@pellux/goodvibes-tui 1.13.0 → 1.14.0

package/src/input/onboarding/onboarding-wizard-steps.ts

@@ -8,6 +8,7 @@ import {
   isExternalSurfaceSelectedByDefault,
   type ExternalSurfaceSpec,
 } from './onboarding-wizard-external-surfaces.ts';
+import { buildFeatureUnitSteps } from './onboarding-feature-units.ts';
 import { countSelected, modelSelectionLabel, normalizeText } from './onboarding-wizard-helpers.ts';
 import { getDaemonSource, pushDaemonAdoptionFields, pushLegacyDaemonMigrationFields } from './onboarding-wizard-network-adopt.ts';
 import type { OnboardingWizardControllerLike } from './onboarding-wizard-types.ts';
@@ -37,10 +38,9 @@ export function buildOnboardingWizardSteps(controller: OnboardingWizardControlle
   if (shouldShowCloudflareStep(controller)) {
     steps.push(buildCloudflareStep(controller));
   }
-  steps.push(buildProviderAccessStep(controller));
-  steps.push(buildDefaultModelStep(controller));
-  steps.push(buildExperienceStep(controller));
-  steps.push(buildReviewStep(controller));
+  steps.push(buildProviderAccessStep(controller), buildDefaultModelStep(controller), buildExperienceStep(controller));
+  // Guided feature coverage: every remaining feature flag is reachable here as a unit.
+  steps.push(...buildFeatureUnitSteps(controller), buildReviewStep(controller));
   return steps.map(addApplyAndContinueAction);
 }
 
@@ -627,7 +627,7 @@ export function buildNetworkStep(controller: OnboardingWizardControllerLike): On
       const cpOff = controlPlaneRemote && String(controller.runtimeSnapshot?.config.controlPlane?.tls?.mode ?? 'off') === 'off';
       const hlOff = listenerEnabled && String(controller.runtimeSnapshot?.config.httpListener?.tls?.mode ?? 'off') === 'off';
       if (cpOff || hlOff) { const a = [cpOff ? 'control plane' : '', hlOff ? 'HTTP listener' : ''].filter(Boolean).join(' and '); fields.push({ kind: 'status', id: 'network.tls-warn', label: `TLS off — ${a} transmits plaintext`, defaultValue: 'Warning', hint: `The ${a} is network-reachable but TLS is off. Traffic travels in plaintext. Enable TLS or use a terminating reverse proxy.` }); }
-      if (listenerEnabled) { fields.push({ kind: 'status', id: 'network.cors-note', label: 'CORS must be configured manually', defaultValue: 'Info', hint: 'httpListener.enforceCors and httpListener.allowedOrigins are not in ConfigKey union (SDK handoff Item 5). Edit ~/.goodvibes/tui/settings.json to set them, then restart the daemon.' }); }
+      if (listenerEnabled) { fields.push({ kind: 'status', id: 'network.cors-note', label: 'Browser CORS is off by default', defaultValue: 'Info', hint: 'The webhook/control-plane HTTP listener honors controlPlane.cors.enabled and controlPlane.cors.allowedOrigins. Set both from Settings > Control Plane (or /config controlPlane) to allow browser origins, then restart the daemon. CORS stays off until you enable it.' }); }
     }
     return {
       id: 'network',

package/src/input/onboarding/onboarding-wizard-types.ts

@@ -26,6 +26,12 @@ export type OnboardingWizardStepId =
   | 'provider-access'
   | 'default-model'
   | 'experience'
+  | 'features-safety'
+  | 'features-context'
+  | 'features-telemetry'
+  | 'features-automation'
+  | 'features-provider'
+  | 'features-advanced'
   | 'review';
 
