@pellux/goodvibes-agent 1.9.0 → 1.10.0

package/src/input/settings-modal.ts

@@ -1,6 +1,6 @@
 /** SettingsModal state for the /settings and /config fullscreen workspace. */
 
-import { CONFIG_SCHEMA, type ConfigKey, type PersistedFlagState } from '@pellux/goodvibes-sdk/platform/config';
+import { CONFIG_SCHEMA, type ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import type { ModelPickerTarget } from './model-picker.ts';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { SubscriptionManager } from '@pellux/goodvibes-sdk/platform/config';
@@ -24,7 +24,9 @@ import {
   THEME_MODE_SYNTHETIC_SETTING,
 } from '../renderer/theme-mode-config.ts';
 import type { FeatureFlagManager } from '@/runtime/index.ts';
-import type { FeatureFlag, FlagState } from '@/runtime/index.ts';
+import type { FlagState } from '@/runtime/index.ts';
+import { FEATURE_SETTINGS } from '@/runtime/index.ts';
+import { isFeatureEnabledInConfig, resolveFeatureEnablementWrite } from '../runtime/feature-enablement.ts';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
@@ -98,7 +100,7 @@ export class SettingsModal {
   /** Settings grouped by category. */
   public groups: Map<SettingsCategory, SettingEntry[]> = new Map();
 
-  /** Feature flag entries (populated when flags tab is active). */
+  /** Feature entries grouped by settings domain (populated when the features tab is active). */
   public flagEntries: FlagEntry[] = [];
   /** MCP server trust entries (populated when mcp tab is active). */
   public mcpEntries: McpEntry[] = [];
@@ -393,7 +395,7 @@ export class SettingsModal {
 
     if (this.currentCategory === 'flags') {
       const flagEntry = this.getSelectedFlag();
-      if (!flagEntry || flagEntry.state === 'killed' || !this.featureFlagManager || !this.configManager) return;
+      if (!flagEntry || flagEntry.state === 'killed' || !this.configManager) return;
       const targetState: FlagState = direction === 'right' ? 'enabled' : 'disabled';
       if (flagEntry.state !== targetState) this._setSelectedFlagState(flagEntry, targetState);
       return;
@@ -448,47 +450,41 @@ export class SettingsModal {
   }
 
   /**
-   * Toggle the currently selected feature flag.
+   * Toggle the currently selected feature by writing its enablement domain
+   * settings key (there is no separate enablement namespace). The live
+   * settings bridge propagates the change into the gate manager; features
+   * that require a restart record an honest pending-restart state instead.
    *
-   * Killed flags cannot be toggled. Non-runtimeToggleable flags are saved as
-   * overrides for the next Agent launch or owning-host reload; runtimeToggleable
-   * flags toggle immediately.
+   * Killed features cannot be toggled. Always-available features (constant
+   * enablement) refuse with guidance naming their real settings keys.
    */
   toggleSelectedFlag(): void {
     const flagEntry = this.getSelectedFlag();
-    if (!flagEntry || !this.featureFlagManager || !this.configManager) return;
+    if (!flagEntry || !this.configManager) return;
 
-    const { flag, state } = flagEntry;
+    // Killed features are blocked
+    if (flagEntry.state === 'killed') return;
 
-    // Killed flags are blocked
-    if (state === 'killed') return;
-
-    const newState: FlagState = state === 'enabled' ? 'disabled' : 'enabled';
+    const newState: FlagState = flagEntry.state === 'enabled' ? 'disabled' : 'enabled';
 
     this._setSelectedFlagState(flagEntry, newState);
   }
 
   private _setSelectedFlagState(flagEntry: FlagEntry, newState: FlagState): void {
-    if (!this.featureFlagManager || !this.configManager) return;
-    const { flag } = flagEntry;
+    if (!this.configManager) return;
+    if (newState === 'killed') return;
+    const feature = flagEntry.feature;
 
