@pellux/goodvibes-tui 0.19.33 → 0.19.35

package/src/input/onboarding/onboarding-wizard-cloudflare.ts

@@ -0,0 +1,204 @@
+import {
+  CLOUDFLARE_COMPONENT_IDS,
+  CLOUDFLARE_COMPONENT_LABELS,
+  DEFAULT_CLOUDFLARE_COMPONENT_SELECTION,
+  type CloudflareBatchMode,
+  type CloudflareComponent,
+  type CloudflareComponentSelection,
+  type CloudflareProvisionRequest,
+} from '../../runtime/cloudflare-control-plane.ts';
+import { buildGoodVibesSecretRef, normalizeText } from './onboarding-wizard-helpers.ts';
+import type { OnboardingWizardController } from './onboarding-wizard.ts';
+import type { OnboardingWizardRadioOption } from './onboarding-wizard-types.ts';
+
+export const CLOUDFLARE_SETUP_SOURCE_OPTIONS: readonly OnboardingWizardRadioOption[] = [
+  {
+    id: 'save-only',
+    label: 'Save settings only',
+    hint: 'Persist Cloudflare fields without passing a token to the daemon. Provision later from the Cloudflare command or settings.',
+  },
+  {
+    id: 'bootstrap-token',
+    label: 'Paste temporary bootstrap token',
+    hint: 'Use a short-lived Cloudflare token once. The SDK creates and stores a narrower GoodVibes operational token.',
+  },
+  {
+    id: 'bootstrap-env',
+    label: 'Read bootstrap token from environment',
+    hint: 'Read a temporary token from an environment variable and pass it once to the SDK. The value is not stored.',
+  },
+  {
+    id: 'operational-token',
+    label: 'Paste final operational token',
+    hint: 'Use a token you already created. The SDK can store it as a GoodVibes secret during provisioning.',
+  },
+  {
+    id: 'operational-env',
+    label: 'Use final token from environment',
+    hint: 'Use an environment-backed token reference such as CLOUDFLARE_API_TOKEN.',
+  },
+];
+
+export const CLOUDFLARE_BATCH_MODE_OPTIONS: readonly OnboardingWizardRadioOption[] = [
+  {
+    id: 'off',
+    label: 'Off',
+    hint: 'Keep daemon requests on the immediate local path. Cloudflare resource settings can still be saved.',
+  },
+  {
+    id: 'explicit',
+    label: 'Explicit batch only',
+    hint: 'Only requests explicitly marked for batch execution use the configured batch path.',
+  },
+  {
+    id: 'eligible-by-default',
+    label: 'Eligible requests batch by default',
+    hint: 'Batch-capable daemon work can use the configured batch path unless the caller opts out.',
+  },
+];
+
+export const CLOUDFLARE_YES_NO_OPTIONS: readonly OnboardingWizardRadioOption[] = [
+  { id: 'yes', label: 'Yes', hint: 'Enable this behavior.' },
+  { id: 'no', label: 'No', hint: 'Leave this behavior off.' },
+];
+
+export const CLOUDFLARE_PROVISION_OPTIONS: readonly OnboardingWizardRadioOption[] = [
+  {
+    id: 'no',
+    label: 'No, save configuration only',
+    hint: 'Final Apply saves the settings. Use the Cloudflare command or this wizard later to provision resources.',
+  },
+  {
+    id: 'yes',
+    label: 'Yes, create or update Cloudflare resources',
+    hint: 'Final Apply asks the daemon SDK route to create/update selected Cloudflare resources and verify the Worker when possible.',
+  },
+];
+
+export type CloudflareSetupSource =
+  | 'save-only'
+  | 'bootstrap-token'
+  | 'bootstrap-env'
+  | 'operational-token'
+  | 'operational-env';
+
+export function cloudflareComponentFieldId(component: CloudflareComponent): string {
+  return `cloudflare.component.${component}`;
+}
+
+export function cloudflareComponentLabel(component: CloudflareComponent): string {
+  return CLOUDFLARE_COMPONENT_LABELS[component];
+}
+
+export function isCloudflareConfigured(controller: OnboardingWizardController): boolean {
+  const config = controller.runtimeSnapshot?.config.cloudflare;
+  if (!config) return false;
+  return config.enabled
+    || normalizeText(config.accountId).length > 0
+    || normalizeText(config.apiTokenRef).length > 0