 export type OnboardingWizardFieldKind =

package/src/input/relay-settings-descriptions.ts

@@ -0,0 +1,35 @@
+/**
+ * relay-settings-descriptions.ts — appends the relay threat-model one-liner to
+ * the `relay.*` CONFIG_SCHEMA descriptions shown in /config and the settings
+ * modal.
+ *
+ * `relay.*` is a real SDK CONFIG_SCHEMA domain (schema-domain-runtime.ts) —
+ * the settings-modal-data.ts CONFIG_SCHEMA loop already surfaces it once
+ * `relay` is listed in SETTINGS_CATEGORIES (see settings-modal-types.ts). The
+ * SDK's own descriptions explain WHAT each key does but not the trust
+ * boundary the outbound relay path crosses; this enrichment appends that
+ * honestly, once, without duplicating or overriding the SDK's wording. Entries
+ * are shallow-cloned (never mutating the shared `ConfigSetting` objects the
+ * SDK exports from CONFIG_SCHEMA) so re-running this on the same groups map
+ * is idempotent.
+ */
+
+import type { SettingEntry, SettingsCategory } from './settings-modal-types.ts';
+
+/** The threat-model note every relay.* setting description gets appended with. */
+export const RELAY_THREAT_MODEL_NOTE =
+  'The relay operator sees only ciphertext and connection metadata — it cannot read message contents. Self-host your own relay for full control.';
+
+/** Append the threat-model note to every relay.* entry's description, in place. */
+export function enrichRelaySettingDescriptions(groups: Map<SettingsCategory, SettingEntry[]>): void {
+  const relayEntries = groups.get('relay');
+  if (!relayEntries) return;
+  for (let i = 0; i < relayEntries.length; i++) {
+    const entry = relayEntries[i];
+    if (!entry || !entry.setting.key.startsWith('relay.') || entry.setting.description.includes(RELAY_THREAT_MODEL_NOTE)) continue;
+    relayEntries[i] = {
+      ...entry,
+      setting: { ...entry.setting, description: `${entry.setting.description} ${RELAY_THREAT_MODEL_NOTE}` },
+    };
+  }
+}

