@pellux/goodvibes-tui 1.1.0 → 1.7.0

package/src/panels/modals/security-modal.ts

@@ -0,0 +1,217 @@
+import { MODAL_TONES } from './modal-theme.ts';
+import { infoRow } from './modal-surface-helpers.ts';
+import type { TokenAuditResult } from '@pellux/goodvibes-sdk/platform/security';
+import type { ModalSectionStyle } from '../../renderer/modal-factory.ts';
+import type { UiReadModel, UiSecuritySnapshot } from '../../runtime/ui-read-models.ts';
+import type {
+  ConfigModalActionContext,
+  ConfigModalRow,
+  ConfigModalSurface,
+  ConfigModalTab,
+  ConfigModalView,
+} from '../../input/config-modal-types.ts';
+
+// ---------------------------------------------------------------------------
+// Security → config-modal surface (W6.1 group-B port). Two tabs: 'Tokens' (the
+// token scope/rotation audit list under the governance summary) and
+// 'Governance' (policy preflight, MCP/plugin quarantine, latest incident, and
+// the MCP attack-path review). Read-model-backed, so refresh() is a no-op —
+// buildView reads getSnapshot() fresh every render. 'f' (preflight) routes to
+// its `/policy preflight` command path; 'i' jumps to the incident surface
+// (fleet) via the command path. Selection-blind port: the panel's
+// selected-token scope/rotation detail is folded into each token row label.
+// Determinism: absolute ISO timestamps (never Date.now()).
+// ---------------------------------------------------------------------------
+
+export interface SecurityModalDeps {
+  readonly readModel: UiReadModel<UiSecuritySnapshot>;
+}
+
+const BAD: ModalSectionStyle = { fg: MODAL_TONES.bad };
+const WARN: ModalSectionStyle = { fg: MODAL_TONES.warn };
+const MAX_FINDINGS_SHOWN = 5;
+
+function resultColor(result: TokenAuditResult): ModalSectionStyle | undefined {
+  if (result.blocked) return BAD;
+  if (result.scope.outcome === 'violation') return BAD;
+  if (result.rotation.outcome === 'overdue') return BAD;
+  if (result.rotation.outcome === 'warning') return WARN;
+  return undefined;
+}
+
+function resultSummary(result: TokenAuditResult): string {
+  const parts: string[] = [];
+  if (result.scope.outcome === 'violation') parts.push(`scope:${result.scope.excessScopes.join(',')}`);
+  if (result.rotation.outcome === 'warning') parts.push('rotation warning');
+  if (result.rotation.outcome === 'overdue') parts.push('rotation overdue');
+  if (result.blocked) parts.push('blocked');
+  return parts.length > 0 ? parts.join(' | ') : 'in policy';
+}
+
+function fmtDue(msUntilDue: number): string {
+  const overdue = msUntilDue < 0;
+  const sec = Math.floor(Math.abs(msUntilDue) / 1000);
+  const unit = sec < 3600 ? `${Math.max(1, Math.floor(sec / 60))}m` : sec < 86400 ? `${Math.floor(sec / 3600)}h` : `${Math.floor(sec / 86400)}d`;
+  return overdue ? `overdue by ${unit}` : `in ${unit}`;
+}
+
+function fmtIso(ts: number | null | undefined): string {
+  return ts === null || ts === undefined ? 'never' : new Date(ts).toISOString();
+}
+
+function findingColor(severity: string): ModalSectionStyle | undefined {
+  return severity === 'critical' || severity === 'high' ? BAD : severity === 'medium' ? WARN : undefined;
+}
+
+class SecurityModalSurface implements ConfigModalSurface {
+  readonly name = 'security-modal';
+  readonly title = 'Security Control Room';
+  private requestRender: () => void = () => {};
+  private unsub: (() => void) | null = null;
+
+  constructor(private readonly deps: SecurityModalDeps) {}
+
+  readonly actions = [