-    if (!flag.runtimeToggleable) {
-      // Persist to config only; the flag owner applies it on the next run.
-      this._persistFlagState(flag.id, newState, flag.defaultState as FlagState);
-      flagEntry.state = newState;
-    } else {
-      // Toggle immediately in manager
-      try {
-        if (newState === 'enabled') {
-          this.featureFlagManager.enable(flag.id);
-        } else {
-          this.featureFlagManager.disable(flag.id);
-        }
-        this._persistFlagState(flag.id, newState, flag.defaultState as FlagState);
-        flagEntry.state = newState;
-      } catch (e) {
-        logger.error('SettingsModal: failed to toggle feature flag', { flag: flag.id, error: summarizeError(e) });
-      }
+    try {
+      const write = resolveFeatureEnablementWrite(feature.id, newState === 'enabled' ? 'enabled' : 'disabled');
+      this.configManager.setDynamic(write.key, write.value);
+      this._loadFlagEntries();
+      this.lastSettingEffectMessage = feature.restartRequired
+        ? `${write.key} = ${String(write.value)} saved; takes effect on the next launch.`
+        : `${write.key} = ${String(write.value)}`;
+    } catch (e) {
+      logger.error('SettingsModal: failed to set feature enablement', { feature: feature.id, error: summarizeError(e) });
+      this.lastSettingEffectMessage = `Save failed: ${summarizeError(e)}`;
     }
   }
 
@@ -666,16 +662,37 @@ export class SettingsModal {
     }
   }
 
-  /** Load or refresh the flags tab entries from the feature flag manager. */
+  /**
+   * Load or refresh the features tab from FEATURE_SETTINGS, grouped by
+   * settings domain. State prefers the live gate manager (kill-switch and
+   * pending-restart aware); without a manager it derives from the feature's
+   * bound domain settings key.
+   */
   private _loadFlagEntries(): void {
-    if (!this.featureFlagManager) {
+    if (!this.configManager) {
       this.flagEntries = [];
       return;
     }
-    this.flagEntries = Array.from(this.featureFlagManager.getAll().values()).map(({ flag, state }) => ({
-      flag,
-      state,
-    }));
+    const configManager = this.configManager;
+    const managerStates = this.featureFlagManager?.getAll() ?? null;
+    this.flagEntries = FEATURE_SETTINGS
+      .map((feature, declarationIndex) => {
+        const managed = managerStates?.get(feature.id);
+        const derivedState: FlagState = isFeatureEnabledInConfig(configManager, feature.id) ? 'enabled' : 'disabled';
+        return {
+          entry: {
+            feature,
+            state: managed?.state ?? derivedState,
+            enablementValue: String(configManager.get(feature.enablement.key)),
+          },
+          declarationIndex,
+        };
+      })
+      .sort((left, right) => (
+        left.entry.feature.domain.localeCompare(right.entry.feature.domain)
+        || left.declarationIndex - right.declarationIndex
+      ))
+      .map(({ entry }) => entry);
   }
 
   private _loadMcpEntries(): void {
@@ -697,28 +714,6 @@ export class SettingsModal {
     this.subscriptionEntries = buildSubscriptionEntries(this.subscriptionManager, this.serviceRegistry);
   }
 
-  /**
-   * Persist a flag state override to config.
-   * Deletes the entry when reverting to defaultState. Skips killed state.
-   */
-  private _persistFlagState(flagId: string, newState: FlagState, defaultState: FlagState): void {
-    if (!this.configManager) return;
-    if (newState === 'killed') return; // never persist killed state
-
-    try {
-      const current = (this.configManager.getCategory('featureFlags') as Record<string, PersistedFlagState>) ?? {};
-      if (newState === defaultState) {
-        // Revert to default — remove override
-        delete current[flagId];
-      } else {
-        current[flagId] = newState;
-      }
-      this.configManager.mergeCategory('featureFlags', current);
-    } catch (e) {
-      logger.error('SettingsModal: failed to persist flag state', { flagId, error: summarizeError(e) });
-    }
-  }
-
   /** Returns [] for the flags category (flags use flagEntries instead). */
   private _currentItems(): SettingEntry[] {
     if (this.currentCategory === 'flags' || this.currentCategory === 'mcp' || this.currentCategory === 'subscriptions') return [];

