@pellux/goodvibes-tui 1.13.1 → 1.14.0

package/src/input/commands.ts

@@ -1,4 +1,5 @@
-import type { CommandRegistry } from './command-registry.ts';
+import { CommandRegistry } from './command-registry.ts';
+import type { SlashCommand } from './command-registry.ts';
 import { policyCommand } from './commands/policy.ts';
 import { providerCommand } from './commands/provider.ts';
 import { evalCommand } from './commands/eval.ts';
@@ -9,6 +10,7 @@ import { registerShellCoreCommands } from './commands/shell-core.ts';
 import { registerConfigCommand } from './commands/config.ts';
 import { registerDiscoveryRuntimeCommands } from './commands/discovery-runtime.ts';
 import { registerPlanningRuntimeCommands } from './commands/planning-runtime.ts';
+import { registerSecretRuntimeCommands } from './commands/secret-runtime.ts';
 import { registerScheduleRuntimeCommands } from './commands/schedule-runtime.ts';
 import { registerBranchRuntimeCommands } from './commands/branch-runtime.ts';
 import { registerOperatorRuntimeCommands } from './commands/operator-runtime.ts';
@@ -34,10 +36,13 @@ import { registerRemoteRuntimeCommands } from './commands/remote-runtime.ts';
 import { registerTeleportRuntimeCommands } from './commands/teleport-runtime.ts';
 import { registerSubscriptionRuntimeCommands } from './commands/subscription-runtime.ts';
 import { registerHooksRuntimeCommands } from './commands/hooks-runtime.ts';
+import { registerFlagsRuntimeCommands } from './commands/flags-runtime.ts';
+import { registerEditorRuntimeCommands } from './commands/editor-runtime.ts';
 import { registerControlRoomRuntimeCommands } from './commands/control-room-runtime.ts';
 import { registerMcpRuntimeCommands } from './commands/mcp-runtime.ts';
 import { registerSessionContentCommands } from './commands/session-content.ts';
 import { registerCheckpointRuntimeCommands } from './commands/checkpoint-runtime.ts';
+import { registerRewindRuntimeCommands } from './commands/rewind-runtime.ts';
 import { registerWorkstreamRuntimeCommands } from './commands/workstream-runtime.ts';
 import { registerCodebaseRuntimeCommands } from './commands/codebase-runtime.ts';
 import { registerLocalRuntimeCommands } from './commands/local-runtime.ts';
@@ -56,6 +61,7 @@ import { registerLocalAuthRuntimeCommands } from './commands/local-auth-runtime.
 import { registerIntelligenceRuntimeCommands } from './commands/intelligence-runtime.ts';
 import { registerConversationRuntimeCommands } from './commands/conversation-runtime.ts';
 import { registerQrcodeRuntimeCommands } from './commands/qrcode-runtime.ts';
+import { registerRelayRuntimeCommands } from './commands/relay-runtime.ts';
 import { registerOnboardingRuntimeCommands } from './commands/onboarding-runtime.ts';
 import { registerTtsRuntimeCommands } from './commands/tts-runtime.ts';
 import { registerCloudflareRuntimeCommands } from './commands/cloudflare-runtime.ts';
@@ -63,90 +69,139 @@ import { registerWorkPlanRuntimeCommands } from './commands/work-plan-runtime.ts
 import { registerCostRuntimeCommands } from './commands/cost-runtime.ts';
 import { registerWebSearchRuntimeCommands } from './commands/websearch-runtime.ts';
 import { registerImageRuntimeCommands } from './commands/image-runtime.ts';
+import { registerPermissionsRuntimeCommands } from './commands/permissions-runtime.ts';
+import { registerReviewRuntimeCommands } from './commands/review-runtime.ts';
+import { registerPaletteRuntimeCommands } from './commands/palette-runtime.ts';
+import { registerCiRuntimeCommands } from './commands/ci-runtime.ts';
+import { registerCheckinRuntimeCommands } from './commands/checkin-runtime.ts';
+import { registerPrincipalsRuntimeCommands } from './commands/principals-runtime.ts';
+
+/**
+ * A named group of built-in commands. The `category` label is the single
+ * source of truth for command categorization: it drives both the runtime
+ * registration order (via {@link registerBuiltinCommands}) and the generated
+ * command-reference docs / command palette grouping (via
+ * {@link categorizeBuiltinCommands}). Adding a new command group here is the
+ * only edit needed for it to appear, categorized, everywhere.