package/src/input/sandbox-exec-config.ts

@@ -0,0 +1,107 @@
+/**
+ * sandbox-exec-config.ts — TUI-local synthetic settings entries for
+ * sandbox.egressAllowlist / sandbox.workspaceWritable.
+ *
+ * The SDK's per-command exec sandbox (bubblewrap on Linux, gated by the
+ * graduation-tracked `exec-sandbox` feature flag) reads its full configuration
+ * straight off `configManager.getCategory('sandbox')` inside
+ * `registerAllTools` (platform/tools/index.ts) — `sandbox.enabled`,
+ * `sandbox.egressAllowlist`, `sandbox.workspaceWritable`. `sandbox.enabled` is
+ * already a real CONFIG_SCHEMA key (with its own honest "requires bubblewrap
+ * on Linux, reports unavailable elsewhere" description) and needs no synthetic
+ * entry — the CONFIG_SCHEMA loop in settings-modal-data.ts already surfaces it.
+ * `egressAllowlist`/`workspaceWritable` are NOT in CONFIG_SCHEMA, so this file
+ * mirrors worktree-setup-config.ts's synthetic-entry pattern for them.
+ *
+ * UNLIKE worktree.setup.* / learning.consolidation.*, no defensive try/catch is
+ * needed here: DEFAULT_CONFIG.sandbox already carries both fields (as empty
+ * arrays), so ConfigManager.resolvePath finds the `sandbox` section on a plain
+ * get()/set() without throwing — only a missing SECTION throws, and `sandbox`
+ * has existed since before this repack (it backs the older VM/REPL isolation
+ * settings). Writing through these entries takes effect for real: the exec
+ * sandbox reads the same `sandbox` config category at tool-registration time.
+ *
+ * Both keys hold a JSON array of strings on disk. The settings modal's inline
+ * editor is a single-line text field, so — matching worktree.setup.* and
+ * controlPlane.cors.allowedOrigins — they are displayed and edited as a
+ * comma-separated list and parsed back into an array on commit (see
+ * isSandboxExecListConfigKey's use in settings-modal.ts#commitEdit).
+ */
+import type { ConfigKey, ConfigManager, ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+import type { SettingEntry, SettingsCategory } from './settings-modal-types.ts';
+
+export const SANDBOX_EGRESS_ALLOWLIST_CONFIG_KEY = 'sandbox.egressAllowlist' as ConfigKey;
+export const SANDBOX_WORKSPACE_WRITABLE_CONFIG_KEY = 'sandbox.workspaceWritable' as ConfigKey;
+
+const SANDBOX_EXEC_LIST_CONFIG_KEYS: ReadonlySet<ConfigKey> = new Set([
+  SANDBOX_EGRESS_ALLOWLIST_CONFIG_KEY,
+  SANDBOX_WORKSPACE_WRITABLE_CONFIG_KEY,
+]);
+
+/** True for the two sandbox exec-boundary list keys, whose stored value is a string array edited as a comma-separated list. */
+export function isSandboxExecListConfigKey(key: ConfigKey): boolean {
+  return SANDBOX_EXEC_LIST_CONFIG_KEYS.has(key);
+}
+
+/** Read a config value as a string array (non-array/malformed degrades to empty). */
+export function readSandboxExecList(configManager: Pick<ConfigManager, 'get'>, key: ConfigKey): string[] {
+  const raw = configManager.get(key);
+  if (!Array.isArray(raw)) return [];
+  return raw.filter((entry): entry is string => typeof entry === 'string' && entry.length > 0);
+}
+
+/** Parse a comma-separated edit-buffer submission back into a string array (trimmed, empties dropped). Shared with worktree.setup.* — same convention. */
+export function parseSandboxExecListInput(text: string): string[] {
+  return text.split(',').map((part) => part.trim()).filter((part) => part.length > 0);
+}
+
+export const SANDBOX_EGRESS_ALLOWLIST_SYNTHETIC_SETTING: ConfigSetting = {
+  key: SANDBOX_EGRESS_ALLOWLIST_CONFIG_KEY,
+  type: 'string',
+  default: [],
+  description: 'Comma-separated command base names (or "*" for all) whose network access is re-enabled inside the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants network"). Empty = the sandbox disables network for every command. Only takes effect when sandbox.enabled is on, the graduation-tracked exec-sandbox feature flag is on, and bubblewrap is available (Linux only — reports unavailable elsewhere).',
+};
+
+export const SANDBOX_WORKSPACE_WRITABLE_SYNTHETIC_SETTING: ConfigSetting = {
+  key: SANDBOX_WORKSPACE_WRITABLE_CONFIG_KEY,
+  type: 'string',
+  default: [],
+  description: 'Comma-separated absolute paths outside the workspace bound writable into the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants path outside workspace"). Empty = only the workspace (and an isolated /tmp) is writable. Only takes effect when sandbox.enabled is on, the graduation-tracked exec-sandbox feature flag is on, and bubblewrap is available (Linux only — reports unavailable elsewhere).',
+};
+
+function buildSandboxExecListEntry(configManager: Pick<ConfigManager, 'get'>, setting: ConfigSetting): SettingEntry {
+  const currentValue = readSandboxExecList(configManager, setting.key);
+  return {
+    setting,
+    currentValue,
+    isDefault: currentValue.length === 0,
+  };
+}
+
+export function buildSandboxEgressAllowlistSyntheticEntry(configManager: Pick<ConfigManager, 'get'>): SettingEntry {
+  return buildSandboxExecListEntry(configManager, SANDBOX_EGRESS_ALLOWLIST_SYNTHETIC_SETTING);
+}
+
+export function buildSandboxWorkspaceWritableSyntheticEntry(configManager: Pick<ConfigManager, 'get'>): SettingEntry {
+  return buildSandboxExecListEntry(configManager, SANDBOX_WORKSPACE_WRITABLE_SYNTHETIC_SETTING);
+}
+
+/**
+ * Inject both synthetic entries into the sandbox category's SettingEntry list
+ * (alongside the real sandbox.enabled CONFIG_SCHEMA entry the caller's own
+ * CONFIG_SCHEMA loop already added), idempotently. No-op when the category
+ * isn't present in `groups` at all.
+ */
+export function injectSandboxExecSyntheticEntries(
+  groups: Map<SettingsCategory, SettingEntry[]>,
+  configManager: Pick<ConfigManager, 'get'>,
+): void {
+  const sandboxEntries = groups.get('sandbox');
+  if (!sandboxEntries) return;
+  if (!sandboxEntries.some((e) => e.setting.key === SANDBOX_EGRESS_ALLOWLIST_CONFIG_KEY)) {
+    sandboxEntries.push(buildSandboxEgressAllowlistSyntheticEntry(configManager));
+  }
+  if (!sandboxEntries.some((e) => e.setting.key === SANDBOX_WORKSPACE_WRITABLE_CONFIG_KEY)) {
+    sandboxEntries.push(buildSandboxWorkspaceWritableSyntheticEntry(configManager));
+  }
+}

package/src/input/settings-modal-adjustment.ts

@@ -45,13 +45,10 @@ export function adjustSelected(
 ): void {
   if (ctx.editingMode) return;
 