package/src/main.ts

@@ -28,7 +28,7 @@ import { createShellLayout } from './renderer/layout-engine.ts';
 import { buildShellFooter, estimateShellFooterHeight } from './renderer/shell-surface.ts';
 import { buildConversationViewport } from './renderer/conversation-layout.ts';
 import { applyConversationOverlays } from './renderer/conversation-overlays.ts';
-import { buildActivitySidebarLines, resolveActivitySidebarWidth } from './renderer/activity-sidebar.ts';
+import { buildActivitySidebarLines, buildSidebarAgentRows, resolveActivitySidebarWidth } from './renderer/activity-sidebar.ts';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { bootstrapRuntime } from './runtime/bootstrap.ts';
 import type { BootstrapContext } from './runtime/bootstrap.ts';
@@ -52,7 +52,8 @@ import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import { installFocusModeExitGuard, markFocusModeEnabled, wrapRequestPermissionWithApprovalAlert } from './shell/terminal-focus-mode.ts';
 import { CLEAR_VIEWPORT_HOME, buildEnterSequence, buildExitSequence } from './renderer/terminal-escapes.ts';
 import { prepareShellCliRuntime } from './cli/entrypoint.ts';
-import { applyInitialTuiCliState, formatFatalStartupErrorForLog, formatFatalStartupErrorForUser, getInteractiveTerminalLaunchError } from './cli/tui-startup.ts';
+import { selfUpdateAtLaunch } from './cli/launch-auto-update.ts';
+import { applyInitialTuiCliState, getInteractiveTerminalLaunchError, reportFatalStartupError } from './cli/tui-startup.ts';
 import { wireSpokenTurnRuntime } from './audio/spoken-turn-wiring.ts';
 import { createUnhandledRejectionHandler } from './runtime/unhandled-rejection-guard.ts';
 import { attachSpokenTurnModelRouting, createSpokenTurnInputOptions } from './audio/spoken-turn-model-routing.ts';
@@ -84,6 +85,10 @@ async function main() {
     process.exit(2);
   }
 
+  // Launch-time self-update, before any bootstrap or terminal mode change; on
+  // an installed update this restarts onto the swapped binary and never returns.
+  const launchUpdateLines = await selfUpdateAtLaunch({ configManager, stdout });
+
   const ctx: BootstrapContext = await bootstrapRuntime(stdout, {
     configManager,
     workingDir: bootstrapWorkingDir,
@@ -126,6 +131,10 @@ async function main() {
   });
   let activeConversationWidth = getTerminalSize(stdout).width;
   conversation.setWidthProvider(() => activeConversationWidth);
+
+  // Re-surface pre-bootstrap launch-update lines in-session (the alternate
+  // screen wipes the stdout copies written before the renderer existed).
+  for (const line of launchUpdateLines) systemMessageRouter.high(`[Update] ${line}`);
   {
     const hitlMode = configManager.get('behavior.hitlMode') as HITLMode | undefined;
     if (hitlMode && (hitlMode === 'quiet' || hitlMode === 'balanced' || hitlMode === 'operator')) {
@@ -622,17 +631,15 @@ async function main() {
       contextWindow: currentModel.contextWindow,
     });
 
-    // Activity sidebar (ambient status on wide terminals)
+    // Activity sidebar (ambient status on wide terminals). Agent rows carry
+    // the fleet read-model's headline and stall tell (see activity-sidebar.ts).
     const sidebar = sidebarWidth > 0
       ? {
           lines: buildActivitySidebarLines({
             now: {
               busy: orchestrator.isThinking,
               label: sessionSnapshot.streamToolPreview?.trim() || undefined,
-              agents: activeAgents.slice(0, 3).map((agent) => ({
-                label: agent.label,
-                progress: agent.latestProgress?.trim() || undefined,
-              })),
+              agents: buildSidebarAgentRows(activeAgents, ctx.services.processRegistry.query().nodes),
               processes: runningProcessCount,
             },
             needsYou: pendingPermission
@@ -781,20 +788,12 @@ async function main() {
   }));
 }
 main().catch((err: unknown) => {
-  const detail = formatFatalStartupErrorForLog(err);
-  try {
-    logger.error('Fatal error', { error: detail });
-  } catch {
-    // Startup diagnostics must never hide the original launch failure.
-  }
-  const userDetail = formatFatalStartupErrorForUser(err, {
+  reportFatalStartupError(err, {
     binary: 'goodvibes-agent',
     debug: process.env['GOODVIBES_AGENT_DEBUG'] === '1',
+  }, {
+    logError: (message, context) => logger.error(message, context),
+    writeStderr: (chunk) => process.stderr.write(chunk),
+    exit: (code) => process.exit(code),
   });
-  try {
-    process.stderr.write(`goodvibes-agent failed to launch:\n${userDetail}\n`);
-  } catch {
-    // Ignore secondary stderr failures during process teardown.
-  }
-  process.exit(1);
 });