+ */
+export interface BuiltinCommandGroup {
+  readonly category: string;
+  readonly register: (registry: CommandRegistry) => void;
+}
+
+/**
+ * Every built-in command group, in registration order. Keeping runtime
+ * registration and doc/palette categorization on one array means a category
+ * label can never drift between the two.
+ */
+export const BUILTIN_COMMAND_GROUPS: readonly BuiltinCommandGroup[] = [
+  { category: 'Shell & Session', register: registerShellCoreCommands },
+  { category: 'Shell & Session', register: registerPaletteRuntimeCommands },
+  { category: 'Configuration', register: registerConfigCommand },
+  { category: 'Operator', register: registerOperatorRuntimeCommands },
+  { category: 'Plugins', register: registerPluginRuntimeCommands },
+  { category: 'Diff & Review', register: registerDiffRuntimeCommands },
+  { category: 'Git', register: registerGitRuntimeCommands },
+  { category: 'Testing', register: registerTestRuntimeCommands },
+  { category: 'Notifications', register: registerNotifyRuntimeCommands },
+  { category: 'Sessions & Replay', register: registerReplayRuntimeCommands },
+  { category: 'Sharing', register: registerShareRuntimeCommands },
+  { category: 'Channels', register: registerChannelRuntimeCommands },
+  { category: 'Local Setup', register: registerLocalSetupCommands },
+  { category: 'Product', register: registerProductRuntimeCommands },
+  { category: 'Platform', register: registerPlatformRuntimeCommands },
+  { category: 'Profiles', register: registerProfileSyncRuntimeCommands },
+  { category: 'Managed Runtime', register: registerManagedRuntimeCommands },
+  { category: 'Platform Access', register: registerPlatformAccessRuntimeCommands },
+  { category: 'Platform Services', register: registerPlatformServicesRuntimeCommands },
+  { category: 'Teamwork', register: registerTeamworkRuntimeCommands },
+  { category: 'Marketplace', register: registerMarketplaceRuntimeCommands },
+  { category: 'Guidance', register: registerGuidanceRuntimeCommands },
+  { category: 'Remote', register: registerRemoteRuntimeCommands },
+  { category: 'Remote', register: registerTeleportRuntimeCommands },
+  { category: 'Subscriptions', register: registerSubscriptionRuntimeCommands },
+  { category: 'Hooks', register: registerHooksRuntimeCommands },
+  { category: 'Feature Flags', register: registerFlagsRuntimeCommands },
+  { category: 'Editor', register: registerEditorRuntimeCommands },
+  { category: 'Control Room', register: registerControlRoomRuntimeCommands },
+  { category: 'MCP', register: registerMcpRuntimeCommands },
+  { category: 'Incidents', register: registerIncidentRuntimeCommands },
+  { category: 'Memory', register: registerMemoryProductRuntimeCommands },
+  { category: 'Skills', register: registerSkillsRuntimeCommands },
+  { category: 'Experience', register: registerExperienceRuntimeCommands },
+  { category: 'Services', register: registerServicesRuntimeCommands },
+  { category: 'Tasks', register: registerTasksRuntimeCommands },
+  { category: 'Local Providers', register: registerLocalProviderRuntimeCommands },
+  { category: 'Health', register: registerHealthRuntimeCommands },
+  { category: 'Settings Sync', register: registerSettingsSyncRuntimeCommands },
+  { category: 'Worktrees', register: registerWorktreeRuntimeCommands },
+  { category: 'Provider Accounts', register: registerProviderAccountsRuntimeCommands },
+  { category: 'Local Auth', register: registerLocalAuthRuntimeCommands },
+  { category: 'Intelligence', register: registerIntelligenceRuntimeCommands },
+  { category: 'Conversation', register: registerConversationRuntimeCommands },
+  { category: 'QR Codes', register: registerQrcodeRuntimeCommands },
+  { category: 'Relay', register: registerRelayRuntimeCommands },
+  { category: 'Onboarding', register: registerOnboardingRuntimeCommands },
+  { category: 'Voice & TTS', register: registerTtsRuntimeCommands },
+  { category: 'Cloudflare', register: registerCloudflareRuntimeCommands },
+  { category: 'Work Plans', register: registerWorkPlanRuntimeCommands },
+  { category: 'Cost', register: registerCostRuntimeCommands },