+    || normalizeText(config.workerBaseUrl).length > 0
+    || normalizeText(config.workerName).length > 0;
+}
+
+export function shouldShowCloudflareStep(controller: OnboardingWizardController): boolean {
+  return controller.isCapabilitySelected('cloudflare-batch') || isCloudflareConfigured(controller);
+}
+
+export function getCloudflareSetupSource(controller: OnboardingWizardController): CloudflareSetupSource {
+  const configuredTokenRef = controller.runtimeSnapshot?.config.cloudflare.apiTokenRef ?? '';
+  const defaultValue = configuredTokenRef.startsWith('goodvibes://secrets/env/') ? 'operational-env' : 'save-only';
+  const value = controller.getStringFieldValue('cloudflare.setup-source', defaultValue);
+  if (
+    value === 'bootstrap-token'
+    || value === 'bootstrap-env'
+    || value === 'operational-token'
+    || value === 'operational-env'
+    || value === 'save-only'
+  ) {
+    return value;
+  }
+  return 'save-only';
+}
+
+export function getCloudflareComponentSelection(controller: OnboardingWizardController): Record<CloudflareComponent, boolean> {
+  const selected: Record<CloudflareComponent, boolean> = { ...DEFAULT_CLOUDFLARE_COMPONENT_SELECTION };
+  const configured = controller.runtimeSnapshot?.config.cloudflare;
+  for (const component of CLOUDFLARE_COMPONENT_IDS) {
+    const fallback = configured?.enabled === true
+      ? component === 'workers' || component === 'queues'
+      : DEFAULT_CLOUDFLARE_COMPONENT_SELECTION[component];
+    selected[component] = controller.getBooleanFieldValue(cloudflareComponentFieldId(component), fallback);
+  }
+  return selected;
+}
+
+export function getSelectedCloudflareComponents(controller: OnboardingWizardController): CloudflareComponentSelection {
+  return getCloudflareComponentSelection(controller);
+}
+
+export function getCloudflareBatchMode(controller: OnboardingWizardController): CloudflareBatchMode {
+  const value = controller.getStringFieldValue('cloudflare.batch-mode', controller.runtimeSnapshot?.config.batch.mode ?? 'off');
+  return value === 'explicit' || value === 'eligible-by-default' ? value : 'off';
+}
+
+export function buildCloudflareApiTokenRef(envName: string): string {
+  const normalized = normalizeText(envName) || 'CLOUDFLARE_API_TOKEN';
+  return `goodvibes://secrets/env/${encodeURIComponent(normalized)}`;
+}
+
+export function buildCloudflareProvisionRequest(controller: OnboardingWizardController, options: {
+  readonly includeTransientSecrets?: boolean;
+} = {}): CloudflareProvisionRequest {
+  const components = getCloudflareComponentSelection(controller);
+  const setupSource = getCloudflareSetupSource(controller);
+  const accountId = controller.getStringFieldValue('cloudflare.account-id', controller.runtimeSnapshot?.config.cloudflare.accountId ?? '');
+  const zoneId = controller.getStringFieldValue('cloudflare.zone-id', controller.runtimeSnapshot?.config.cloudflare.zoneId ?? '');
+  const zoneName = controller.getStringFieldValue('cloudflare.zone-name', controller.runtimeSnapshot?.config.cloudflare.zoneName ?? '');
+  const apiToken = setupSource === 'operational-token' && options.includeTransientSecrets
+    ? controller.getStringFieldValue('cloudflare.operational-token', '')
+    : '';
+  const apiTokenRef = setupSource === 'operational-env'
+    ? buildCloudflareApiTokenRef(controller.getStringFieldValue('cloudflare.operational-env-name', 'CLOUDFLARE_API_TOKEN'))
+    : controller.runtimeSnapshot?.config.cloudflare.apiTokenRef ?? '';
+
+  return {
+    components,
+    ...(accountId ? { accountId } : {}),
+    ...(zoneId ? { zoneId } : {}),
+    ...(zoneName ? { zoneName } : {}),
+    ...(apiToken ? { apiToken, storeApiToken: true } : {}),
+    ...(!apiToken && apiTokenRef ? { apiTokenRef } : {}),