+    { key: 'f', id: 'preflight', label: 'preflight' },
+    { key: 'i', id: 'jumpToIncident', label: 'jump to incident', enabledFor: () => Boolean(this.deps.readModel.getSnapshot().latestIncident) },
+    { key: 'r', id: 'refresh', label: 'refresh audit' },
+  ];
+
+  onOpen(requestRender: () => void): void {
+    this.requestRender = requestRender;
+    if (!this.unsub) this.unsub = this.deps.readModel.subscribe(() => this.requestRender());
+  }
+
+  onClose(): void { this.unsub?.(); this.unsub = null; }
+
+  private governanceHeader(snapshot: UiSecuritySnapshot): string[] {
+    const audit = snapshot.audit;
+    const quarantinedMcp = snapshot.mcpServers.filter((s) => s.schemaFreshness === 'quarantined');
+    const elevatedMcp = snapshot.mcpServers.filter((s) => s.trustMode === 'allow-all');
+    return [
+      `mode ${audit.managed ? 'MANAGED' : 'ADVISORY'}  tokens ${audit.totalTokens}  blocked ${audit.blocked.length}  scope violations ${audit.scopeViolations.length}  overdue ${audit.rotationOverdue.length}  warnings ${audit.rotationWarnings.length}`,
+      `preflight ${snapshot.policy.preflightStatus.toUpperCase()}  issues ${snapshot.policy.preflightIssueCount}  lint ${snapshot.policy.lintFindingCount}  denied permissions ${snapshot.deniedPermissions}`,
+      `quarantined MCP ${quarantinedMcp.length}  elevated MCP ${elevatedMcp.length}  quarantined plugins ${snapshot.quarantinedPlugins.length}  untrusted plugins ${snapshot.untrustedPlugins.length}`,
+      `incidents ${snapshot.incidents.length}`,
+    ];
+  }
+
+  private tokensTab(snapshot: UiSecuritySnapshot): ConfigModalTab {
+    const audit = snapshot.audit;
+    const header = this.governanceHeader(snapshot);
+    const rows: ConfigModalRow[] = [];
+
+    if (audit.results.length === 0) {
+      const quarantinedMcp = snapshot.mcpServers.filter((s) => s.schemaFreshness === 'quarantined');
+      rows.push(infoRow('empty:0', 'No API tokens are registered with the security auditor yet.'));
+      rows.push(infoRow('empty:1', 'The security control room can already review policy, MCP, plugin, and incident posture, but token-specific scope and rotation audit data has not been registered.', { dim: true }));
+      if (quarantinedMcp.length > 0) rows.push(infoRow('empty:mcp', 'MCP quarantine still active despite no registered tokens.', WARN));
+      rows.push(infoRow('empty:title', 'Inspect further'));
+      rows.push(infoRow('empty:storage', '/storage review — inspect secure secret storage and environment overrides', { dim: true }));
+      rows.push(infoRow('empty:mcptrust', '/mcp trust      — inspect active MCP trust and quarantine posture', { dim: true }));
+      return { id: 'tokens', label: 'Tokens', header, rows, emptyText: '' };
+    }
+
+    for (const result of audit.results) {
+      const ageDays = Math.floor(result.rotation.ageMs / (24 * 60 * 60 * 1000));
+      rows.push({
+        id: result.tokenId,
+        label: `${result.label.padEnd(22)} ${result.tokenId.padEnd(14)} ${result.scope.policyId.padEnd(12)} ${resultSummary(result)} · rot ${result.rotation.outcome}/${fmtDue(result.rotation.msUntilDue)} age ${ageDays}d${result.blocked ? ' · BLOCKED' : ''}`,
+        ...(resultColor(result) ? { style: resultColor(result)! } : {}),
+      });
+    }
+    rows.push(infoRow('audit:when', `Last audit ${fmtIso(audit.lastAuditAt)} — press r to refresh`, { dim: true }));
+    return { id: 'tokens', label: 'Tokens', header, rows, hints: ['f preflight'] };
+  }
+