+  { category: 'Local Runtime', register: registerLocalRuntimeCommands },
+  { category: 'Discovery', register: registerDiscoveryRuntimeCommands },
+  { category: 'Planning', register: registerPlanningRuntimeCommands },
+  { category: 'Secrets', register: registerSecretRuntimeCommands },
+  { category: 'Scheduling', register: registerScheduleRuntimeCommands },
+  { category: 'Branches', register: registerBranchRuntimeCommands },
+  { category: 'Session Content', register: registerSessionContentCommands },
+  { category: 'Checkpoints', register: registerCheckpointRuntimeCommands },
+  { category: 'Checkpoints', register: registerRewindRuntimeCommands },
+  { category: 'Workstreams', register: registerWorkstreamRuntimeCommands },
+  { category: 'Codebase', register: registerCodebaseRuntimeCommands },
+  { category: 'Web Search', register: registerWebSearchRuntimeCommands },
+  { category: 'Image', register: registerImageRuntimeCommands },
+  { category: 'Permissions', register: registerPermissionsRuntimeCommands },
+  { category: 'Diff & Review', register: registerReviewRuntimeCommands },
+  { category: 'CI', register: registerCiRuntimeCommands },
+  { category: 'Check-in', register: registerCheckinRuntimeCommands },
+  { category: 'Principals', register: registerPrincipalsRuntimeCommands },
+  { category: 'Policy', register: (registry) => registry.register(policyCommand) },
+  { category: 'Providers', register: (registry) => registry.register(providerCommand) },
+  { category: 'Eval', register: (registry) => registry.register(evalCommand) },
+  { category: 'Sessions & Replay', register: (registry) => registry.register(sessionCommand) },
+  { category: 'Sessions & Replay', register: (registry) => registry.register(resumeCommand) },
+  { category: 'Memory', register: (registry) => registry.register(recallCommand) },
+  { category: 'Knowledge', register: (registry) => registry.register(knowledgeCommand) },
+];
 
 /**
  * registerBuiltinCommands - Register all built-in slash commands into the registry.
  * Call once during application startup.
  */
 export function registerBuiltinCommands(registry: CommandRegistry): void {
-  registerShellCoreCommands(registry);
-  registerConfigCommand(registry);
-  registerOperatorRuntimeCommands(registry);
-  registerPluginRuntimeCommands(registry);
-  registerDiffRuntimeCommands(registry);
-  registerGitRuntimeCommands(registry);
-  registerTestRuntimeCommands(registry);
-  registerNotifyRuntimeCommands(registry);
-  registerReplayRuntimeCommands(registry);
-  registerShareRuntimeCommands(registry);
-  registerChannelRuntimeCommands(registry);
-  registerLocalSetupCommands(registry);
-  registerProductRuntimeCommands(registry);
-  registerPlatformRuntimeCommands(registry);
-  registerProfileSyncRuntimeCommands(registry);
-  registerManagedRuntimeCommands(registry);
-  registerPlatformAccessRuntimeCommands(registry);
-  registerPlatformServicesRuntimeCommands(registry);
-  registerTeamworkRuntimeCommands(registry);
-  registerMarketplaceRuntimeCommands(registry);
-  registerGuidanceRuntimeCommands(registry);
-  registerRemoteRuntimeCommands(registry);
-  registerTeleportRuntimeCommands(registry);
-  registerSubscriptionRuntimeCommands(registry);
-  registerHooksRuntimeCommands(registry);
-  registerControlRoomRuntimeCommands(registry);
-  registerMcpRuntimeCommands(registry);
-  registerIncidentRuntimeCommands(registry);
-  registerMemoryProductRuntimeCommands(registry);
-  registerSkillsRuntimeCommands(registry);
-  registerExperienceRuntimeCommands(registry);
-  registerServicesRuntimeCommands(registry);
-  registerTasksRuntimeCommands(registry);
-  registerLocalProviderRuntimeCommands(registry);
-  registerHealthRuntimeCommands(registry);
-  registerSettingsSyncRuntimeCommands(registry);
-  registerWorktreeRuntimeCommands(registry);
-  registerProviderAccountsRuntimeCommands(registry);
-  registerLocalAuthRuntimeCommands(registry);
-  registerIntelligenceRuntimeCommands(registry);
-  registerConversationRuntimeCommands(registry);
-  registerQrcodeRuntimeCommands(registry);
-  registerOnboardingRuntimeCommands(registry);
-  registerTtsRuntimeCommands(registry);
-  registerCloudflareRuntimeCommands(registry);
