@pellux/goodvibes-agent 1.8.1 → 1.8.2

package/src/core/rewind-turn-anchors.ts

@@ -0,0 +1,82 @@
+/**
+ * rewind-turn-anchors.ts — the session-scoped join key between the conversation
+ * and the workspace-checkpoint store, for message-anchored rewind.
+ *
+ * The unified rewind service (SDK platform/rewind) anchors a rewind to a
+ * `{ sessionId, turnId }`. Files-scope resolves that turnId against the
+ * workspace checkpoints the turn engine already stamps with the same turnId.
+ * Conversation-scope, however, needs to know HOW MANY conversation messages
+ * existed at that turn boundary — a mapping the SDK's checkpoint store does not
+ * carry. This registry supplies exactly that mapping: at every TURN_COMPLETED
+ * this Agent records the turnId together with the live
+ * `conversation.getMessageCount()`, so a later rewind to that turnId can
+ * truncate the conversation to precisely the boundary the files checkpoint
+ * captured.
+ *
+ * Ported from goodvibes-tui's src/core/rewind-turn-anchors.ts (same join-key
+ * shape, same TURN_COMPLETED wiring point) so the two front-ends' rewind
+ * semantics cannot drift.
+ *
+ * Scope + lifetime: in-memory, keyed by sessionId, populated for the CURRENT
+ * process run only. Turns from a resumed prior session (whose turnIds predate
+ * this run) are not present — an honest limitation: a rewind to an
+ * unrecorded turnId gets exactly the anchors this run recorded, never an
+ * invented boundary.
+ */
+
+/** One recorded turn boundary — the rewind coordinator's per-turn anchor. */
+export interface TurnAnchor {
+  /** The turn engine's turn id, shared with the workspace checkpoint's `turnId`. */
+  readonly turnId: string;
+  /** A short human label (the truncated user prompt) for the recent-turns picker. */
+  readonly label: string;
+  /** `conversation.getMessageCount()` captured at this turn's completion — the conversation truncation boundary. */
+  readonly messageCount: number;
+  /** Wall-clock ms at capture, for ordering + age display. */
+  readonly at: number;
+}
+
+/** Hard cap so a very long session cannot grow this registry without bound. */
+const MAX_ANCHORS_PER_SESSION = 500;
+
+const registry = new Map<string, TurnAnchor[]>();
+
+/** Trim a user prompt to a single compact line for the picker. */
+export function summarizeTurnLabel(text: string | null | undefined, max = 72): string {
+  const oneLine = (text ?? '').replace(/\s+/g, ' ').trim();
+  if (oneLine.length === 0) return '(no prompt text)';
+  return oneLine.length > max ? `${oneLine.slice(0, max - 1)}…` : oneLine;
+}
+
+/**
+ * Record a completed turn's anchor. Idempotent per turnId: a repeated turnId
+ * updates the existing entry in place (the checkpoint engine can re-snapshot a
+ * turn) rather than duplicating it.
+ */
+export function recordTurnAnchor(sessionId: string, anchor: TurnAnchor): void {
+  if (!sessionId || !anchor.turnId) return;
+  const list = registry.get(sessionId) ?? [];
+  const existingIndex = list.findIndex((a) => a.turnId === anchor.turnId);
+  if (existingIndex >= 0) {
+    list[existingIndex] = anchor;
+  } else {
+    list.push(anchor);
+    if (list.length > MAX_ANCHORS_PER_SESSION) list.splice(0, list.length - MAX_ANCHORS_PER_SESSION);
+  }
+  registry.set(sessionId, list);
+}
+
+/** All recorded anchors for a session, oldest first (chronological). */
+export function getTurnAnchors(sessionId: string): readonly TurnAnchor[] {
+  return registry.get(sessionId) ?? [];
+}
+
+/** Resolve an anchor by exact turnId, or null when this run never recorded it. */
+export function resolveTurnAnchor(sessionId: string, turnId: string): TurnAnchor | null {
+  return registry.get(sessionId)?.find((a) => a.turnId === turnId) ?? null;
+}
+
+/** Drop a session's anchors. Exposed for tests and session reset. */
+export function clearTurnAnchors(sessionId: string): void {
+  registry.delete(sessionId);
+}