-  if (ctx.currentCategory === 'flags') {
-    const flagEntry = ctx.getSelectedFlag();
-    if (!flagEntry || flagEntry.state === 'killed' || !ctx.featureFlagManager || !ctx.configManager) return;
-    const targetState: FlagState = direction === 'right' ? 'enabled' : 'disabled';
-    if (flagEntry.state !== targetState) applyFlagState(flagEntry, targetState, ctx.featureFlagManager, ctx.configManager);
-    return;
-  }
+  // Feature-unit toggle headers (setting.type === 'boolean', key featureFlags.<id>)
+  // now live across topical categories, not a single flags tab. They fall through
+  // to the boolean branch below, which routes through setValue → the modal's
+  // flag-toggle chokepoint. No category-special-case is needed here anymore.
 
   if (ctx.currentCategory === 'mcp') {
     const entry = ctx.getSelectedMcp();

package/src/input/settings-modal-data.ts

@@ -15,7 +15,26 @@ import { buildSubscriptionEntries } from './settings-modal-subscriptions.ts';
 import type { SubscriptionManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { ServiceInspectionQuery } from '../runtime/ui-service-queries.ts';
 import { CODE_INDEX_ENABLED_CONFIG_KEY } from '../runtime/code-index-services.ts';
+import {
+  WORKTREE_SETUP_CARRY_OVER_GLOBS_CONFIG_KEY,
+  WORKTREE_SETUP_COMMANDS_CONFIG_KEY,
+  buildWorktreeSetupCarryOverGlobsSyntheticEntry,
+  buildWorktreeSetupCommandsSyntheticEntry,
+  isWorktreeSetupListConfigKey,
+  readWorktreeSetupList,
+} from './worktree-setup-config.ts';
 import { BUDGET_ALERT_USD_CONFIG_KEY, BUDGET_ALERT_USD_DEFAULT, readBudgetAlertUsd } from '../export/cost-utils.ts';
+import { MEMORY_PROJECTION_DIR_CONFIG_KEY, buildMemoryProjectionDirSyntheticEntry } from './commands/recall-files-config.ts';
+import {
+  injectSandboxExecSyntheticEntries,
+  isSandboxExecListConfigKey,
+  readSandboxExecList,
+} from './sandbox-exec-config.ts';
+import {
+  injectExecEnvScrubSyntheticEntry,
+  isExecEnvScrubAllowlistConfigKey,
+  readExecEnvScrubAllowlist,
+} from './exec-env-scrub-config.ts';
 import {
   THEME_MODE_CONFIG_KEY,
   THEME_MODE_VALUES,
@@ -31,6 +50,8 @@ import {
   type SettingsCategory,
   type SubscriptionEntry,
 } from './settings-modal-types.ts';
+import { enrichRelaySettingDescriptions } from './relay-settings-descriptions.ts';
+import { applyFeatureUnitLayout } from './feature-unit-layout.ts';
 
 // ---------------------------------------------------------------------------
 // deepEqual — structural equality for isDefault comparisons
@@ -74,12 +95,13 @@ export function deepEqual(a: unknown, b: unknown): boolean {
 
 export function buildSettingGroups(
   configManager: ConfigManager,
+  featureFlagManager?: FeatureFlagManager | null,
 ): Map<SettingsCategory, SettingEntry[]> {
   const groups = new Map<SettingsCategory, SettingEntry[]>();
-  for (const cat of SETTINGS_CATEGORIES) {
-    if (cat === 'flags') continue;
-    groups.set(cat, []);
-  }
+  // Every category starts empty (including 'flags', now the Advanced Features
+  // bucket, and the new fetch/agents/security/integrations/policy/notifications
+  // namespaces) and is filled from CONFIG_SCHEMA below.
+  for (const cat of SETTINGS_CATEGORIES) groups.set(cat, []);
 
   for (const setting of CONFIG_SCHEMA) {
     const rawCat = setting.key.split('.')[0] as string;
@@ -167,6 +189,13 @@ export function buildSettingGroups(
         behaviorEntries.push(entry);
       }
     }
+    // In-terminal (OSC 9) notification toggles + audible bell — same category,
+    // per-key defaults (see terminal-notifier.ts).
+    for (const entry of buildTerminalNotifySyntheticEntries(configManager)) {
+      if (!behaviorEntries.some((e) => e.setting.key === entry.setting.key)) {
+        behaviorEntries.push(entry);
+      }
+    }
   }
 
   // Inject the storage.codeIndexEnabled toggle into the
@@ -178,6 +207,50 @@ export function buildSettingGroups(
     storageEntries.push(buildCodeIndexEnabledSyntheticEntry(configManager));
   }
 