-  registerWorkPlanRuntimeCommands(registry);
-  registerCostRuntimeCommands(registry);
-  registerLocalRuntimeCommands(registry);
-  registerDiscoveryRuntimeCommands(registry);
-  registerPlanningRuntimeCommands(registry);
-  registerScheduleRuntimeCommands(registry);
-  registerBranchRuntimeCommands(registry);
-  registerSessionContentCommands(registry);
-  registerCheckpointRuntimeCommands(registry);
-  registerWorkstreamRuntimeCommands(registry);
-  registerCodebaseRuntimeCommands(registry);
-  registerWebSearchRuntimeCommands(registry);
-  registerImageRuntimeCommands(registry);
-
-  // ── /policy ───────────────────────────────────────────────────────────────
-  registry.register(policyCommand);
-
-  // ── /provider ─────────────────────────────────────────────────────────────
-  registry.register(providerCommand);
-
-  // ── /eval ─────────────────────────────────────────────────────────────────
-  registry.register(evalCommand);
-
-  // ── /session ─────────────────────────────────────────────────────────────
-  registry.register(sessionCommand);
-
-  // ── /resume — the discoverable front door to /session resume ─────────────
-  registry.register(resumeCommand);
-
-  // ── /recall ──────────────────────────────────────────────────────────────
-  registry.register(recallCommand);
-
-  // ── /knowledge ───────────────────────────────────────────────────────────
-  registry.register(knowledgeCommand);
+  for (const group of BUILTIN_COMMAND_GROUPS) {
+    group.register(registry);
+  }
+}
 
+/**
+ * categorizeBuiltinCommands - Build every built-in command paired with its
+ * category label, by replaying the same {@link BUILTIN_COMMAND_GROUPS} into a
+ * throwaway registry and attributing each newly-registered command to the
+ * group that added it. Handlers are never invoked, so this is side-effect free
+ * and safe to call from build scripts and tests. Used by the generated command
+ * reference (docs) and the command palette so both stay registry-driven.
+ */
+export function categorizeBuiltinCommands(): Array<{ command: SlashCommand; category: string }> {
+  const registry = new CommandRegistry();
+  const out: Array<{ command: SlashCommand; category: string }> = [];
+  const seen = new Set<string>();
+  for (const group of BUILTIN_COMMAND_GROUPS) {
+    group.register(registry);
+    for (const command of registry.getAll()) {
+      if (seen.has(command.name)) continue;
+      seen.add(command.name);
+      out.push({ command, category: group.category });
+    }
+  }
+  return out;
 }

package/src/input/composer-capture.ts

@@ -0,0 +1,67 @@
+/**
+ * Composer capture intents — leading markers in the composer that write to
+ * memory instead of (or in addition to) sending a turn.
+ *
+ *   `!# <text>`  pins <text> to session memory AND sends it as a normal prompt
+ *                (pre-existing behavior).
+ *   `# <text>`   captures <text> as a session-memory note and does NOT send a
+ *                turn — a pure "jot this down" gesture. A single leading `#`
+ *                only; `##...` (markdown headings) is left alone so it can be
+ *                sent as an ordinary prompt.
+ *
+ * Both write through the existing session memory machinery
+ * (SessionMemoryStore.add) and surface a visible confirmation naming what was
+ * written and where.
+ */
+
+export interface ComposerCaptureDeps {
+  readonly sessionMemoryStore: { add(text: string): string };
+  /** Surfaces the confirmation / usage message (a system message the shell renders). */
+  readonly notify: (message: string) => void;
+}
+
+export interface ComposerCaptureResult {
+  /** Text the caller should continue submission with (empty when nothing should be sent). */
+  readonly text: string;
+  /** Whether a capture marker was recognized and handled. */
+  readonly captured: boolean;
+}
+
+function truncateForChip(text: string): string {
+  return text.length > 60 ? `${text.slice(0, 57)}...` : text;
+}
+
+/**
+ * Interpret composer capture markers. Returns the (possibly emptied) text to
+ * continue with and whether a marker was handled. When `captured` is true and
+ * the returned `text` is empty, the caller should not send a turn.
