@pellux/goodvibes-tui 1.13.1 → 1.14.0

package/src/runtime/onboarding/fast-path.ts

@@ -0,0 +1,93 @@
+/**
+ * fast-path.ts — minimum-steps first run.
+ *
+ * The full onboarding wizard is comprehensive but long (5+ steps for a brand
+ * new user). The fast path gets a new user to a working session in the fewest
+ * possible steps:
+ *   - If a provider API key is already configured (env / secrets), skip
+ *     onboarding entirely — write the check marker and drop straight into a
+ *     working session. ZERO steps.
+ *   - Otherwise ask exactly one question: start now on the free default model,
+ *     or run the full guided setup. Dismissing (Esc) starts now — so it is
+ *     always skippable.
+ *
+ * The full wizard remains one keystroke away (the "Full guided setup" choice,
+ * or `/onboarding` at any time). If the command context can't answer whether a
+ * provider is configured (e.g. a headless/test surface), we fall back to the
+ * classic behavior of opening the wizard, so nothing regresses.
+ */
+import type { CommandContext } from '../../input/command-registry.ts';
+import type { SelectionItem } from '../../input/selection-modal.ts';
+import { writeOnboardingCheckMarker } from './markers.ts';
+import type { WriteOnboardingCheckMarkerOptions } from './types.ts';
+
+type OnboardingMarkerShellPaths = Parameters<typeof writeOnboardingCheckMarker>[0];
+
+export interface OnboardingFastPathDeps {
+  readonly input: { openOnboardingWizard: (options: { mode: 'new'; reset: boolean }) => void };
+  readonly commandContext: CommandContext;
+  readonly shellPaths: OnboardingMarkerShellPaths;
+  readonly render: () => void;
+}
+
+/** Read configured provider ids defensively — returns [] if the surface can't answer. */
+function readConfiguredProviderIds(commandContext: CommandContext): string[] | null {
+  const registry = commandContext.provider?.providerRegistry;
+  if (!registry || typeof registry.getConfiguredProviderIds !== 'function') return null;
+  try {
+    return registry.getConfiguredProviderIds();
+  } catch {
+    return null;
+  }
+}
+
+const MARKER_OPTIONS: WriteOnboardingCheckMarkerOptions = { source: 'command' };
+
+/**
+ * Run the fast-path first-run flow. Returns nothing; side effects (wizard open,
+ * marker write, modal) happen through the injected deps.
+ */
+export function startOnboardingFastPath(deps: OnboardingFastPathDeps): void {
+  const { input, commandContext, shellPaths, render } = deps;
+  const openWizard = (): void => input.openOnboardingWizard({ mode: 'new', reset: true });
+
+  const configured = readConfiguredProviderIds(commandContext);
+  // Fall back to the classic wizard if we can't detect providers or can't prompt.
+  if (configured === null || !commandContext.openSelection) {
+    openWizard();
+    return;
+  }
+
+  if (configured.length > 0) {
+    // A provider key already exists — nothing to ask. Straight to a working session.
+    writeOnboardingCheckMarker(shellPaths, MARKER_OPTIONS);
+    commandContext.print?.(
+      `Ready — provider configured (${configured.join(', ')}). Run /onboarding anytime for full setup.`,
+    );
+    render();
+    return;
+  }
+
+  const items: SelectionItem[] = [
+    { id: 'start-now', label: 'Start now', detail: 'Use the free default model — no API key needed', primaryAction: 'select' },
+    { id: 'full-setup', label: 'Full guided setup', detail: 'Choose provider, model, channels, and more', primaryAction: 'select' },
+  ];
+  commandContext.openSelection(
+    'Welcome to GoodVibes — get started',
+    items,
+    { allowSearch: false, primaryVerbLabel: 'Choose' },
+    (result) => {
+      if (result?.item.id === 'full-setup') {
+        openWizard();
+        return;
+      }
+      // Start now (or dismissed): mark first-run done and drop into a working
+      // session on the free default model.
+      writeOnboardingCheckMarker(shellPaths, MARKER_OPTIONS);
+      commandContext.print?.(
+        'You\'re on the free default model. Add a provider key anytime with /provider, or run /onboarding for full setup.',
+      );
+      render();
+    },
+  );
+}

