@pellux/goodvibes-tui 1.13.1 → 1.14.0

package/src/renderer/shell-surface.ts

@@ -36,11 +36,23 @@ export interface ShellFooterBuildOptions {
   readonly composerStatus?: string;
   readonly composerFlags?: readonly string[];
   readonly composerPendingRisk?: 'none' | 'approval-wait' | 'shell' | 'command' | 'remote';
+  /**
+   * Current session permission mode (config value: 'prompt' | 'allow-all' |
+   * 'custom' | 'plan' | 'accept-edits'). Rendered as a pill in the composer
+   * posture block. Cycled by Shift+Tab and toggled by /plan.
+   */
+  readonly permissionMode?: string;
   /**
    * Passive context pressure hint from buildContextStatusHint.
    * Rendered as a dim informational line above the prompt when non-null.
    */
   readonly contextStatusHint?: string | null;
+  /**
+   * Output of the user's scriptable status line (`statusline.command`).
+   * Rendered as a dim informational line above the prompt when non-null,
+   * below the context pressure hint.
+   */
+  readonly scriptableStatusLine?: string | null;
   /**
    * Compact footer posture for short terminals (~<30 rows). Collapses the
    * footer to its essentials (prompt box + token/cost line + help) and drops
@@ -72,6 +84,10 @@ const PROCESS_INDICATOR_ROWS = 1;
 // border, token-usage line, and the help/exit line.
 const COMPACT_FOOTER_BASE_ROWS = 4;
 
+// Dim slate foreground shared by the passive footer status lines (context
+// pressure hint and the scriptable status line).
+const DIM_STATUS_FG = '#64748b';
+
 /**
  * Real height of the most recently rendered footer, tagged with the compact
  * posture it was rendered under. estimateShellFooterHeight prefers this so
@@ -127,6 +143,7 @@ export function buildShellFooter(
     options.composerPendingRisk,
     options.compact ?? false,
     options.sessionSpineStatus,
+    options.permissionMode,
   );
   // Compact posture drops the process indicator and context hint entirely so
   // the footer fits within ~5 rows on short terminals.
@@ -140,9 +157,14 @@ export function buildShellFooter(
     );
     const inputBoxRows = Math.max(1, options.promptLineCount) + 2;
     lines.splice(inputBoxRows, 0, ...processIndicator);
+    // Scriptable status line — dim informational line above the prompt. Unshifted
+    // before the context hint so the context hint (if any) sits above it.
+    if (options.scriptableStatusLine) {
+      lines.unshift(UIFactory.stringToLine(options.scriptableStatusLine, options.width, { fg: DIM_STATUS_FG }));
+    }
     // Passive context status hint — rendered as a dim informational line before the prompt.
     if (options.contextStatusHint) {
-      const hintLine = UIFactory.stringToLine(options.contextStatusHint, options.width, { fg: '#64748b' });
+      const hintLine = UIFactory.stringToLine(options.contextStatusHint, options.width, { fg: DIM_STATUS_FG });
       lines.unshift(hintLine);
     }
   }

package/src/renderer/system-message.ts

@@ -46,6 +46,10 @@ export function classifySystemMessage(content: string): SystemMessageType {
     return 'info';
   }
 
+  // [Routing] chip — a mid-session model change is informational (the [Failover]
+  // line, not this, carries the alarming transport-error cases).
+  if (/^\[Routing\]/.test(content)) return 'info';
+
   // [Local] and [Recovery] messages
   if (/^\[Local\]/.test(content)) return 'info';
   if (/^\[Recovery\]/.test(content)) {

package/src/renderer/tool-result-summary.ts

@@ -93,20 +93,65 @@ function summarizeEdit(obj: Record<string, unknown>): string | null {
   return `${verb} ${applied} edit${applied === 1 ? '' : 's'}${target}${failText}`;
 }
 
