-      IDLEWATCH_ENROLL_OUTPUT_ENV_FILE: envOut,
-      IDLEWATCH_ENROLL_CONFIG_DIR: configDir,
-      IDLEWATCH_DEVICE_NAME: 'Validator Box',
-      IDLEWATCH_DEVICE_ID: 'validator-box',
-      IDLEWATCH_MONITOR_TARGETS: 'cpu,memory',
-      IDLEWATCH_OPENCLAW_USAGE: 'off'
-    },
-    encoding: 'utf8'
+  const run = await runQuickstart({
+    ...process.env,
+    IDLEWATCH_ENROLL_NON_INTERACTIVE: '1',
+    IDLEWATCH_ENROLL_MODE: 'production',
+    IDLEWATCH_CLOUD_API_KEY: 'iwk_abcdefghijklmnopqrstuvwxyz123456',
+    IDLEWATCH_CLOUD_INGEST_URL: cloudIngestUrl,
+    IDLEWATCH_ENROLL_OUTPUT_ENV_FILE: envOut,
+    IDLEWATCH_ENROLL_CONFIG_DIR: configDir,
+    IDLEWATCH_DEVICE_NAME: 'Validator Box',
+    IDLEWATCH_DEVICE_ID: 'validator-box',
+    IDLEWATCH_MONITOR_TARGETS: 'cpu,memory',
+    IDLEWATCH_OPENCLAW_USAGE: 'off'
   })
 
-  if (run.status !== 0) {
+  if (run.code !== 0) {
     throw new Error(`quickstart failed\nstdout:\n${run.stdout}\nstderr:\n${run.stderr}`)
   }
 
@@ -82,6 +99,10 @@ try {
     }
   }
 
+  if (!run.stdout.includes('✅ Setup complete.')) {
+    throw new Error('quickstart success output did not include setup completion summary')
+  }
+
   if (requests.length === 0) {
     throw new Error('quickstart did not send the initial telemetry sample')
   }
@@ -93,6 +114,6 @@ try {
 
   console.log('onboarding validation passed')
 } finally {
-  server.close()
+  await new Promise((resolve) => server.close(resolve))
   fs.rmSync(tmpRoot, { recursive: true, force: true })
 }

package/src/config.js

@@ -21,6 +21,22 @@ const isNonNegFinite = (v) => Number.isFinite(v) && v >= 0
 const isNonNegInt = (v) => Number.isInteger(v) && v >= 0
 const isBool01 = (v) => v === 0 || v === 1
 
+function expandSupportedPathVars(value) {
+  if (typeof value !== 'string' || !value) return value
+
+  const home = process.env.HOME || os.homedir()
+  const tmpdir = process.env.TMPDIR || os.tmpdir()
+
+  return value
+    .replace(/^~(?=$|\/)/, home)
+    .replace(/\$\{HOME\}|\$HOME/g, home)
+    .replace(/\$\{TMPDIR\}|\$TMPDIR/g, tmpdir)
+}
+
+function resolveEnvPath(value) {
+  return path.resolve(expandSupportedPathVars(value))
+}
+
 /**
  * Build the full IdleWatch configuration from environment variables.
  * Throws on invalid values.
@@ -63,11 +79,11 @@ export function buildConfig() {
   const BASE_DIR = path.join(os.homedir(), '.idlewatch')
 
   const LOCAL_LOG_PATH = process.env.IDLEWATCH_LOCAL_LOG_PATH
-    ? path.resolve(process.env.IDLEWATCH_LOCAL_LOG_PATH)
+    ? resolveEnvPath(process.env.IDLEWATCH_LOCAL_LOG_PATH)
     : path.join(BASE_DIR, 'logs', `${SAFE_HOST}-metrics.ndjson`)
 
   const OPENCLAW_LAST_GOOD_CACHE_PATH = process.env.IDLEWATCH_OPENCLAW_LAST_GOOD_CACHE_PATH
-    ? path.resolve(process.env.IDLEWATCH_OPENCLAW_LAST_GOOD_CACHE_PATH)
+    ? resolveEnvPath(process.env.IDLEWATCH_OPENCLAW_LAST_GOOD_CACHE_PATH)
     : path.join(BASE_DIR, 'cache', `${SAFE_HOST}-openclaw-last-good.json`)
 
   return Object.freeze({

package/src/enrollment.js

@@ -3,6 +3,7 @@ import os from 'node:os'
 import path from 'node:path'
 import readline from 'node:readline/promises'
 import process from 'node:process'
+import { fileURLToPath } from 'node:url'
 import { spawnSync } from 'node:child_process'
 
 function defaultConfigDir() {
@@ -24,6 +25,8 @@ function writeSecureFile(filePath, content) {
 }
 
 const MONITOR_TARGET_CHOICES = ['cpu', 'memory', 'gpu', 'openclaw']
+const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url))
+const PACKAGE_ROOT = path.resolve(MODULE_DIR, '..')
 
 function commandExists(bin, args = ['--version']) {
   const result = spawnSync(bin, args, { stdio: 'ignore' })
@@ -91,15 +94,52 @@ function sanitizeDeviceId(raw, fallback = os.hostname()) {
   return sanitized || normalizeDeviceName(fallback).replace(/[^a-zA-Z0-9_.-]/g, '_')
 }
 