package/src/input/agent-workspace-categories.ts

@@ -489,6 +489,7 @@ export const AGENT_WORKSPACE_CATEGORIES: readonly AgentWorkspaceCategory[] = [
       { id: 'tasks-filter', label: 'Filter host tasks', detail: 'Open a status/kind form for read-only connected-host task filtering.', editorKind: 'task-list-filter', kind: 'editor', safety: 'read-only' },
       { id: 'task-show', label: 'Inspect host task', detail: 'Open a task-id form for read-only connected-host task metadata.', editorKind: 'task-show', kind: 'editor', safety: 'read-only' },
       { id: 'task-output', label: 'Show task output', detail: 'Open a task-id form for read-only connected-host task output.', editorKind: 'task-output', kind: 'editor', safety: 'read-only' },
+      { id: 'ci-watches-list', label: 'CI watches', detail: 'List standing CI watches on the connected host. Use /ci status <repo> for a per-job conclusion report, and /ci watches create ... --yes to add a watch with channel delivery.', command: '/ci watches list', kind: 'command', safety: 'read-only' },
       { id: 'approval-review', label: 'Review approval class', detail: 'Open an approval-kind form for read-only review of one approval class.', editorKind: 'approval-review', kind: 'editor', safety: 'read-only' },
       { id: 'approval-approve', label: 'Approve request', detail: 'Open a confirmed form for approving one pending connected-host approval request by id.', editorKind: 'approval-approve', kind: 'editor', safety: 'safe' },
       { id: 'approval-deny', label: 'Deny request', detail: 'Open a confirmed form for denying one pending connected-host approval request by id.', editorKind: 'approval-deny', kind: 'editor', safety: 'safe' },

package/src/input/agent-workspace-channel-triage.ts

@@ -1,9 +1,16 @@
 import { createHash } from 'node:crypto';
 import { formatAgentChannelDeliveryReceiptLine, readAgentChannelDeliveryReceipts } from '../agent/channel-delivery-receipts.ts';
 import type { CommandContext } from './command-registry.ts';
-import { fetchConnectedHostReadOnlyRoute, type ConnectedHostRouteFailure, type ConnectedHostRouteResult } from './connected-host-routes.ts';
+import {
+  fetchConnectedHostReadOnlyRoute,
+  resolveConnectedHostConnection,
+  type ConnectedHostConnection,
+  type ConnectedHostRouteFailure,
+  type ConnectedHostRouteResult,
+} from './connected-host-routes.ts';
 import type { AgentWorkspaceChannelStatus } from './agent-workspace-channels.ts';
 import { buildAgentWorkspaceChannels } from './agent-workspace-channels.ts';
+import { resolveChannelPrincipalAttribution, UNKNOWN_PRINCIPAL_LABEL } from '../agent/principal-attribution.ts';
 
 type JsonRecord = Record<string, unknown>;
 
@@ -249,15 +256,20 @@ function surfaceMessageTriage(result: ConnectedHostRouteResult, limit: number):
   };
 }
 
-function routeBindingView(binding: JsonRecord): Record<string, unknown> {
+async function routeBindingView(binding: JsonRecord, connection: ConnectedHostConnection): Promise<Record<string, unknown>> {
   const externalId = readString(binding, 'externalId');
+  const surfaceKind = readString(binding, 'surfaceKind', 'unknown');
+  const attribution = await resolveChannelPrincipalAttribution(connection, surfaceKind, externalId);
   return {
     id: readString(binding, 'id', 'binding'),
     kind: readString(binding, 'kind', 'unknown'),
-    surfaceKind: readString(binding, 'surfaceKind', 'unknown'),
+    surfaceKind,
     surfaceId: readString(binding, 'surfaceId') || null,
     title: redactText(readString(binding, 'title'), 100) || null,
     externalIdDigest: externalId ? `sha256:${digest(externalId)}` : null,
+    principal: attribution.principal,
+    principalLabel: attribution.label,
+    ...(attribution.error ? { principalResolutionError: attribution.error } : {}),
     sessionPolicy: readString(binding, 'sessionPolicy') || null,
     threadPolicy: readString(binding, 'threadPolicy') || null,
     deliveryGuarantee: readString(binding, 'deliveryGuarantee') || null,
@@ -268,7 +280,11 @@ function routeBindingView(binding: JsonRecord): Record<string, unknown> {
   };
 }
 
-function routeBindingTriage(result: ConnectedHostRouteResult, limit: number): Record<string, unknown> {
+async function routeBindingTriage(
+  result: ConnectedHostRouteResult,
+  limit: number,
+  connection: ConnectedHostConnection,
+): Promise<Record<string, unknown>> {
   if (!result.ok) {
     return {
       route: result.route,
@@ -280,12 +296,14 @@ function routeBindingTriage(result: ConnectedHostRouteResult, limit: number): Re
   }
   const root = isRecord(result.body) ? result.body : {};
   const bindings = readRecordArray(root, 'bindings');
+  const sliced = bindings.slice(0, limit);
+  const bindingViews = await Promise.all(sliced.map((binding) => routeBindingView(binding, connection)));
   return {
     route: result.route,
     state: routeState(result, bindings.length === 0),
     totalBindings: bindings.length,
-    bindings: bindings.slice(0, limit).map(routeBindingView),
-    policy: 'Read-only route continuity. External ids are digested so channel identifiers are not printed into chat.',
+    bindings: bindingViews,
+    policy: `Read-only route continuity. External ids are digested so channel identifiers are not printed into chat. Sender attribution shows the resolved principal when the channel identity maps to one, and "${UNKNOWN_PRINCIPAL_LABEL}" otherwise.`,
   };
 }
 