+  // Inject the memory.projection.dir synthetic entry into the storage
+  // category (alongside codeIndexEnabled — both are local-storage posture
+  // settings). Not in the SDK ConfigKey union, same rationale as above.
+  if (storageEntries && !storageEntries.some((e) => e.setting.key === MEMORY_PROJECTION_DIR_CONFIG_KEY)) {
+    storageEntries.push(buildMemoryProjectionDirSyntheticEntry(configManager));
+  }
+
+  // Inject the worktree.setup.commands / worktree.setup.carryOverGlobs
+  // synthetic entries into the orchestration category (worktree isolation is
+  // an orchestration-engine concern — see WorkstreamIsolation 'worktree').
+  // Neither key is in the SDK ConfigKey union (see worktree-setup-config.ts),
+  // same rationale as the other synthetic settings above.
+  const orchestrationEntries = groups.get('orchestration');
+  if (orchestrationEntries) {
+    if (!orchestrationEntries.some((e) => e.setting.key === WORKTREE_SETUP_COMMANDS_CONFIG_KEY)) {
+      orchestrationEntries.push(buildWorktreeSetupCommandsSyntheticEntry(configManager));
+    }
+    if (!orchestrationEntries.some((e) => e.setting.key === WORKTREE_SETUP_CARRY_OVER_GLOBS_CONFIG_KEY)) {
+      orchestrationEntries.push(buildWorktreeSetupCarryOverGlobsSyntheticEntry(configManager));
+    }
+  }
+
+  // Inject the sandbox.egressAllowlist / sandbox.workspaceWritable and
+  // permissions.execEnvScrubAllowlist synthetic entries — see
+  // sandbox-exec-config.ts / exec-env-scrub-config.ts for why they are not in
+  // CONFIG_SCHEMA, same rationale as the other synthetic settings above.
+  injectSandboxExecSyntheticEntries(groups, configManager);
+  injectExecEnvScrubSyntheticEntry(groups, configManager);
+
+  // relay.* is a real SDK CONFIG_SCHEMA domain; append the threat-model note
+  // the SDK's own descriptions don't carry (see relay-settings-descriptions.ts).
+  enrichRelaySettingDescriptions(groups);
+
+  // Feature-unit presentation: turn each flag into ONE unit (toggle + the config
+  // keys it tunes) hosted in its topical category, folding no-config flags into
+  // the Advanced Features bucket. Sourced from FEATURE_FLAG_CONFIG. Runs AFTER
+  // synthetic injection so non-flag-owned rows stay as orphans; skipped on the
+  // flagless test path.
+  if (featureFlagManager) applyFeatureUnitLayout(groups, buildFlagEntries(featureFlagManager));
+
+  // learning.consolidation.* is a real SDK config domain now, so its keys arrive
+  // through the CONFIG_SCHEMA loop above; the old TUI-local synthetic entries were
+  // removed for this reason.
+
   return groups;
 }
 
@@ -395,6 +468,48 @@ export function buildNotifyAlertSyntheticEntries(configManager: Pick<ConfigManag
   return NOTIFY_ALERT_SYNTHETIC_SETTINGS.map((spec) => buildBooleanSyntheticEntry(configManager, spec.key, spec.description, true));
 }
 
+// ---------------------------------------------------------------------------
+// In-terminal (OSC 9) notification settings — see core/terminal-notifier.ts
+// ---------------------------------------------------------------------------
+
+/**
+ * The OSC 9 in-terminal desktop-notification toggles + the audible bell.
+ * TUI-local synthetic booleans (not in the SDK ConfigKey union), each carrying
+ * its OWN default (unlike the always-on W2.3 alert toggles above): approval-wait
+ * on, turn-end/agent-blocked off, bell off. Read generically by
+ * core/terminal-notifier.ts (readBooleanConfig); this is only the
+ * settings-modal-visible surface. These are independent of the master
+ * `notifyOnlyWhenUnfocused` gate — an in-terminal notification is always
+ * focus-gated on its own (only fires for an unfocused/unknown terminal).
+ */
+const TERMINAL_NOTIFY_SYNTHETIC_SETTINGS: ReadonlyArray<{ readonly key: string; readonly description: string; readonly defaultOn: boolean }> = [
+  {
+    key: 'behavior.terminalNotifyApprovalWait',
+    description: 'Send an in-terminal (OSC 9) desktop notification when a tool call is waiting on your approval. Fires only when the terminal window is unfocused. Works over SSH/tmux where OS notifications do not.',
+    defaultOn: true,
+  },
+  {
+    key: 'behavior.terminalNotifyTurnEnd',
+    description: 'Send an in-terminal (OSC 9) desktop notification when a turn finishes. Off by default. Fires only when the terminal window is unfocused.',
+    defaultOn: false,
+  },
+  {
+    key: 'behavior.terminalNotifyAgentBlocked',
+    description: 'Send an in-terminal (OSC 9) desktop notification when a delegated agent blocks waiting for your input. Off by default. Fires only when the terminal window is unfocused.',
+    defaultOn: false,
+  },
+  {
+    key: 'behavior.terminalBell',
+    description: 'Also ring the terminal bell alongside in-terminal notifications. Off by default.',
+    defaultOn: false,
+  },
+];
+
+/** Build the OSC 9 in-terminal notification SettingEntry rows for the behavior category. */
+export function buildTerminalNotifySyntheticEntries(configManager: Pick<ConfigManager, 'get'>): SettingEntry[] {
+  return TERMINAL_NOTIFY_SYNTHETIC_SETTINGS.map((spec) => buildBooleanSyntheticEntry(configManager, spec.key, spec.description, spec.defaultOn));
+}
+
 // ---------------------------------------------------------------------------
 // storage.codeIndexEnabled synthetic setting
 // ---------------------------------------------------------------------------
@@ -422,10 +537,9 @@ export function buildCodeIndexEnabledSyntheticEntry(configManager: Pick<ConfigMa
 
