@pellux/goodvibes-tui 1.1.0 → 1.7.0

package/src/panels/modals/policy-modal.ts

@@ -0,0 +1,256 @@
+import { MODAL_TONES } from './modal-theme.ts';
+import type {
+  DivergenceDashboardSnapshot,
+  DivergenceStats,
+  PermissionAuditEntry,
+  PolicyBundleVersion,
+  PolicyDiffResult,
+  PolicyLintFinding,
+  PolicyPreflightReview,
+  PolicySimulationSummary,
+} from '@/runtime/index.ts';
+import type { ModalSectionStyle } from '../../renderer/modal-factory.ts';
+import type {
+  ConfigModalActionContext,
+  ConfigModalRow,
+  ConfigModalSurface,
+  ConfigModalView,
+} from '../../input/config-modal-types.ts';
+
+// ---------------------------------------------------------------------------
+// Policy → config-modal surface (W6.1 group-B port). Governance CONTENT view,
+// not a selectable list — current/candidate bundle state, diff, divergence
+// gate, history, permission audit, lint findings, preflight review, and
+// simulation samples render as non-selectable rows (the host windows/scrolls
+// them). EVERY dispatchable key in the original panel (s/f/l/p/b) already
+// routed to `/policy <sub>` via executeCommand — none were in-panel mutations;
+// the panel's promote/rollback confirm step is dropped per charter (never fold
+// a confirm into a modal) and the command dispatches directly. Determinism:
+// timestamps are formatted (fmtTime/fmtRate), never read from the clock.
+// ---------------------------------------------------------------------------
+
+interface PolicyModalSnapshot {
+  readonly current: PolicyBundleVersion | null;
+  readonly candidate: PolicyBundleVersion | null;
+  readonly history: readonly PolicyBundleVersion[];
+  readonly diff: PolicyDiffResult | null;
+  readonly divergence: DivergenceDashboardSnapshot | null;
+  readonly recentPermissionAudit: readonly PermissionAuditEntry[];
+  readonly lintFindings: readonly PolicyLintFinding[];
+  readonly lastSimulationSummary: PolicySimulationSummary | null;
+  readonly lastPreflightReview: PolicyPreflightReview | null;
+  readonly capturedAt: string;
+}
+
+export interface PolicyModalDeps {
+  readonly policyRuntimeState: { getSnapshot(): PolicyModalSnapshot };
+}
+
+const BAD: ModalSectionStyle = { fg: MODAL_TONES.bad };
+const WARN: ModalSectionStyle = { fg: MODAL_TONES.warn };
+const GOOD: ModalSectionStyle = { fg: MODAL_TONES.good };
+const DIM: ModalSectionStyle = { dim: true };
+const MAX_ROWS = 5;
+
+function fmtTime(value: string | undefined): string {
+  if (!value) return 'n/a';
+  return value.replace('T', ' ').slice(0, 19);
+}
+
+function fmtRate(value: number | undefined): string {
+  if (value === undefined) return 'n/a';
+  return `${(value * 100).toFixed(1)}%`;
+}
+
+function gateColor(status: string | undefined): ModalSectionStyle | undefined {
+  switch (status) {
+    case 'allowed': return GOOD;
+    case 'blocked': return BAD;
+    case 'no_data': return WARN;
+    default: return DIM;
+  }
+}
+
+function ruleLine(rule: { id: string; type: string; effect: string }): string {
+  return `${rule.id} (${rule.type}, effect=${rule.effect})`;
+}
+
+class PolicyModalSurface implements ConfigModalSurface {
+  readonly name = 'policy-modal';
+  readonly title = 'Policy And Governance';
+
+  constructor(private readonly deps: PolicyModalDeps) {}
+
+  readonly actions = [
+    { key: 's', id: 'simulate', label: 'simulate' },
+    { key: 'f', id: 'preflight', label: 'preflight' },
+    { key: 'l', id: 'lint', label: 'lint' },
+    { key: 'p', id: 'promote', label: 'promote' },
+    { key: 'b', id: 'rollback', label: 'rollback' },
+  ];
+
+  buildView(): ConfigModalView {
+    const snapshot = this.deps.policyRuntimeState.getSnapshot();
+    const preflight = snapshot.lastPreflightReview;
+    const divergence = snapshot.divergence;
+    const lintCount = snapshot.lintFindings.length;
+    const preflightStatus = preflight ? preflight.status : 'none';
+    const gateStatus = divergence?.gate.status ?? 'n/a';
+
+    const header = [`bundles ${snapshot.current ? 1 : 0}+${snapshot.candidate ? 1 : 0}c  preflight ${preflightStatus.toUpperCase()}  gate ${gateStatus}  lint ${lintCount}`];