@@ -338,6 +356,7 @@ export async function buildAgentWorkspaceChannelTriage(
 ): Promise<AgentWorkspaceChannelTriage> {
   const limit = readLimit(args.limit, 12);
   const channels = buildAgentWorkspaceChannels(context);
+  const connection = resolveConnectedHostConnection(context);
   const [deliveriesResult, messagesResult, bindingsResult] = await Promise.all([
     fetchConnectedHostReadOnlyRoute(context, '/api/deliveries'),
     fetchConnectedHostReadOnlyRoute(context, '/api/control-plane/messages'),
@@ -346,7 +365,7 @@ export async function buildAgentWorkspaceChannelTriage(
   const readiness = channelTriageReadiness(channels, limit);
   const deliveries = deliveryTriage(deliveriesResult, limit);
   const surfaceMessages = surfaceMessageTriage(messagesResult, limit);
-  const routeBindings = routeBindingTriage(bindingsResult, limit);
+  const routeBindings = await routeBindingTriage(bindingsResult, limit, connection);
   const receipts = receiptTriage(context, limit);
   const routeFailures = routeFailureCount([deliveriesResult, messagesResult, bindingsResult]);
   const readinessAttention = typeof readiness.attention === 'number' ? readiness.attention : 0;
@@ -457,7 +476,7 @@ export function formatAgentWorkspaceChannelTriage(triage: AgentWorkspaceChannelT
     lines.push(`  state: ${bindings.state}; total: ${bindings.totalBindings}`);
     const routeRows = Array.isArray(bindings.bindings) ? bindings.bindings.filter(isRecord) : [];
     for (const binding of routeRows.slice(0, 5)) {
-      lines.push(`  - ${readString(binding, 'id')}: ${readString(binding, 'surfaceKind')} ${readString(binding, 'kind')} external=${readString(binding, 'externalIdDigest')}`);
+      lines.push(`  - ${readString(binding, 'id')}: ${readString(binding, 'surfaceKind')} ${readString(binding, 'kind')} external=${readString(binding, 'externalIdDigest')} sender=${readString(binding, 'principalLabel', UNKNOWN_PRINCIPAL_LABEL)}`);
     }
     if (routeRows.length === 0) lines.push('  no route bindings reported');
   }

package/src/input/agent-workspace-local-library-snapshot.ts

@@ -1,4 +1,4 @@
-import type { MemoryRecord } from '@pellux/goodvibes-sdk/platform/state';
+import { memoryRecordTemporalStatus, type MemoryRecord } from '@pellux/goodvibes-sdk/platform/state';
 import type { AgentNoteRecord } from '../agent/note-registry.ts';
 import type { AgentPersonaRecord } from '../agent/persona-registry.ts';
 import { formatAgentRecordOrigin } from '../agent/record-labels.ts';
@@ -125,6 +125,10 @@ export function summarizeMemoryItem(record: MemoryRecord): AgentWorkspaceLocalLi
     scope: record.scope,
     cls: record.cls,
     confidence: record.confidence,
+    // Visible expiry: a record outside its [validFrom, validUntil) window is
+    // still stored (not deleted) but not prompt-injected — see
+    // memoryRecordTemporalStatus / describeMemoryPromptEligibility.
+    temporalStatus: memoryRecordTemporalStatus(record),
   };
 }
 

package/src/input/agent-workspace-onboarding-categories.ts

@@ -1,7 +1,8 @@
 import type { AgentWorkspaceCategory } from './agent-workspace-types.ts';
 import { settingAction } from './agent-workspace-category-actions.ts';
+import { renderCapabilityReadinessLine } from '../agent/capability-registry.ts';
 