+    workerName: controller.getStringFieldValue('cloudflare.worker-name', controller.runtimeSnapshot?.config.cloudflare.workerName ?? 'goodvibes-batch-worker'),
+    workerSubdomain: controller.getStringFieldValue('cloudflare.worker-subdomain', controller.runtimeSnapshot?.config.cloudflare.workerSubdomain ?? ''),
+    workerHostname: controller.getStringFieldValue('cloudflare.worker-hostname', controller.runtimeSnapshot?.config.cloudflare.workerHostname ?? ''),
+    workerBaseUrl: controller.getStringFieldValue('cloudflare.worker-base-url', controller.runtimeSnapshot?.config.cloudflare.workerBaseUrl ?? ''),
+    daemonBaseUrl: controller.getStringFieldValue('cloudflare.daemon-base-url', controller.runtimeSnapshot?.config.cloudflare.daemonBaseUrl ?? ''),
+    daemonHostname: controller.getStringFieldValue('cloudflare.daemon-hostname', controller.runtimeSnapshot?.config.cloudflare.daemonHostname ?? ''),
+    queueName: controller.getStringFieldValue('cloudflare.queue-name', controller.runtimeSnapshot?.config.cloudflare.queueName ?? 'goodvibes-batch'),
+    deadLetterQueueName: controller.getStringFieldValue('cloudflare.dead-letter-queue-name', controller.runtimeSnapshot?.config.cloudflare.deadLetterQueueName ?? 'goodvibes-batch-dlq'),
+    tunnelName: controller.getStringFieldValue('cloudflare.tunnel-name', controller.runtimeSnapshot?.config.cloudflare.tunnelName ?? 'goodvibes-daemon'),
+    tunnelId: controller.getStringFieldValue('cloudflare.tunnel-id', controller.runtimeSnapshot?.config.cloudflare.tunnelId ?? ''),
+    tunnelServiceUrl: controller.getStringFieldValue('cloudflare.tunnel-service-url', ''),
+    tunnelTokenRef: controller.getStringFieldValue('cloudflare.tunnel-token-ref', controller.runtimeSnapshot?.config.cloudflare.tunnelTokenRef ?? ''),
+    accessAppId: controller.getStringFieldValue('cloudflare.access-app-id', controller.runtimeSnapshot?.config.cloudflare.accessAppId ?? ''),
+    accessServiceTokenId: controller.getStringFieldValue('cloudflare.access-service-token-id', controller.runtimeSnapshot?.config.cloudflare.accessServiceTokenId ?? ''),
+    accessServiceTokenRef: controller.getStringFieldValue('cloudflare.access-service-token-ref', controller.runtimeSnapshot?.config.cloudflare.accessServiceTokenRef ?? ''),
+    kvNamespaceName: controller.getStringFieldValue('cloudflare.kv-namespace-name', controller.runtimeSnapshot?.config.cloudflare.kvNamespaceName ?? 'goodvibes-runtime'),
+    kvNamespaceId: controller.getStringFieldValue('cloudflare.kv-namespace-id', controller.runtimeSnapshot?.config.cloudflare.kvNamespaceId ?? ''),
+    durableObjectNamespaceName: controller.getStringFieldValue('cloudflare.do-namespace-name', controller.runtimeSnapshot?.config.cloudflare.durableObjectNamespaceName ?? 'GoodVibesCoordinator'),
+    durableObjectNamespaceId: controller.getStringFieldValue('cloudflare.do-namespace-id', controller.runtimeSnapshot?.config.cloudflare.durableObjectNamespaceId ?? ''),
+    r2BucketName: controller.getStringFieldValue('cloudflare.r2-bucket-name', controller.runtimeSnapshot?.config.cloudflare.r2BucketName ?? 'goodvibes-artifacts'),
+    secretsStoreName: controller.getStringFieldValue('cloudflare.secrets-store-name', controller.runtimeSnapshot?.config.cloudflare.secretsStoreName ?? 'goodvibes'),
+    secretsStoreId: controller.getStringFieldValue('cloudflare.secrets-store-id', controller.runtimeSnapshot?.config.cloudflare.secretsStoreId ?? ''),
+    workerCron: controller.getStringFieldValue('cloudflare.worker-cron', controller.runtimeSnapshot?.config.cloudflare.workerCron ?? '*/5 * * * *'),
+    enableWorkersDev: true,
+    queueJobPayloads: false,
+    persistConfig: true,
+    verify: true,
+    batchMode: getCloudflareBatchMode(controller),
+  };
+}
+
+export function buildCloudflareOperationalTokenRef(): string {
+  return buildGoodVibesSecretRef('CLOUDFLARE_API_TOKEN');
+}