package/src/renderer/activity-sidebar.ts

@@ -28,12 +28,57 @@ export interface ActivitySidebarNow {
   readonly busy: boolean;
   /** Short human label for the current work, e.g. "Searching the web…". */
   readonly label?: string;
-  /** Background agents with their latest progress lines. */
-  readonly agents: ReadonlyArray<{ readonly label: string; readonly progress?: string }>;
+  /**
+   * Background agents with their latest progress lines. `headline` is the
+   * fleet read-model's per-node headline (derived from task/phase identity
+   * only, replaced in place — never a feed) and wins over the raw progress
+   * line when present; `quietForMs` is the fleet stall tell (pure timestamp
+   * comparison), rendered as a quiet-duration marker.
+   */
+  readonly agents: ReadonlyArray<{
+    readonly label: string;
+    readonly progress?: string;
+    readonly headline?: string;
+    readonly quietForMs?: number;
+  }>;
   /** Count of running background processes. */
   readonly processes: number;
 }
 
+/**
+ * Join active agents with the fleet read-model's nodes (matched by id) into
+ * sidebar rows: the per-node headline (task/phase identity only — replaced
+ * in place, never a feed) wins over the raw progress line, and the stall
+ * tell renders as a quiet-duration marker.
+ */
+export function buildSidebarAgentRows(
+  activeAgents: ReadonlyArray<{ readonly id: string; readonly label: string; readonly latestProgress?: string | undefined }>,
+  fleetNodes: ReadonlyArray<{
+    readonly id: string;
+    readonly headline?: { readonly text: string } | undefined;
+    readonly stall?: { readonly quietForMs: number } | undefined;
+  }>,
+): ActivitySidebarNow['agents'] {
+  const nodesById = new Map(fleetNodes.map((node) => [node.id, node]));
+  return activeAgents.slice(0, 3).map((agent) => {
+    const node = nodesById.get(agent.id);
+    return {
+      label: agent.label,
+      progress: agent.latestProgress?.trim() || undefined,
+      headline: node?.headline?.text,
+      quietForMs: node?.stall?.quietForMs,
+    };
+  });
+}
+
+/** Compact quiet-duration text for the stall tell, e.g. "quiet 4m". */
+function fmtQuietFor(quietForMs: number): string {
+  const minutes = Math.floor(quietForMs / 60_000);
+  if (minutes < 60) return `quiet ${Math.max(1, minutes)}m`;
+  const hours = Math.floor(minutes / 60);
+  return `quiet ${hours}h${minutes % 60 > 0 ? ` ${minutes % 60}m` : ''}`;
+}
+
 export interface ActivitySidebarView {
   readonly now: ActivitySidebarNow;
   /** Plain-language items waiting on the user (approvals, prompts). */
@@ -124,10 +169,14 @@ export function buildActivitySidebarLines(
       ]));
     }
     for (const agent of view.now.agents.slice(0, 3)) {
-      const text = agent.progress ? `${agent.label} — ${agent.progress}` : agent.label;
+      const detail = agent.headline ?? agent.progress;
+      const text = detail ? `${agent.label} — ${detail}` : agent.label;
+      const quiet = agent.quietForMs !== undefined ? ` ${fmtQuietFor(agent.quietForMs)}` : '';
+      const room = Math.max(4, width - 4 - getDisplayWidth(quiet));
       push(buildPanelLine(width, [
         [' » ', C.info],
-        [truncateDisplay(text, Math.max(4, width - 4)), C.dim],
+        [truncateDisplay(text, room), C.dim],
+        ...(quiet ? [[quiet, C.warn] as [string, string]] : []),
       ]));
     }
     if (view.now.processes > 0) {