-export const AGENT_WORKSPACE_ONBOARDING_DETAIL_CATEGORIES: readonly AgentWorkspaceCategory[] = [
+const ONBOARDING_DETAIL_CATEGORIES_BASE: readonly AgentWorkspaceCategory[] = [
   {
     id: 'onboarding-channels',
     group: 'ONBOARDING',
@@ -80,6 +81,8 @@ export const AGENT_WORKSPACE_ONBOARDING_DETAIL_CATEGORIES: readonly AgentWorkspa
       { id: 'notification-remove-webhook', label: 'Remove notification target', detail: 'Remove one webhook notification target after confirmation.', editorKind: 'notify-webhook-remove', kind: 'editor', safety: 'safe' },
       { id: 'notification-clear-webhooks', label: 'Clear notification targets', detail: 'Remove every configured webhook notification target after confirmation.', editorKind: 'notify-webhook-clear', kind: 'editor', safety: 'safe' },
       { id: 'notification-test-webhooks', label: 'Test notification targets', detail: 'Send one test notification to configured targets after typed confirmation.', editorKind: 'notify-webhook-test', kind: 'editor', safety: 'safe' },
+      { id: 'principals-list', label: 'People & identities', detail: 'List the cross-channel principal registry: who each channel identity (Slack member, Telegram chat, ...) resolves to. Unmapped senders show as "unknown principal" in session attribution; use /principals create ... --yes to map them.', command: '/principals list', kind: 'command', safety: 'read-only' },
+      { id: 'channel-profiles-list', label: 'Channel session profiles', detail: 'List per-channel session profile bindings: the model, provider, and permission mode sessions from each channel start with. Use /channel-profiles set <surface-kind> ... --yes to change one.', command: '/channel-profiles list', kind: 'command', safety: 'read-only' },
       { id: 'channel-safety', label: 'Delivery safety', detail: 'Messages only go out when you explicitly send them. Nothing is delivered silently from this page.', kind: 'guidance', safety: 'blocked' },
     ],
   },
@@ -142,3 +145,16 @@ export const AGENT_WORKSPACE_ONBOARDING_DETAIL_CATEGORIES: readonly AgentWorkspa
     ],
   },
 ];
+
+/**
+ * Each onboarding category shows the readiness of the capabilities it
+ * advertises, appended to its detail and sourced entirely from the capability
+ * registry. No category hand-writes a maturity claim; the registry is the one
+ * source of truth, so onboarding copy and the enforcement tests can never
+ * drift from a capability's declared level.
+ */
+export const AGENT_WORKSPACE_ONBOARDING_DETAIL_CATEGORIES: readonly AgentWorkspaceCategory[] =
+  ONBOARDING_DETAIL_CATEGORIES_BASE.map((category) => {
+    const readinessLine = renderCapabilityReadinessLine(category.id);
+    return readinessLine ? { ...category, detail: `${category.detail} ${readinessLine}` } : category;
+  });

package/src/input/agent-workspace-snapshot.ts

@@ -1,6 +1,7 @@
 import { basename, sep } from 'node:path';
 import type { CommandContext } from './command-registry.ts';
 import { AgentRoutineRegistry } from '../agent/routine-registry.ts';
+import { memoryRecordTemporalStatus } from '@pellux/goodvibes-sdk/platform/state';
 import { describeMemoryPromptEligibility, isPromptActiveMemory } from '../agent/memory-prompt.ts';
 import { summarizeAgentBehaviorDiscovery } from '../agent/behavior-discovery-summary.ts';
 import { buildSetupWizardDurableReceipts } from '../agent/setup-wizard-artifact-receipts.ts';
@@ -56,6 +57,10 @@ export interface AgentWorkspaceLiveMemoryCounters {
   readonly count: number;
   readonly reviewQueueCount: number;
   readonly promptActiveCount: number;
+  /** Stored but not yet valid (now < validFrom). Still counted in `count`. */
+  readonly temporallyPendingCount: number;
+  /** Stored but past validUntil. Still counted in `count`, never deleted. */
+  readonly temporallyExpiredCount: number;
   readonly items: readonly AgentWorkspaceLocalLibraryItem[];
 }
 
@@ -78,12 +83,27 @@ export interface AgentWorkspaceLiveMemoryCounters {
  */
 export function readLiveAgentMemoryCounters(context: CommandContext): AgentWorkspaceLiveMemoryCounters {
   const memory = context.clients?.agentKnowledgeApi?.memory;
-  if (!memory) return { count: 0, reviewQueueCount: 0, promptActiveCount: 0, items: [] };
+  if (!memory) {
+    return { count: 0, reviewQueueCount: 0, promptActiveCount: 0, temporallyPendingCount: 0, temporallyExpiredCount: 0, items: [] };
+  }
   const records = [...memory.getAll()].sort((left, right) => right.updatedAt - left.updatedAt);
+  let temporallyPendingCount = 0;
+  let temporallyExpiredCount = 0;
+  for (const record of records) {
+    const temporalStatus = memoryRecordTemporalStatus(record);
+    if (temporalStatus === 'pending') temporallyPendingCount += 1;
+    else if (temporalStatus === 'expired') temporallyExpiredCount += 1;
+  }
   return {
     count: records.length,
     reviewQueueCount: memory.reviewQueue(100).length,
-    promptActiveCount: records.filter(isPromptActiveMemory).length,
+    // Bound to one arg — a bare `.filter(isPromptActiveMemory)` leaks the
+    // array index in as Array.filter's second (index) argument, which lands
+    // in isPromptActiveMemory's `now` param and silently breaks the
+    // temporal-validity check for every record past index 0.
+    promptActiveCount: records.filter((record) => isPromptActiveMemory(record)).length,
+    temporallyPendingCount,
+    temporallyExpiredCount,
     // Each item carries the honest, per-record eligibility reason straight from
     // describeMemoryPromptEligibility — the same wording source
     // prompt-context-receipts.ts and agent-harness-prompt-context.ts use for prompt
@@ -104,7 +124,7 @@ export function buildAgentWorkspaceMemorySnapshot(context: CommandContext): Agen
   try {
     return readLiveAgentMemoryCounters(context);
   } catch {
-    return { count: 0, reviewQueueCount: 0, promptActiveCount: 0, items: [] };
+    return { count: 0, reviewQueueCount: 0, promptActiveCount: 0, temporallyPendingCount: 0, temporallyExpiredCount: 0, items: [] };
   }
 }
 