package/src/input/onboarding/onboarding-wizard-constants.ts

@@ -6,6 +6,7 @@ export const STEP_ORDER: readonly OnboardingWizardStepId[] = [
   'network',
   'access',
   'external-services',
+  'cloudflare',
   'provider-access',
   'default-model',
   'experience',
@@ -41,7 +42,13 @@ export const DEFAULT_CAPABILITIES: readonly OnboardingStep1CapabilityItem[] = [
     id: 'external-integrations',
     label: 'Connect GoodVibes to external apps and services',
     selected: false,
-    detail: 'Enable setup screens for Slack, Discord, Telegram, Teams, Matrix, and other app surfaces you choose.',
+    detail: 'Enable setup screens for Slack, Discord, Telegram, Home Assistant, Teams, Matrix, and other app surfaces you choose.',
+  },
+  {
+    id: 'cloudflare-batch',
+    label: 'Use Cloudflare for batch or remote daemon work',
+    selected: false,
+    detail: 'Optionally configure Cloudflare Workers and Queues for explicit or eligible background batch jobs. Immediate local daemon behavior stays the default unless enabled.',
   },
 ];
 
@@ -95,6 +102,7 @@ export const INBOUND_EXTERNAL_SURFACE_IDS = new Set<string>([
   'bluebubbles',
   'discord',
   'googleChat',
+  'homeassistant',
   'imessage',
   'mattermost',
   'matrix',
@@ -116,6 +124,9 @@ export const REQUIRED_EXTERNAL_SETUP_FIELD_IDS = new Set<string>([
   'external-services.telegram.bot-token',
   'external-services.telegram.webhook-secret',
   'external-services.webhook.default-target',
+  'external-services.homeassistant.instance-url',
+  'external-services.homeassistant.access-token',
+  'external-services.homeassistant.webhook-secret',
   'external-services.google-chat.webhook-url',
   'external-services.google-chat.verification-token',
   'external-services.signal.bridge-url',

