@pellux/goodvibes-tui 0.19.41 → 0.19.42

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to GoodVibes TUI.
 
 ---
 
+## [0.19.42] — 2026-04-27
+
+### Changed
+- Updated `@pellux/goodvibes-sdk` to `0.25.19` for SDK-owned Cloudflare Workers provisioning fixes around existing workers.dev subdomains, Worker cron settings, and workers.dev route disable flows.
+- Regenerated foundation operator contract artifacts from the SDK 0.25.19 contract.
+
+### Fixed
+- Home Assistant setup is now detected as an external onboarding surface even when configured values exist but `surfaces.homeassistant.enabled` is off.
+- Home Assistant token and webhook secret edits from `/settings` and `/config` now store raw values through GoodVibes secrets and persist `goodvibes://secrets/goodvibes/...` refs in config.
+- `/config surfaces...` now exposes the surfaces category so Home Assistant settings can be inspected and changed outside the wizard.
+
 ## [0.19.41] — 2026-04-27
 
 ### Changed

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-0.19.41-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
+[![Version](https://img.shields.io/badge/version-0.19.42-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
 
 A terminal-native AI coding, operations, automation, knowledge, and integration console with a typed runtime, omnichannel surfaces, structured memory/knowledge, and a raw ANSI renderer.
 

package/docs/foundation-artifacts/operator-contract.json

@@ -3,7 +3,7 @@
   "product": {
     "id": "goodvibes",
     "surface": "operator",
-    "version": "0.25.18"
+    "version": "0.25.19"
   },
   "auth": {
     "modes": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "0.19.41",
+  "version": "0.19.42",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
@@ -91,7 +91,7 @@
     "@anthropic-ai/vertex-sdk": "^0.16.0",
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
-    "@pellux/goodvibes-sdk": "0.25.18",
+    "@pellux/goodvibes-sdk": "0.25.19",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",

package/src/config/secret-config.ts

@@ -0,0 +1,119 @@
+import { isSecretRefInput } from '@pellux/goodvibes-sdk/platform/config/secret-refs';
+import type { ConfigKey } from './index.ts';
+import type { SecretScope, SecretStorageMedium } from './secrets.ts';
+
+export const SECRET_CONFIG_KEYS = new Set<ConfigKey>([
+  'surfaces.slack.signingSecret',
+  'surfaces.slack.botToken',
+  'surfaces.slack.appToken',
+  'surfaces.discord.botToken',
+  'surfaces.ntfy.token',
+  'surfaces.webhook.secret',
+  'surfaces.homeassistant.accessToken',
+  'surfaces.homeassistant.webhookSecret',
+  'surfaces.telegram.botToken',
+  'surfaces.telegram.webhookSecret',
+  'surfaces.googleChat.verificationToken',
+  'surfaces.signal.token',
+  'surfaces.whatsapp.accessToken',
+  'surfaces.whatsapp.verifyToken',
+  'surfaces.whatsapp.signingSecret',
+  'surfaces.imessage.token',
+  'surfaces.msteams.appPassword',
+  'surfaces.bluebubbles.password',
+  'surfaces.mattermost.botToken',
+  'surfaces.matrix.accessToken',
+]);
+
+export interface SecretBackedConfigUpdate {
+  readonly configValue: string;
+  readonly secretKey?: string;
+  readonly secretValue?: string;
+  readonly clearSecretKey?: string;
+}
+
+export interface SecretBackedConfigManager {
+  readonly get: (key: ConfigKey) => unknown;
+  readonly setDynamic: (key: ConfigKey, value: unknown) => void;
+}
+
+export interface SecretBackedSecretStore {
+  readonly set: (key: string, value: string, options?: { readonly scope?: SecretScope; readonly medium?: SecretStorageMedium }) => Promise<void>;
+  readonly delete?: (key: string, options?: { readonly scope?: SecretScope; readonly medium?: SecretStorageMedium }) => Promise<void>;
+}
+
+export function isSecretConfigKey(key: string): key is ConfigKey {
+  return SECRET_CONFIG_KEYS.has(key as ConfigKey);
+}
+
+export function normalizeSecretKeyPart(value: string): string {
+  return value
+    .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+    .replace(/[^a-zA-Z0-9]+/g, '_')
+    .replace(/^_+|_+$/g, '')
+    .toUpperCase();
+}
+
+export function buildGoodVibesSecretKey(configKey: string): string {
+  return `GOODVIBES_${configKey.split('.').map(normalizeSecretKeyPart).filter(Boolean).join('_')}`;
+}
+
+export function buildGoodVibesSecretRef(secretKey: string): string {
+  return `goodvibes://secrets/goodvibes/${encodeURIComponent(secretKey)}`;
+}
+
+export function isSecretReferenceValue(value: string): boolean {
+  const normalized = value.trim();
+  return normalized.startsWith('goodvibes://secrets/') && isSecretRefInput(normalized);
+}
+
+export function isMalformedGoodVibesSecretReferenceValue(value: string): boolean {
+  const normalized = value.trim();
+  return normalized.startsWith('goodvibes://') && !isSecretReferenceValue(normalized);
+}
+
+export function getSecretWriteMedium(policy: unknown): SecretStorageMedium {
+  if (policy === 'plaintext_allowed') return 'plaintext';
+  return 'secure';
+}
+
+export function buildSecretBackedConfigUpdate(configKey: ConfigKey, rawValue: string): SecretBackedConfigUpdate {
+  const value = rawValue.trim();
+  const secretKey = buildGoodVibesSecretKey(configKey);
+  if (value.length === 0) {
+    return {
+      configValue: '',
+      clearSecretKey: secretKey,
+    };
+  }
+  if (isSecretReferenceValue(value)) {
+    return { configValue: value };
+  }
+  return {
+    configValue: buildGoodVibesSecretRef(secretKey),
+    secretKey,
+    secretValue: rawValue,
+  };
+}
+
+export async function persistSecretBackedConfigValue(
+  configManager: SecretBackedConfigManager,
+  secretsManager: SecretBackedSecretStore | null | undefined,
+  configKey: ConfigKey,
+  rawValue: string,
+  options: { readonly scope?: SecretScope } = {},
+): Promise<string> {
+  const update = buildSecretBackedConfigUpdate(configKey, rawValue);
+  const scope = options.scope ?? 'user';
+  if (update.secretKey && update.secretValue !== undefined && secretsManager) {
+    await secretsManager.set(update.secretKey, update.secretValue, {
+      scope,
+      medium: getSecretWriteMedium(configManager.get('storage.secretPolicy')),
+    });
+  }
+  if (update.clearSecretKey && secretsManager?.delete) {
+    await secretsManager.delete(update.clearSecretKey, { scope });
+  }
+  configManager.setDynamic(configKey, update.configValue);
+  return update.configValue;
+}