package/src/renderer/settings-modal-helpers.ts

@@ -117,6 +117,8 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   fetch: 'Fetch Safety',
   security: 'Token Rotation',
   integrations: 'Delivery Reliability',
+  update: 'Daemon Updates',
+  pricing: 'Model Pricing',
 };
 
 export const SETTING_LABELS: Partial<Record<string, string>> = {

package/src/renderer/settings-modal.ts

@@ -42,7 +42,7 @@ const CATEGORY_INFO: Record<SettingsCategory, string> = {
   web: 'Web companion surface settings including host, port, public URL, and static asset path.',
   watchers: 'Polling watcher and heartbeat behavior for runtime recovery and periodic checks.',
   network: 'Outbound TLS and remote fetch network policy.',
-  relay: 'Outbound zero-knowledge relay reachability for the connected GoodVibes daemon: an end-to-end encrypted tunnel (ECDH P-256 -> HKDF -> AES-256-GCM) that terminates INSIDE the daemon, so the relay operator only ever sees ciphertext plus connection metadata (who paired with whom, byte counts, timing) — never plaintext requests, responses, or the operator token. Default off, and gated by the relay-connect feature flag in addition to relay.enabled. These are the connected daemon\'s own settings (imported here, not live-shared): changing them in Agent does not itself start or stop the daemon\'s relay registration.',
+  relay: 'Outbound zero-knowledge relay reachability for the connected GoodVibes daemon: an end-to-end encrypted tunnel (ECDH P-256 -> HKDF -> AES-256-GCM) that terminates INSIDE the daemon, so the relay operator only ever sees ciphertext plus connection metadata (who paired with whom, byte counts, timing) — never plaintext requests, responses, or the operator token. relay.enabled is the relay-connect feature\'s switch. These are the connected daemon\'s own settings (imported here, not live-shared): changing them in Agent does not itself start or stop the daemon\'s relay registration.',
   orchestration: 'Visible agent orchestration limits such as recursion and active-agent caps.',
   planner: 'Planning-decomposition agent limits: decomposition strategy, max turns, token ceiling, and wall-clock timeout before falling back to the deterministic heuristic path.',
   daemon: 'Whether the local session daemon runs, and whether it is embedded in this surface process instead of spawned as a detached background service.',
@@ -56,8 +56,10 @@ const CATEGORY_INFO: Record<SettingsCategory, string> = {
   mcp: 'MCP server trust and scope review. Trust changes can expose local files, tools, databases, browsers, or remote automation depending on the server.',
   surfaces: 'Messaging and notification channel accounts such as Slack, Discord, ntfy, Telegram, chat bridges, and delivery providers.',
   release: 'Update-channel preference.',
+  update: "Connected-host self-update posture: whether the daemon checks for, verifies, and swaps in new releases on its own, how often it checks, and where releases are resolved from. The daemon applies these itself; the Agent only edits the shared keys.",
+  pricing: 'Manual model prices (USD per 1M tokens, keyed provider:model). A manual price outranks registration, provider-served, and catalog prices in the one pricing resolver; unknown models stay honestly unpriced.',
   tools: 'Tool LLM and helper model routing. Empty provider/model values inherit the active chat route unless a specific helper/tool route is set.',
-  flags: 'Feature controls for optional behavior that can be enabled or disabled separately from normal configuration.',
+  flags: 'Every optional capability grouped by its settings domain: each feature is switched through a first-class domain settings key (shown per row), with its full description and related settings under the cursor.',
   atRest: 'Data-at-rest protection: whether stored content is redacted, and retention limits by age and total size.',
   learning: 'Idle-time memory consolidation: dedupe merges, confidence decay of never-referenced records, and review proposals. Off by default.',
   agents: 'Agent runtime tuning: the context-window fraction that triggers sub-agent conversation compaction, and the token budget, relevance floor, and code-chunk limit for per-turn passive knowledge/code injection.',
@@ -197,22 +199,32 @@ function formatSubscriptionRoute(route: SubscriptionEntry['activeRoute'] | Subsc
   return route ? formatProviderAuthRouteId(route) : 'n/a';
 }
 