package/src/input/onboarding/onboarding-wizard-external-surface-extra-specs.ts

@@ -0,0 +1,117 @@
+import type { ExternalSurfaceSpec } from './onboarding-wizard-external-surfaces.ts';
+
+export const WEBHOOK_SURFACE_SPEC: ExternalSurfaceSpec = {
+  id: 'webhook',
+  enabledFieldId: 'external-services.webhook',
+  enabledConfigKey: 'surfaces.webhook.enabled',
+  label: 'Outbound webhook surface',
+  hint: 'Enable outbound webhook delivery targets.',
+  defaultEnabled: (snapshot) => snapshot?.config.surfaces.webhook.enabled ?? false,
+  fields: [
+    {
+      id: 'external-services.webhook.default-target',
+      configKey: 'surfaces.webhook.defaultTarget',
+      kind: 'text',
+      label: 'Default webhook target',
+      hint: 'Fallback URL used for outbound webhook deliveries.',
+      placeholder: 'https://example.com/goodvibes',
+      defaultValue: (snapshot) => snapshot?.config.surfaces.webhook.defaultTarget ?? '',
+    },
+    {
+      id: 'external-services.webhook.secret',
+      configKey: 'surfaces.webhook.secret',
+      kind: 'masked',
+      label: 'Webhook signing secret',
+      hint: 'Secret used to sign outbound webhook payloads.',
+      placeholder: 'secret',
+      defaultValue: (snapshot) => snapshot?.config.surfaces.webhook.secret ?? '',
+    },
+    {
+      id: 'external-services.webhook.timeout-ms',
+      configKey: 'surfaces.webhook.timeoutMs',
+      kind: 'text',
+      valueType: 'number',
+      label: 'Webhook timeout ms',
+      hint: 'Request timeout for outbound webhook deliveries.',
+      placeholder: '10000',
+      defaultNumber: 10000,
+      min: 1000,
+      max: 60000,
+      defaultValue: (snapshot) => String(snapshot?.config.surfaces.webhook.timeoutMs ?? 10000),
+    },
+  ],
+};
+
+export const HOME_ASSISTANT_SURFACE_SPEC: ExternalSurfaceSpec = {
+  id: 'homeassistant',
+  enabledFieldId: 'external-services.homeassistant',
+  enabledConfigKey: 'surfaces.homeassistant.enabled',
+  label: 'Home Assistant surface',
+  hint: 'Enable the Home Assistant companion surface, daemon callbacks, and event delivery.',
+  defaultEnabled: (snapshot) => snapshot?.config.surfaces.homeassistant.enabled ?? false,
+  fields: [
+    {
+      id: 'external-services.homeassistant.instance-url',
+      configKey: 'surfaces.homeassistant.instanceUrl',
+      kind: 'text',
+      label: 'Home Assistant URL',
+      hint: 'Base URL of the Home Assistant instance.',
+      placeholder: 'http://homeassistant.local:8123',
+      defaultValue: (snapshot) => snapshot?.config.surfaces.homeassistant.instanceUrl ?? '',
+    },
+    {
+      id: 'external-services.homeassistant.access-token',
+      configKey: 'surfaces.homeassistant.accessToken',
+      kind: 'masked',
+      label: 'Home Assistant access token',
+      hint: 'Long-lived Home Assistant access token or goodvibes:// secret reference.',
+      placeholder: 'long-lived access token',
+      defaultValue: (snapshot) => snapshot?.config.surfaces.homeassistant.accessToken ?? '',
+    },
+    {
+      id: 'external-services.homeassistant.webhook-secret',
+      configKey: 'surfaces.homeassistant.webhookSecret',
+      kind: 'masked',
+      label: 'Home Assistant webhook secret',
+      hint: 'Shared secret used to verify inbound Home Assistant callbacks.',
+      placeholder: 'webhook secret',
+      defaultValue: (snapshot) => snapshot?.config.surfaces.homeassistant.webhookSecret ?? '',
+    },
+    {
+      id: 'external-services.homeassistant.default-conversation-id',
+      configKey: 'surfaces.homeassistant.defaultConversationId',
+      kind: 'text',
+      label: 'Default conversation ID',
+      hint: 'Default Home Assistant conversation id used for route binding.',
+      placeholder: 'goodvibes',
+      defaultValue: (snapshot) => snapshot?.config.surfaces.homeassistant.defaultConversationId ?? 'goodvibes',
+    },
+    {
+      id: 'external-services.homeassistant.device-id',
+      configKey: 'surfaces.homeassistant.deviceId',
+      kind: 'text',
+      label: 'Home Assistant device ID',
+      hint: 'Stable device identifier exposed by the GoodVibes daemon.',
+      placeholder: 'goodvibes-daemon',
+      defaultValue: (snapshot) => snapshot?.config.surfaces.homeassistant.deviceId ?? 'goodvibes-daemon',
+    },
+    {
+      id: 'external-services.homeassistant.device-name',
+      configKey: 'surfaces.homeassistant.deviceName',
+      kind: 'text',
+      label: 'Home Assistant device name',
+      hint: 'Display name for the GoodVibes daemon device in Home Assistant.',
+      placeholder: 'GoodVibes Daemon',
+      defaultValue: (snapshot) => snapshot?.config.surfaces.homeassistant.deviceName ?? 'GoodVibes Daemon',
+    },
+    {
+      id: 'external-services.homeassistant.event-type',
+      configKey: 'surfaces.homeassistant.eventType',
+      kind: 'text',
+      label: 'Home Assistant event type',
+      hint: 'Event type used for daemon-to-Home Assistant deliveries.',
+      placeholder: 'goodvibes_message',
+      defaultValue: (snapshot) => snapshot?.config.surfaces.homeassistant.eventType ?? 'goodvibes_message',
+    },
+  ],
+};

package/src/input/onboarding/onboarding-wizard-external-surfaces.ts

@@ -7,6 +7,7 @@ import {
 import { DEFAULT_CONFIG, type ConfigKey } from '../../config/index.ts';
 import type { OnboardingSnapshotState } from '../../runtime/onboarding/index.ts';
 import { TELEGRAM_MODE_OPTIONS, WHATSAPP_PROVIDER_OPTIONS } from './onboarding-wizard-constants.ts';
+import { HOME_ASSISTANT_SURFACE_SPEC, WEBHOOK_SURFACE_SPEC } from './onboarding-wizard-external-surface-extra-specs.ts';
 import type { OnboardingWizardRadioOption } from './onboarding-wizard-types.ts';
 