package/src/input/commands/config.ts

@@ -1,9 +1,10 @@
 import type { CommandRegistry } from '../command-registry.ts';
 import { CONFIG_SCHEMA, type ConfigKey } from '../../config/index.ts';
+import { buildGoodVibesSecretKey, isSecretConfigKey, isSecretReferenceValue, persistSecretBackedConfigValue } from '../../config/secret-config.ts';
 import { configSnapshotToProfileData, profileDataToConfigSnapshot } from '@pellux/goodvibes-sdk/platform/profiles/shape';
 import { dirname, join, resolve } from 'node:path';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { requireProfileManager, requireProviderApi, requireShellPaths } from './runtime-services.ts';
+import { requireProfileManager, requireProviderApi, requireSecretsManager, requireShellPaths } from './runtime-services.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils/error-display';
 
 interface ConfigBundle {
@@ -78,6 +79,22 @@ function buildConfigSnapshot(
   return snapshot;
 }
 
+function formatConfigSchemaEntry(
+  manager: { get: (key: ConfigKey) => unknown },
+  schema: { readonly key: ConfigKey; readonly description: string },
+): string {
+  let value: unknown = '(unavailable)';
+  try {
+    value = manager.get(schema.key);
+  } catch {
+    // keep unavailable marker
+  }
+  const displayValue = typeof value === 'string' && isSecretConfigKey(schema.key) && !isSecretReferenceValue(value)
+    ? value.length === 0 ? '(empty)' : '[secret]'
+    : String(value);
+  return `  ${schema.key.padEnd(46)} ${displayValue} — ${schema.description}`;
+}
+
 function coerceValue(
   raw: string,
   type: 'boolean' | 'number' | 'string' | 'enum',
@@ -113,8 +130,7 @@ export function registerConfigCommand(registry: CommandRegistry): void {
     argsHint: '<key> [value]',
     async handler(args, ctx) {
       const cm = ctx.platform.configManager;
-      const all = cm.getAll();
-      const categories = ['display', 'provider', 'behavior', 'permissions', 'danger', 'tools'] as const;
+      const categories = ['display', 'ui', 'provider', 'behavior', 'storage', 'permissions', 'surfaces', 'cloudflare', 'batch', 'tts', 'danger', 'tools'] as const;
 