+/** Credential-bearing env-var names withheld from the spawn (never values). Empty when the field is absent/empty. */
+function withheldEnvNames(obj: Record<string, unknown>): string[] {
+  const raw = obj.withheld_env;
+  if (!Array.isArray(raw)) return [];
+  return raw.filter((n): n is string => typeof n === 'string' && n.length > 0);
+}
+
+/** Compact "withheld: NAME, NAME, …" suffix, capped so a long scrub list doesn't dominate the collapsed line. */
+function withheldEnvSuffix(names: readonly string[]): string {
+  if (names.length === 0) return '';
+  const MAX_SHOWN = 3;
+  const shown = names.slice(0, MAX_SHOWN).join(', ');
+  const more = names.length > MAX_SHOWN ? `, +${names.length - MAX_SHOWN} more` : '';
+  return ` · withheld: ${shown}${more}`;
+}
+
+/**
+ * Compact per-command exec-sandbox suffix: `sandboxed` fields are present
+ * only when the sandbox was active for the run (SDK's attachSandboxMeta stays
+ * quiet otherwise), so absence here means "ran unsandboxed" and the suffix is
+ * empty — never a fabricated claim either way.
+ *
+ *   sandboxed, network disabled            -> " · sandboxed (net off)"
+ *   sandboxed, network enabled, escalation -> " · sandboxed (net on, +1 escalation)"
+ *   requested but host couldn't provide it -> " · sandbox unavailable (<reason>)"
+ */
+function sandboxSuffix(obj: Record<string, unknown>): string {
+  const sandboxed = obj.sandboxed;
+  if (sandboxed === undefined) return '';
+  if (sandboxed === false) {
+    const reason = typeof obj.sandbox_boundary === 'string' ? obj.sandbox_boundary : undefined;
+    return reason ? ` · sandbox unavailable (${reason})` : ' · sandbox unavailable';
+  }
+  const network = typeof obj.sandbox_network === 'string' ? obj.sandbox_network : undefined;
+  const escalations = Array.isArray(obj.sandbox_escalations)
+    ? obj.sandbox_escalations.filter((e): e is string => typeof e === 'string')
+    : [];
+  const netText = network ? `net ${network}` : undefined;
+  const escText = escalations.length > 0 ? `+${escalations.length} escalation${escalations.length === 1 ? '' : 's'}` : undefined;
+  const detail = [netText, escText].filter((s): s is string => s !== undefined).join(', ');
+  return detail ? ` · sandboxed (${detail})` : ' · sandboxed';
+}
+
 /** A single exec command result. */
 function summarizeExecOne(obj: Record<string, unknown>): string | null {
   const exit = obj.exit_code;
   const dur = asNumber(obj.duration_ms);
   const durText = dur !== undefined ? ` · ${formatDuration(dur)}` : '';
-  if (obj.timed_out === true) return `timed out${durText}`;
-  if (obj.cancelled === true) return `cancelled${durText}`;
+  const withheldText = withheldEnvSuffix(withheldEnvNames(obj));
+  const sandboxText = sandboxSuffix(obj);
+  if (obj.timed_out === true) return `timed out${durText}${withheldText}${sandboxText}`;
+  if (obj.cancelled === true) return `cancelled${durText}${withheldText}${sandboxText}`;
   const stdout = typeof obj.stdout === 'string' ? obj.stdout : '';
   const lineCount = stdout.length === 0
     ? 0
     : stdout.replace(/\n$/, '').split('\n').length;
   const lineText = lineCount > 0 ? ` · ${lineCount} line${lineCount === 1 ? '' : 's'}` : '';
   const code = typeof exit === 'number' ? String(exit) : '?';
-  return `exit ${code}${durText}${lineText}`;
+  return `exit ${code}${durText}${lineText}${withheldText}${sandboxText}`;
 }
 
 /** exec: single { cmd, exit_code, ... } or multi { commands: [...], total }. */
@@ -116,9 +161,24 @@ function summarizeExec(obj: Record<string, unknown>): string | null {
     const failed = obj.commands.filter(
       (c) => c && typeof c === 'object' && (c as Record<string, unknown>).success === false,
     ).length;
+    // Union of withheld names across every command in the batch — the scrub
+    // runs per-spawn, so different commands can withhold different names.
+    const withheldAcrossCommands = new Set<string>();
+    for (const c of obj.commands) {
+      if (c && typeof c === 'object') {
+        for (const name of withheldEnvNames(c as Record<string, unknown>)) withheldAcrossCommands.add(name);
+      }
+    }
+    const withheldText = withheldEnvSuffix([...withheldAcrossCommands]);
+    // Count sandboxed commands across the batch — a compact "N sandboxed" beats
+    // repeating each command's full boundary detail on the collapsed line.
+    const sandboxedCount = obj.commands.filter(
+      (c) => c && typeof c === 'object' && (c as Record<string, unknown>).sandboxed === true,
+    ).length;
+    const sandboxText = sandboxedCount > 0 ? ` · ${sandboxedCount} sandboxed` : '';
     return failed > 0
-      ? `${total} commands · ${failed} failed`
-      : `${total} commands · all ok`;
+      ? `${total} commands · ${failed} failed${withheldText}${sandboxText}`
+      : `${total} commands · all ok${withheldText}${sandboxText}`;
   }
   if ('exit_code' in obj || 'timed_out' in obj || 'cancelled' in obj) {
     return summarizeExecOne(obj);
@@ -126,6 +186,35 @@ function summarizeExec(obj: Record<string, unknown>): string | null {
   return null;
 }
 