 export interface ExternalSurfaceSetupFieldSpec {
@@ -333,47 +334,8 @@ export const EXTERNAL_SURFACE_SPECS: readonly ExternalSurfaceSpec[] = [
       },
     ],
   },
-  {
-    id: 'webhook',
-    enabledFieldId: 'external-services.webhook',
-    enabledConfigKey: 'surfaces.webhook.enabled',
-    label: 'Outbound webhook surface',
-    hint: 'Enable outbound webhook delivery targets.',
-    defaultEnabled: (snapshot) => snapshot?.config.surfaces.webhook.enabled ?? false,
-    fields: [
-      {
-        id: 'external-services.webhook.default-target',
-        configKey: 'surfaces.webhook.defaultTarget',
-        kind: 'text',
-        label: 'Default webhook target',
-        hint: 'Fallback URL used for outbound webhook deliveries.',
-        placeholder: 'https://example.com/goodvibes',
-        defaultValue: (snapshot) => snapshot?.config.surfaces.webhook.defaultTarget ?? '',
-      },
-      {
-        id: 'external-services.webhook.secret',
-        configKey: 'surfaces.webhook.secret',
-        kind: 'masked',
-        label: 'Webhook signing secret',
-        hint: 'Secret used to sign outbound webhook payloads.',
-        placeholder: 'secret',
-        defaultValue: (snapshot) => snapshot?.config.surfaces.webhook.secret ?? '',
-      },
-      {
-        id: 'external-services.webhook.timeout-ms',
-        configKey: 'surfaces.webhook.timeoutMs',
-        kind: 'text',
-        valueType: 'number',
-        label: 'Webhook timeout ms',
-        hint: 'Request timeout for outbound webhook deliveries.',
-        placeholder: '10000',
-        defaultNumber: 10000,
-        min: 1000,
-        max: 60000,
-        defaultValue: (snapshot) => String(snapshot?.config.surfaces.webhook.timeoutMs ?? 10000),
-      },
-    ],
-  },
+  WEBHOOK_SURFACE_SPEC,
+  HOME_ASSISTANT_SURFACE_SPEC,
   {
     id: 'googleChat',
     enabledFieldId: 'external-services.google-chat',

package/src/input/onboarding/onboarding-wizard-steps.ts

@@ -1,4 +1,6 @@
 import { NETWORK_MODE_OPTIONS, REASONING_OPTIONS, HITL_MODE_OPTIONS, GUIDANCE_MODE_OPTIONS, PERMISSION_MODE_OPTIONS, SECRET_POLICY_OPTIONS } from './onboarding-wizard-constants.ts';
+import { shouldShowCloudflareStep } from './onboarding-wizard-cloudflare.ts';
+import { buildCloudflareStep } from './onboarding-wizard-cloudflare-step.ts';
 import {
   EXTERNAL_SURFACE_SPECS,
   getExternalSurfaceAutoStartDefaultValue,
@@ -19,27 +21,25 @@ export function buildOnboardingWizardSteps(controller: OnboardingWizardControlle
   const steps: OnboardingWizardStepDefinition[] = [
     buildCapabilitiesStep(controller),
   ];
-
   if (hasServers) {
     steps.push(buildNetworkStep(controller));
   }
-
   if (hasServers || controller.hasExistingAccessState()) {
     steps.push(buildAccessStep(controller));
   }
-
   if (wantsExternalServices) {
     steps.push(buildExternalServicesStep(controller));
     for (const surface of getSelectedExternalSurfaceSpecs(controller)) {
       steps.push(buildExternalSurfaceStep(controller, surface));
     }
   }
-
+  if (shouldShowCloudflareStep(controller)) {
+    steps.push(buildCloudflareStep(controller));
+  }
   steps.push(buildProviderAccessStep(controller));
   steps.push(buildDefaultModelStep(controller));
   steps.push(buildExperienceStep(controller));
   steps.push(buildReviewStep(controller));
-
   return steps.map(addApplyAndContinueAction);
 }
 
