@pellux/goodvibes-tui 1.13.1 → 1.15.0

package/src/input/feature-unit-layout.ts

@@ -0,0 +1,142 @@
+/**
+ * feature-unit-layout — turns the flat "44 flags in one bucket + their config
+ * keys scattered across namespace categories" layout into feature UNITS: each
+ * feature flag renders as a toggle header immediately followed by the config
+ * keys that tune it, hosted in the topical category its config lives under
+ * (sandbox with Runtime & Data, surfaces with Surfaces & Cloud, and so on).
+ *
+ * Grouping metadata is sourced entirely from the SDK's FEATURE_FLAG_CONFIG map
+ * (the single source of truth, completeness test-guarded SDK-side) so the three
+ * surfaces that present features — the settings modal, the onboarding wizard,
+ * and /flags — agree on which config keys belong to which flag.
+ *
+ * A flag whose FEATURE_FLAG_CONFIG entry has no config keys is hosted in the
+ * Advanced Features bucket as a simple toggle (genuinely internal / startup-gated
+ * plumbing flags with nothing to tune).
+ */
+
+import { FEATURE_FLAG_CONFIG, FEATURE_FLAGS } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import type { ConfigKey, ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+import type { FeatureFlag } from '@/runtime/index.ts';
+import type { FlagEntry, SettingEntry, SettingsCategory } from './settings-modal-types.ts';
+
+/**
+ * The category that hosts flags with no tunable config keys. Repurposed from the
+ * old flat "Feature Flags" tab — it now holds only the internal/plumbing flags
+ * that have nothing to configure, as simple toggles.
+ */
+export const ADVANCED_FEATURES_CATEGORY: SettingsCategory = 'flags';
+
+/**
+ * Host category for a flag's feature unit: the single top-level namespace its
+ * config keys live under (verified single-namespace SDK-side), or the Advanced
+ * Features bucket when the flag has no config keys.
+ */
+export function getFeatureUnitHostCategory(flagId: string): SettingsCategory {
+  const assoc = FEATURE_FLAG_CONFIG[flagId];
+  const namespace = assoc?.configCategories[0];
+  return (namespace ?? ADVANCED_FEATURES_CATEGORY) as SettingsCategory;
+}
+
+/**
+ * Map every config key claimed by any flag to the flag that OWNS it — the first
+ * flag (in FEATURE_FLAGS declaration order) whose FEATURE_FLAG_CONFIG entry lists
+ * it. A key claimed by two flags (e.g. behavior.compactionStrategy, shared by
+ * session-compaction and compaction-distiller-strategy) is listed once, under its
+ * owner, so no config key double-lists across feature units.
+ */
+export function buildConfigKeyOwnership(): Map<string, string> {
+  const owner = new Map<string, string>();
+  for (const flag of FEATURE_FLAGS) {
+    const assoc = FEATURE_FLAG_CONFIG[flag.id];
+    if (!assoc) continue;
+    for (const key of assoc.configKeys) {
+      if (!owner.has(key)) owner.set(key, flag.id);
+    }
+  }
+  return owner;
+}
+
+/**
+ * Build the synthetic SettingEntry that is a feature unit's toggle header. Its
+ * key is `featureFlags.<id>` (the same override path persistFlagState writes), so
+ * it round-trips through the config layer; type boolean so the existing
+ * activate/adjust toggle paths drive it. currentValue mirrors the live runtime
+ * state; isDefault is true when the flag sits at its declared default state (so
+ * the "modified" marker shows only for an actual override). The attached
+ * `flag` marks the row as a feature-unit header for rendering and interaction.
+ */
+export function buildFlagHeaderEntry(entry: FlagEntry): SettingEntry {
+  const { flag, state } = entry;
+  const setting: ConfigSetting = {
+    key: `featureFlags.${flag.id}` as ConfigKey,
+    type: 'boolean',
+    default: flag.defaultState === 'enabled',
+    description: flag.description,
+  };
+  return {
+    setting,
+    currentValue: state === 'enabled',
+    isDefault: state === flag.defaultState,
+    flag: entry,
+  };
+}
+
+/** Shallow-clone a config SettingEntry so a host-category copy can carry ownerFlagId without mutating a cross-listed original (e.g. the network combined view shares controlPlane/web entry objects). */
+function cloneOwnedEntry(entry: SettingEntry, ownerFlagId: string): SettingEntry {
+  return { ...entry, ownerFlagId };
+}
+
+/**
+ * Rewrite `groups` in place so each host category leads with its feature units
+ * (flag toggle header + its owned config sub-options, in FEATURE_FLAGS order),
+ * followed by the category's remaining un-owned config rows. The Advanced
+ * Features category is filled with the no-config flags as bare toggles.
+ *
+ * No-op when there are no flag entries (the flagless test path), leaving the
+ * plain namespace-bucketed layout intact.
+ */
+export function applyFeatureUnitLayout(
+  groups: Map<SettingsCategory, SettingEntry[]>,
+  flagEntries: readonly FlagEntry[],
+): void {
+  if (flagEntries.length === 0) return;
+  const owner = buildConfigKeyOwnership();
+  const flagState = new Map<string, FlagEntry>(flagEntries.map((entry) => [entry.flag.id, entry]));
+
+  // Group the flags this runtime actually registered by their host category,
+  // preserving FEATURE_FLAGS declaration order within each category.
+  const flagsByCategory = new Map<SettingsCategory, FeatureFlag[]>();
+  for (const flag of FEATURE_FLAGS) {
+    if (!flagState.has(flag.id)) continue; // not registered in this runtime
+    const category = getFeatureUnitHostCategory(flag.id);
+    if (!flagsByCategory.has(category)) flagsByCategory.set(category, []);
+    flagsByCategory.get(category)!.push(flag);
+  }
+
+  for (const [category, flags] of flagsByCategory) {
+    const existing = groups.get(category) ?? [];
+    // Split existing config rows into those owned by a feature unit hosted here
+    // and the remaining orphan rows. An owned row's owner is guaranteed to be a
+    // flag hosted in THIS category (owned keys share the flag's namespace).
+    const ownedByFlag = new Map<string, SettingEntry[]>();
+    const orphans: SettingEntry[] = [];
+    for (const entry of existing) {
+      const ownerId = owner.get(entry.setting.key);
+      if (ownerId !== undefined && flagState.has(ownerId)) {
+        if (!ownedByFlag.has(ownerId)) ownedByFlag.set(ownerId, []);
+        ownedByFlag.get(ownerId)!.push(cloneOwnedEntry(entry, ownerId));
+      } else {
+        orphans.push(entry);
+      }
+    }
+
+    const rebuilt: SettingEntry[] = [];
+    for (const flag of flags) {
+      rebuilt.push(buildFlagHeaderEntry(flagState.get(flag.id)!));
+      for (const sub of ownedByFlag.get(flag.id) ?? []) rebuilt.push(sub);
+    }
+    rebuilt.push(...orphans);
+    groups.set(category, rebuilt);
+  }
+}