+  private governanceTab(snapshot: UiSecuritySnapshot): ConfigModalTab {
+    const rows: ConfigModalRow[] = [];
+    const quarantinedMcp = snapshot.mcpServers.filter((s) => s.schemaFreshness === 'quarantined');
+    if (quarantinedMcp.length > 0) {
+      const server = quarantinedMcp[0]!;
+      rows.push(infoRow('mcp:q', `MCP quarantine: ${server.name} ${server.quarantineReason ?? 'unknown'}${server.quarantineDetail ? ` — ${server.quarantineDetail}` : ''}`, BAD));
+    }
+    if (snapshot.quarantinedPlugins.length > 0) {
+      const plugin = snapshot.quarantinedPlugins[0]!;
+      rows.push(infoRow('plugin:q', `Plugin quarantine: ${plugin.name} (${plugin.trustTier})`, BAD));
+    } else if (snapshot.untrustedPlugins.length > 0) {
+      const plugin = snapshot.untrustedPlugins[0]!;
+      rows.push(infoRow('plugin:u', `Plugin trust warning: ${plugin.name} remains untrusted.`, WARN));
+    }
+    if (snapshot.latestIncident) {
+      rows.push(infoRow('incident', `Latest incident: ${snapshot.latestIncident.classification} — ${snapshot.latestIncident.summary} (${fmtIso(snapshot.latestIncident.generatedAt)})`, WARN));
+    }
+
+    const review = snapshot.attackPathReview;
+    rows.push(infoRow('atk:title', 'MCP Attack-Path Review'));
+    rows.push(infoRow('atk:counts', `critical ${review.criticalFindings}  incoherent ${review.incoherentFindings}`, review.criticalFindings > 0 ? BAD : { dim: true }));
+    rows.push(infoRow('atk:summary', review.summary, { dim: true }));
+    const shown = review.findings.slice(0, MAX_FINDINGS_SHOWN);
+    shown.forEach((finding, i) => {
+      rows.push(infoRow(`atk:${i}:h`, `${finding.severity.toUpperCase()} ${finding.serverName}: ${finding.route}`, findingColor(finding.severity)));
+      rows.push(infoRow(`atk:${i}:r`, `  ${finding.reason}`, { dim: true }));
+      rows.push(infoRow(`atk:${i}:e`, `  evidence: ${finding.evidence.join(' | ')}`, { dim: true }));
+    });
+    if (review.findings.length > shown.length) {
+      const extra = review.findings.length - shown.length;
+      rows.push(infoRow('atk:more', `+${extra} more finding${extra === 1 ? '' : 's'} not shown`, { dim: true }));
+    }
+    return { id: 'governance', label: 'Governance', rows, emptyText: 'No governance findings.' };
+  }
+
+  buildView(): ConfigModalView {
+    const snapshot = this.deps.readModel.getSnapshot();
+    return { title: 'Security Control Room', tabs: [this.tokensTab(snapshot), this.governanceTab(snapshot)] };
+  }
+
+  onAction(id: string, ctx: ConfigModalActionContext): void {
+    if (id === 'refresh') { ctx.setStatus('Security posture is read live.'); ctx.requestRender(); return; }
+    if (id === 'preflight') { void ctx.executeCommand?.('policy', ['preflight']); ctx.setStatus('Dispatched /policy preflight.'); return; }
+    if (id === 'jumpToIncident' && this.deps.readModel.getSnapshot().latestIncident) {
+      void ctx.executeCommand?.('panel', ['open', 'incident']);
+      ctx.setStatus('Opened the incident surface (fleet).');
+    }
+  }
+}
+
+export function createSecurityModalSurface(deps: SecurityModalDeps): ConfigModalSurface {
+  return new SecurityModalSurface(deps);
+}
+
+/**
+ * Deterministic golden fixture. A fixed `UiSecuritySnapshot` literal covering
+ * the meaningful states in one shot: a clean token, a blocked/overdue/scope-
+ * violating token, a quarantined allow-all MCP server, a quarantined plugin,
+ * one recorded incident, and one critical attack-path finding. No Date.now().