+
+    const rows: ConfigModalRow[] = [];
+    let n = 0;
+    const push = (label: string, style?: ModalSectionStyle): void => { rows.push({ id: `row:${n++}`, label, selectable: false, ...(style ? { style } : {}) }); };
+
+    const nothingRecorded = !snapshot.current && !snapshot.candidate && !divergence
+      && snapshot.history.length === 0 && snapshot.recentPermissionAudit.length === 0
+      && snapshot.lintFindings.length === 0 && !snapshot.lastSimulationSummary && !preflight;
+
+    if (nothingRecorded) {
+      push('No policy bundles loaded.');
+      push('Bundle: none active, none candidate. Gate: n/a.', DIM);
+      push('Get started');
+      push('/policy load — load a policy bundle to begin governance review', DIM);
+      return { title: 'Policy And Governance', tabs: [{ id: 'governance', label: 'Governance', header, rows, emptyText: '' }] };
+    }
+
+    if (snapshot.current) {
+      push('Current');
+      push(`Bundle ${snapshot.current.bundle.bundleId}  State ${snapshot.current.state}`);
+      push(`Loaded ${fmtTime(snapshot.current.loadedAt)}  Active ${fmtTime(snapshot.current.activatedAt)}`, DIM);
+    }
+    if (snapshot.candidate) {
+      push('Candidate');
+      push(`Bundle ${snapshot.candidate.bundle.bundleId}  State ${snapshot.candidate.state}`);
+      push(`Loaded ${fmtTime(snapshot.candidate.loadedAt)}  Rules ${snapshot.candidate.rules.length}`, DIM);
+    }
+    if (snapshot.diff) {
+      const diff = snapshot.diff;
+      push('Diff');
+      push(`${diff.fromBundleId} -> ${diff.toBundleId}  changes ${diff.totalChanges}`);
+      if (diff.added.length > 0) { push('Added', GOOD); for (const r of diff.added.slice(0, MAX_ROWS)) push(`  + ${ruleLine(r)}`, DIM); }
+      if (diff.removed.length > 0) { push('Removed', BAD); for (const r of diff.removed.slice(0, MAX_ROWS)) push(`  - ${ruleLine(r)}`, DIM); }
+      if (diff.changed.length > 0) { push('Changed', WARN); for (const c of diff.changed.slice(0, MAX_ROWS)) push(`  ~ ${c.ruleId}`, DIM); }
+    }
+    if (divergence) {
+      push('Governance Gate');
+      push(`Mode ${divergence.mode}  Gate ${divergence.gate.status}  Divergence ${fmtRate(divergence.gate.divergenceRate ?? divergence.report.overall.divergenceRate)}`, gateColor(divergence.gate.status));
+      push(`Evaluations ${divergence.report.overall.totalEvaluations}  Trend points ${divergence.trend.length}`, DIM);
+      const prefixEntries = Object.entries(divergence.report.byCommandPrefix);
+      if (prefixEntries.length > 0) {
+        push('Divergence by command prefix', DIM);
+        for (const [prefix, stats] of prefixEntries.slice(0, MAX_ROWS)) push(`  ${prefix}  ${fmtRate(stats.divergenceRate)}  ${stats.total}/${stats.totalEvaluations}`, stats.divergenceRate > 0 ? WARN : undefined);
+      }
+      const classEntries = Object.entries(divergence.report.byToolClass).filter((e): e is [string, DivergenceStats] => e[1] !== undefined);
+      if (classEntries.length > 0) {
+        push('Divergence by tool class', DIM);
+        for (const [cls, stats] of classEntries.slice(0, MAX_ROWS)) push(`  ${cls}  ${fmtRate(stats.divergenceRate)}  ${stats.total}/${stats.totalEvaluations}`, stats.divergenceRate > 0 ? WARN : undefined);
+      }
+    }
+    if (snapshot.history.length > 0) {
+      push('History');
+      for (const v of snapshot.history.slice(0, MAX_ROWS)) push(`${v.bundle.bundleId}  ${v.state}  ${fmtTime(v.activatedAt ?? v.loadedAt)}`, DIM);
+    }
+    if (snapshot.recentPermissionAudit.length > 0) {
+      push('Permission Audit');
+      for (const entry of snapshot.recentPermissionAudit.slice(0, MAX_ROWS)) {
+        const outcome = entry.approved === undefined ? 'pending' : entry.approved ? 'approved' : 'denied';
+        push(`${entry.tool}  ${entry.riskLevel.toUpperCase()}  ${outcome}`, entry.approved === undefined ? WARN : entry.approved ? undefined : BAD);
+        push(`  ${entry.summary}`, DIM);
+      }
+    }
+    if (snapshot.lintFindings.length > 0) {