package/src/runtime/process-lifecycle.ts

@@ -19,6 +19,7 @@
  * `unsubs` registry is shared by reference and drained on exit.
  */
 import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { createTerminalLifecycle, TERMINAL_ESCAPES } from '@pellux/goodvibes-terminal-shell';
 import { formatUserFacingErrorLine } from '../core/format-user-error.ts';
 import { allowTerminalWrite } from './terminal-output-guard.ts';
 import { buildPersistedSessionContext, deleteRecoveryFile } from '@/runtime/index.ts';
@@ -129,30 +130,37 @@ export function installProcessLifecycle(deps: ProcessLifecycleDeps): ProcessLife
     render();
   };
 
-  let terminalRestored = false;
+  // Terminal enter/restore sequencing is the byte-identical seam both daemon
+  // front-ends share, so it lives in @pellux/goodvibes-terminal-shell and this
+  // wiring delegates to it. Only the restore path is used here (the TUI's
+  // startup enter sequence stays in main.ts); the graceful shutdown below
+  // (draining services, persisting sessions, exit codes) is TUI-specific and
+  // stays local, calling restoreTerminal() for the synchronous hand-back.
+  //
+  // The injected `ansi` restore sequences are mapped onto the package's escape
+  // set so the exact bytes the TUI has always emitted are preserved. The no-alt
+  // exit deliberately uses the package's CLEAR_VIEWPORT_HOME ('\x1b[2J\x1b[H',
+  // no ESC[3J) — never ansi.CLEAR_SCREEN, which carries the scrollback-wiping 3J.
+  const terminalLifecycle = createTerminalLifecycle({
+    write: (data) => { stdout.write(data); },
+    noAltScreen,
+    guardedWrite: allowTerminalWrite,
+    disposeOutputGuard: () => getTerminalOutputGuard().dispose(),
+    setRawMode: (enabled) => stdin.setRawMode(enabled),
+    escapes: {
+      ...TERMINAL_ESCAPES,
+      ALT_SCREEN_EXIT: ansi.ALT_SCREEN_EXIT,
+      PASTE_DISABLE: ansi.PASTE_DISABLE,
+      KEYBOARD_EXT_DISABLE: ansi.KEYBOARD_EXT_DISABLE,
+      MOUSE_DISABLE: ansi.MOUSE_DISABLE,
+      CURSOR_SHOW: ansi.CURSOR_SHOW,
+      FOCUS_DISABLE: ansi.FOCUS_DISABLE,
+    },
+  });
   // Idempotent, synchronous-only terminal restore. Safe to call from process.on('exit'),
-  // signal handlers, uncaughtException, and exitApp. Disposes the output guard FIRST so a
-  // crash stack reaches the real stderr instead of being suppressed by the guard.
-  const restoreTerminal = (): void => {
-    if (terminalRestored) return;
-    terminalRestored = true;
-    // Alt-screen path: just leave the alt screen — 1049l restores the primary
-    // screen and cursor exactly as they were at launch. Clearing first is
-    // pointless (the alt screen is discarded) and actively harmful: the old
-    // CLEAR_SCREEN included ESC[3J, which wipes the PRIMARY scrollback on
-    // several emulators even when issued from the alt screen.
-    // No-alt path: the compositor painted over the primary screen, so clear
-    // the viewport and home the cursor — but WITHOUT 3J, the user's scrollback
-    // is theirs. CURSOR_SHOW goes AFTER the screen switch so visibility
-    // applies to the screen the shell prompt lands on.
-    const exitScreen = noAltScreen ? '\x1b[2J\x1b[H' : ansi.ALT_SCREEN_EXIT;
-    allowTerminalWrite(() => stdout.write(
-      ansi.PASTE_DISABLE + ansi.KEYBOARD_EXT_DISABLE + ansi.MOUSE_DISABLE + ansi.FOCUS_DISABLE
-      + exitScreen + ansi.CURSOR_SHOW,
-    ));
-    getTerminalOutputGuard().dispose();
-    try { stdin.setRawMode(false); } catch { /* stdin may not be a TTY */ }
-  };
+  // signal handlers, uncaughtException, and exitApp. Disposes the output guard AFTER the
+  // restore write so a crash stack reaches the real stderr instead of being suppressed.
+  const restoreTerminal = terminalLifecycle.restoreTerminal;
 