+ */
+export function securityModalGoldenSurface(): ConfigModalSurface {
+  const FIXED_INCIDENT = {
+    id: 'inc-0001', traceId: 'trace-0001', sessionId: 'sess-0001', generatedAt: 1700000000000,
+    classification: 'permission_denied' as const, summary: 'blocked write outside sandbox root',
+    phaseTimings: [], phaseLedger: [], causalChain: [], cascadeEvents: [], permissionEvidence: [], budgetBreaches: [], jumpLinks: [],
+  };
+  const snapshot: UiSecuritySnapshot = {
+    audit: {
+      managed: true, totalTokens: 2,
+      results: [
+        { tokenId: 'tok-openai', label: 'OPENAI_API_KEY', scope: { tokenId: 'tok-openai', outcome: 'ok', excessScopes: [], policyId: 'openai' }, rotation: { tokenId: 'tok-openai', outcome: 'ok', ageMs: 5 * 86400000, cadenceMs: 90 * 86400000, msUntilDue: 85 * 86400000, dueAt: 1707600000000 }, blocked: false },
+        { tokenId: 'tok-slack', label: 'SLACK_BOT_TOKEN', scope: { tokenId: 'tok-slack', outcome: 'violation', excessScopes: ['admin'], policyId: 'slack' }, rotation: { tokenId: 'tok-slack', outcome: 'overdue', ageMs: 120 * 86400000, cadenceMs: 90 * 86400000, msUntilDue: -30 * 86400000, dueAt: 1697328000000 }, blocked: true },
+      ],
+      blocked: ['tok-slack'], scopeViolations: ['tok-slack'], rotationWarnings: [], rotationOverdue: ['tok-slack'],
+      lastAuditAt: 1700000000000, capturedAt: '2023-11-14T22:13:20.000Z',
+    },
+    policy: { preflightStatus: 'warn', preflightIssueCount: 2, lintFindingCount: 1 },
+    deniedPermissions: 3, incidents: [FIXED_INCIDENT], latestIncident: FIXED_INCIDENT,
+    mcpServers: [{ name: 'fs-server', role: 'filesystem', trustMode: 'allow-all', connected: true, allowedPaths: [], allowedHosts: [], schemaFreshness: 'quarantined', quarantineReason: 'stale_threshold', quarantineDetail: 'ttl expired 2 days ago' }],
+    recentMcpDecisions: [],
+    attackPathReview: {
+      reviewedAt: 1700000000000, totalServers: 1, connectedServers: 1, allowAllServers: 1, askOnRiskServers: 0, constrainedServers: 0, blockedServers: 0, quarantinedServers: 1, incoherentFindings: 1, criticalFindings: 1,
+      findings: [{ kind: 'server-posture', serverName: 'fs-server', route: 'fs-server -> write_fs', verdict: 'ask', severity: 'critical', incoherent: true, reason: 'allow-all trust combined with a quarantined schema', evidence: ['schemaFreshness=quarantined', 'trustMode=allow-all'] }],
+      summary: '1 server in allow-all mode with a quarantined schema',
+    },
+    plugins: [],
+    quarantinedPlugins: [{ name: 'legacy-formatter', version: '0.1.0', description: 'old formatter plugin', enabled: false, active: false, trustTier: 'untrusted', quarantined: true }],
+    untrustedPlugins: [],
+  };
+  return createSecurityModalSurface({ readModel: { getSnapshot: () => snapshot, subscribe: () => () => {} } });
+}

package/src/panels/modals/services-modal.ts

@@ -0,0 +1,179 @@
+import type { ConfigModalActionContext, ConfigModalSurface, ConfigModalView } from '../../input/config-modal-types.ts';
+import type { ServiceInspectionQuery, SubscriptionAccessQuery } from '../../runtime/ui-service-queries.ts';
+import type { ServiceConfig, ServiceInspection, ServiceConnectionTestResult } from '@pellux/goodvibes-sdk/platform/config';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { toneStyle, statusGlyph, pad, postureLine, kv, type Tone } from './modal-surface-helpers.ts';
+
+interface Entry {
+  readonly name: string;
+  readonly inspection: ServiceInspection | null;
+  lastTest?: ServiceConnectionTestResult;
+}
+
+function statusLabel(e: Entry): string {
+  if (!e.inspection) return 'INSPECT FAILED';