+      push('Policy Lint');
+      for (const f of snapshot.lintFindings.slice(0, MAX_ROWS)) push(`${f.severity.toUpperCase()} ${f.message}`, f.severity === 'error' ? BAD : f.severity === 'warn' ? WARN : undefined);
+    }
+    if (preflight) {
+      push('Preflight Review');
+      push(`Status ${preflight.status.toUpperCase()}  Issues ${preflight.issueCount}  Generated ${fmtTime(preflight.generatedAt)}`, preflight.status === 'pass' ? GOOD : preflight.status === 'warn' ? WARN : BAD);
+      push(preflight.summary, DIM);
+      for (const issue of preflight.issues.slice(0, 4)) push(`${issue.severity.toUpperCase()} ${issue.message}`, issue.severity === 'error' ? BAD : issue.severity === 'warn' ? WARN : undefined);
+    }
+    if (snapshot.lastSimulationSummary) {
+      const sim = snapshot.lastSimulationSummary;
+      push('Simulation Samples');
+      push(`Mode ${sim.mode}  Diverged ${sim.divergentScenarios}/${sim.totalScenarios}  Allowed(actual/sim) ${sim.allowedByActual}/${sim.allowedBySimulated}`, sim.divergentScenarios > 0 ? WARN : GOOD);
+      for (const result of sim.results.slice(0, 4)) push(`${result.scenario.label}  ${(result.authoritativeDecision.allowed ? 'allow' : 'deny').toUpperCase()}  ${result.diverged ? (result.divergenceType ?? 'diverged') : 'aligned'}`, result.diverged ? WARN : (result.authoritativeDecision.allowed ? GOOD : BAD));
+    }
+
+    return { title: 'Policy And Governance', tabs: [{ id: 'governance', label: 'Governance', header, rows }] };
+  }
+
+  onAction(id: string, ctx: ConfigModalActionContext): void {
+    // "Rollout" in the WO brief maps to the registry's actual subcommand —
+    // there is no separate `/policy rollout`.
+    const sub = id === 'simulate' ? 'simulate' : id === 'preflight' ? 'preflight' : id === 'lint' ? 'lint' : id === 'promote' ? 'promote' : id === 'rollback' ? 'rollback' : null;
+    if (!sub) return;
+    void ctx.executeCommand?.('policy', [sub]);
+    ctx.setStatus(`Dispatched /policy ${sub}.`);
+  }
+}
+
+export function createPolicyModalSurface(deps: PolicyModalDeps): ConfigModalSurface {
+  return new PolicyModalSurface(deps);
+}
+
+/**
+ * Deterministic golden fixture. A fixed `PolicyModalSnapshot` literal covering
+ * every rendered branch in one shot: an active current bundle, a simulating
+ * candidate, a 3-rule diff, a blocked divergence gate with one command-prefix
+ * and one tool-class breakdown row, one rolled-back history entry, one denied
+ * permission-audit entry, one lint warning, one preflight review with one issue,
+ * and one diverged simulation sample. No Date.now().
+ */
+export function policyModalGoldenSurface(): ConfigModalSurface {
+  const currentBundle: PolicyBundleVersion = {
+    bundle: { bundleId: 'bundle-current-1', issuedAt: '2023-11-01T00:00:00.000Z', payload: { version: 1, rules: [] }, issuer: 'ops' },
+    provenance: { policyBundleId: 'bundle-current-1', signatureStatus: 'unsigned', provenanceSource: 'local-file', issuedAt: '2023-11-01T00:00:00.000Z', issuer: 'ops' },
+    rules: [{ id: 'rule-base-1', type: 'prefix', origin: 'managed', effect: 'allow', toolPattern: '*', commandPrefixes: [] }],
+    state: 'active', loadedAt: '2023-11-01T00:00:00.000Z', activatedAt: '2023-11-01T00:05:00.000Z',
+  };
+  const candidateBundle: PolicyBundleVersion = {
+    bundle: { bundleId: 'bundle-candidate-1', issuedAt: '2023-11-10T00:00:00.000Z', payload: { version: 1, rules: [] }, issuer: 'ops' },
+    provenance: { policyBundleId: 'bundle-candidate-1', signatureStatus: 'unsigned', provenanceSource: 'local-file', issuedAt: '2023-11-10T00:00:00.000Z', issuer: 'ops' },
+    rules: [
+      { id: 'rule-base-1', type: 'prefix', origin: 'managed', effect: 'allow', toolPattern: '*', commandPrefixes: [] },
+      { id: 'rule-added-1', type: 'network-scope', origin: 'user', effect: 'deny', toolPattern: 'Fetch', hostPatterns: ['*'] },
+    ],
+    state: 'simulating', loadedAt: '2023-11-10T00:00:00.000Z',
+  };
+  const historyBundle: PolicyBundleVersion = {