+/**
+ * agent status/get/wait: an optional `failure` field (ChildFailureEnvelope,
+ * see the SDK's tools/agent/child-failure-envelope.ts) is present once the
+ * child agent terminated abnormally (max_turns, circuit_breaker,
+ * watchdog_timeout, budget_exhausted, claim_unverified, api_error, killed,
+ * interrupted, error). Renders it compactly on the collapsed preview line so
+ * a failed child is visible without expanding the full result; absent
+ * `failure` (the common, successful case) falls through to the raw preview.
+ */
+function summarizeAgentFailure(obj: Record<string, unknown>): string | null {
+  const failure = obj.failure;
+  if (!failure || typeof failure !== 'object') return null;
+  const f = failure as Record<string, unknown>;
+  const agentId = typeof f.agentId === 'string' ? f.agentId : '?';
+  const phase = typeof f.phase === 'string' ? f.phase : undefined;
+  const reason = f.reason && typeof f.reason === 'object' ? f.reason as Record<string, unknown> : undefined;
+  const code = reason && typeof reason.code === 'string' ? reason.code : 'error';
+  const message = reason && typeof reason.message === 'string' ? reason.message : '';
+  const partialOutputs = f.partialOutputs && typeof f.partialOutputs === 'object' ? f.partialOutputs as Record<string, unknown> : undefined;
+  const turnsCompleted = asNumber(partialOutputs?.turnsCompleted);
+
+  const MAX_MSG_LEN = 80;
+  const truncatedMessage = message.length > MAX_MSG_LEN ? `${message.slice(0, MAX_MSG_LEN - 3)}...` : message;
+  const phaseText = phase ? ` at ${phase}` : '';
+  const turnsText = turnsCompleted !== undefined ? ` (${turnsCompleted} turn${turnsCompleted === 1 ? '' : 's'} completed)` : '';
+  const msgText = truncatedMessage.length > 0 ? `: ${truncatedMessage}` : '';
+  return `agent ${agentId} failed [${code}]${phaseText}${msgText}${turnsText}`;
+}
+
 export function summarizeToolResult(toolName: string | undefined, content: string): string | null {
   if (!toolName) return null;
   const family = toolName.includes('__') ? toolName.split('__').pop()! : toolName;
@@ -143,6 +232,7 @@ export function summarizeToolResult(toolName: string | undefined, content: strin
     case 'read': return summarizeRead(obj);
     case 'edit': return summarizeEdit(obj);
     case 'exec': return summarizeExec(obj);
+    case 'agent': return summarizeAgentFailure(obj);
     default: return null;
   }
 }