+ */
+export function applyComposerCapture(input: string, deps: ComposerCaptureDeps): ComposerCaptureResult {
+  // `!#` — pin to session memory and continue to send as a prompt.
+  if (input.startsWith('!#')) {
+    const memoryText = input.slice(2).trim();
+    if (!memoryText) {
+      deps.notify('[Memory] Usage: !# <text to pin as session memory>');
+      return { text: '', captured: true };
+    }
+    const id = deps.sessionMemoryStore.add(memoryText);
+    deps.notify(`[Memory] Pinned: "${memoryText}" (${id})`);
+    return { text: memoryText, captured: true };
+  }
+
+  // `#` (single, not `##`) — capture a note to session memory; do not send.
+  const leading = input.replace(/^\s+/, '');
+  if (leading.startsWith('#') && !leading.startsWith('##')) {
+    const noteText = leading.slice(1).trim();
+    if (!noteText) {
+      deps.notify('[Note] Usage: # <text to save as a session-memory note>');
+      return { text: '', captured: true };
+    }
+    const id = deps.sessionMemoryStore.add(noteText);
+    // Confirmation chip: names WHAT was written and WHERE it went.
+    deps.notify(`✓ Note saved → session memory: "${truncateForChip(noteText)}" (${id})`);
+    return { text: '', captured: true };
+  }
+
+  return { text: input, captured: false };
+}

package/src/input/composer-editor.ts

@@ -0,0 +1,134 @@
+/**
+ * External-editor composition for the composer.
+ *
+ * Opens the user's $VISUAL/$EDITOR on the current composer draft, then loads
+ * the edited text back into the composer. While the editor runs the TUI is
+ * suspended: raw mode is dropped and the alt screen / mouse / paste / focus
+ * modes are disabled so the editor owns a normal terminal; on return the TUI
+ * modes are restored and the screen is repainted from scratch.
+ *
+ * The subprocess is run through the existing exec pattern (Bun/Node
+ * `spawnSync` with inherited stdio) so the editor shares this process's tty.
+ * The spawn is injectable for testing.
+ */
+
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  ALT_SCREEN_ENTER, ALT_SCREEN_EXIT, CLEAR_SCREEN, CURSOR_HIDE, CURSOR_SHOW,
+  MOUSE_ENABLE, MOUSE_DISABLE, KEYBOARD_EXT_ENABLE, KEYBOARD_EXT_DISABLE,
+  PASTE_ENABLE, PASTE_DISABLE, FOCUS_ENABLE, FOCUS_DISABLE,
+} from '../renderer/terminal-escapes.ts';
+
+export interface EditorSpawnResult {
+  readonly status: number | null;
+  readonly error?: Error | undefined;
+}
+
+/** Runs the editor synchronously with inherited stdio. Injectable for tests. */
+export type EditorSpawn = (cmd: string, args: string[], opts: { cwd: string; env: NodeJS.ProcessEnv }) => EditorSpawnResult;
+
+export interface ComposerEditorDeps {
+  readonly readDraft: () => string;
+  readonly writeDraft: (text: string) => void;
+  readonly cwd: string;
+  readonly env: NodeJS.ProcessEnv;
+  /** Drop the TUI's raw/alt-screen modes so the editor owns the terminal. */
+  readonly suspend: () => void;
+  /** Restore the TUI's modes and repaint. */
+  readonly resume: () => void;
+  readonly notify: (message: string) => void;
+  readonly spawn?: EditorSpawn;
+}
+
+/** Resolve $VISUAL/$EDITOR into a command + fixed args, or null when unset. */
+export function resolveEditorCommand(env: NodeJS.ProcessEnv): { cmd: string; args: string[] } | null {
+  const raw = (env.VISUAL || env.EDITOR || '').trim();
+  if (!raw) return null;
+  const parts = raw.split(/\s+/);
+  const cmd = parts[0];
+  if (!cmd) return null;
+  return { cmd, args: parts.slice(1) };
+}
+
+const defaultSpawn: EditorSpawn = (cmd, args, opts) => {
+  const res = spawnSync(cmd, args, { stdio: 'inherit', cwd: opts.cwd, env: opts.env });