       if (args[0] === 'profile') {
         const sub = args[1];
@@ -310,6 +326,10 @@ export function registerConfigCommand(registry: CommandRegistry): void {
         }
         try {
           cm.setDynamic(resetKey as ConfigKey, schema.default);
+          if (isSecretConfigKey(resetKey)) {
+            const secretsManager = requireSecretsManager(ctx);
+            await secretsManager.delete(buildGoodVibesSecretKey(resetKey), { scope: 'user' });
+          }
           if (resetKey === 'provider.model') ctx.session.runtime.model = schema.default as string;
           if (resetKey === 'provider.provider') ctx.session.runtime.provider = schema.default as string;
           if (resetKey === 'provider.reasoningEffort') ctx.session.runtime.reasoningEffort = schema.default as string;
@@ -403,12 +423,8 @@ export function registerConfigCommand(registry: CommandRegistry): void {
         const lines: string[] = ['Config settings:'];
         for (const cat of categories) {
           lines.push(`  [${cat}]`);
-          const catObj = all[cat] as Record<string, unknown>;
-          for (const [field, val] of Object.entries(catObj)) {
-            const key = `${cat}.${field}`;
-            const schema = CONFIG_SCHEMA.find((entry) => entry.key === key);
-            const desc = schema ? ` — ${schema.description}` : '';
-            lines.push(`    ${key.padEnd(36)} ${String(val)}${desc}`);
+          for (const schema of CONFIG_SCHEMA.filter((entry) => entry.key.startsWith(`${cat}.`))) {
+            lines.push(`  ${formatConfigSchemaEntry(cm, schema)}`);
           }
         }
         ctx.print(lines.join('\n'));
@@ -418,13 +434,9 @@ export function registerConfigCommand(registry: CommandRegistry): void {
       const firstArg = args[0];
       if (categories.includes(firstArg as typeof categories[number]) && args.length === 1) {
         const cat = firstArg as typeof categories[number];
-        const catObj = all[cat] as Record<string, unknown>;
         const lines: string[] = [`[${cat}]`];
-        for (const [field, val] of Object.entries(catObj)) {
-          const key = `${cat}.${field}`;
-          const schema = CONFIG_SCHEMA.find((entry) => entry.key === key);
-          const desc = schema ? ` — ${schema.description}` : '';
-          lines.push(`  ${key.padEnd(36)} ${String(val)}${desc}`);
+        for (const schema of CONFIG_SCHEMA.filter((entry) => entry.key.startsWith(`${cat}.`))) {
+          lines.push(formatConfigSchemaEntry(cm, schema));
         }
         ctx.print(lines.join('\n'));
         return;
@@ -471,8 +483,13 @@ export function registerConfigCommand(registry: CommandRegistry): void {
         }
 
         try {
-          cm.setDynamic(key, coerced);
-          ctx.print(`Set ${key} = ${String(coerced)}`);
+          if (schema.type === 'string' && isSecretConfigKey(key)) {
+            const configValue = await persistSecretBackedConfigValue(cm, requireSecretsManager(ctx), key, String(coerced), { scope: 'user' });
+            ctx.print(`Set ${key} = ${configValue}`);
+          } else {
+            cm.setDynamic(key, coerced);
+            ctx.print(`Set ${key} = ${String(coerced)}`);
+          }
           if (key === 'provider.model') ctx.session.runtime.model = coerced as string;
           if (key === 'provider.provider') ctx.session.runtime.provider = coerced as string;
           if (key === 'provider.reasoningEffort') ctx.session.runtime.reasoningEffort = coerced as string;

package/src/input/onboarding/onboarding-wizard-helpers.ts

@@ -3,6 +3,13 @@ import { deriveOnboardingStepState, type OnboardingStep1CapabilityItem, type Onb
 import { DEFAULT_CAPABILITIES } from './onboarding-wizard-constants.ts';
 import { EXTERNAL_SURFACE_SPECS, type ExternalSurfaceSetupFieldSpec, type ExternalSurfaceSpec } from './onboarding-wizard-external-surfaces.ts';
 import type { OnboardingWizardAcknowledgementFieldDefinition, OnboardingWizardModelSelection, OnboardingWizardRuntimeHydration } from './onboarding-wizard-types.ts';
+export {
+  buildGoodVibesSecretKey,
+  buildGoodVibesSecretRef,
+  isMalformedGoodVibesSecretReferenceValue,
+  isSecretReferenceValue,
+  normalizeSecretKeyPart,
+} from '../../config/secret-config.ts';
 