package/src/renderer/ui-factory.ts

@@ -9,6 +9,7 @@ import { activeUiTones } from './theme.ts';
 import { formatElapsed } from '../utils/format-elapsed.ts';
 import { abbreviateCount } from '../utils/format-number.ts';
 import { computeContextUsage } from '../core/context-usage.ts';
+import { permissionModeLabel, permissionModeTone } from '../core/permission-mode.ts';
 import { calcSessionCost, isModelPriced } from '../export/cost-utils.ts';
 import { buildFooterTip, isAgentActive } from './footer-tips.ts';
 import type { StreamMetrics } from '../core/stream-event-wiring.ts';
@@ -198,6 +199,9 @@ export class UIFactory {
     // Honest cross-surface spine posture. Defined ONLY in adopted-daemon
     // mode (undefined in embedded/local), so the segment is absent otherwise.
     sessionSpineStatus?: 'online' | 'offline',
+    // Session permission mode (config value). Rendered as a leading pill in the
+    // posture block; undefined suppresses the pill (e.g. bare test callers).
+    permissionMode?: string,
   ): Line[] {
     const lines: Line[] = [];
     const promptLines = prompt.split('\n');
@@ -332,6 +336,24 @@ export class UIFactory {
     // (light-terminal-aware); state.info reads on both light and dark terminals.
     const t = activeUiTones();
     const composerTokens: Array<{ text: string; fg: string; bold?: boolean; dim?: boolean }> = [];
+    // Permission-mode pill — always shown so the active session posture (normal
+    // / plan / accept-edits / auto) is visible at a glance. Tone: normal reads
+    // dim/neutral, plan reads info (read-only, safe), accept-edits and auto read
+    // as caution (raised autonomy). Cycled by Shift+Tab, toggled by /plan.
+    if (permissionMode) {
+      const modeTone = permissionModeTone(permissionMode);
+      const modeFg = modeTone === 'caution' ? t.chrome.warn : modeTone === 'info' ? t.state.info : '244';
+      composerTokens.push({ text: ` mode:${permissionModeLabel(permissionMode)} `, fg: modeFg, bold: modeTone !== 'neutral', dim: modeTone === 'neutral' });
+    }
+    // Context-usage chip — always-visible compaction-pressure indicator so the
+    // user sees compaction approaching before it happens. Colored by proximity
+    // to the auto-compact threshold (fraction; falls back to 0.85 when unset).
+    if (contextWindow && contextWindow > 0) {
+      const ctxUsage = computeContextUsage(lastInputTokens ?? 0, contextWindow);
+      const ctxThr = compactThreshold && compactThreshold > 0 ? compactThreshold : 0.85;
+      const ctxFg = ctxUsage.clampedRatio >= ctxThr ? t.chrome.bad : ctxUsage.clampedRatio >= ctxThr * 0.85 ? t.chrome.warn : '244';
+      composerTokens.push({ text: ` ctx:${ctxUsage.pct}% `, fg: ctxFg, bold: ctxUsage.clampedRatio >= ctxThr, dim: ctxUsage.clampedRatio < ctxThr * 0.85 });
+    }
     if (composerMode) composerTokens.push({ text: ` ${GLYPHS.status.active} ${composerMode} `, fg: t.state.info, bold: true });
     if (composerPendingRisk && composerPendingRisk !== 'none') {
       const riskColor = composerPendingRisk === 'approval-wait'

package/src/runtime/bootstrap-command-context.ts

@@ -18,6 +18,9 @@ import type { ForensicsRegistry } from '@/runtime/index.ts';
 import type { PolicyRuntimeState } from '@/runtime/index.ts';
 import type { FileUndoManager } from '@pellux/goodvibes-sdk/platform/state';
 import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
+import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { WorkspaceTrustManager } from './trust/workspace-trust.ts';
+import type { WorkspaceRegistrationManager } from './trust/workspace-registration.ts';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
 import type { MemoryRegistry } from '@pellux/goodvibes-sdk/platform/state';
 import type { IntegrationHelperService } from '@/runtime/index.ts';
@@ -53,6 +56,7 @@ import {
 
 export type CreateBootstrapCommandContextOptions = {
   configManager: ConfigManager;
+  featureFlagManager?: import('@/runtime/index.ts').FeatureFlagManager;
   providerRegistry: ProviderRegistry;
   conversation: ConversationManager;
   runtime: MutableRuntimeState;
@@ -75,6 +79,9 @@ export type CreateBootstrapCommandContextOptions = {
   planRuntime?: PlanRuntimeService;
   fileUndoManager: FileUndoManager;
   workspaceCheckpointManager?: WorkspaceCheckpointManager;
+  gatewayMethods?: GatewayMethodCatalog;
+  workspaceTrustManager?: WorkspaceTrustManager;
+  workspaceRegistrationManager?: WorkspaceRegistrationManager;
   memoryRegistry?: MemoryRegistry;
   integrationHelpers?: IntegrationHelperService;
   automationManager?: ShellAutomationManagerRuntimeService;
@@ -136,6 +143,7 @@ export function createBootstrapCommandContext(
   const {
     providerRegistry,
     configManager,
+    featureFlagManager,
     conversation,
     runtime,
     requestRender,
@@ -156,6 +164,9 @@ export function createBootstrapCommandContext(
     planRuntime,
     fileUndoManager,
     workspaceCheckpointManager,
+    gatewayMethods,
+    workspaceTrustManager,
+    workspaceRegistrationManager,
     memoryRegistry,
     integrationHelpers,
     automationManager,
@@ -265,6 +276,9 @@ export function createBootstrapCommandContext(
     keybindingsManager,
     fileUndoManager,
     workspaceCheckpointManager,
+    gatewayMethods,
+    workspaceTrustManager,
+    workspaceRegistrationManager,
     panelManager,
     profileManager,
     bookmarkManager,
@@ -272,7 +286,7 @@ export function createBootstrapCommandContext(
     projectPlanningProjectId,
     workPlanStore,
   }, shellServices);
-  const platform = createBootstrapCommandPlatformSection({ configManager, voiceProviderRegistry, voiceService, webSearchService, mediaProviders, artifactStore }, shellServices);
+  const platform = createBootstrapCommandPlatformSection({ configManager, featureFlagManager, voiceProviderRegistry, voiceService, webSearchService, mediaProviders, artifactStore }, shellServices);
   const extensions = createBootstrapCommandExtensionsSection({
     toolRegistry,
     mcpRegistry,