+function describeFeatureEnablement(entry: FlagEntry): string {
+  const { key, kind, enabledValues } = entry.feature.enablement;
+  if (kind === 'boolean') return `Switch: ${key} (true/false).`;
+  if (kind === 'enum') return `Switch: ${key} — active while set to ${(enabledValues ?? []).join(' or ')}.`;
+  return `Always available; its settings (${entry.feature.settings.join(', ')}) govern runtime activation directly.`;
+}
+
 function buildFlagContext(entry: FlagEntry | null): string[] {
   if (!entry) return ['Feature Controls', 'No feature control is selected.'];
   return [
-    entry.flag.name,
-    `ID: ${entry.flag.id}`,
+    entry.feature.name,
+    `ID: ${entry.feature.id}`,
+    `Domain: ${entry.feature.domain}`,
     `State: ${entry.state}`,
-    `Default: ${entry.flag.defaultState}`,
-    `Tier: ${entry.flag.tier}`,
-    `Live toggleable: ${entry.flag.runtimeToggleable ? 'yes' : 'no'}`,
+    `Default: ${entry.feature.defaultEnabled ? 'enabled' : 'disabled'}`,
+    `Current value: ${entry.feature.enablement.key} = ${entry.enablementValue}`,
+    `Live toggleable: ${entry.feature.restartRequired ? 'no' : 'yes'}`,
+    '',
+    entry.feature.description,
     '',
-    entry.flag.description,
-    ...(entry.state === 'killed' && entry.flag.killReason ? ['', `Kill reason: ${entry.flag.killReason}`] : []),
+    describeFeatureEnablement(entry),
+    `Settings: ${entry.feature.settings.join(', ')}`,
     '',
-    entry.flag.runtimeToggleable
-      ? 'Impact: changes apply immediately and are also persisted as an override when they differ from the default.'
-      : 'Impact: this override is saved for the next Agent launch or owning-host reload, depending on who owns the flag.',
+    entry.feature.restartRequired
+      ? 'Impact: the domain settings key is saved now and takes effect on the next Agent launch or owning-host reload.'
+      : 'Impact: changes to the domain settings key apply immediately through the live settings bridge.',
   ];
 }
 