+  return { status: res.status, error: res.error };
+};
+
+/** Core flow: temp file round-trip around a suspended-terminal editor launch. */
+export function openComposerInEditor(deps: ComposerEditorDeps): void {
+  const editor = resolveEditorCommand(deps.env);
+  if (!editor) {
+    deps.notify('[Editor] Set $EDITOR or $VISUAL to edit the composer in an external editor.');
+    return;
+  }
+  const draft = deps.readDraft();
+  const dir = mkdtempSync(join(tmpdir(), 'goodvibes-composer-'));
+  const file = join(dir, 'COMPOSER.md');
+  const spawn = deps.spawn ?? defaultSpawn;
+  let result: EditorSpawnResult;
+  try {
+    writeFileSync(file, draft, 'utf8');
+    deps.suspend();
+    try {
+      result = spawn(editor.cmd, [...editor.args, file], { cwd: deps.cwd, env: deps.env });
+    } finally {
+      deps.resume();
+    }
+    if (result.error) {
+      deps.notify(`[Editor] Failed to launch ${editor.cmd}: ${result.error.message}`);
+      return;
+    }
+    if (result.status !== 0 && result.status !== null) {
+      deps.notify(`[Editor] ${editor.cmd} exited with code ${result.status}; composer left unchanged.`);
+      return;
+    }
+    let edited = draft;
+    try { edited = readFileSync(file, 'utf8'); } catch { /* keep the original draft */ }
+    deps.writeDraft(edited.replace(/\n+$/, '')); // editors append a trailing newline
+    deps.notify('[Editor] Composer updated from external editor.');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+const LEAVE_TUI = PASTE_DISABLE + KEYBOARD_EXT_DISABLE + MOUSE_DISABLE + FOCUS_DISABLE + ALT_SCREEN_EXIT + CURSOR_SHOW;
+const ENTER_TUI = ALT_SCREEN_ENTER + CLEAR_SCREEN + CURSOR_HIDE + MOUSE_ENABLE + KEYBOARD_EXT_ENABLE + PASTE_ENABLE + FOCUS_ENABLE;
+
+export interface ComposerEditorOpenerDeps {
+  /** The live composer buffer (InputHandler exposes public `prompt`/`cursorPos`). */
+  readonly buffer: { prompt: string; cursorPos: number };
+  readonly stdin: { setRawMode(on: boolean): unknown };
+  readonly stdout: { write(seq: string): unknown };
+  /** Terminal-output guard wrapper (allowTerminalWrite). */
+  readonly writeGuard: (fn: () => void) => void;
+  readonly repaint: () => void;
+  readonly cwd: string;
+  readonly env: NodeJS.ProcessEnv;
+  readonly notify: (message: string) => void;
+  readonly spawn?: EditorSpawn;
+}
+
+/** Build the `openComposerEditor` command action, wiring terminal suspend/resume. */
+export function makeComposerEditorOpener(deps: ComposerEditorOpenerDeps): () => void {
+  return () => openComposerInEditor({
+    readDraft: () => deps.buffer.prompt,
+    writeDraft: (text) => { deps.buffer.prompt = text; deps.buffer.cursorPos = text.length; },
+    cwd: deps.cwd,
+    env: deps.env,
+    notify: deps.notify,
+    spawn: deps.spawn,
+    suspend: () => {
+      try { deps.stdin.setRawMode(false); } catch { /* stdin may not be a TTY */ }
+      deps.writeGuard(() => deps.stdout.write(LEAVE_TUI));
+    },
+    resume: () => {
+      deps.writeGuard(() => deps.stdout.write(ENTER_TUI));
+      try { deps.stdin.setRawMode(true); } catch { /* stdin may not be a TTY */ }
+      deps.repaint();
+    },
+  });
+}

package/src/input/concealed-input.ts

@@ -0,0 +1,94 @@
+/**
+ * Composer concealed-input mode.
+ *
+ * Generalizes the masking that previously lived only on the two purpose-built
+ * auth surfaces (local-auth panel, onboarding wizard) into the MAIN composer,
+ * so any password-like prompt can request concealed entry: the typed text is
+ * masked in the composer AND never reaches input history or the transcript
+ * plaintext. The plaintext is delivered exactly once, to the requester's
+ * onSubmit callback.