   const uncaughtExceptionHandler = (err: Error): void => {
     restoreTerminal();
@@ -220,7 +228,7 @@ export function installProcessLifecycle(deps: ProcessLifecycleDeps): ProcessLife
   return {
     exitApp,
     restoreTerminal,
-    isTerminalRestored: () => terminalRestored,
+    isTerminalRestored: terminalLifecycle.isTerminalRestored,
     resizeHandler,
     sigintHandler,
     unhandledRejectionHandler,

package/src/runtime/relay-reachability-bridge.ts

@@ -0,0 +1,53 @@
+/**
+ * relay-reachability-bridge.ts — reads the LIVE outbound-relay reachability
+ * state off the running embedded/standalone DaemonServer.
+ *
+ * The SDK's `DaemonServer` composes and owns a `RelayReachability` controller
+ * internally (gated by `relay.enabled` + the `relay-connect` feature flag) and
+ * exposes it via `getRelayReachability(): RelayReachability | null` — but that
+ * accessor is not on the narrow `DaemonService` interface `HostServicesHandle`
+ * types its `daemonServer` field with (see
+ * `@pellux/goodvibes-sdk/platform/runtime/bootstrap-services`), so the field
+ * needs a defensive structural check before use — same pattern
+ * `waitForConfigDrivenRestarts` in bootstrap.ts already uses for
+ * `waitForRestart`. `platform/relay` itself has no public export subpath
+ * (daemon-internal), so the RelayReachability shape is described locally as a
+ * minimal structural type rather than imported by name.
+ */
+
+import type { RelayRegistrationStatus } from '@pellux/goodvibes-daemon-sdk';
+import { encodeRelayPairingString, type RelayPairingPayload } from '@pellux/goodvibes-transport-core/relay';
+
+/** Structural subset of the SDK's `RelayReachability` this bridge needs. */
+interface RelayReachabilityLike {
+  readonly status: RelayRegistrationStatus | 'disabled';
+  mintPairing(): Promise<RelayPairingPayload | null>;
+}
+
+/** Structural subset of a live daemon that may expose relay reachability. */
+interface RelayCapableDaemonService {
+  getRelayReachability?(): RelayReachabilityLike | null;
+}
+
+function getRelay(daemonServer: unknown): RelayReachabilityLike | null {
+  const candidate = daemonServer as RelayCapableDaemonService | null;
+  if (!candidate || typeof candidate.getRelayReachability !== 'function') return null;
+  return candidate.getRelayReachability() ?? null;
+}
+
+/** Two live-relay accessors, spread into `externalServices` from bootstrap.ts. */
+export function buildRelayExternalServiceMethods(getDaemonServer: () => unknown): {
+  relayStatus(): RelayRegistrationStatus | 'disabled';
+  mintRelayPairing(): Promise<{ readonly payload: RelayPairingPayload; readonly encoded: string } | null>;
+} {
+  return {
+    relayStatus: () => getRelay(getDaemonServer())?.status ?? 'disabled',
+    mintRelayPairing: async () => {
+      const relay = getRelay(getDaemonServer());
+      if (!relay) return null;
+      const payload = await relay.mintPairing();
+      if (!payload) return null;
+      return { payload, encoded: encodeRelayPairingString(payload) };
+    },
+  };
+}