package/src/runtime/bootstrap-command-parts.ts

@@ -9,6 +9,7 @@ import type { McpApi } from '@pellux/goodvibes-sdk/platform/mcp';
 import type { PanelManager, PanelDeepLinkTarget } from '../panels/panel-manager.ts';
 import type { ProviderApi } from '@pellux/goodvibes-sdk/platform/providers';
 import type { OpsApi } from '@/runtime/index.ts';
+import type { FeatureFlagManager } from '@/runtime/index.ts';
 import type { MutableRuntimeState } from '@/runtime/index.ts';
 import type { ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
 import type { CommandContext } from '../input/command-registry.ts';
@@ -19,6 +20,9 @@ import type { ForensicsRegistry } from '@/runtime/index.ts';
 import type { PolicyRuntimeState } from '@/runtime/index.ts';
 import type { CodeIndexStore, FileUndoManager } from '@pellux/goodvibes-sdk/platform/state';
 import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
+import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { WorkspaceTrustManager } from './trust/workspace-trust.ts';
+import type { WorkspaceRegistrationManager } from './trust/workspace-registration.ts';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
 import type { MemoryRegistry } from '@pellux/goodvibes-sdk/platform/state';
 import type { IntegrationHelperService } from '@/runtime/index.ts';
@@ -70,6 +74,7 @@ export interface BootstrapCommandActionOptions {
 
 export interface BootstrapCommandSectionOptions {
   readonly configManager: ConfigManager;
+  readonly featureFlagManager?: FeatureFlagManager;
   readonly providerRegistry: ProviderRegistry;
   readonly conversation: ConversationManager;
   readonly runtime: MutableRuntimeState;
@@ -91,6 +96,9 @@ export interface BootstrapCommandSectionOptions {
   readonly shellPaths: ShellPathService;
   readonly fileUndoManager: FileUndoManager;
   readonly workspaceCheckpointManager?: WorkspaceCheckpointManager;
+  readonly gatewayMethods?: GatewayMethodCatalog;
+  readonly workspaceTrustManager?: WorkspaceTrustManager;
+  readonly workspaceRegistrationManager?: WorkspaceRegistrationManager;
   readonly memoryRegistry?: MemoryRegistry;
   readonly integrationHelpers?: IntegrationHelperService;
   readonly knowledgeService?: KnowledgeService;
@@ -362,7 +370,7 @@ export function createBootstrapCommandProviderSection(
 export function createBootstrapCommandWorkspaceSection(
   options: Pick<
     BootstrapCommandSectionOptions,
-    'keybindingsManager' | 'fileUndoManager' | 'workspaceCheckpointManager' | 'panelManager' | 'profileManager' | 'bookmarkManager'
+    'keybindingsManager' | 'fileUndoManager' | 'workspaceCheckpointManager' | 'gatewayMethods' | 'workspaceTrustManager' | 'workspaceRegistrationManager' | 'panelManager' | 'profileManager' | 'bookmarkManager'
     | 'projectPlanningService' | 'projectPlanningProjectId' | 'workPlanStore'
   >,
   shellServices: BootstrapCommandShellServices,
@@ -371,6 +379,9 @@ export function createBootstrapCommandWorkspaceSection(
     keybindingsManager: options.keybindingsManager,
     fileUndoManager: options.fileUndoManager,
     workspaceCheckpointManager: options.workspaceCheckpointManager,
+    gatewayMethods: options.gatewayMethods,
+    workspaceTrustManager: options.workspaceTrustManager,
+    workspaceRegistrationManager: options.workspaceRegistrationManager,
     panelManager: options.panelManager,
     profileManager: options.profileManager,
     bookmarkManager: options.bookmarkManager,
@@ -384,13 +395,14 @@ export function createBootstrapCommandWorkspaceSection(
 export function createBootstrapCommandPlatformSection(
   options: Pick<
     BootstrapCommandSectionOptions,
-    'configManager' | 'voiceProviderRegistry' | 'voiceService' | 'webSearchService' | 'mediaProviders' | 'artifactStore'
+    'configManager' | 'featureFlagManager' | 'voiceProviderRegistry' | 'voiceService' | 'webSearchService' | 'mediaProviders' | 'artifactStore'
   >,
   shellServices: BootstrapCommandShellServices,
 ): BootstrapCommandPlatformSection {
   return {
     config: getConfigSnapshot(options.configManager),
     configManager: options.configManager,
+    featureFlagManager: options.featureFlagManager,
     voiceProviderRegistry: options.voiceProviderRegistry,
     voiceService: options.voiceService,
     webSearchService: options.webSearchService,