 export function buildFlagEntries(featureFlagManager: FeatureFlagManager | null): FlagEntry[] {
   if (!featureFlagManager) return [];
-  return Array.from(featureFlagManager.getAll().values()).map(({ flag, state }) => ({
-    flag,
-    state,
-  }));
+  return Array.from(featureFlagManager.getAll().values()).map(
+    ({ flag, state, persistedState, pendingRestart }) => ({ flag, state, persistedState, pendingRestart }),
+  );
 }
 
 // ---------------------------------------------------------------------------
@@ -492,6 +606,46 @@ export function refreshEntryValues(
 ): void {
   for (const entries of groups.values()) {
     for (const entry of entries) {
+      // The worktree.setup.* keys read through a defensive helper. The SDK now
+      // registers the 'worktree' section in DEFAULT_CONFIG, so a plain
+      // configManager.get returns the empty default rather than throwing; the
+      // helper's guard (belt-and-suspenders for an older SDK) keeps this
+      // refresh from crashing for EVERY setting change if the section is ever
+      // absent (see worktree-setup-config.ts).
+      if (isWorktreeSetupListConfigKey(entry.setting.key)) {
+        entry.currentValue = readWorktreeSetupList(configManager, entry.setting.key);
+        entry.isDefault = (entry.currentValue as string[]).length === 0;
+        continue;
+      }
+      // sandbox.egressAllowlist / sandbox.workspaceWritable: 'sandbox' IS a real
+      // DEFAULT_CONFIG section (has been since before this repack, backing the
+      // VM/REPL isolation settings), so a plain get() would not throw — but an
+      // unset leaf still reads back as `undefined`, not `[]`, so this still needs
+      // the same array-normalizing read as the worktree keys above (see
+      // sandbox-exec-config.ts).
+      if (isSandboxExecListConfigKey(entry.setting.key)) {
+        entry.currentValue = readSandboxExecList(configManager, entry.setting.key);
+        entry.isDefault = (entry.currentValue as string[]).length === 0;
+        continue;
+      }
+      // permissions.execEnvScrubAllowlist: same normalizing-read trap as above —
+      // 'permissions' is a real section but this leaf is TUI-local (see
+      // exec-env-scrub-config.ts).
+      if (isExecEnvScrubAllowlistConfigKey(entry.setting.key)) {
+        entry.currentValue = readExecEnvScrubAllowlist(configManager);
+        entry.isDefault = (entry.currentValue as string[]).length === 0;
+        continue;
+      }
+      // 'learning' is now a real DEFAULT_CONFIG section (schema-domain-learning.ts),
+      // so learning.consolidation.* keys read through the plain path below like any
+      // other schema-driven setting — no special case needed anymore.
+      // Same trap still applies here: 'memory' has no DEFAULT_CONFIG entry.
+      if (entry.setting.key === MEMORY_PROJECTION_DIR_CONFIG_KEY) {
+        const refreshed = buildMemoryProjectionDirSyntheticEntry(configManager);
+        entry.currentValue = refreshed.currentValue;
+        entry.isDefault = refreshed.isDefault;
+        continue;
+      }
       const raw = configManager.get(entry.setting.key as ConfigKey);
       // Synthetic entries (e.g. tts.speed) that have no SDK schema key return
       // undefined from configManager. Normalize using the same logic used at
@@ -520,6 +674,22 @@ export function updateEntryForKey(
   for (const entries of groups.values()) {
     const entry = entries.find((candidate) => candidate.setting.key === key);
     if (entry) {
+      if (key === MEMORY_PROJECTION_DIR_CONFIG_KEY) {
+        const refreshed = buildMemoryProjectionDirSyntheticEntry(configManager);
+        entry.currentValue = refreshed.currentValue;
+        entry.isDefault = refreshed.isDefault;
+        continue;
+      }
+      if (isSandboxExecListConfigKey(key)) {
+        entry.currentValue = readSandboxExecList(configManager, key);
+        entry.isDefault = (entry.currentValue as string[]).length === 0;
+        continue;
+      }
+      if (isExecEnvScrubAllowlistConfigKey(key)) {
+        entry.currentValue = readExecEnvScrubAllowlist(configManager);
+        entry.isDefault = (entry.currentValue as string[]).length === 0;
+        continue;
+      }
       const raw = configManager.get(key);
       // Synthetic entries: normalize using the same fallback logic as construction.
       entry.currentValue = key === ('tts.speed' as ConfigKey)