-function tryRustTui({ configDir, outputEnvFile }) {
-  const disabled = process.env.IDLEWATCH_DISABLE_RUST_TUI === '1'
-  if (disabled) return false
-
+function cargoAvailable() {
   const cargoProbe = spawnSync('cargo', ['--version'], { stdio: 'ignore' })
-  if (cargoProbe.status !== 0) return false
+  return cargoProbe.status === 0
+}
 
-  const manifestPath = path.resolve(process.cwd(), 'tui', 'Cargo.toml')
-  if (!fs.existsSync(manifestPath)) return false
+function installRustToolchain() {
+  if (cargoAvailable()) return { ok: true, installed: false }
+  if (process.env.IDLEWATCH_DISABLE_RUST_INSTALL === '1') return { ok: false, reason: 'install-disabled' }
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return { ok: false, reason: 'non-tty' }
+  if (!['darwin', 'linux'].includes(process.platform)) return { ok: false, reason: `unsupported-platform:${process.platform}` }
+
+  console.log('IdleWatch TUI needs Rust/Cargo. Installing rustup + Cargo now...')
+  const install = spawnSync('sh', ['-c', 'curl --proto "=https" --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y'], {
+    stdio: 'inherit',
+    env: {
+      ...process.env,
+      CARGO_HOME: process.env.CARGO_HOME || path.join(os.homedir(), '.cargo'),
+      RUSTUP_HOME: process.env.RUSTUP_HOME || path.join(os.homedir(), '.rustup')
+    }
+  })
+
+  if (install.status !== 0) return { ok: false, reason: `rustup-install-failed:${install.status ?? 'unknown'}` }
+
+  const cargoBinDir = path.join(process.env.CARGO_HOME || path.join(os.homedir(), '.cargo'), 'bin')
+  if (!process.env.PATH?.split(path.delimiter).includes(cargoBinDir)) {
+    process.env.PATH = `${cargoBinDir}${path.delimiter}${process.env.PATH || ''}`
+  }
+
+  return cargoAvailable() ? { ok: true, installed: true } : { ok: false, reason: 'cargo-still-missing' }
+}
+
+function tryRustTui({ configDir, outputEnvFile, autoInstallRust = true }) {
+  const disabled = process.env.IDLEWATCH_DISABLE_RUST_TUI === '1'
+  if (disabled) return { ok: false, reason: 'disabled' }
+
+  if (!cargoAvailable()) {
+    if (autoInstallRust) {
+      const installResult = installRustToolchain()
+      if (!installResult.ok) return { ok: false, reason: installResult.reason || 'cargo-missing' }
+    } else {
+      return { ok: false, reason: 'cargo-missing' }
+    }
+  }
+
+  const manifestPath = path.join(PACKAGE_ROOT, 'tui', 'Cargo.toml')
+  if (!fs.existsSync(manifestPath)) return { ok: false, reason: 'manifest-missing', manifestPath }
 
   const run = spawnSync('cargo', ['run', '--quiet', '--manifest-path', manifestPath], {
     stdio: 'inherit',
@@ -111,10 +151,10 @@ function tryRustTui({ configDir, outputEnvFile }) {
   })
 
   if (run.status === 0) {
-    return true
+    return { ok: true, manifestPath }
   }
 
-  return false
+  return { ok: false, reason: `cargo-run-failed:${run.status ?? 'unknown'}`, manifestPath }
 }
 
 function promptModeText() {
@@ -123,6 +163,7 @@ function promptModeText() {
 
 export async function runEnrollmentWizard(options = {}) {
   const nonInteractive = options.nonInteractive || process.env.IDLEWATCH_ENROLL_NON_INTERACTIVE === '1'
+  const noTui = options.noTui || process.env.IDLEWATCH_NO_TUI === '1'
   const configDir = path.resolve(options.configDir || process.env.IDLEWATCH_ENROLL_CONFIG_DIR || defaultConfigDir())
   const outputEnvFile = path.resolve(options.outputEnvFile || process.env.IDLEWATCH_ENROLL_OUTPUT_ENV_FILE || path.join(configDir, 'idlewatch.env'))
 
@@ -137,11 +178,18 @@ export async function runEnrollmentWizard(options = {}) {
     availableMonitorTargets
   )
 
-  if (!nonInteractive && tryRustTui({ configDir, outputEnvFile })) {
-    return {
-      mode: 'tui',
-      configDir,
-      outputEnvFile
+  if (!nonInteractive && !noTui) {
+    const tuiResult = tryRustTui({ configDir, outputEnvFile, autoInstallRust: true })
+    if (tuiResult.ok) {
+      return {
+        mode: 'tui',
+        configDir,
+        outputEnvFile
+      }
+    }
+
+    if (!['disabled', 'cargo-missing'].includes(tuiResult.reason || '')) {
+      console.warn(`IdleWatch TUI unavailable (${tuiResult.reason || 'unknown'}). Falling back to text setup.`)
     }
   }