@@ -326,6 +346,8 @@ export function buildAgentWorkspaceRuntimeSnapshot(context: CommandContext): Age
     localMemoryCount: memorySnapshot.count,
     localMemoryReviewQueueCount: memorySnapshot.reviewQueueCount,
     localMemoryPromptActiveCount: memorySnapshot.promptActiveCount,
+    localMemoryTemporallyPendingCount: memorySnapshot.temporallyPendingCount,
+    localMemoryTemporallyExpiredCount: memorySnapshot.temporallyExpiredCount,
     localMemories: memorySnapshot.items,
     localNoteCount: noteSnapshot.count,
     localNoteReviewQueueCount: noteSnapshot.reviewQueueCount,

package/src/input/agent-workspace-types.ts

@@ -370,13 +370,11 @@ export interface AgentWorkspaceLocalLibraryItem {
   readonly missingRequirementCount?: number;
   readonly missingRequirements?: readonly string[];
   readonly startCount?: number;
-  /** Memory-only: whether this record currently clears the prompt-injection
-   *  recall floor, per describeMemoryPromptEligibility. */
+  /** Memory-only: whether this record currently clears the prompt-injection recall floor, per describeMemoryPromptEligibility. */
   readonly promptEligible?: boolean;
-  /** Memory-only: the honest, per-record reason from describeMemoryPromptEligibility —
-   *  the same wording source prompt-context-receipts.ts and agent-harness-prompt-context.ts
-   *  use, so this workspace snapshot never has to invent its own paraphrase. */
+  /** Memory-only: the honest, per-record reason from describeMemoryPromptEligibility — the same wording source prompt-context-receipts.ts and agent-harness-prompt-context.ts use. */
   readonly promptEligibilityReason?: string;
+  readonly temporalStatus?: 'active' | 'pending' | 'expired'; // memoryRecordTemporalStatus; pending/expired stay stored, just not prompt-injected
 }
 
 export interface AgentWorkspaceRecentReviewerHandoffArtifact {
@@ -699,6 +697,8 @@ export interface AgentWorkspaceRuntimeSnapshot {
   readonly localMemoryCount: number;
   readonly localMemoryReviewQueueCount: number;
   readonly localMemoryPromptActiveCount: number;
+  readonly localMemoryTemporallyPendingCount: number;
+  readonly localMemoryTemporallyExpiredCount: number;
   readonly localMemories: readonly AgentWorkspaceLocalLibraryItem[];
   readonly localNoteCount: number;
   readonly localNoteReviewQueueCount: number;