+    bundle: { bundleId: 'bundle-prev-1', issuedAt: '2023-10-01T00:00:00.000Z', payload: { version: 1, rules: [] } },
+    provenance: { policyBundleId: 'bundle-prev-1', signatureStatus: 'unsigned', provenanceSource: 'local-file', issuedAt: '2023-10-01T00:00:00.000Z' },
+    rules: [], state: 'rolled-back', loadedAt: '2023-10-01T00:00:00.000Z', activatedAt: '2023-10-01T00:05:00.000Z', rolledBackAt: '2023-11-01T00:00:00.000Z',
+  };
+  const removedRule = { id: 'rule-removed-1', type: 'path-scope' as const, origin: 'user' as const, effect: 'deny' as const, toolPattern: '*', pathPatterns: ['/tmp/**'] };
+  const addedRule = { id: 'rule-added-1', type: 'network-scope' as const, origin: 'user' as const, effect: 'deny' as const, toolPattern: 'Fetch', hostPatterns: ['*'] };
+  const changedFrom = { id: 'rule-base-1', type: 'prefix' as const, origin: 'managed' as const, effect: 'allow' as const, toolPattern: '*', commandPrefixes: [] };
+  const changedTo = { id: 'rule-base-1', type: 'prefix' as const, origin: 'managed' as const, effect: 'deny' as const, toolPattern: '*', commandPrefixes: [] };
+  const stats = (divergenceRate: number): DivergenceStats => ({ total: 1, byType: { 'allow-vs-deny': 1, 'deny-vs-allow': 0, 'reason-mismatch': 0 }, divergenceRate, totalEvaluations: 20 });
+  const decision = (allowed: boolean, reason: 'DEFAULT_ALLOW' | 'RULE_DENY_USER') => ({ allowed, reason, sourceLayer: 'policy' as const, toolName: 'Fetch', args: {}, timestamp: 1700000000000, evaluationTrace: [] });
+
+  const snapshot: PolicyModalSnapshot = {
+    current: currentBundle, candidate: candidateBundle, history: [historyBundle],
+    diff: { fromBundleId: 'bundle-current-1', toBundleId: 'bundle-candidate-1', removed: [removedRule], added: [addedRule], changed: [{ ruleId: 'rule-base-1', from: changedFrom, to: changedTo }], unchanged: [], totalChanges: 3 },
+    divergence: {
+      report: { overall: stats(0.1), byToolClass: { network: stats(0.1) }, byCommandPrefix: { 'fetch ': stats(0.1) }, byMode: {}, records: [] },
+      mode: 'warn-on-divergence',
+      gate: { status: 'blocked', divergenceRate: 0.1, threshold: 0.05, totalEvaluations: 20, message: 'divergence rate 10.0% exceeds 5.0% threshold' },
+      trend: [{ ts: 1700000000000, divergenceRate: 0.1, totalEvaluations: 20, totalDivergences: 2, gatePassing: false }],
+      capturedAt: 1700000000000,
+    },
+    recentPermissionAudit: [{ callId: 'call-1', tool: 'Bash', category: 'exec', approved: false, riskLevel: 'high', classification: 'destructive', summary: 'blocked rm -rf outside sandbox root', reasons: ['path escape'], requestedAt: 1700000000000, decidedAt: 1700000001000 }],
+    lintFindings: [{ severity: 'warn', ruleId: 'rule-added-1', message: 'toolPattern "Fetch" combined with a wildcard host pattern is broad; consider narrowing.' }],
+    lastSimulationSummary: {
+      simulatedAt: '2023-11-10T00:00:00.000Z', mode: 'warn-on-divergence', totalScenarios: 4, divergentScenarios: 1, allowedByActual: 3, allowedBySimulated: 2,
+      results: [{ scenario: { id: 'scenario-1', label: 'fetch external API', toolName: 'Fetch', args: {} }, actualDecision: decision(true, 'DEFAULT_ALLOW'), simulatedDecision: decision(false, 'RULE_DENY_USER'), authoritativeDecision: decision(true, 'DEFAULT_ALLOW'), diverged: true, divergenceType: 'allow-vs-deny' }],
+    },
+    lastPreflightReview: {
+      generatedAt: '2023-11-10T00:10:00.000Z', status: 'warn', summary: '1 candidate rule broadens network access beyond the current policy.', issueCount: 1,
+      issues: [{ severity: 'warn', source: 'policy', message: 'candidate rule rule-added-1 denies all outbound network access', detail: 'verify this is intentional before promotion' }],
+    },
+    capturedAt: '2023-11-10T00:15:00.000Z',
+  };
+  return createPolicyModalSurface({ policyRuntimeState: { getSnapshot: () => snapshot } });
+}

package/src/panels/modals/provider-health-modal.ts

@@ -0,0 +1,136 @@
+import type { ConfigModalActionContext, ConfigModalRow, ConfigModalSurface, ConfigModalView } from '../../input/config-modal-types.ts';