+  if (!e.inspection.hasPrimaryCredential) return 'UNCONFIGURED';
+  if (e.lastTest?.ok) return 'HEALTHY';
+  if (e.lastTest && !e.lastTest.ok) return 'ERROR';
+  return 'CONFIGURED';
+}
+
+function statusTone(e: Entry): Tone {
+  const label = statusLabel(e);
+  if (label === 'HEALTHY') return 'good';
+  if (label === 'ERROR' || label === 'INSPECT FAILED') return 'bad';
+  if (label === 'CONFIGURED') return 'warn';
+  return 'dim';
+}
+
+function statusDotTone(e: Entry): Tone {
+  const label = statusLabel(e);
+  if (label === 'HEALTHY') return 'good';
+  if (label === 'ERROR' || label === 'INSPECT FAILED') return 'bad';
+  return 'dim';
+}
+
+// Ported verbatim from ServicesPanel.authSummary (the retired panel's derivation).
+function authSummary(config: ServiceConfig, manager: SubscriptionAccessQuery): string {
+  const provider = config.providerId ?? config.name;
+  const hasOverride = manager.getAccessToken(provider) != null;
+  switch (config.authType) {
+    case 'bearer': return hasOverride ? 'bearer+subscription' : 'bearer';
+    case 'basic': return 'basic';
+    case 'api-key': return hasOverride ? 'oauth-override' : config.apiKeyHeader ? `api-key:${config.apiKeyHeader}` : 'api-key';
+    case 'oauth': return manager.get(provider) != null ? 'oauth(active)' : 'oauth';
+  }
+}
+
+/**
+ * Services config-modal surface (migrated from the `services` panel). Reads the
+ * same ServiceInspectionQuery — getAll() is sync but inspect()/testConnection()
+ * are async, so an inspection cache is refreshed on open / `r` and read
+ * synchronously by buildView (mirrors the panel's own refresh contract).
+ * Actions map onto their existing behaviours; `s` jumps to the subscription
+ * surface, `t`/`T` run the same live connection tests, `r` re-inspects.
+ */
+class ServicesModalSurface implements ConfigModalSurface {
+  readonly name = 'services-modal';
+  readonly title = 'Services';
+  private entries: Entry[] = [];
+  private loading = false;
+  private error = '';
+  private requestRender: () => void = () => {};
+
+  constructor(
+    private readonly registry: ServiceInspectionQuery,
+    private readonly manager: SubscriptionAccessQuery,
+  ) {}
+
+  readonly actions = [
+    { key: 'r', id: 'refresh', label: 'refresh' },
+    { key: 't', id: 'test', label: 'test' },
+    { key: 'T', id: 'test-all', label: 'test all' },
+    { key: 's', id: 'subscription', label: 'subscription' },
+  ];
+
+  onOpen(requestRender: () => void): void {
+    this.requestRender = requestRender;
+    if (this.entries.length === 0 && !this.loading) void this.refresh();
+  }
+
+  buildView(): ConfigModalView {
+    const counts = { healthy: 0, error: 0, unconfigured: 0 };
+    for (const e of this.entries) {
+      const label = statusLabel(e);
+      if (label === 'HEALTHY') counts.healthy++;
+      else if (label === 'ERROR') counts.error++;
+      else if (label !== 'CONFIGURED') counts.unconfigured++;
+    }
+    const header = [postureLine([
+      kv('services', this.entries.length),
+      kv('healthy', counts.healthy),
+      kv('errors', counts.error),
+      kv('unconfigured', counts.unconfigured),
+    ])];
+
+    const rows = this.entries.map((e) => {
+      const auth = e.inspection ? authSummary(e.inspection.config, this.manager) : 'n/a';
+      const base = e.inspection ? (e.inspection.config.baseUrl ?? '(no baseUrl)') : '(inspection failed)';
+      return {
+        id: `svc:${e.name}`,
+        label: `${statusGlyph(statusDotTone(e))} ${pad(e.name, 16)} ${pad(statusLabel(e), 13)} ${pad(auth, 18)} ${base}`,
+        style: toneStyle(statusTone(e)),
+      };