package/src/input/commands/connected-host-admin-runtime.ts

@@ -0,0 +1,75 @@
+/**
+ * TUI slash commands for the connected host's CI-watch, principal registry,
+ * and per-channel profile admin families: /ci, /principals, /channel-profiles.
+ *
+ * These are thin bridges onto the exact same CLI handlers the terminal
+ * commands use (src/cli/ci-command.ts, principals-command.ts,
+ * channel-profiles-command.ts): the TUI handler re-parses the invocation
+ * through the real CLI parser and hands the result to the CLI handler, so
+ * subcommand grammar, --yes confirmation gates, per-job CI conclusion
+ * rendering, and connected-host failure classification can never drift
+ * between the two surfaces. Output prints into the transcript verbatim.
+ */
+import type { CommandContext, CommandRegistry } from '../command-registry.ts';
+import { parseGoodVibesCli } from '../../cli/parser.ts';
+import type { CliCommandOutput } from '../../cli/types.ts';
+import type { CliCommandRuntime } from '../../cli/management.ts';
+import { handleCiCommand } from '../../cli/ci-command.ts';
+import { handlePrincipalsCommand } from '../../cli/principals-command.ts';
+import { handleChannelProfilesCommand } from '../../cli/channel-profiles-command.ts';
+import { requireShellPaths } from './runtime-services.ts';
+
+function buildCliRuntime(ctx: CommandContext, command: string, args: readonly string[]): CliCommandRuntime {
+  const shellPaths = requireShellPaths(ctx);
+  return {
+    cli: parseGoodVibesCli([command, ...args]),
+    configManager: ctx.platform.configManager,
+    workingDirectory: shellPaths.workingDirectory,
+    homeDirectory: shellPaths.homeDirectory,
+  };
+}
+
+async function runBridgedCliCommand(
+  ctx: CommandContext,
+  command: string,
+  args: readonly string[],
+  handler: (runtime: CliCommandRuntime) => Promise<CliCommandOutput>,
+): Promise<void> {
+  const result = await handler(buildCliRuntime(ctx, command, args));
+  ctx.print(result.output);
+}
+
+export function registerConnectedHostAdminCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'ci',
+    description: 'Check a repo/PR CI status with per-job conclusions and manage standing CI watches on the connected host',
+    hidden: true,
+    usage: 'status <repo> [--ref <ref>] [--pr <number>] | watches list | watches create <repo> --delivery-channel <channel> [--trigger-fix-session] --yes | watches run <watch-id> | watches delete <watch-id> --yes',
+    argsHint: 'status <repo> | watches list',
+    async handler(args, ctx) {
+      await runBridgedCliCommand(ctx, 'ci', args, handleCiCommand);
+    },
+  });
+  registry.register({
+    name: 'principals',
+    aliases: ['principal'],
+    description: 'Manage the connected host cross-channel principal identity registry',
+    hidden: true,
+    usage: 'list | get <id> | resolve --channel <channel> --value <value> | create --name <name> --kind <user|bot|service|token> [--identity channel:value] --yes | update <id> [...] --yes | delete <id> --yes',
+    argsHint: 'list | resolve --channel slack --value U123',
+    async handler(args, ctx) {
+      await runBridgedCliCommand(ctx, 'principals', args, handlePrincipalsCommand);
+    },
+  });
+  registry.register({
+    name: 'channel-profiles',
+    aliases: ['channel-profile'],
+    description: 'Manage per-channel session profile bindings (model, provider, permission mode) on the connected host',
+    hidden: true,
+    usage: 'list | get <surface-kind> [--channel-id <id>] | set <surface-kind> [--model <model>] [--provider <provider>] [--permission-mode <mode>] --yes | delete <surface-kind> --yes',
+    argsHint: 'list | get slack',
+    async handler(args, ctx) {
+      await runBridgedCliCommand(ctx, 'channel-profiles', args, handleChannelProfilesCommand);
+    },
+  });
+}

package/src/input/commands.ts

@@ -38,6 +38,7 @@ import { registerBriefRuntimeCommands } from './commands/brief-runtime.ts';
 import { registerSupportBundleRuntimeCommands } from './commands/support-bundle-runtime.ts';
 import { registerCompatRuntimeCommands } from './commands/compat-runtime.ts';
 import { registerOperatorActionRuntimeCommands } from './commands/operator-actions-runtime.ts';
+import { registerConnectedHostAdminCommands } from './commands/connected-host-admin-runtime.ts';
 import { registerEmailRuntimeCommands } from './commands/email-runtime.ts';
 import { registerCalendarRuntimeCommands } from './commands/calendar-runtime.ts';
 
@@ -65,6 +66,7 @@ export function registerBuiltinCommands(registry: CommandRegistry): void {
   registerSupportBundleRuntimeCommands(registry);
   registerCompatRuntimeCommands(registry);
   registerOperatorActionRuntimeCommands(registry);
+  registerConnectedHostAdminCommands(registry);
   registerCalendarRuntimeCommands(registry);
   registerAgentRuntimeProfileRuntimeCommands(registry);
   registerVibeRuntimeCommands(registry);

package/src/input/settings-modal-types.ts

@@ -27,16 +27,19 @@ export type SettingsCategory =
   | 'behavior'
   | 'storage'
   | 'permissions'
+  | 'diagnostics'
   | 'tools'
   | 'helper'
   | 'tts'
   | 'surfaces'
   | 'automation'
+  | 'checkin'
   | 'service'
   | 'controlPlane'
   | 'httpListener'
   | 'web'
   | 'watchers'
+  | 'relay'
   | 'network'
   | 'orchestration'
   | 'planner'
@@ -50,7 +53,15 @@ export type SettingsCategory =
   | 'mcp'
   | 'flags'
   | 'release'
-  | 'daemon';
+  | 'daemon'
+  | 'atRest'
+  | 'learning'
+  | 'agents'
+  | 'notifications'
+  | 'policy'
+  | 'fetch'
+  | 'security'
+  | 'integrations';
 
 export type SettingsFocusPane = 'categories' | 'settings';
 