@@ -388,25 +400,25 @@ function renderSettingRows(modal: SettingsModal, width: number, height: number):
 function renderFlagRows(modal: SettingsModal, width: number, height: number): string[] {
   const rows: string[] = [];
   const items = modal.flagEntries;
-  if (items.length === 0) return ['No feature flags registered.'];
+  if (items.length === 0) return ['No features registered.'];
   const selectedIndex = clamp(modal.selectedIndex, 0, items.length - 1);
-  const nameWidth = clamp(Math.floor(width * 0.40), 24, 58);
+  const nameWidth = clamp(Math.floor(width * 0.34), 22, 52);
   const stateWidth = 10;
-  const tierWidth = 6;
+  const domainWidth = 13;
   const runtimeWidth = 10;
   const defaultWidth = 9;
-  const idWidth = Math.max(12, width - nameWidth - stateWidth - tierWidth - runtimeWidth - defaultWidth - 14);
-  rows.push(`  ${padDisplay('Feature Flag', nameWidth)}  ${padDisplay('State', stateWidth)}  ${padDisplay('Tier', tierWidth)}  ${padDisplay('Applies', runtimeWidth)}  ${padDisplay('Default', defaultWidth)}  ${padDisplay('ID', idWidth)}`);
+  const settingWidth = Math.max(16, width - nameWidth - stateWidth - domainWidth - runtimeWidth - defaultWidth - 14);
+  rows.push(`  ${padDisplay('Feature', nameWidth)}  ${padDisplay('State', stateWidth)}  ${padDisplay('Domain', domainWidth)}  ${padDisplay('Applies', runtimeWidth)}  ${padDisplay('Default', defaultWidth)}  ${padDisplay('Setting', settingWidth)}`);
   const visibleCount = Math.max(1, height - 2);
   const window = stableWindow(items.length, selectedIndex, visibleCount);
-  if (window.start > 0) rows.push(`${GLYPHS.navigation.moreAbove} ${window.start} more flag(s) above`);
+  if (window.start > 0) rows.push(`${GLYPHS.navigation.moreAbove} ${window.start} more feature(s) above`);
   for (let index = window.start; index < window.end; index += 1) {
     const entry = items[index]!;
     const selected = index === selectedIndex;
     const marker = selected ? (modal.focusPane === 'settings' ? GLYPHS.navigation.selected : '•') : ' ';
-    rows.push(`${marker} ${padDisplay(entry.flag.name, nameWidth)}  ${padDisplay(entry.state, stateWidth)}  ${padDisplay(String(entry.flag.tier), tierWidth)}  ${padDisplay(entry.flag.runtimeToggleable ? 'now' : 'next run', runtimeWidth)}  ${padDisplay(entry.flag.defaultState, defaultWidth)}  ${padDisplay(entry.flag.id, idWidth)}`);
+    rows.push(`${marker} ${padDisplay(entry.feature.name, nameWidth)}  ${padDisplay(entry.state, stateWidth)}  ${padDisplay(entry.feature.domain, domainWidth)}  ${padDisplay(entry.feature.restartRequired ? 'next run' : 'now', runtimeWidth)}  ${padDisplay(entry.feature.defaultEnabled ? 'enabled' : 'disabled', defaultWidth)}  ${padDisplay(`${entry.feature.enablement.key}=${entry.enablementValue}`, settingWidth)}`);
   }
-  if (window.end < items.length) rows.push(`${GLYPHS.navigation.moreBelow} ${items.length - window.end} more flag(s) below`);
+  if (window.end < items.length) rows.push(`${GLYPHS.navigation.moreBelow} ${items.length - window.end} more feature(s) below`);
   return rows.slice(0, height);
 }
 
@@ -478,7 +490,7 @@ function footerText(modal: SettingsModal): string {
   if (modal.focusPane === 'categories') return 'Focus categories · Up/Down choose · Right/Enter settings · Tab pane · Esc close';
   if (modal.currentCategory === 'subscriptions') return 'Focus settings · Up/Down provider · Left categories · Tab pane · Enter review/sign out · Esc close';
   if (modal.currentCategory === 'mcp') return 'Focus settings · Up/Down server · Left categories · Tab pane · Enter edit trust · Esc close';
-  if (modal.currentCategory === 'flags') return 'Focus feature flags · Up/Down flag · Left categories · Tab pane · Enter/Space toggle · Esc close';
+  if (modal.currentCategory === 'flags') return 'Focus features · Up/Down feature · Left categories · Tab pane · Enter/Space toggle · Esc close';
   const selected = modal.getSelected();
   if (selected && isExternalHostOwnedSettingKey(selected.setting.key)) {
     return 'Read-only connected-host setting · Change from GoodVibes TUI or the owning host · Esc close';
@@ -495,9 +507,9 @@ export function renderSettingsModalPackageText(): string {
     'Type',
     'Source',
     'Default',
-    'Feature Flag',
+    'Feature',
     'State',
-    'Tier',
+    'Domain',
     'Applies',
     'Server',
     'Trust',
@@ -509,7 +521,7 @@ export function renderSettingsModalPackageText(): string {
     'OAuth',
     'Note',
     'No settings in this category.',
-    'No feature flags registered.',
+    'No features registered.',
     'No MCP servers registered.',
     'No provider subscriptions available or configured.',
     'No setting is selected in this category.',
@@ -531,7 +543,7 @@ export function renderSettingsModalPackageText(): string {
     'Focus categories · Up/Down choose · Right/Enter settings · Tab pane · Esc close',
     'Focus settings · Up/Down provider · Left categories · Tab pane · Enter review/sign out · Esc close',
     'Focus settings · Up/Down server · Left categories · Tab pane · Enter edit trust · Esc close',
-    'Focus feature flags · Up/Down flag · Left categories · Tab pane · Enter/Space toggle · Esc close',
+    'Focus features · Up/Down feature · Left categories · Tab pane · Enter/Space toggle · Esc close',
     'Read-only connected-host setting · Change from GoodVibes TUI or the owning host · Esc close',
     'Focus settings · Up/Down setting · Left categories · Tab pane · Enter/Space edit/toggle · R reset · Esc close',
   ];