+    });
+
+    return {
+      title: this.loading && this.entries.length === 0 ? 'Services (loading…)' : 'Services',
+      degraded: this.error || undefined,
+      tabs: [{
+        id: 'services',
+        label: 'Services',
+        header,
+        rows,
+        emptyText: this.loading ? 'Loading configured services…' : 'No services configured. Try /services auth-review.',
+      }],
+    };
+  }
+
+  onAction(id: string, ctx: ConfigModalActionContext): void {
+    if (id === 'refresh') void this.refresh();
+    else if (id === 'test') void this.testOne(ctx);
+    else if (id === 'test-all') void this.testAll();
+    else if (id === 'subscription') ctx.openModal?.('subscription-modal');
+  }
+
+  private nameOf(rowId: string | undefined): string | null {
+    return rowId?.startsWith('svc:') ? rowId.slice('svc:'.length) : null;
+  }
+
+  private async refresh(): Promise<void> {
+    this.loading = true;
+    this.error = '';
+    this.requestRender();
+    try {
+      const configs = this.registry.getAll();
+      const names = Object.keys(configs).sort((a, b) => a.localeCompare(b));
+      const inspections = await Promise.all(names.map(async (name) => ({ name, inspection: await this.registry.inspect(name) })));
+      const prev = new Map(this.entries.map((e) => [e.name, e.lastTest] as const));
+      this.entries = inspections.map((e) => ({ ...e, lastTest: prev.get(e.name) }));
+    } catch (e) {
+      this.error = `Refresh failed: ${summarizeError(e)}`;
+    } finally {
+      this.loading = false;
+      this.requestRender();
+    }
+  }
+
+  private async testOne(ctx: ConfigModalActionContext): Promise<void> {
+    const name = this.nameOf(ctx.row?.id);
+    if (!name) return;
+    try {
+      const result = await this.registry.testConnection(name);
+      this.entries = this.entries.map((e) => (e.name === name ? { ...e, lastTest: result } : e));
+      ctx.setStatus(`${name}: ${result.ok ? 'ok' : `failed (${result.status ?? 'n/a'})`}`);
+    } catch (e) {
+      ctx.setStatus(`Test failed: ${summarizeError(e)}`);
+    }
+    this.requestRender();
+  }
+
+  private async testAll(): Promise<void> {
+    for (const entry of this.entries) {
+      try {
+        const result = await this.registry.testConnection(entry.name);
+        this.entries = this.entries.map((e) => (e.name === entry.name ? { ...e, lastTest: result } : e));
+      } catch (e) {
+        this.error = `Test failed for ${entry.name}: ${summarizeError(e)}`;
+      }
+      this.requestRender();
+    }
+  }
+}
+
+export function createServicesModalSurface(
+  registry: ServiceInspectionQuery,
+  manager: SubscriptionAccessQuery,
+): ConfigModalSurface {
+  return new ServicesModalSurface(registry, manager);
+}

package/src/panels/modals/settings-sync-modal.ts

@@ -0,0 +1,142 @@
+import type { ConfigModalAction, ConfigModalActionContext, ConfigModalRow, ConfigModalSurface, ConfigModalView } from '../../input/config-modal-types.ts';
+import { getSettingsControlPlaneSnapshot } from '@/runtime/index.ts';
+import type { ConfigManager } from '../../config/index.ts';
+import { toneStyle, pad, postureLine, kv, type Tone } from './modal-surface-helpers.ts';
+
+type Snapshot = ReturnType<typeof getSettingsControlPlaneSnapshot>;
+
+function sourceTone(source: string, conflict: boolean, locked: boolean): Tone {
+  if (conflict) return 'bad';
+  if (locked || source === 'managed') return 'warn';
+  if (source === 'synced') return 'good';
+  if (source === 'local') return 'info';
+  return 'dim';
+}
+
+/**
+ * Settings-sync config-modal surface (migrated from the `settings-sync` panel).