@@ -58,11 +69,11 @@ export const SETTINGS_CATEGORY_GROUPS: ReadonlyArray<{
   readonly label: string;
   readonly categories: readonly SettingsCategory[];
 }> = [
-  { label: 'Agent Experience', categories: ['display', 'ui', 'behavior', 'permissions'] },
+  { label: 'Agent Experience', categories: ['display', 'ui', 'behavior', 'agents', 'notifications', 'permissions', 'policy', 'fetch', 'diagnostics'] },
   { label: 'Models and Providers', categories: ['provider', 'subscriptions', 'helper', 'tools', 'tts'] },
-  { label: 'Agent-local state', categories: ['storage', 'cache', 'telemetry'] },
-  { label: 'Channels and Tools', categories: ['surfaces', 'mcp', 'automation'] },
-  { label: 'Daemon Runtime', categories: ['daemon', 'service', 'controlPlane', 'httpListener', 'web', 'watchers', 'network'] },
+  { label: 'Agent-local state', categories: ['storage', 'cache', 'telemetry', 'atRest', 'security', 'learning'] },
+  { label: 'Channels and Tools', categories: ['surfaces', 'mcp', 'automation', 'checkin', 'integrations'] },
+  { label: 'Daemon Runtime', categories: ['daemon', 'service', 'controlPlane', 'httpListener', 'web', 'watchers', 'network', 'relay'] },
   { label: 'Advanced Runtime', categories: ['orchestration', 'planner', 'runtime', 'sandbox', 'batch', 'cloudflare', 'wrfc'] },
   { label: 'Advanced', categories: ['flags', 'release'] },
 ];

package/src/main.ts

@@ -41,7 +41,7 @@ import {
   loadRecoveryConversation,
 } from '@/runtime/index.ts';
 import type { SessionSnapshot } from '@/runtime/index.ts';
-import { handleBlockingShellInput, type PendingPermissionState } from './shell/blocking-input.ts';
+import { handleBlockingShellInput, type PendingPermissionState, type PendingWorkspaceRegistrationState } from './shell/blocking-input.ts';
 import { createAgentWorkspaceFullscreenComposite, createFullscreenCompositeFromLines } from './shell/agent-workspace-fullscreen.ts';
 import { getTerminalSize } from './shell/terminal-size.ts';
 import { buildShellSessionContinuityHints } from './shell/session-continuity-hints.ts';
@@ -49,7 +49,8 @@ import { wireShellUiOpeners } from './shell/ui-openers.ts';
 import { deriveComposerState } from './core/composer-state.ts';
 import { buildPersistedSessionContext } from '@/runtime/index.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
-import { FOCUS_ENABLE, FOCUS_DISABLE, installFocusModeExitGuard, markFocusModeEnabled, wrapRequestPermissionWithApprovalAlert } from './shell/terminal-focus-mode.ts';
+import { installFocusModeExitGuard, markFocusModeEnabled, wrapRequestPermissionWithApprovalAlert } from './shell/terminal-focus-mode.ts';
+import { CLEAR_VIEWPORT_HOME, buildEnterSequence, buildExitSequence } from './renderer/terminal-escapes.ts';
 import { prepareShellCliRuntime } from './cli/entrypoint.ts';
 import { applyInitialTuiCliState, formatFatalStartupErrorForLog, formatFatalStartupErrorForUser, getInteractiveTerminalLaunchError } from './cli/tui-startup.ts';
 import { wireSpokenTurnRuntime } from './audio/spoken-turn-wiring.ts';
@@ -62,8 +63,7 @@ import { createAutonomySurfacing, buildCalendarEventsLister, buildSkillDraftProp
 import { startHardwareProbe } from './core/hardware-profile.ts';
 import { readApprovalPostureFromConfig } from './permissions/approval-posture.ts';
 
-const ALT_SCREEN_ENTER = '\x1b[?1049h', ALT_SCREEN_EXIT = '\x1b[?1049l', MOUSE_ENABLE = '\x1b[?1000h\x1b[?1002h\x1b[?1006h', MOUSE_DISABLE = '\x1b[?1006l\x1b[?1002l\x1b[?1000l', CURSOR_HIDE = '\x1b[?25l', CURSOR_SHOW = '\x1b[?25h', CLEAR_SCREEN = '\x1b[2J\x1b[3J\x1b[H';
-const KEYBOARD_EXT_ENABLE = '\x1b[>4;2m' + '\x1b[?1u', KEYBOARD_EXT_DISABLE = '\x1b[>4;0m' + '\x1b[?1l', PASTE_ENABLE = '\x1b[?2004h', PASTE_DISABLE = '\x1b[?2004l';
+// Escape bytes and enter/exit sequencing live in renderer/terminal-escapes.ts (re-exported from @pellux/goodvibes-terminal-shell) so this file never holds its own drifting copy.
 