package/src/runtime/release-artifacts.ts

@@ -0,0 +1,79 @@
+/**
+ * Shared release-artifact naming and checksum-verification logic.
+ *
+ * This is the one place that knows the release asset naming convention
+ * (`goodvibes[-daemon]-{platform}-{arch}`) and how to verify a downloaded
+ * artifact against SHA256SUMS.txt. Two callers share it and must stay in
+ * lockstep:
+ *   - scripts/postinstall.js (npm install-time binary download)
+ *   - src/input/commands/update-runtime.ts (the /update command's self-update)
+ *
+ * A downloaded artifact with NO entry in the checksum manifest is just as
+ * unverified as one with a mismatching entry — verifyChecksum() throws in
+ * both cases, never silently skips.
+ */
+import { createHash } from 'node:crypto';
+
+export const CHECKSUM_MANIFEST_NAME = 'SHA256SUMS.txt';
+
+export type SupportedPlatform = 'linux' | 'darwin';
+export type SupportedArch = 'x64' | 'arm64';
+
+export interface ReleaseArtifactNames {
+  readonly app: string;
+  readonly daemon: string;
+}
+
+/** Release-asset platform tag as used in artifact filenames ("linux" | "macos"). */
+const PLATFORM_TAGS: Record<SupportedPlatform, string> = {
+  linux: 'linux',
+  darwin: 'macos',
+};
+
+export function resolveArtifactNames(platform: string, arch: string): ReleaseArtifactNames | null {
+  const platformTag = PLATFORM_TAGS[platform as SupportedPlatform];
+  if (!platformTag || (arch !== 'x64' && arch !== 'arm64')) {
+    return null;
+  }
+  const suffix = `${platformTag}-${arch}`;
+  return {
+    app: `goodvibes-${suffix}`,
+    daemon: `goodvibes-daemon-${suffix}`,
+  };
+}
+
+export function sha256(buffer: Buffer | Uint8Array): string {
+  return createHash('sha256').update(buffer).digest('hex');
+}
+
+export function parseChecksumFile(contents: string): Map<string, string> {
+  const checksums = new Map<string, string>();
+  for (const rawLine of contents.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line) continue;
+    const match = line.match(/^([a-f0-9]{64})\s+\*?(.+)$/i);
+    if (!match) continue;
+    checksums.set(match[2], match[1].toLowerCase());
+  }
+  return checksums;
+}
+
+/**
+ * Verify a downloaded artifact's checksum against the parsed manifest.
+ * An artifact with no entry in the manifest is a hard failure, identical
+ * in severity to a mismatching entry — never treated as "unverifiable, so
+ * skip the check". Throws naming the artifact and the manifest.
+ */
+export function verifyChecksum(
+  artifactName: string,
+  actual: string,
+  expected: string | undefined,
+  manifestName: string = CHECKSUM_MANIFEST_NAME,
+): void {
+  if (expected === undefined) {
+    throw new Error(`no checksum entry for ${artifactName} in ${manifestName} — refusing to install an unverified binary`);
+  }
+  if (expected !== actual) {
+    throw new Error(`checksum mismatch for ${artifactName}: expected ${expected}, got ${actual}`);
+  }
+}