+import type { UiReadModel, UiProvidersSnapshot } from '../../runtime/ui-read-models.ts';
+import type { ProviderRuntimeSnapshot } from '@pellux/goodvibes-sdk/platform/providers';
+import { toneStyle, statusGlyph, pad, postureLine, kv } from './modal-surface-helpers.ts';
+
+/** The slice of ProviderRuntimeInspectionQuery this surface consumes. */
+export interface ProviderRuntimeInspect {
+  listProviderIds(): readonly string[];
+  inspectAll(): Promise<readonly ProviderRuntimeSnapshot[]>;
+}
+
+/**
+ * Provider-health config-modal surface (migrated from the `provider-health`
+ * panel — the charter's live-modal exemplar; also the target of the `providers`
+ * and `accounts` redirects). providerRuntime.inspectAll() is async, so its
+ * result is cached and refreshed on open, on `r`, and on a 3s live tick (the
+ * panel's display-tick cadence); buildView reads the cache synchronously so
+ * live status/model-count values update in place with a stable layout.
+ *
+ * Fidelity boundary (stated divergence): the panel's per-request latency
+ * timelines, auth-route table, and 8 repair-domain posture blocks are driven by
+ * an event-fed tracker + account-posture snapshots; those deep views remain on
+ * the `/health` and `/accounts` commands (which print them in full). The modal
+ * ports the live provider status list + the panel's one dispatch action
+ * (Enter → `/accounts repair <provider>`), across a Health and an Accounts tab.
+ */
+class ProviderHealthModalSurface implements ConfigModalSurface {
+  readonly name = 'providers-modal';
+  readonly title = 'Providers';
+  private requestRender: () => void = () => {};
+  private cache = new Map<string, ProviderRuntimeSnapshot>();
+  private timer: ReturnType<typeof setInterval> | null = null;
+  private unsub: (() => void) | null = null;
+  private loaded = false;
+
+  constructor(
+    private readonly providerRuntime: ProviderRuntimeInspect,
+    private readonly providersReadModel?: UiReadModel<UiProvidersSnapshot>,
+  ) {}
+
+  readonly actions = [
+    { key: 'enter', id: 'repair', label: 'repair' },
+    { key: 'r', id: 'refresh', label: 'refresh posture' },
+  ];
+
+  onOpen(requestRender: () => void): void {
+    this.requestRender = requestRender;
+    void this.reinspect();
+    if (this.providersReadModel && !this.unsub) this.unsub = this.providersReadModel.subscribe(() => this.requestRender());
+    if (this.timer === null) this.timer = setInterval(() => { void this.reinspect(); }, 3_000);
+  }
+
+  onClose(): void {
+    if (this.timer !== null) { clearInterval(this.timer); this.timer = null; }
+    this.unsub?.();
+    this.unsub = null;
+  }
+
+  private providerIds(): string[] {
+    const ids = new Set<string>([
+      ...(this.providersReadModel?.getSnapshot().providerIds ?? []),
+      ...this.providerRuntime.listProviderIds(),
+      ...this.cache.keys(),
+    ]);
+    return [...ids].sort((a, b) => a.localeCompare(b));
+  }
+
+  buildView(): ConfigModalView {
+    const ids = this.providerIds();
+    const active = ids.filter((id) => this.cache.get(id)?.active).length;
+    const header = [postureLine([
+      kv('providers', ids.length),
+      kv('active', active),
+      kv('inspected', this.cache.size),
+    ])];
+
+    const rowFor = (id: string): ConfigModalRow => {
+      const snap = this.cache.get(id);
+      const isActive = Boolean(snap?.active);
+      return {
+        id: `provider:${id}`,
+        label: `${statusGlyph(isActive ? 'good' : 'dim')} ${pad(id, 18)} ${pad(isActive ? 'ACTIVE' : 'idle', 8)} models=${snap?.modelCount ?? '—'}`,
+        style: toneStyle(isActive ? 'good' : 'dim'),
+      };
+    };
+
+    const rows = ids.map(rowFor);
+    const emptyText = ids.length === 0
+      ? (this.loaded ? 'No providers registered. Try /provider or /subscription.' : 'Inspecting providers…')
+      : undefined;
+
+    return {
+      title: 'Providers',
+      tabs: [
+        { id: 'health', label: 'Health', header, rows, emptyText, hints: ['r refresh posture', '/health for latency & routes'] },