+ * All reads are synchronous (getSettingsControlPlaneSnapshot). The panel's six
+ * Tab-cycled browse modes become six real tabs. Conflict resolution keeps the
+ * panel's two-step shape: Enter on a conflicted key arms a resolve prompt, then
+ * l/s dispatch the existing `/settings-sync resolve <key> <local|synced>`
+ * command (the command owns the mutation + live-session refresh). `m` dispatches
+ * `/managed review`. push/pull remain CLI-only (they were never panel actions).
+ */
+class SettingsSyncModalSurface implements ConfigModalSurface {
+  readonly name = 'settings-sync-modal';
+  readonly title = 'Settings Sync';
+  private requestRender: () => void = () => {};
+  /** Conflicted key awaiting an l/s choice (surface-managed sub-flow). */
+  private resolvePrompt: string | null = null;
+  private conflictedKeys = new Set<string>();
+  private hasStaged = false;
+
+  constructor(private readonly configManager: ConfigManager) {}
+
+  readonly actions: ConfigModalAction[] = [
+    { key: 'enter', id: 'resolve-open', label: 'resolve conflict', enabledFor: (row, tab) => tab === 'keys' && this.isConflicted(row) && this.resolvePrompt === null },
+    { key: 'l', id: 'resolve-local', label: 'keep local', enabledFor: () => this.resolvePrompt !== null },
+    { key: 's', id: 'resolve-synced', label: 'use synced', enabledFor: () => this.resolvePrompt !== null },
+    { key: 'n', id: 'resolve-cancel', label: 'cancel', enabledFor: () => this.resolvePrompt !== null },
+    { key: 'm', id: 'managed-review', label: 'managed review', enabledFor: () => this.hasStaged },
+  ];
+
+  onOpen(requestRender: () => void): void {
+    this.requestRender = requestRender;
+    this.resolvePrompt = null;
+  }
+
+  onClose(): void {
+    this.resolvePrompt = null;
+  }
+
+  private isConflicted(row: ConfigModalRow | null): boolean {
+    return !!row && row.id.startsWith('key:') && this.conflictedKeys.has(row.id.slice('key:'.length));
+  }
+
+  buildView(): ConfigModalView {
+    const s = this.configManager ? this.trySnapshot() : null;
+    if (!s) {
+      return { title: 'Settings Sync', degraded: 'settings control plane unavailable', tabs: [{ id: 'keys', label: 'Keys', rows: [] }] };
+    }
+    this.conflictedKeys = new Set(s.conflicts.map((c) => c.key));
+    this.hasStaged = Boolean(s.stagedManagedBundle);
+
+    const header = [
+      postureLine([kv('resolved', s.resolvedEntries.length), kv('conflicts', s.conflicts.length), kv('failures', s.recentFailures.length), kv('locks', s.managedLockCount)]),
+      postureLine([kv('local', s.resolvedCounts.local), kv('synced', s.resolvedCounts.synced), kv('managed', s.resolvedCounts.managed), kv('last-sync', s.lastSync ? `${s.lastSync.surface}/${s.lastSync.direction}` : 'none'), kv('staged', s.stagedManagedBundle ? s.stagedManagedBundle.profileName : 'none')]),
+    ];
+
+    const keysRows: ConfigModalRow[] = s.resolvedEntries.map((e) => ({
+      id: `key:${e.key}`,
+      label: `${pad(e.key, 32)} ${pad(String(e.effectiveSource), 10)} ${String(e.effectiveValue)}`,
+      style: toneStyle(sourceTone(String(e.effectiveSource), Boolean(e.conflict), Boolean(e.locked))),
+    }));
+
+    const eventRows: ConfigModalRow[] = s.recentEvents.map((ev, i) => ({ id: `event:${i}`, label: `${pad(`${ev.surface}/${ev.direction}`, 18)} ${ev.detail}`, style: toneStyle('info') }));