@@ -49,7 +49,7 @@ function buildApplyAndContinueAction(step: OnboardingWizardStepDefinition): Onbo
       id: `${step.id}.apply-and-continue`,
       action: 'apply-and-continue',
       label: 'Apply & Continue To Next Section',
-      hint: 'Persist the current wizard settings, verify them, and move to the next onboarding section.',
+      hint: 'Save the current wizard selections in this onboarding session and move to the next section. Settings are persisted on the final Review apply.',
       defaultValue: 'Apply & next',
       spacerBeforeRows: 2,
     };

package/src/input/onboarding/onboarding-wizard-types.ts

@@ -25,6 +25,7 @@ export type OnboardingWizardStepId =
   | 'access'
   | 'external-services'
   | OnboardingWizardExternalSurfaceStepId
+  | 'cloudflare'
   | 'provider-access'
   | 'default-model'
   | 'experience'
@@ -47,6 +48,13 @@ export type OnboardingWizardAction =
   | 'clear-capabilities'
   | 'select-all-external-surfaces'
   | 'clear-external-surfaces'
+  | 'cloudflare-token-requirements'
+  | 'cloudflare-create-operational-token'
+  | 'cloudflare-discover'
+  | 'cloudflare-validate'
+  | 'cloudflare-provision'
+  | 'cloudflare-verify'
+  | 'cloudflare-disable'
   | 'start-openai-subscription'
   | 'finish-openai-subscription';
 

package/src/input/settings-modal-types.ts

@@ -2,7 +2,7 @@ import type { ConfigSetting } from '@pellux/goodvibes-sdk/platform/config/schema
 import type { ProviderAuthFreshness, ProviderAuthRoute } from '@pellux/goodvibes-sdk/platform/runtime/provider-accounts/registry';
 import type { FeatureFlag, FlagState } from '@pellux/goodvibes-sdk/platform/runtime/feature-flags/types';
 
-export type SettingsCategory = 'display' | 'ui' | 'provider' | 'subscriptions' | 'behavior' | 'storage' | 'permissions' | 'mcp' | 'sandbox' | 'surfaces' | 'danger' | 'tools' | 'flags' | 'network';
+export type SettingsCategory = 'display' | 'ui' | 'provider' | 'subscriptions' | 'behavior' | 'storage' | 'permissions' | 'mcp' | 'sandbox' | 'surfaces' | 'cloudflare' | 'danger' | 'tools' | 'flags' | 'network';
 
 export const SETTINGS_CATEGORIES: SettingsCategory[] = [
   'display',
@@ -15,6 +15,7 @@ export const SETTINGS_CATEGORIES: SettingsCategory[] = [
   'mcp',
   'sandbox',
   'surfaces',
+  'cloudflare',
   'danger',
   'tools',
   'flags',

package/src/input/settings-modal.ts

@@ -41,13 +41,21 @@ export {
   type SubscriptionEntry,
 } from './settings-modal-types.ts';
 
+type ModelPickerLaunch =
+  | { readonly flow: 'providerModel'; readonly target: ModelPickerTarget }
+  | { readonly flow: 'model'; readonly target: ModelPickerTarget };
+
 /**
- * Map a config key to the model picker target it should open, or null if the
- * setting should use the normal inline text-edit flow.
+ * Map config keys to the shared provider/model picker flows. Provider rows open
+ * provider first; model rows open directly to models for the same target.
  */
-function _modelPickerTargetForKey(key: string): ModelPickerTarget | null {
-  if (key === 'helper.globalProvider' || key === 'helper.globalModel') return 'helper';
-  if (key === 'tools.llmProvider' || key === 'tools.llmModel') return 'tool';
+function _modelPickerLaunchForKey(key: string): ModelPickerLaunch | null {
+  if (key === 'helper.globalProvider') return { flow: 'providerModel', target: 'helper' };
+  if (key === 'helper.globalModel') return { flow: 'model', target: 'helper' };
+  if (key === 'tools.llmProvider') return { flow: 'providerModel', target: 'tool' };
+  if (key === 'tools.llmModel') return { flow: 'model', target: 'tool' };
+  if (key === 'tts.llmProvider') return { flow: 'providerModel', target: 'tts' };
+  if (key === 'tts.llmModel') return { flow: 'model', target: 'tts' };
   return null;
 }
 
@@ -94,6 +102,8 @@ export class SettingsModal {
    * Consumed and cleared by the route handler after each Enter/Space action.
    */
   public pendingModelPickerTarget: ModelPickerTarget | null = null;
+  /** Set when the highlighted setting should open provider selection before model selection. */
+  public pendingProviderModelPickerTarget: ModelPickerTarget | null = null;
   /** Provider awaiting explicit logout confirmation, if any. */
   public subscriptionLogoutConfirmationTarget: string | null = null;
 