+        { id: 'accounts', label: 'Accounts', header, rows: ids.map(rowFor), emptyText, hints: ['Enter repair', '/accounts routes <p> for detail'] },
+      ],
+    };
+  }
+
+  onAction(id: string, ctx: ConfigModalActionContext): void {
+    if (id === 'refresh') {
+      void this.reinspect();
+      ctx.setStatus('Refreshing provider posture…');
+      return;
+    }
+    if (id === 'repair') {
+      const provider = ctx.row?.id.startsWith('provider:') ? ctx.row.id.slice('provider:'.length) : null;
+      if (!provider) return;
+      void ctx.executeCommand?.('accounts', ['repair', provider]);
+      ctx.setStatus(`Dispatched /accounts repair ${provider} (see transcript).`);
+    }
+  }
+
+  private async reinspect(): Promise<void> {
+    try {
+      const snapshots = await this.providerRuntime.inspectAll();
+      const next = new Map<string, ProviderRuntimeSnapshot>();
+      for (const s of snapshots) next.set(s.providerId, s);
+      this.cache = next;
+    } catch {
+      // Leave the last-known cache in place; a transient inspect failure should
+      // not blank the live table (honest degraded behaviour).
+    } finally {
+      this.loaded = true;
+      this.requestRender();
+    }
+  }
+}
+
+export function createProviderHealthModalSurface(
+  providerRuntime: ProviderRuntimeInspect,
+  providersReadModel?: UiReadModel<UiProvidersSnapshot>,
+): ConfigModalSurface {
+  return new ProviderHealthModalSurface(providerRuntime, providersReadModel);
+}

package/src/panels/modals/remote-modal.ts

@@ -0,0 +1,115 @@
+import type { ConfigModalActionContext, ConfigModalSurface, ConfigModalView } from '../../input/config-modal-types.ts';
+import type { UiReadModel, UiRemoteSnapshot } from '../../runtime/ui-read-models.ts';
+import { toneStyle, statusGlyph, pad, postureLine, kv, type Tone } from './modal-surface-helpers.ts';
+
+function stateTone(state: string): Tone {
+  switch (state) {
+    case 'connected':
+    case 'syncing':
+      return 'good';
+    case 'degraded':
+    case 'reconnecting':
+    case 'authenticating':
+    case 'initializing':
+      return 'warn';
+    case 'terminal_failure':
+      return 'bad';
+    default:
+      return 'dim';
+  }
+}
+
+/**
+ * Remote config-modal surface (migrated from the `remote` panel). The read-model
+ * snapshot is synchronous; a subscribe() keeps live transport/heartbeat values
+ * refreshing between key presses. The panel's `Tab` connections/contracts browse
+ * toggle becomes two real tabs. `r`/Enter dispatch `/remote recover` for the
+ * selected runner — the panel's only corrective keybinding; the richer
+ * `/remote` command set (show/supervisor/cancel/dispatch/artifact/…) stays on
+ * the command front-door.
+ */
+class RemoteModalSurface implements ConfigModalSurface {
+  readonly name = 'remote-modal';
+  readonly title = 'Remote';
+  private requestRender: () => void = () => {};
+  private unsub: (() => void) | null = null;
+
+  constructor(private readonly readModel?: UiReadModel<UiRemoteSnapshot>) {}
+
+  readonly actions = [
+    { key: 'r', id: 'recover', label: 'recover' },
+    { key: 'enter', id: 'recover', label: 'recover' },
+  ];
+
+  onOpen(requestRender: () => void): void {
+    this.requestRender = requestRender;
+    if (this.readModel && !this.unsub) this.unsub = this.readModel.subscribe(() => this.requestRender());
+  }
+
+  onClose(): void {
+    this.unsub?.();
+    this.unsub = null;
+  }
+
+  buildView(): ConfigModalView {
+    const snapshot = this.readModel?.getSnapshot();
+    if (!snapshot) {
+      return {
+        title: 'Remote',
+        degraded: 'Runtime store not wired into this runtime.',
+        tabs: [{ id: 'connections', label: 'Connections', rows: [], emptyText: 'Try /remote setup.' }],
+      };
+    }
+    const { daemon, acp, contracts, artifacts, supervisor, distributed } = snapshot;
+    const peersConnected = distributed.peers.filter((p) => p.status === 'connected').length;
+    const header = [
+      postureLine([
+        `daemon ${daemon.transportState.toUpperCase()}`,