package/src/runtime/bootstrap-core.ts

@@ -1,4 +1,5 @@
 import { ConversationManager } from '../core/conversation';
+import { registerSessionConversation } from './conversation-rewind-port.ts';
 import { SelectionManager } from '../input/selection.ts';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { ConfigManager, getConfiguredSystemPrompt } from '../config/index.ts';
@@ -13,19 +14,15 @@ import type { SystemMessageRouter } from '../core/system-message-router.ts';
 import type { ConversationFollowUpItem } from '@pellux/goodvibes-sdk/platform/core';
 import type { OrchestratorUserInputOptions } from '../core/orchestrator.ts';
 import type { ControlPlaneRecentEvent } from '@pellux/goodvibes-sdk/platform/control-plane';
-import type { MutableRuntimeState } from '@/runtime/index.ts';
 import type { BootstrapOptions } from './context.ts';
-import { createFeatureFlagManager } from '@/runtime/index.ts';
-import { RuntimeEventBus } from '@/runtime/index.ts';
-import type { SessionEvent } from '@/runtime/index.ts';
 import { createRuntimeStore, createDomainDispatch, type RuntimeStore } from './store/index.ts';
-import { ForensicsCollector, ForensicsRegistry } from '@/runtime/index.ts';
 import {
-  generateUserSessionId,
+  type MutableRuntimeState, type SessionEvent, createFeatureFlagManager, RuntimeEventBus, ForensicsCollector,
+  ForensicsRegistry, generateUserSessionId, loadBootstrapSystemPrompt, syncConfiguredServices,
+  registerBootstrapHookBridge, registerBootstrapRuntimeEvents,
 } from '@/runtime/index.ts';
-import { loadBootstrapSystemPrompt, syncConfiguredServices } from '@/runtime/index.ts';
-import { registerBootstrapHookBridge } from '@/runtime/index.ts';
-import { registerBootstrapRuntimeEvents } from '@/runtime/index.ts';
+import { readExecEnvScrubAllowlist } from '../input/exec-env-scrub-config.ts';
+import { createSandboxExecAsk, sandboxExecAskDepsFromRuntime } from '../permissions/sandbox-exec-gate.ts';
 import { createRuntimeServices, type RuntimeServices } from './services.ts';
 import { runBootMemoryFold } from './memory-fold.ts';
 import { setPricingSource } from '../export/cost-utils.ts';
@@ -36,6 +33,8 @@ import { createWrfcPersistence, type WrfcPersistence } from './wrfc-persistence.
 import type { SystemMessagePriority } from '../core/system-message-router.ts';
 import { SessionSpineClient, SessionUnionCache, TUI_SPINE_PARTICIPANT } from '@pellux/goodvibes-sdk/platform/runtime/session-spine';
 import { SessionInboundInputPoller, createBootstrapInboundInputPoller } from './session-inbound-inputs.ts';
+import { detectPriorWorkspaceState, trustGatedAsk } from './trust/workspace-trust.ts';
+import { syncNotifierQueueIntegrations } from './bootstrap-notifier-sync.ts';
 