 export function clamp(value: number, min: number, max: number): number {
   return Math.max(min, Math.min(max, value));
@@ -16,63 +23,6 @@ export function normalizeText(value: string | null | undefined): string {
   return (value ?? '').trim();
 }
 
-export function normalizeSecretKeyPart(value: string): string {
-  return value
-    .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
-    .replace(/[^a-zA-Z0-9]+/g, '_')
-    .replace(/^_+|_+$/g, '')
-    .toUpperCase();
-}
-
-export function buildGoodVibesSecretKey(configKey: string): string {
-  return `GOODVIBES_${configKey.split('.').map(normalizeSecretKeyPart).filter(Boolean).join('_')}`;
-}
-
-export function buildGoodVibesSecretRef(secretKey: string): string {
-  return `goodvibes://secrets/goodvibes/${encodeURIComponent(secretKey)}`;
-}
-
-export function isSecretReferenceValue(value: string): boolean {
-  const normalized = value.trim();
-  if (normalized.length === 0) return false;
-  let url: URL;
-  try {
-    url = new URL(normalized);
-  } catch {
-    return false;
-  }
-  if (url.protocol !== 'goodvibes:' || url.hostname !== 'secrets') return false;
-  const segments = url.pathname.split('/').filter(Boolean).map((segment) => decodeURIComponent(segment));
-  const source = (segments[0] ?? '').toLowerCase();
-  const rest = segments.slice(1);
-  const params = url.searchParams;
-  if (source === 'env' || source === 'goodvibes') {
-    return Boolean(rest[0] ?? params.get('id') ?? params.get('key') ?? params.get('name'));
-  }
-  if (source === 'file') {
-    return Boolean(rest.length > 0 || params.get('path'));
-  }
-  if (source === 'exec') {
-    return Boolean(rest[0] ?? params.get('command') ?? params.get('cmd'));
-  }
-  if (source === '1password' || source === 'onepassword' || source === 'op') {
-    return Boolean(params.get('ref') ?? params.get('uri'))
-      || Boolean((params.get('vault') ?? rest[0]) && (params.get('item') ?? rest[1]) && (params.get('field') ?? rest[2]));
-  }
-  if (source === 'bitwarden' || source === 'vaultwarden') {
-    return Boolean(rest[0] ?? params.get('item') ?? params.get('id') ?? params.get('name'));
-  }
-  if (source === 'bitwarden-secrets-manager' || source === 'bws') {
-    return Boolean(rest[0] ?? params.get('id') ?? params.get('secretId') ?? params.get('secret'));
-  }
-  return false;
-}
-
-export function isMalformedGoodVibesSecretReferenceValue(value: string): boolean {
-  const normalized = value.trim();
-  return normalized.startsWith('goodvibes://') && !isSecretReferenceValue(normalized);
-}
-
 export function isValidHostValue(value: string): boolean {
   const normalized = value.trim();
   if (normalized.length === 0) return false;

package/src/input/settings-modal-behavior.ts

@@ -0,0 +1,37 @@
+import type { ConfigSetting } from '@pellux/goodvibes-sdk/platform/config/schema';
+import type { ModelPickerTarget } from './model-picker.ts';
+
+export type ModelPickerLaunch =
+  | { readonly flow: 'providerModel'; readonly target: ModelPickerTarget }
+  | { readonly flow: 'model'; readonly target: ModelPickerTarget };
+
+/**
+ * Map config keys to the shared provider/model picker flows. Provider rows open
+ * provider first; model rows open directly to models for the same target.
+ */
+export function modelPickerLaunchForKey(key: string): ModelPickerLaunch | null {
+  if (key === 'helper.globalProvider') return { flow: 'providerModel', target: 'helper' };
+  if (key === 'helper.globalModel') return { flow: 'model', target: 'helper' };
+  if (key === 'tools.llmProvider') return { flow: 'providerModel', target: 'tool' };
+  if (key === 'tools.llmModel') return { flow: 'model', target: 'tool' };
+  if (key === 'tts.llmProvider') return { flow: 'providerModel', target: 'tts' };
+  if (key === 'tts.llmModel') return { flow: 'model', target: 'tts' };
+  return null;
+}
+
+export function roundToPrecision(value: number, precision: number): number {
+  const factor = 10 ** precision;
+  return Math.round(value * factor) / factor;
+}
+
+export function getNumericAdjustmentMeta(setting: ConfigSetting): {
+  step: number;
+  min?: number;
+  max?: number;
+  precision: number;
+} {
+  if (setting.key === 'wrfc.scoreThreshold') {
+    return { step: 0.1, min: 0, max: 10, precision: 1 };
+  }
+  return { step: 1, precision: 0 };
+}