+        kv('running', daemon.isRunning ? 'yes' : 'no'),
+        kv('reconnects', daemon.reconnectAttempts),
+        kv('jobs', daemon.runningJobCount),
+      ]),
+      postureLine([
+        `acp ${acp.transportState.toUpperCase()}`,
+        kv('conns', acp.activeConnections.length),
+        kv('contracts', contracts.length),
+        kv('artifacts', artifacts.length),
+        kv('sessions', supervisor.sessions.length),
+        kv('peers', `${peersConnected}/${distributed.peers.length}`),
+      ]),
+    ];
+
+    const connectionRows = acp.activeConnections.map((c) => ({
+      id: `conn:${c.agentId}`,
+      label: `${statusGlyph(stateTone(c.transportState))} ${pad(c.agentId, 20)} ${pad(c.transportState.toUpperCase(), 14)} msgs=${c.messageCount} errs=${c.errorCount}  ${c.label ?? ''}`,
+      style: toneStyle(stateTone(c.transportState)),
+    }));
+
+    const contractRows = contracts.map((ct) => ({
+      id: `contract:${ct.runnerId}`,
+      label: `${statusGlyph(stateTone(ct.transport.state))} ${pad(ct.runnerId, 20)} ${pad(ct.transport.state.toUpperCase(), 14)} ${ct.template ?? ''}`,
+      style: toneStyle(stateTone(ct.transport.state)),
+    }));
+
+    return {
+      title: 'Remote',
+      tabs: [
+        { id: 'connections', label: 'Connections', header, rows: connectionRows, emptyText: 'No active ACP or remote subagent connections.', hints: ['r recover'] },
+        { id: 'contracts', label: 'Contracts', header, rows: contractRows, emptyText: 'No registered remote runner contracts.', hints: ['r recover'] },
+      ],
+    };
+  }
+
+  onAction(id: string, ctx: ConfigModalActionContext): void {
+    if (id !== 'recover') return;
+    const rowId = ctx.row?.id ?? '';
+    const runner = rowId.includes(':') ? rowId.slice(rowId.indexOf(':') + 1) : '';
+    void ctx.executeCommand?.('remote', runner ? ['recover', runner] : ['recover']);
+    ctx.setStatus(runner ? `Recovering ${runner}…` : 'Recovering…');
+    this.requestRender();
+  }
+}
+
+export function createRemoteModalSurface(readModel?: UiReadModel<UiRemoteSnapshot>): ConfigModalSurface {
+  return new RemoteModalSurface(readModel);
+}

package/src/panels/modals/sandbox-modal.ts

@@ -0,0 +1,150 @@
+import type { ConfigModalAction, ConfigModalActionContext, ConfigModalRow, ConfigModalSurface, ConfigModalView } from '../../input/config-modal-types.ts';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import { buildSandboxReview, listSandboxProfiles } from '@/runtime/index.ts';
+import type { SandboxProfile, SandboxSession, SandboxSessionRegistry } from '@/runtime/index.ts';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { toneStyle, statusGlyph, pad, postureLine, kv, type Tone } from './modal-surface-helpers.ts';
+
+/** SandboxSessionRegistry has no event subscription — poll at the same 3s
+ *  cadence the retired panel used (POLL_INTERVAL_MS in sandbox-panel.ts). */
+const POLL_INTERVAL_MS = 3_000;
+
+function sessionTone(state: SandboxSession['state']): Tone {
+  switch (state) {
+    case 'running': return 'good';
+    case 'failed': return 'bad';
+    case 'planned': return 'warn';
+    case 'stopped': return 'dim';
+    default: return 'dim';
+  }
+}
+
+function profileIdOf(row: ConfigModalRow | null): SandboxProfile['id'] | null {
+  return row?.id.startsWith('profile:') ? (row.id.slice('profile:'.length) as SandboxProfile['id']) : null;
+}
+
+function sessionIdOf(row: ConfigModalRow | null): string | null {
+  return row?.id.startsWith('session:') ? row.id.slice('session:'.length) : null;
+}
+
+/**
+ * Sandbox config-modal surface (migrated from the `sandbox` panel). All reads
+ * (buildSandboxReview, listSandboxProfiles, sessions.list) are synchronous, so
+ * buildView reads them live each tick. The panel's single profile+session
+ * selectable list becomes two real tabs. s/x/e call the SandboxSessionRegistry
+ * directly (these were never slash commands) — start/execute are wrapped so a
+ * rejection surfaces via ctx.setStatus instead of an unhandled rejection,
+ * matching the panel's try/catch + setError behaviour.