@@ -146,6 +156,8 @@ export class SettingsModal {
     this.selectedIndex = 0;
     this.editingMode = false;
     this.editBuffer = '';
+    this.pendingModelPickerTarget = null;
+    this.pendingProviderModelPickerTarget = null;
     this.mcpAllowAllConfirmationTarget = null;
     this.subscriptionLogoutConfirmationTarget = null;
     this.lastSaveTriggeredRestart = null;
@@ -156,6 +168,8 @@ export class SettingsModal {
     this.active = false;
     this.editingMode = false;
     this.editBuffer = '';
+    this.pendingModelPickerTarget = null;
+    this.pendingProviderModelPickerTarget = null;
     this.mcpAllowAllConfirmationTarget = null;
     this.subscriptionLogoutConfirmationTarget = null;
     this.lastSaveTriggeredRestart = null;
@@ -290,9 +304,13 @@ export class SettingsModal {
     const { setting } = entry;
 
     // Delegate provider/model picker settings to the model picker UI
-    const pickerTarget = _modelPickerTargetForKey(setting.key);
-    if (pickerTarget !== null) {
-      this.pendingModelPickerTarget = pickerTarget;
+    const pickerLaunch = _modelPickerLaunchForKey(setting.key);
+    if (pickerLaunch !== null) {
+      if (pickerLaunch.flow === 'providerModel') {
+        this.pendingProviderModelPickerTarget = pickerLaunch.target;
+      } else {
+        this.pendingModelPickerTarget = pickerLaunch.target;
+      }
       return;
     }
 
@@ -521,6 +539,8 @@ export class SettingsModal {
         cat = 'network';
       } else if (rawCat === 'surfaces') {
         cat = 'surfaces';
+      } else if (rawCat === 'cloudflare' || rawCat === 'batch') {
+        cat = 'cloudflare';
       } else {
         cat = rawCat as SettingsCategory;
       }
@@ -750,6 +770,8 @@ export class SettingsModal {
         }
       } else if (rawCat === 'surfaces') {
         cat = 'surfaces';
+      } else if (rawCat === 'cloudflare' || rawCat === 'batch') {
+        cat = 'cloudflare';
       } else {
         cat = rawCat as SettingsCategory;
       }

package/src/renderer/buffer.ts

@@ -39,7 +39,13 @@ export class TerminalBuffer {
 
   public blitLine(row: number, line: Line): void {
     if (row >= 0 && row < this.height) {
-      this.cells[row] = [...line];
+      const current = this.cells[row]!;
+      const next = createEmptyLine(this.width);
+      for (let x = 0; x < Math.min(line.length, this.width); x++) {
+        next[x] = { ...line[x]! };
+      }
+      if (linesEqual(current, next, this.width)) return;
+      this.cells[row] = next;
       this.dirtyRows[row] = true;
     }
   }
@@ -56,12 +62,17 @@ export class TerminalBuffer {
    * If dimensions changed, reallocates cells array.
    * Always clears the dirty bitmap.
    */
-  public reset(width: number, height: number): void {
+  public reset(width: number, height: number, source?: TerminalBuffer | null): void {
     if (width !== this.width || height !== this.height) {
       this.width = width;
       this.height = height;
       this.cells = Array.from({ length: height }, () => createEmptyLine(width));
       this.dirtyRows = new Array(height).fill(false);
+    } else if (source && source.width === width && source.height === height) {
+      for (let y = 0; y < this.height; y++) {
+        this.cells[y] = source.cells[y]!.map(cell => ({ ...cell }));
+        this.dirtyRows[y] = false;
+      }
     } else {
       for (let y = 0; y < this.height; y++) {
         const row = this.cells[y]!;
@@ -72,4 +83,31 @@ export class TerminalBuffer {
       }
     }
   }
+
+  public clearDirty(): void {
+    this.dirtyRows.fill(false);
+  }
+}
+
+function linesEqual(left: Line, right: Line, width: number): boolean {
+  for (let x = 0; x < width; x++) {
+    const a = left[x];
+    const b = right[x];
+    if (!a && !b) continue;
+    if (!a || !b) return false;
+    if (
+      a.char !== b.char
+      || a.fg !== b.fg
+      || a.bg !== b.bg
+      || a.bold !== b.bold
+      || a.dim !== b.dim
+      || a.underline !== b.underline
+      || a.italic !== b.italic
+      || a.strikethrough !== b.strikethrough
+      || (a.link ?? '') !== (b.link ?? '')
+    ) {
+      return false;
+    }
+  }
+  return true;
 }