package/src/input/settings-modal-secrets.ts

@@ -0,0 +1,41 @@
+import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config/schema';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config/manager';
+import { logger } from '@pellux/goodvibes-sdk/platform/utils/logger';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils/error-display';
+import type { SecretsManager } from '../config/secrets.ts';
+import {
+  buildSecretBackedConfigUpdate,
+  getSecretWriteMedium,
+} from '../config/secret-config.ts';
+
+export type SettingsSecretsManager = Pick<SecretsManager, 'delete' | 'set'>;
+
+export function setSecretBackedSettingValue(args: {
+  key: ConfigKey;
+  value: string;
+  configManager: ConfigManager;
+  secretsManager: SettingsSecretsManager | null;
+  setConfigValue: (key: ConfigKey, value: unknown) => void;
+}): void {
+  const { key, value, configManager, secretsManager, setConfigValue } = args;
+  if (!secretsManager) {
+    setConfigValue(key, value.trim());
+    return;
+  }
+
+  const update = buildSecretBackedConfigUpdate(key, value);
+  if (update.secretKey && update.secretValue !== undefined) {
+    void secretsManager.set(update.secretKey, update.secretValue, {
+      scope: 'user',
+      medium: getSecretWriteMedium(configManager.get('storage.secretPolicy')),
+    }).catch((error) => {
+      logger.error('SettingsModal: failed to store secret config value', { key, error: summarizeError(error) });
+    });
+  }
+  if (update.clearSecretKey) {
+    void secretsManager.delete(update.clearSecretKey, { scope: 'user' }).catch((error) => {
+      logger.error('SettingsModal: failed to clear secret config value', { key, error: summarizeError(error) });
+    });
+  }
+  setConfigValue(key, update.configValue);
+}

package/src/input/settings-modal.ts

@@ -10,7 +10,7 @@
  * Saves changes via configManager.set(key, value) or featureFlagManager methods.
  */
 
-import { CONFIG_SCHEMA, type ConfigSetting, type ConfigKey, type PersistedFlagState } from '@pellux/goodvibes-sdk/platform/config/schema';
+import { CONFIG_SCHEMA, type ConfigKey, type PersistedFlagState } from '@pellux/goodvibes-sdk/platform/config/schema';
 import type { ModelPickerTarget } from './model-picker.ts';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config/manager';
 import type { SubscriptionManager } from '@pellux/goodvibes-sdk/platform/config/subscriptions';
@@ -18,6 +18,16 @@ import { listBuiltinSubscriptionProviders } from '@pellux/goodvibes-sdk/platform
 import type { ProviderAuthFreshness, ProviderAuthRoute } from '@pellux/goodvibes-sdk/platform/runtime/provider-accounts/registry';
 import { getResolvedSettingLookup } from '@pellux/goodvibes-sdk/platform/runtime/settings/control-plane';
 import type { ServiceInspectionQuery } from '../runtime/ui-service-queries.ts';
+import { isSecretConfigKey } from '../config/secret-config.ts';
+import {
+  getNumericAdjustmentMeta,
+  modelPickerLaunchForKey,
+  roundToPrecision,
+} from './settings-modal-behavior.ts';
+import {
+  setSecretBackedSettingValue,
+  type SettingsSecretsManager,
+} from './settings-modal-secrets.ts';
 import type { FeatureFlagManager } from '@pellux/goodvibes-sdk/platform/runtime/feature-flags/index';
 import type { FeatureFlag, FlagState } from '@pellux/goodvibes-sdk/platform/runtime/feature-flags/types';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp/registry';
@@ -41,41 +51,6 @@ export {
   type SubscriptionEntry,
 } from './settings-modal-types.ts';
 