package/src/runtime/services.ts

@@ -5,7 +5,8 @@ import { SecretsManager } from '../config/secrets.ts';
 import { AutomationDeliveryManager, AutomationManager, AutomationRouteStore } from '@pellux/goodvibes-sdk/platform/automation';
 import { ChannelDeliveryRouter, ChannelPluginRegistry, ChannelPolicyManager, RouteBindingManager, SurfaceRegistry } from '@pellux/goodvibes-sdk/platform/channels';
 import { ApprovalBroker, GatewayMethodCatalog, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
-import { attachWsOnlyGatewayVerbHandlers, createArchivableFleetRegistry } from './gateway-verbs.ts';
+import { StepUpService } from '@pellux/goodvibes-sdk/daemon';
+import { attachWsOnlyGatewayVerbHandlers, createArchivableFleetRegistry } from '@pellux/goodvibes-terminal-shell';
 import { WatcherRegistry } from '@pellux/goodvibes-sdk/platform/watchers';
 import { ArtifactStore } from '@pellux/goodvibes-sdk/platform/artifacts';
 import {
@@ -23,16 +24,19 @@ import {
 import { MediaProviderRegistry, ensureBuiltinMediaProviders } from '@pellux/goodvibes-sdk/platform/media';
 import { MultimodalService } from '@pellux/goodvibes-sdk/platform/multimodal';
 import { AgentMessageBus, AgentOrchestrator, ArchetypeLoader, WrfcController } from '@pellux/goodvibes-sdk/platform/agents';
-import { AgentManager, OverflowHandler, ProcessManager, createWorkflowServices, type WorkflowServices } from '@pellux/goodvibes-sdk/platform/tools';
+import { AgentManager, ContextAccountingHolder, OverflowHandler, ProcessManager, createWorkflowServices, type WorkflowServices } from '@pellux/goodvibes-sdk/platform/tools';
 import { FileStateCache, FileUndoManager, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, resolveCanonicalMemoryDbPath, type CodeIndexStore, type CodeIndexReindexScheduler } from '@pellux/goodvibes-sdk/platform/state';
 import { MemorySpineClient, createLocalMemoryAccess } from '@pellux/goodvibes-sdk/platform/runtime/memory-spine';
 import { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
-import type { RuntimeEventBus } from '@/runtime/index.ts';
+import { createWorkspaceCheckpointing } from './workspace-checkpointing.ts';
+import { createSessionConversationRewindPort } from './conversation-rewind-port.ts';
 import { createDomainDispatch } from './store/index.ts';
 import type { DomainDispatch, RuntimeStore } from './store/index.ts';
-import { DistributedRuntimeManager } from '@/runtime/index.ts';
-import { RemoteRunnerRegistry, RemoteSupervisor } from '@/runtime/index.ts';
-import { IntegrationHelperService } from '@/runtime/index.ts';
+import {
+  type RuntimeEventBus, DistributedRuntimeManager, RemoteRunnerRegistry, RemoteSupervisor, IntegrationHelperService,
+  IdempotencyStore, ComponentHealthMonitor, WorktreeRegistry, SandboxSessionRegistry, createShellPathService,
+  type ShellPathService, type FeatureFlagManager, createFeatureFlagManager, PolicyRuntimeState,
+} from '@/runtime/index.ts';
 import { VoiceProviderRegistry, VoiceService, ensureBuiltinVoiceProviders } from '@pellux/goodvibes-sdk/platform/voice';
 import { WebSearchProviderRegistry, WebSearchService } from '@pellux/goodvibes-sdk/platform/web-search';
 import { PanelManager } from '../panels/panel-manager.ts';
@@ -48,18 +52,11 @@ import { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
 import { BenchmarkStore, CacheHitTracker, FavoritesStore, inferFallbackContextWindow, type ModelDefinition, ModelLimitsService, ProviderCapabilityRegistry, ProviderOptimizer, ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
 import { KeybindingsManager } from '../input/keybindings.ts';
 import { AdaptivePlanner, DeterministicReplayEngine, ExecutionPlanManager, SessionLineageTracker, SessionMemoryStore } from '@pellux/goodvibes-sdk/platform/core';
-import { IdempotencyStore } from '@/runtime/index.ts';
-import { ComponentHealthMonitor } from '@/runtime/index.ts';
-import { WorktreeRegistry } from '@/runtime/index.ts';
-import { SandboxSessionRegistry } from '@/runtime/index.ts';
-import { createShellPathService, type ShellPathService } from '@/runtime/index.ts';
 import { isFeatureFlagEnabled } from './surface-feature-flags.ts';
-import type { FeatureFlagManager } from '@/runtime/index.ts';
-import { createFeatureFlagManager } from '@/runtime/index.ts';
-import { PolicyRuntimeState } from '@/runtime/index.ts';
 import { type ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
 import { calcSessionCost, isModelPriced } from '../export/cost-utils.ts';
 import { createWorkstreamServices, type OrchestrationEngine, type WorkstreamCommandService } from './workstream-services.ts';
+import { wireFleetNeedsInputPush } from './fleet-needs-input-push.ts';
 import { codeIndexDbPath, createCodeIndexServices, isCodeInjectionSettingEnabled } from './code-index-services.ts';
 import { WorkPlanStore } from '../work-plans/work-plan-store.ts';
 import {
@@ -75,6 +72,7 @@ import { registerDraftMethods } from '../daemon/handlers/drafts/index.ts';
 import { registerCalendar } from '../daemon/handlers/calendar/index.ts';
 import { registerEmailMethods } from '../daemon/handlers/email/index.ts';
 import { registerRemoteSurface } from '../daemon/handlers/remote/index.ts';
+import { WorkspaceTrustManager } from './trust/workspace-trust.ts';
 