+ *
+ * The real value lives in the composer's normal prompt buffer (so all the usual
+ * editing works); only the RENDER path is masked (see maskConcealedText) and
+ * the SUBMIT path is diverted (see InputHandler.submitConcealedInput).
+ */
+
+/** A pending request for one line of concealed input from the composer. */
+export interface ConcealedInputRequest {
+  /**
+   * Short label describing what is being asked for, e.g. 'Password' or
+   * 'API key'. Surfaced by the caller (e.g. as a system message) — the composer
+   * itself only masks; it does not print the label.
+   */
+  readonly label?: string;
+  /** Receives the entered plaintext exactly once, when the user submits. */
+  readonly onSubmit: (value: string) => void;
+  /** Invoked if the user cancels (Escape) instead of submitting. */
+  readonly onCancel?: () => void;
+}
+
+/**
+ * Mask a composer buffer for display. Every UTF-16 code unit except a newline
+ * becomes a bullet, so the masked string has the EXACT same length and line
+ * structure as the plaintext — word-wrap and cursor-position math (which index
+ * the string by code unit) stay correct while no plaintext character ever
+ * reaches the screen buffer.
+ */
+export function maskConcealedText(text: string): string {
+  return text.replace(/[^\n]/g, '•');
+}
+
+/**
+ * Minimal composer surface the concealed-input helpers mutate. Kept structural
+ * so the logic lives here (out of the 800-line handler.ts) while the InputHandler
+ * only holds thin delegating methods.
+ */
+export interface ConcealedInputHost {
+  prompt: string;
+  cursorPos: number;
+  concealedInput: ConcealedInputRequest | null;
+  requestRender: () => void;
+}
+
+/**
+ * Begin one line of concealed input. The composer starts empty and masked; the
+ * next submit delivers the plaintext to request.onSubmit and auto-clears
+ * concealed mode. A second call replaces any in-flight request (its onCancel
+ * fires so no requester is left dangling).
+ */
+export function beginConcealedInputFor(host: ConcealedInputHost, request: ConcealedInputRequest): void {
+  if (host.concealedInput) host.concealedInput.onCancel?.();
+  host.concealedInput = request;
+  host.prompt = '';
+  host.cursorPos = 0;
+  host.requestRender();
+}
+
+/**
+ * Deliver a concealed submission. Returns true when concealed mode was active
+ * and consumed the value; false when not concealed (caller uses the normal
+ * submit path). The value is passed by the caller (the live feed snapshot),
+ * never read back from host.prompt, to avoid mid-feed staleness. Concealed
+ * state is cleared BEFORE onSubmit runs so the secret does not linger.
+ */
+export function submitConcealedInputFor(host: ConcealedInputHost, value: string): boolean {
+  const request = host.concealedInput;
+  if (!request) return false;
+  host.concealedInput = null;
+  host.prompt = '';
+  host.cursorPos = 0;
+  request.onSubmit(value);
+  return true;
+}
+
+/** Cancel an active concealed-input request without submitting (Escape). */
+export function cancelConcealedInputFor(host: ConcealedInputHost): boolean {
+  const request = host.concealedInput;
+  if (!request) return false;
+  host.concealedInput = null;
+  host.prompt = '';
+  host.cursorPos = 0;
+  request.onCancel?.();
+  host.requestRender();
+  return true;
+}

package/src/input/exec-env-scrub-config.ts

@@ -0,0 +1,84 @@
+/**
+ * exec-env-scrub-config.ts — TUI-local synthetic settings entry for
+ * permissions.execEnvScrubAllowlist.
+ *
+ * The SDK's credential-bearing env-var scrub (platform/tools/exec/credential-env.ts)
+ * removes well-known credential-bearing variable NAMES (AWS_SECRET_ACCESS_KEY,
+ * GITHUB_TOKEN, OPENAI_API_KEY, …) from the environment handed to every spawned
+ * exec command, and is threaded into `registerAllTools`'s `credentialEnvScrub`
+ * option (bootstrap-core.ts) so a consumer can wire an operator-configured
+ * allowlist instead of the scrub always resolving to its built-in default. The
+ * scrub's master switch stays on: this entry configures ONLY the allowlist —
+ * variable NAMES always kept even though their name looks credential-bearing
+ * (case-insensitive), for a command that genuinely needs one (e.g. a CI runner
+ * re-reading its own signing key). NEVER a value; the scrub only ever inspects
+ * and reports NAMES.