 // ---------------------------------------------------------------------------
 // Pre-router buffer
@@ -250,7 +249,10 @@ export async function initializeBootstrapCore(
     getConversationTitle: () => getConversationTitle(),
     workingDir,
     homeDirectory,
+    // Sampled BEFORE any service writes to <cwd>/.goodvibes so a new workspace isn't misread as used.
+    workspaceHadPriorState: detectPriorWorkspaceState(workingDir),
   });
+  await services.workspaceTrustManager.load(); // settle trust (+ grandfathering) before any tool runs
   const providerRegistry = services.providerRegistry;
   providerRegistry.initModelLimits();
   services.benchmarkStore.initBenchmarks();
@@ -371,6 +373,15 @@ export async function initializeBootstrapCore(
     serviceRegistry: services.serviceRegistry,
     overflowHandler: services.overflowHandler,
     changeTracker: services.sessionChangeTracker,
+    // Master switch stays on (SDK default); this only widens the allowlist of
+    // variable NAMES kept even though they look credential-bearing. See
+    // exec-env-scrub-config.ts (permissions.execEnvScrubAllowlist).
+    credentialEnvScrub: { allowlist: readExecEnvScrubAllowlist(configManager) },
+    // Registers the context_accounting tool on this (the real, interactive)
+    // registry against OUR holder rather than a fresh internal one, so the
+    // Orchestrator-backed source bound at bootstrap.ts is what the tool
+    // actually reads from. See runtime/context-accounting-source.ts.
+    contextAccountingHolder: services.contextAccountingHolder,
   });
   // Note: installWrfcAgentToolGuard is called after routeOrBuffer is defined
   // (further below) so the onTrace callback can route guard decisions through
@@ -400,6 +411,7 @@ export async function initializeBootstrapCore(
     memoryRegistry: services.memoryRegistry,
     sandboxSessionRegistry: services.sandboxSessionRegistry,
     workflowServices: services.workflow,
+    contextAccountingHolder: services.contextAccountingHolder,
   });
 
   const bootstrapUnsubs: Array<() => void> = [];
@@ -679,39 +691,24 @@ export async function initializeBootstrapCore(
   services.webhookNotifier.attachToRuntimeBus(runtimeBus);
 
   const notifier = await Notifier.fromConfig(services.serviceRegistry);
-  const queueStatuses = notifier.getQueueStatus();
-  if (queueStatuses.length > 0) {
-    notifier.attachToRuntimeBus(runtimeBus);
-    for (const queueStatus of queueStatuses) {
-      domainDispatch.syncIntegration({
-        id: queueStatus.channel,
-        displayName: queueStatus.channel[0]!.toUpperCase() + queueStatus.channel.slice(1),
-        category: 'communication',
-        status: queueStatus.metrics.deadLettered > 0 ? 'degraded' : 'healthy',
-        enabled: true,
-        successCount: queueStatus.metrics.delivered,
-        errorCount: queueStatus.metrics.deadLettered,
-        ...(queueStatus.dlqEntries[0]?.deadAt ? { lastErrorAt: queueStatus.dlqEntries[0].deadAt } : {}),
-        ...(queueStatus.dlqEntries[0]?.finalError ? { lastError: queueStatus.dlqEntries[0].finalError } : {}),
-        meta: {
-          attempts: queueStatus.metrics.totalAttempts,
-          retrying: queueStatus.metrics.retrying,
-          deadLetters: queueStatus.metrics.deadLettered,
-          dlqSize: queueStatus.metrics.dlqSize,
-          sloEnforced: queueStatus.sloEnforced,
-        },
-      }, 'bootstrap.notifier');
-    }
-  }
+  syncNotifierQueueIntegrations(notifier, runtimeBus, domainDispatch);
 
   await syncConfiguredServices(domainDispatch.syncIntegration, services.serviceRegistry);
 
   const permissionManager = new PermissionManager(
-    (request) => approvalBroker.requestApproval({
-      request,
-      sessionId: runtimeSessionIdRef.value,
-      localPrompt: permissionPromptRef.requestPermission,
-    }),
+    // Composed ask layer: the workspace trust gate (outer) wraps the sandbox-aware
+    // exec gate (inner); see sandbox-exec-gate.ts. The catastrophic block is untouched.
+    trustGatedAsk(
+      services.workspaceTrustManager,
+      createSandboxExecAsk(
+        sandboxExecAskDepsFromRuntime(configManager, featureFlags),
+        (request) => approvalBroker.requestApproval({
+          request,
+          sessionId: runtimeSessionIdRef.value,
+          localPrompt: permissionPromptRef.requestPermission,
+        }),
+      ),
+    ),
     createPermissionConfigReader(configManager),
     policyRuntimeState,
     services.hookDispatcher,
@@ -728,6 +725,9 @@ export async function initializeBootstrapCore(
     sessionId: userSessionId,
   };
   runtimeSessionIdRef.value = runtime.sessionId;
+  // Register the live conversation so the composed daemon's rewind.plan/apply verbs
+  // can serve conversation scope for this session (see conversation-rewind-port.ts).
+  registerSessionConversation(runtime.sessionId, conversation);
   void sharedSessionBroker.createSession({
     id: runtime.sessionId,
     title: 'Terminal UI session',