package/src/input/settings-modal-mutations.ts

@@ -54,7 +54,19 @@ export function applySettingValue({
   /** Called after applying the value so the caller can re-read currentValues. */
   refreshGroups: () => void;
 }): ApplyValueResult {
-  const previousValue = configManager.get(key);
+  // Defensive: a handful of TUI-local synthetic keys (see worktree-setup-config.ts)
+  // live under a config section CONFIG_SCHEMA/DEFAULT_CONFIG has never populated
+  // (e.g. 'worktree' as of the SDK 1.6.1 repack), so configManager.get can throw
+  // "Invalid config path" here even though the write attempt below is already
+  // guarded. Without this, that read — which runs unconditionally, before the
+  // write's own try/catch — would crash the whole settings modal on save instead
+  // of surfacing the honest "Save failed" message the write path below produces.
+  let previousValue: unknown;
+  try {
+    previousValue = configManager.get(key);
+  } catch (e) {
+    logger.error('SettingsModal: failed to read previous config value', { key, error: summarizeError(e) });
+  }
   // REQUIRES_RESTART: SDK's ConfigSetting has no requiresRestart field yet (see
   // goodvibes-sdk HANDOFF-FROM-TUI-SESSION-20260611.md §Item 8). Until it does,
   // we detect restart-triggering keys by sub-key name heuristic below.
@@ -139,21 +151,37 @@ export function applyFlagState(
 ): void {
   const flag: FeatureFlag = flagEntry.flag;
 
-  if (!flag.runtimeToggleable) {
-    persistFlagState(configManager, flag.id, newState, flag.defaultState as FlagState);
-    flagEntry.state = newState;
-    return;
-  }
-
   try {
-    if (newState === 'enabled') {
-      featureFlagManager.enable(flag.id);
-    } else {
-      featureFlagManager.disable(flag.id);
-    }
+    // Persist first so the on-disk override is the source of truth, then apply
+    // the same value to the live manager through applyConfigState. That single
+    // call keeps both paths consistent with the SDK's config→flag bridge:
+    //   - runtime-toggleable flags apply immediately (firing flag subscribers
+    //     exactly as a direct enable()/disable() would), and
+    //   - startup-gated flags are NOT faked live — the effective state is left
+    //     untouched and a pending-restart marker is recorded instead.
     persistFlagState(configManager, flag.id, newState, flag.defaultState as FlagState);
-    flagEntry.state = newState;
+    featureFlagManager.applyConfigState(flag.id, newState);
   } catch (e) {
     logger.error('SettingsModal: failed to toggle feature flag', { flag: flag.id, error: summarizeError(e) });
   }
+
+  // Reflect the manager's real state, never the requested target: for a
+  // startup-gated flag `state` stays at the unchanged effective value and
+  // `pendingRestart` reports that a restart is needed for `persistedState`.
+  syncFlagEntryFromManager(flagEntry, featureFlagManager);
+}
+
+/**
+ * Refresh a FlagEntry's live/persisted/pending fields from the manager's
+ * authoritative snapshot so the settings UI never displays a guessed state.
+ */
+export function syncFlagEntryFromManager(
+  flagEntry: FlagEntry,
+  featureFlagManager: FeatureFlagManager,
+): void {
+  const snapshot = featureFlagManager.getAll().get(flagEntry.flag.id);
+  if (!snapshot) return;
+  flagEntry.state = snapshot.state;
+  flagEntry.persistedState = snapshot.persistedState;
+  flagEntry.pendingRestart = snapshot.pendingRestart;
 }