package/src/runtime/bootstrap-core.ts

@@ -17,7 +17,7 @@ import type { OrchestratorUserInputOptions } from '../core/orchestrator.ts';
 import type { ControlPlaneRecentEvent } from '@pellux/goodvibes-sdk/platform/control-plane';
 import type { MutableRuntimeState } from '@/runtime/index.ts';
 import type { BootstrapOptions } from './context.ts';
-import { createFeatureFlagManager } from '@/runtime/index.ts';
+import { createFeatureFlagManager, deriveFeatureStates, bindFeatureSettingsBridge } from '@/runtime/index.ts';
 import { RuntimeEventBus } from '@/runtime/index.ts';
 import type { SessionEvent } from '@/runtime/index.ts';
 import { emitPermissionModeChanged } from '@pellux/goodvibes-sdk/platform/runtime/emitters';
@@ -178,10 +178,12 @@ export async function initializeBootstrapCore(
   const homeDirectory = options.homeDirectory;
   const configManager = options.configManager;
 
+  // Gate states derive from domain settings keys (behavior.*, sandbox.*, ...);
+  // the featureFlags config category no longer exists. The live bridge keeps
+  // config.set changes on those keys flowing into the manager afterwards.
   const featureFlags = createFeatureFlagManager();
-  featureFlags.loadFromConfig({
-    flags: (configManager.getCategory('featureFlags') as Record<string, import('@/runtime/index.ts').FlagState>) ?? {},
-  });
+  featureFlags.loadFromConfig({ flags: deriveFeatureStates(configManager) });
+  bindFeatureSettingsBridge(configManager, featureFlags);
 
   const userSessionId = `user-${generateUserSessionId()}`;
   // Declared here, before createRuntimeServices, so the checkpoint manager can be
@@ -367,6 +369,11 @@ export async function initializeBootstrapCore(
   // everything set here.
   const agentOrchestratorToolDeps = {
     surfaceRoot: GOODVIBES_AGENT_SURFACE_ROOT,
+    // Same instances services.ts wired at construction — setDependencies()
+    // fully replaces, so the localhost fetch ask and the announce-once
+    // containment receipt must be replayed here or they silently vanish.
+    localhostFetchApproval: services.localhostFetchApproval,
+    onSandboxedRun: services.onSandboxedRun,
     fileCache,
     projectIndex,
     workingDirectory: services.workingDirectory,
@@ -585,6 +592,10 @@ export async function initializeBootstrapCore(
     policyRuntimeState,
     services.hookDispatcher,
     featureFlags,
+    // Durable user-origin permission rules (remembered approvals), mirroring
+    // the SDK composition root: "always allow" style decisions persist across
+    // restarts and are listable/deletable via permissions.rules.*.
+    services.userPermissionRuleStore,
   );
   installPermissionManagerSafetyGuard(permissionManager);
   // Wire permissionManager into the SAME AgentOrchestrator instance that runs
@@ -630,7 +641,7 @@ export async function initializeBootstrapCore(
     },
   }).catch((err) => { logger.debug('session broker create session failed at bootstrap', { err }); });
 
-  // W2A: mirror the create into the daemon spine (fire-and-forget; the local
+  // Mirror the create into the daemon spine (fire-and-forget; the local
   // broker above stays the source of truth). kind:'agent' is the canonical record
   // identity; participant.surfaceKind stays 'service' (the TRANSPORT axis).
   services.sessionSpineClient.register({