-type ModelPickerLaunch =
-  | { readonly flow: 'providerModel'; readonly target: ModelPickerTarget }
-  | { readonly flow: 'model'; readonly target: ModelPickerTarget };
-
-/**
- * Map config keys to the shared provider/model picker flows. Provider rows open
- * provider first; model rows open directly to models for the same target.
- */
-function _modelPickerLaunchForKey(key: string): ModelPickerLaunch | null {
-  if (key === 'helper.globalProvider') return { flow: 'providerModel', target: 'helper' };
-  if (key === 'helper.globalModel') return { flow: 'model', target: 'helper' };
-  if (key === 'tools.llmProvider') return { flow: 'providerModel', target: 'tool' };
-  if (key === 'tools.llmModel') return { flow: 'model', target: 'tool' };
-  if (key === 'tts.llmProvider') return { flow: 'providerModel', target: 'tts' };
-  if (key === 'tts.llmModel') return { flow: 'model', target: 'tts' };
-  return null;
-}
-
-function roundToPrecision(value: number, precision: number): number {
-  const factor = 10 ** precision;
-  return Math.round(value * factor) / factor;
-}
-
-function getNumericAdjustmentMeta(setting: ConfigSetting): {
-  step: number;
-  min?: number;
-  max?: number;
-  precision: number;
-} {
-  if (setting.key === 'wrfc.scoreThreshold') {
-    return { step: 0.1, min: 0, max: 10, precision: 1 };
-  }
-  return { step: 1, precision: 0 };
-}
-
 // ---------------------------------------------------------------------------
 // SettingsModal
 // ---------------------------------------------------------------------------
@@ -125,6 +100,7 @@ export class SettingsModal {
   public lastSaveTriggeredRestart: 'control-plane' | 'http-listener' | 'web' | null = null;
 
   private configManager: ConfigManager | null = null;
+  private secretsManager: SettingsSecretsManager | null = null;
   private featureFlagManager: FeatureFlagManager | null = null;
   private mcpRegistry: McpRegistry | null = null;
   private subscriptionManager: SubscriptionManager | null = null;
@@ -142,8 +118,10 @@ export class SettingsModal {
     subscriptionManager: SubscriptionManager,
     serviceRegistry: Pick<ServiceInspectionQuery, 'getAll'>,
     mcpRegistry?: McpRegistry,
+    secretsManager?: SettingsSecretsManager,
   ): void {
     this.configManager = configManager;
+    this.secretsManager = secretsManager ?? null;
     this.featureFlagManager = featureFlagManager;
     this.subscriptionManager = subscriptionManager;
     this.serviceRegistry = serviceRegistry;
@@ -174,6 +152,7 @@ export class SettingsModal {
     this.subscriptionLogoutConfirmationTarget = null;
     this.lastSaveTriggeredRestart = null;
     this.serviceRegistry = null;
+    this.secretsManager = null;
   }
 
   /** Cycle to the next category (Tab). */
@@ -304,7 +283,7 @@ export class SettingsModal {
     const { setting } = entry;
 
     // Delegate provider/model picker settings to the model picker UI
-    const pickerLaunch = _modelPickerLaunchForKey(setting.key);
+    const pickerLaunch = modelPickerLaunchForKey(setting.key);
     if (pickerLaunch !== null) {
       if (pickerLaunch.flow === 'providerModel') {
         this.pendingProviderModelPickerTarget = pickerLaunch.target;
@@ -495,7 +474,17 @@ export class SettingsModal {
       return false;
     }
 
-    this._setValue(setting.key, parsed);
+    if (setting.type === 'string' && isSecretConfigKey(setting.key)) {
+      setSecretBackedSettingValue({
+        key: setting.key,
+        value: String(parsed ?? ''),
+        configManager: this.configManager,
+        secretsManager: this.secretsManager,
+        setConfigValue: (key, value) => this._setValue(key, value),
+      });
+    } else {
+      this._setValue(setting.key, parsed);
+    }
     this.editingMode = false;
     this.editBuffer = '';
     return true;
@@ -787,4 +776,5 @@ export class SettingsModal {
       logger.error('SettingsModal: failed to set config value', { key, error: summarizeError(e) });
     }
   }
+
 }