 const REGULAR_KNOWLEDGE_DB_FILE = 'knowledge-wiki.sqlite';
 const HOME_GRAPH_KNOWLEDGE_DB_FILE = 'knowledge-home-graph.sqlite';
@@ -136,6 +134,8 @@ export interface RuntimeServicesOptions {
   readonly getConversationTitle?: () => string | undefined;
   readonly workingDir: string;
   readonly homeDirectory: string;
+  /** Prior GoodVibes runtime state existed at startup — sampled before any write; seeds the trust gate's grandfathering. */
+  readonly workspaceHadPriorState?: boolean;
 }
 
 export interface RuntimeServices {
@@ -172,6 +172,7 @@ export interface RuntimeServices {
   readonly memorySpine: MemorySpineClient;
   readonly serviceRegistry: ServiceRegistry;
   readonly secretsManager: SecretsManager;
+  readonly stepUpService: StepUpService;
   readonly subscriptionManager: SubscriptionManager;
   readonly localUserAuthManager: UserAuthManager;
   readonly profileManager: ProfileManager;
@@ -224,6 +225,7 @@ export interface RuntimeServices {
   readonly agentManager: AgentManager;
   readonly agentMessageBus: AgentMessageBus;
   readonly agentOrchestrator: AgentOrchestrator;
+  readonly contextAccountingHolder: ContextAccountingHolder; // bound at bootstrap.ts; see context-accounting-source.ts
   readonly wrfcController: WrfcController;
   readonly processManager: ProcessManager;
   /** The phase/work-item orchestration engine — see runtime/workstream-services.ts. */
@@ -237,6 +239,8 @@ export interface RuntimeServices {
   readonly modeManager: ModeManager;
   readonly fileUndoManager: FileUndoManager;
   readonly workspaceCheckpointManager: WorkspaceCheckpointManager;
+  /** Per-workspace trust gate — restricts write/execute/delegate tools until the workspace is trusted. */
+  readonly workspaceTrustManager: WorkspaceTrustManager;
   readonly integrationHelpers: IntegrationHelperService;
   /** Re-root path-bound stores (MemoryStore, ProjectIndex) to a new working directory, called by WorkspaceSwapManager after verification; stores needing a process restart just warn-log and keep serving the old path until the daemon restarts with the new --working-dir. */
   rerootStores(newWorkingDir: string): Promise<void>;
@@ -249,6 +253,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     workingDirectory,
     homeDirectory,
   });
+  const workspaceTrustManager = new WorkspaceTrustManager({ shellPaths, hadPriorState: options.workspaceHadPriorState ?? false });
   const configManager = options.configManager;
   const featureFlags = options.featureFlags ?? createFeatureFlagManager();
   const runtimeDispatch = createDomainDispatch(options.runtimeStore);
@@ -273,9 +278,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     globalHome: homeDirectory,
     configManager,
   });
-  const subscriptionManager = new SubscriptionManager(
-    shellPaths.resolveUserPath('tui', 'subscriptions.json'),
-  );
+  // Step-up (WebAuthn) ceremony service, shared between the ceremony gateway verbs and the relay gate's verifier.
+  const stepUpService = new StepUpService({ secrets: secretsManager });
+  const subscriptionManager = new SubscriptionManager(shellPaths.resolveUserPath('tui', 'subscriptions.json'));
   const serviceRegistry = new ServiceRegistry(shellPaths.resolveProjectPath('tui', 'services.json'), {
     secretsManager,
     subscriptionManager,