 async function main() {
   const stdout = process.stdout;
@@ -223,7 +223,9 @@ async function main() {
   const unsubs: Array<() => void> = [];
   let recoveryInterval: ReturnType<typeof setInterval> | null = null;
   let stopSpokenOutputForExit: (() => Promise<void>) | null = null;
-  let recoveryPending = false;
+  let recoveryPending = false, pendingWorkspaceRegistration: PendingWorkspaceRegistrationState | null = null;
+  // Set by exitApp before the terminal-restore write; render() checks this so no late frame can paint over the screen after the terminal has been handed back.
+  let terminalRestored = false;
 
   const sigintHandler = (): void => input.feed('\x03');
   const unhandledRejectionHandler = createUnhandledRejectionHandler({
@@ -242,6 +244,8 @@ async function main() {
     // spoken-audio drain below must not re-run teardown.
     if (exiting) return;
     exiting = true;
+    // Gate render() before anything else so no late frame follows the terminal-restore write below.
+    terminalRestored = true;
     // Exit lets the spoken audio the user is already hearing finish inside a
     // short bounded window (capped inside stopForExit) instead of killing the
     // player mid-drain; queued-but-unplayed speech is dropped. Deliberate
@@ -263,8 +267,7 @@ async function main() {
     stdout.removeListener('resize', resizeHandler);
     process.removeListener('SIGINT', sigintHandler);
     process.removeListener('unhandledRejection', unhandledRejectionHandler);
-    const exitScreen = cli.flags.noAltScreen ? CLEAR_SCREEN : CLEAR_SCREEN + ALT_SCREEN_EXIT;
-    allowTerminalWrite(() => stdout.write(PASTE_DISABLE + KEYBOARD_EXT_DISABLE + MOUSE_DISABLE + FOCUS_DISABLE + CURSOR_SHOW + exitScreen));
+    allowTerminalWrite(() => stdout.write(buildExitSequence(cli.flags.noAltScreen)));
     terminalOutputGuard.dispose();
     stdin.setRawMode(false);
     // The terminal is already restored above; only the process exit waits for
@@ -388,7 +391,7 @@ async function main() {
   commandContext.scrollToLine = scrollToLine;
   commandContext.clearScreen = () => {
     compositor.resetDiff();
-    allowTerminalWrite(() => stdout.write(CLEAR_SCREEN));
+    allowTerminalWrite(() => stdout.write(CLEAR_VIEWPORT_HOME));
     render();
   };
   commandContext.toggleActivitySidebar = () => {
@@ -472,6 +475,8 @@ async function main() {
   };
 
   const render = () => {
+    // The terminal has already been handed back to the shell; never paint another frame over it.
+    if (terminalRestored) return;
     const { width, height } = getTerminalSize(stdout);
 
     // Fire-and-forget refresh for the 'Coming up' sidebar section.
@@ -685,7 +690,7 @@ async function main() {
   stdin.setRawMode(true);
   stdin.resume();
   stdin.setEncoding('utf8');
-  allowTerminalWrite(() => { markFocusModeEnabled(); return stdout.write((cli.flags.noAltScreen ? '' : ALT_SCREEN_ENTER) + CLEAR_SCREEN + CURSOR_HIDE + MOUSE_ENABLE + KEYBOARD_EXT_ENABLE + PASTE_ENABLE + FOCUS_ENABLE); });
+  allowTerminalWrite(() => { markFocusModeEnabled(); return stdout.write(buildEnterSequence(cli.flags.noAltScreen)); });
 
   // Forced dark/light before first paint; auto (TTY) probes + repaints once if light.
   const themeProbe = installStartupThemeProbe({
@@ -710,6 +715,7 @@ async function main() {
       data,
       pendingPermission,
       recoveryPending,
+      pendingWorkspaceRegistration,
       abortTurn: () => orchestrator.abort(),
       conversation,
       systemMessageRouter,
@@ -717,8 +723,7 @@ async function main() {
       loadRecoveryConversation: () => loadRecoveryConversation({ homeDirectory }),
       deleteRecoveryFile: () => deleteRecoveryFile({ homeDirectory }),
     });
-    pendingPermission = blocking.pendingPermission;
-    recoveryPending = blocking.recoveryPending;
+    ({ pendingPermission, recoveryPending, pendingWorkspaceRegistration } = blocking);
     if (blocking.handled) {
       return;
     }
@@ -760,7 +765,7 @@ async function main() {
 
   // Wire streaming-speed metrics, auto-save, and recovery — all run after the
   // first render so they land as ambient context, never startup blockers.
-  ({ recoveryInterval, recoveryPending } = wireSessionPersistenceAndRecovery({
+  ({ recoveryInterval, recoveryPending, pendingWorkspaceRegistration } = wireSessionPersistenceAndRecovery({
     buildCurrentSessionSnapshot,
     runtime,
     conversation,