package/src/renderer/settings-modal-helpers.ts

@@ -6,11 +6,20 @@
 
 import type { SettingEntry, McpEntry, SubscriptionEntry } from '../input/settings-modal.ts';
 import { SETTINGS_CATEGORIES } from '../input/settings-modal.ts';
+import { isSecretConfigKey, isSecretReferenceValue } from '../config/secret-config.ts';
+
+function maskSecretValue(value: string): string {
+  if (value.length === 0) return '(empty)';
+  if (isSecretReferenceValue(value)) return value;
+  if (value.length <= 4) return '••••';
+  return `${'•'.repeat(Math.min(12, Math.max(4, value.length - 4)))}${value.slice(-4)}`;
+}
 
 export function formatValue(entry: SettingEntry): string {
   const val = entry.currentValue;
   if (val === null || val === undefined) return '(unset)';
   if (typeof val === 'boolean') return val ? 'true' : 'false';
+  if (typeof val === 'string' && isSecretConfigKey(entry.setting.key)) return maskSecretValue(val);
   if (typeof val === 'string' && val === '') return '(empty)';
   return String(val);
 }

package/src/runtime/onboarding/derivation.ts

@@ -54,6 +54,7 @@ const INBOUND_EVENT_SURFACE_KINDS = new Set<string>([
   'discord',
   'google-chat',
   'googleChat',
+  'homeassistant',
   'imessage',
   'mattermost',
   'matrix',
@@ -148,11 +149,24 @@ function hasConfiguredProviderState(snapshot: OnboardingSnapshotState): boolean
   return getConfiguredProviderSignalIds(snapshot).length > 0;
 }
 
-function countConfiguredSurfaceKinds(snapshot: OnboardingSnapshotState): number {
-  return new Set<string>([
+function getConfiguredSurfaceKinds(snapshot: OnboardingSnapshotState): string[] {
+  const kinds = new Set<string>([
     ...snapshot.surfaces.configuredEnabledKinds,
     ...snapshot.surfaces.records.filter((surface) => surface.enabled).map((surface) => surface.kind),
-  ]).size;
+  ]);
+
+  for (const [kind, value] of Object.entries(snapshot.config.surfaces)) {
+    if (!value || typeof value !== 'object') continue;
+    const defaults = DEFAULT_CONFIG.surfaces[kind as keyof typeof DEFAULT_CONFIG.surfaces];
+    if (!defaults || typeof defaults !== 'object') continue;
+    if (!isDeepEqual(value, defaults)) kinds.add(kind);
+  }
+
+  return [...kinds].sort((left, right) => left.localeCompare(right));
+}
+
+function countConfiguredSurfaceKinds(snapshot: OnboardingSnapshotState): number {
+  return getConfiguredSurfaceKinds(snapshot).length;
 }
 
 function hasInboundEventSurface(snapshot: OnboardingSnapshotState): boolean {
@@ -276,8 +290,7 @@ function describeWebhookIngress(snapshot: OnboardingSnapshotState): string {
 function describeExternalIntegrations(snapshot: OnboardingSnapshotState): string {
   const integrationCount = new Set<string>([
     ...getExternalIntegrationServiceIds(snapshot),
-    ...snapshot.surfaces.configuredEnabledKinds,
-    ...snapshot.surfaces.records.filter((surface) => surface.enabled).map((surface) => surface.kind),
+    ...getConfiguredSurfaceKinds(snapshot),
   ]).size;
 
   if (integrationCount === 0) {

package/src/shell/ui-openers.ts

@@ -22,7 +22,7 @@ type WireShellUiOpenersOptions = {
   featureFlags: FeatureFlagManager;
   mcpRegistry: McpRegistry;
   subscriptionManager: SubscriptionManager;
-  secretsManager?: Pick<SecretsManager, 'get'>;
+  secretsManager?: Pick<SecretsManager, 'delete' | 'get' | 'set'>;
   serviceRegistry: Pick<ServiceInspectionQuery, 'getAll'>;
   getConfiguredProviderIds: () => string[];
   getPinned: () => Promise<string[]>;
@@ -208,7 +208,7 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
 
   commandContext.openSettingsModal = () => {
     input.modalOpened('settings');
-    input.settingsModal.open(configManager, featureFlags, subscriptionManager, serviceRegistry, mcpRegistry);
+    input.settingsModal.open(configManager, featureFlags, subscriptionManager, serviceRegistry, mcpRegistry, secretsManager);
     render();
   };
 

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '0.19.41';
+let _version = '0.19.42';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   _version = pkg.version ?? _version;