@@ -337,6 +342,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     executor: agentOrchestrator,
     configManager,
   });
+  const contextAccountingHolder = new ContextAccountingHolder();
   agentOrchestrator.setConversationSink({ // Conversation-snapshot bridge (mirrors the SDK's own createRuntimeServices)
     register: (agentId, source) => agentManager.registerConversationSource(agentId, source),
     release: (agentId) => agentManager.releaseConversationSource(agentId),
@@ -629,23 +635,13 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   });
   const modeManager = new ModeManager();
   const fileUndoManager = new FileUndoManager();
-  const workspaceCheckpointManager = new WorkspaceCheckpointManager({
-    workspaceRoot: workingDirectory,
-    runtimeBus: options.runtimeBus,
-  });
-  // Fire-and-forget: subscriptions go live immediately if init() succeeds.
-  // If it rejects, WorkspaceCheckpointManager caches that rejection on
-  // `initPromise` and never clears it, so every later call (create/list/
-  // diff/restore — each awaits init() first) re-throws the same error
-  // forever: checkpointing becomes entirely unavailable for the rest of the
-  // session, not "degraded to manual-only". The `.catch(() => {})` here only
-  // exists to prevent an unhandled rejection at startup; the checkpoint
-  // commands (checkpoint-runtime.ts) are what actually catch and report the
-  // failure to the user, on first use.
-  void workspaceCheckpointManager.init().catch(() => {});
+  const workspaceCheckpointManager = createWorkspaceCheckpointing({ workspaceRoot: workingDirectory, runtimeBus: options.runtimeBus, configManager });
 
-  // ws-only verbs (fleet/checkpoints/search/push) 501 without this — see gateway-verbs.ts.
-  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, sessionBroker, secretsManager, approvalBroker, shellPaths });
+  // Shared terminal-shell wrapper over the SDK's registerGatewayVerbGroups (see gateway-verbs.ts): 501s the ws-only
+  // family without it. principals.*/channels.profiles.*/ci.* register unconditionally; checkin.* only with
+  // channelDeliveryRouter/providerRegistry/automationManager/sessionLister ALL present; fleet needs-input push gated by
+  // runtimeBus/sessionPresence (fleet-needs-input-push.ts). conversationRewindPort serves conversation-scope rewind live.
+  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
   const integrationHelpers = new IntegrationHelperService({
     workingDirectory,
     homeDirectory,
@@ -692,12 +688,14 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     overflowHandler,
     sandboxSessionRegistry,
     workflowServices: workflow,
+    contextAccountingHolder,
   });
 
   return {
     workingDirectory,
     homeDirectory,
     shellPaths,
+    workspaceTrustManager,
     configManager,
     featureFlags,
     runtimeBus: options.runtimeBus,
@@ -727,6 +725,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     memorySpine,
     serviceRegistry,
     secretsManager,
+    stepUpService,
     subscriptionManager,
     localUserAuthManager,
     profileManager,
@@ -778,6 +777,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     agentManager,
     agentMessageBus,
     agentOrchestrator,
+    contextAccountingHolder,
     wrfcController,
     processManager,
     orchestrationEngine,