+ *
+ * `permissions.execEnvScrubAllowlist` is not in CONFIG_SCHEMA — there is no SDK
+ * config domain for the exec env scrub at all (it is consumer-wired, not
+ * schema-registered), so this mirrors the other TUI-local synthetic settings
+ * (worktree.setup.*, sandbox.egressAllowlist, …). No defensive try/catch is
+ * needed: 'permissions' already exists as a DEFAULT_CONFIG section (it backs
+ * permissions.mode/tools.*), so a plain get()/set() resolves the path without
+ * throwing — only the LEAF field is new, and ConfigManager.resolvePath never
+ * validates leaf existence.
+ *
+ * Stored as a JSON array of strings on disk; the settings modal's inline
+ * editor is a single-line text field, so — matching worktree.setup.* and
+ * sandbox.egressAllowlist/workspaceWritable — it is displayed and edited as a
+ * comma-separated list and parsed back into an array on commit (see
+ * isExecEnvScrubAllowlistConfigKey's use in settings-modal.ts#commitEdit).
+ */
+import type { ConfigKey, ConfigManager, ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+import type { SettingEntry, SettingsCategory } from './settings-modal-types.ts';
+
+export const EXEC_ENV_SCRUB_ALLOWLIST_CONFIG_KEY = 'permissions.execEnvScrubAllowlist' as ConfigKey;
+
+/** True for the exec env-scrub allowlist key, whose stored value is a string array edited as a comma-separated list. */
+export function isExecEnvScrubAllowlistConfigKey(key: ConfigKey): boolean {
+  return key === EXEC_ENV_SCRUB_ALLOWLIST_CONFIG_KEY;
+}
+
+/** Read the allowlist as a string array (non-array/malformed/unset degrades to empty). */
+export function readExecEnvScrubAllowlist(configManager: Pick<ConfigManager, 'get'>): string[] {
+  const raw = configManager.get(EXEC_ENV_SCRUB_ALLOWLIST_CONFIG_KEY);
+  if (!Array.isArray(raw)) return [];
+  return raw.filter((entry): entry is string => typeof entry === 'string' && entry.length > 0);
+}
+
+/** Parse a comma-separated edit-buffer submission back into a string array (trimmed, empties dropped). Same convention as worktree.setup.* / sandbox.egressAllowlist. */
+export function parseExecEnvScrubAllowlistInput(text: string): string[] {
+  return text.split(',').map((part) => part.trim()).filter((part) => part.length > 0);
+}
+
+export const EXEC_ENV_SCRUB_ALLOWLIST_SYNTHETIC_SETTING: ConfigSetting = {
+  key: EXEC_ENV_SCRUB_ALLOWLIST_CONFIG_KEY,
+  type: 'string',
+  default: [],
+  description: 'Comma-separated environment variable NAMES always kept in a spawned exec command\'s environment even when the name looks credential-bearing (case-insensitive). Names only — this never inspects or reports values. The scrub itself stays on; this only widens what it lets through. Empty = the built-in credential-name scrub applies with no extra exceptions.',
+};
+
+/** Build the synthetic SettingEntry for permissions.execEnvScrubAllowlist. */
+export function buildExecEnvScrubAllowlistSyntheticEntry(configManager: Pick<ConfigManager, 'get'>): SettingEntry {
+  const currentValue = readExecEnvScrubAllowlist(configManager);
+  return {
+    setting: EXEC_ENV_SCRUB_ALLOWLIST_SYNTHETIC_SETTING,
+    currentValue,
+    isDefault: currentValue.length === 0,
+  };
+}
+
+/**
+ * Inject the synthetic entry into the permissions category's SettingEntry
+ * list, idempotently. No-op when the category isn't present in `groups`.
+ */
+export function injectExecEnvScrubSyntheticEntry(
+  groups: Map<SettingsCategory, SettingEntry[]>,
+  configManager: Pick<ConfigManager, 'get'>,
+): void {
+  const permissionsEntries = groups.get('permissions');
+  if (!permissionsEntries) return;
+  if (!permissionsEntries.some((e) => e.setting.key === EXEC_ENV_SCRUB_ALLOWLIST_CONFIG_KEY)) {
+    permissionsEntries.push(buildExecEnvScrubAllowlistSyntheticEntry(configManager));
+  }
+}