+ */
+class SandboxModalSurface implements ConfigModalSurface {
+  readonly name = 'sandbox-modal';
+  readonly title = 'Sandbox';
+  private requestRender: () => void;
+  private timer: ReturnType<typeof setInterval> | null = null;
+
+  constructor(
+    private readonly config: ConfigManager,
+    private readonly sessions: SandboxSessionRegistry,
+    requestRender: () => void = () => {},
+  ) {
+    this.requestRender = requestRender;
+  }
+
+  readonly actions: ConfigModalAction[] = [
+    { key: 's', id: 'start', label: 'start', enabledFor: (row, tabId) => tabId === 'profiles' && profileIdOf(row) !== null },
+    { key: 'x', id: 'stop', label: 'stop', confirm: true, enabledFor: (row, tabId) => tabId === 'sessions' && sessionIdOf(row) !== null },
+    { key: 'e', id: 'execute', label: 'execute probe', enabledFor: (row, tabId) => tabId === 'sessions' && sessionIdOf(row) !== null },
+  ];
+
+  onOpen(requestRender: () => void): void {
+    this.requestRender = requestRender;
+    if (this.timer === null) this.timer = setInterval(() => this.requestRender(), POLL_INTERVAL_MS);
+  }
+
+  onClose(): void {
+    if (this.timer !== null) { clearInterval(this.timer); this.timer = null; }
+  }
+
+  buildView(): ConfigModalView {
+    try {
+      const review = buildSandboxReview(this.config);
+      const profiles = listSandboxProfiles(this.config);
+      const sessions = this.sessions.list();
+
+      const header = [postureLine([
+        kv('platform', review.host.platform),
+        kv('backend', review.config.vmBackend),
+        kv('sessions', sessions.length),
+        kv('ready', review.host.secureSandboxReady ? 'yes' : 'no'),
+      ])];
+
+      const profileRows: ConfigModalRow[] = profiles.map((profile) => ({
+        id: `profile:${profile.id}`,
+        label: `${pad(profile.id, 14)} ${pad(profile.kind, 6)} ${pad(profile.isolation, 10)} vm=${profile.requiresVm ? 'yes' : 'no'}`,
+      }));
+
+      const sessionRows: ConfigModalRow[] = sessions.map((session) => ({
+        id: `session:${session.id}`,
+        label: `${statusGlyph(sessionTone(session.state))} ${pad(session.id, 20)} ${pad(session.state.toUpperCase(), 9)} backend=${pad(session.resolvedBackend ?? session.backend, 6)} runs=${session.executionCount ?? 0}`,
+        style: toneStyle(sessionTone(session.state)),
+      }));
+
+      return {
+        title: 'Sandbox',
+        tabs: [
+          { id: 'profiles', label: 'Profiles', header, rows: profileRows, emptyText: 'No sandbox profiles available.', hints: ['s start'] },
+          { id: 'sessions', label: 'Sessions', header, rows: sessionRows, emptyText: 'No active sandbox sessions.', hints: ['x stop', 'e execute probe'] },
+        ],
+      };
+    } catch (error) {
+      return {
+        title: 'Sandbox',
+        degraded: `Sandbox posture unavailable: ${summarizeError(error)}`,
+        tabs: [
+          { id: 'profiles', label: 'Profiles', rows: [] },
+          { id: 'sessions', label: 'Sessions', rows: [] },
+        ],
+      };
+    }
+  }
+
+  onAction(id: string, ctx: ConfigModalActionContext): void {
+    switch (id) {
+      case 'start': {
+        const profileId = profileIdOf(ctx.row);
+        if (!profileId) return;
+        void this.sessions.start(profileId, undefined, this.config)
+          .catch((error: unknown) => ctx.setStatus(summarizeError(error)))
+          .finally(() => this.requestRender());
+        return;
+      }
+      case 'stop': {
+        const sessionId = sessionIdOf(ctx.row);
+        if (!sessionId) return;
+        this.sessions.stop(sessionId);
+        break;
+      }
+      case 'execute': {
+        const sessionId = sessionIdOf(ctx.row);
+        if (!sessionId) return;
+        try {
+          this.sessions.execute(sessionId, process.execPath, ['-e', "console.log('sandbox modal probe ok')"], this.config, { timeoutMs: 5_000 });
+        } catch (error) {
+          ctx.setStatus(summarizeError(error));
+        }
+        break;
+      }
+      default:
+        return;
+    }
+    this.requestRender();
+  }
+}
+
+export function createSandboxModalSurface(
+  config: ConfigManager,
+  sessions: SandboxSessionRegistry,
+  requestRender: () => void = () => {},
+): ConfigModalSurface {
+  return new SandboxModalSurface(config, sessions, requestRender);
+}