package/src/runtime/bootstrap-notifier-sync.ts

@@ -0,0 +1,41 @@
+import type { Notifier } from '@pellux/goodvibes-sdk/platform/integrations';
+import type { RuntimeEventBus } from '@/runtime/index.ts';
+import type { createDomainDispatch } from './store/index.ts';
+
+type DomainDispatch = ReturnType<typeof createDomainDispatch>;
+
+/**
+ * Reflect the notifier's outbound delivery queues into the integrations domain
+ * (so the UI shows per-channel health) and attach the notifier to the runtime
+ * bus when any queue exists. Extracted from bootstrap-core to keep that file
+ * within the module size budget.
+ */
+export function syncNotifierQueueIntegrations(
+  notifier: Notifier,
+  runtimeBus: RuntimeEventBus,
+  domainDispatch: DomainDispatch,
+): void {
+  const queueStatuses = notifier.getQueueStatus();
+  if (queueStatuses.length === 0) return;
+  notifier.attachToRuntimeBus(runtimeBus);
+  for (const queueStatus of queueStatuses) {
+    domainDispatch.syncIntegration({
+      id: queueStatus.channel,
+      displayName: queueStatus.channel[0]!.toUpperCase() + queueStatus.channel.slice(1),
+      category: 'communication',
+      status: queueStatus.metrics.deadLettered > 0 ? 'degraded' : 'healthy',
+      enabled: true,
+      successCount: queueStatus.metrics.delivered,
+      errorCount: queueStatus.metrics.deadLettered,
+      ...(queueStatus.dlqEntries[0]?.deadAt ? { lastErrorAt: queueStatus.dlqEntries[0].deadAt } : {}),
+      ...(queueStatus.dlqEntries[0]?.finalError ? { lastError: queueStatus.dlqEntries[0].finalError } : {}),
+      meta: {
+        attempts: queueStatus.metrics.totalAttempts,
+        retrying: queueStatus.metrics.retrying,
+        deadLetters: queueStatus.metrics.deadLettered,
+        dlqSize: queueStatus.metrics.dlqSize,
+        sloEnforced: queueStatus.sloEnforced,
+      },
+    }, 'bootstrap.notifier');
+  }
+}

package/src/runtime/bootstrap-shell.ts

@@ -17,6 +17,7 @@ import { GitStatusProvider } from '../renderer/git-status.ts';
 import type { GitHeaderInfo } from '../renderer/git-status.ts';
 import type { PermissionRequestHandler } from '@pellux/goodvibes-sdk/platform/permissions';
 import { registerBuiltinPanels } from '../panels/builtin-panels.ts';
+import { WorkspaceRegistrationManager } from './trust/workspace-registration.ts';
 import { createSystemMessageRouter, type SystemMessageRouter } from '../core/system-message-router.ts';
 import { getConfigSnapshot } from '../config/index.ts';
 import { createBootstrapCommandContext } from './bootstrap-command-context.ts';
@@ -259,6 +260,12 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     planRuntime,
     fileUndoManager: services.fileUndoManager,
     workspaceCheckpointManager: services.workspaceCheckpointManager,
+    gatewayMethods: services.gatewayMethods,
+    workspaceTrustManager: services.workspaceTrustManager,
+    // Registration half is stateless (reads the shared registry on demand), so
+    // it is constructed here for the command context rather than threaded through
+    // RuntimeServices — no early-load requirement like the trust gate has.
+    workspaceRegistrationManager: new WorkspaceRegistrationManager({ shellPaths: services.shellPaths }),
     memoryRegistry: services.memoryRegistry,
     integrationHelpers: services.integrationHelpers,
     automationManager: services.automationManager,
@@ -291,6 +298,7 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     codeIndexStore: services.codeIndexStore,
     codeIndexReindexScheduler: services.codeIndexReindexScheduler,
     isPassiveCodeInjectionFlagEnabled: () => services.featureFlags.isEnabled('agent-passive-code-injection'),
+    featureFlagManager: services.featureFlags,
     // Expose the MAIN session's per-turn passive-injection ring
     // so `/recall injections` (no agent id) renders it — see recall-review.ts.
     getMainSessionTurnInjections: () => orchestrator.getTurnInjections(),