package/src/input/settings-modal-types.ts

@@ -9,6 +9,7 @@ export type SettingsCategory =
   | 'subscriptions'
   | 'behavior'
   | 'storage'
+  | 'atRest'
   | 'permissions'
   | 'orchestration'
   | 'planner'
@@ -22,16 +23,26 @@ export type SettingsCategory =
   | 'httpListener'
   | 'web'
   | 'network'
+  | 'relay'
   | 'surfaces'
   | 'cloudflare'
   | 'batch'
   | 'automation'
+  | 'checkin'
   | 'watchers'
   | 'runtime'
   | 'telemetry'
   | 'cache'
+  | 'diagnostics'
   | 'sandbox'
   | 'mcp'
+  | 'learning'
+  | 'fetch'
+  | 'agents'
+  | 'security'
+  | 'integrations'
+  | 'policy'
+  | 'notifications'
   | 'flags'
   | 'release'
   | 'danger';
@@ -42,12 +53,12 @@ export const SETTINGS_CATEGORY_GROUPS: ReadonlyArray<{
   readonly label: string;
   readonly categories: readonly SettingsCategory[];
 }> = [
-  { label: 'Interface', categories: ['display', 'ui', 'behavior', 'permissions'] },
+  { label: 'Interface', categories: ['display', 'ui', 'behavior', 'notifications', 'permissions', 'policy', 'security'] },
   { label: 'AI Routing', categories: ['provider', 'subscriptions', 'helper', 'tools', 'tts'] },
-  { label: 'Service & Network', categories: ['service', 'daemon', 'network', 'controlPlane', 'httpListener', 'web'] },
-  { label: 'Surfaces & Cloud', categories: ['surfaces', 'mcp', 'cloudflare'] },
-  { label: 'Automation', categories: ['batch', 'automation', 'watchers', 'orchestration', 'planner', 'wrfc'] },
-  { label: 'Runtime & Data', categories: ['storage', 'sandbox', 'runtime', 'cache', 'telemetry'] },
+  { label: 'Service & Network', categories: ['service', 'daemon', 'network', 'controlPlane', 'httpListener', 'web', 'relay'] },
+  { label: 'Surfaces & Cloud', categories: ['surfaces', 'integrations', 'mcp', 'cloudflare'] },
+  { label: 'Automation', categories: ['batch', 'automation', 'checkin', 'watchers', 'orchestration', 'planner', 'wrfc'] },
+  { label: 'Runtime & Data', categories: ['storage', 'atRest', 'sandbox', 'fetch', 'agents', 'runtime', 'cache', 'telemetry', 'diagnostics', 'learning'] },
   { label: 'Advanced', categories: ['flags', 'release', 'danger'] },
 ];
 
@@ -62,11 +73,37 @@ export interface SettingEntry {
   conflict?: boolean;
   sourceLabel?: string;
   lockReason?: string;
+  /**
+   * Present when this row is a feature-unit toggle header (a feature flag
+   * rendered as one unit with its config keys beneath it). The row's
+   * setting.key is `featureFlags.<id>` and setting.type is 'boolean'; toggling
+   * routes to the feature-flag manager, not a plain config write.
+   */
+  flag?: FlagEntry;
+  /**
+   * Present when this row is a config sub-option OWNED by a feature unit — the
+   * id of the owning flag. Drives the indented rendering beneath its header and
+   * marks the row as claimed so it does not double-list as an orphan.
+   */
+  ownerFlagId?: string;
 }
 
 export interface FlagEntry {
   flag: FeatureFlag;
+  /** Live effective state as the runtime currently sees it. */
   state: FlagState;
+  /**
+   * Last known config-layer (persisted) value. Equals `state` unless a
+   * startup-gated flag was toggled this session — then it holds the value that
+   * will take effect on the next launch.
+   */
+  persistedState: FlagState;
+  /**
+   * True when a startup-gated flag's persisted value differs from its effective
+   * state, i.e. a restart is required before the change takes effect. Sourced
+   * from FeatureFlagManager.getAll(), never guessed.
+   */
+  pendingRestart: boolean;
 }
 
 export interface McpEntry {