+    const lockRows: ConfigModalRow[] = s.managedLocks.map((l) => ({ id: `lock:${l.key}`, label: `${pad(l.key, 30)} source=${pad(l.source, 12)} ${l.reason}`, style: toneStyle('warn') }));
+    const failureRows: ConfigModalRow[] = s.recentFailures.map((f, i) => ({ id: `failure:${i}`, label: `${pad(f.surface, 10)} ${f.message}`, style: toneStyle('bad') }));
+    const conflictRows: ConfigModalRow[] = s.conflicts.map((c) => ({ id: `conflict:${c.key}`, label: `${pad(c.key, 30)} ${pad(c.source, 10)} local=${String(c.localValue)} incoming=${String(c.incomingValue)}`, style: toneStyle('warn') }));
+    const rollbackRows: ConfigModalRow[] = s.rollbackHistory.map((r) => ({ id: `rollback:${r.token}`, label: `${pad(r.token, 18)} ${pad(r.profileName, 18)} restored=${r.restoredKeys.length}  ${new Date(r.appliedAt).toLocaleString()}`, style: toneStyle('dim') }));
+
+    const keyHints = this.resolvePrompt
+      ? [`resolving "${this.resolvePrompt}"`, 'l keep local', 's use synced', 'n cancel']
+      : ['Enter resolve conflict', 'm managed review'];
+
+    return {
+      title: 'Settings Sync',
+      hints: ['←/→ tab'],
+      tabs: [
+        { id: 'keys', label: 'Keys', header, rows: keysRows, emptyText: 'No resolved settings entries.', hints: keyHints },
+        { id: 'events', label: 'Events', header, rows: eventRows, emptyText: 'No sync or managed-setting events recorded yet.' },
+        { id: 'locks', label: 'Locks', header, rows: lockRows, emptyText: 'No managed locks are currently active.' },
+        { id: 'failures', label: 'Failures', header, rows: failureRows, emptyText: 'No recent sync or managed-setting failures.' },
+        { id: 'conflicts', label: 'Conflicts', header, rows: conflictRows, emptyText: 'No settings conflicts detected.' },
+        { id: 'rollback', label: 'Rollback', header, rows: rollbackRows, emptyText: 'No managed rollback records yet.' },
+      ],
+    };
+  }
+
+  onAction(id: string, ctx: ConfigModalActionContext): void {
+    switch (id) {
+      case 'resolve-open': {
+        const key = ctx.row?.id.startsWith('key:') ? ctx.row.id.slice('key:'.length) : null;
+        if (key && this.conflictedKeys.has(key)) {
+          this.resolvePrompt = key;
+          ctx.setStatus(`Resolve "${key}": l keep local · s use synced · n cancel`);
+        }
+        break;
+      }
+      case 'resolve-local':
+      case 'resolve-synced': {
+        if (!this.resolvePrompt) break;
+        const choice = id === 'resolve-local' ? 'local' : 'synced';
+        void ctx.executeCommand?.('settings-sync', ['resolve', this.resolvePrompt, choice]);
+        ctx.setStatus(`Resolving ${this.resolvePrompt} → ${choice}…`);
+        this.resolvePrompt = null;
+        break;
+      }
+      case 'resolve-cancel':
+        this.resolvePrompt = null;
+        ctx.setStatus('');
+        break;
+      case 'managed-review':
+        void ctx.executeCommand?.('managed', ['review']);
+        ctx.setStatus('Opening managed review…');
+        break;
+    }
+    this.requestRender();
+  }
+
+  private trySnapshot(): Snapshot | null {
+    try {
+      return getSettingsControlPlaneSnapshot(this.configManager);
+    } catch {
+      return null;
+    }
+  }
+}
+
+export function createSettingsSyncModalSurface(configManager: ConfigManager): ConfigModalSurface {
+  return new SettingsSyncModalSurface(configManager);
+}