package/src/input/feed-context-factory.ts

@@ -139,6 +139,8 @@ export interface FeedContextStableRefs {
 export interface FeedContextClosures {
   modalOpened: (name: string) => void;
   handleEscape: () => void;
+  /** Deliver a concealed submission; returns true when concealed mode consumed it. */
+  submitConcealedInput: (value: string) => boolean;
   handleCopy: () => void;
   handleCtrlC: () => void;
   handleBlockCopy: () => void;

package/src/input/handler-feed-routes.ts

@@ -327,6 +327,13 @@ export type KeyRouteState = {
   indicatorFocused: boolean;
   conversationManager: ConversationManager | null;
   commandContext: CommandContext | undefined;
+  /**
+   * Deliver a concealed submission. When it returns true, concealed mode was
+   * active and consumed the value — the plaintext went straight to the
+   * requester, bypassing input history and the transcript. Optional so bare
+   * test callers omit it.
+   */
+  submitConcealedInput?: (value: string) => boolean;
   /**
    * Optional: only used by the enter-key desync safety net below (a stray
    * slash-prefixed submission with commandMode somehow still false). When
@@ -411,6 +418,16 @@ export function handlePromptKeyToken(state: KeyRouteState, token: InputToken): {
       return { handled: true, prompt, cursorPos, inputScrollTop, commandMode, indicatorFocused };
     }
 
+    // Concealed input: the typed line is a secret. Deliver the plaintext (the
+    // live feed snapshot, not the possibly-stale handler buffer) to the
+    // concealed consumer, never to input history or the transcript, then clear.
+    if (state.submitConcealedInput?.(prompt)) {
+      prompt = '';
+      cursorPos = 0;
+      state.requestRender();
+      return { handled: true, prompt, cursorPos, inputScrollTop, commandMode, indicatorFocused };
+    }
+
     const text = prompt.trim();
     if (!text && !commandMode) {
       const lineIndex = 0;

package/src/input/handler-feed.ts

@@ -140,6 +140,8 @@ export interface InputFeedContext {
   requestRender: () => void;
   readonly modalOpened: (name: string) => void;
   readonly handleEscape: () => void;
+  /** Deliver a concealed submission; returns true when concealed mode consumed it. */
+  readonly submitConcealedInput: (value: string) => boolean;
   readonly handleCopy: () => void;
   readonly handleCtrlC: () => void;
   readonly handleBlockCopy: () => void;
@@ -472,6 +474,7 @@ export function feedInputTokens(context: InputFeedContext, tokens: readonly Inpu
         conversationManager: context.conversationManager,
         commandContext: context.commandContext,
         commandRegistry: context.commandRegistry,
+        submitConcealedInput: context.submitConcealedInput,
         autocomplete: context.autocomplete,
         blockActionsMenu: { open: (block: BlockMeta) => context.blockActionsMenu.open(block) },
         openFleetPanel,

package/src/input/handler-modal-routes.ts

@@ -384,8 +384,10 @@ export function handleSettingsModalToken(state: SettingsRouteState, token: Input
         state.settingsModal.activateSelected();
         consumeSettingsPickerRequest(state);
       } else if (focusPane === 'categories') state.settingsModal.focusSettings?.();
-      else if (state.settingsModal.currentCategory === 'flags') state.settingsModal.toggleSelectedFlag();
       else {
+        // Feature-unit toggle headers are boolean settings rows now, so
+        // activateSelected toggles them (via the flag-toggle chokepoint) the same
+        // way it edits/toggles any other setting — no flags-category special case.
         state.settingsModal.activateSelected();
         consumeSettingsPickerRequest(state);
       }
@@ -447,8 +449,9 @@ export function handleSettingsModalToken(state: SettingsRouteState, token: Input
     } else if (token.value === ' ' && !state.settingsModal.editingMode) {
       const focusPane = state.settingsModal.focusPane ?? 'settings';
       if (focusPane === 'categories') state.settingsModal.focusSettings?.();
-      else if (state.settingsModal.currentCategory === 'flags') state.settingsModal.toggleSelectedFlag();
       else {
+        // See the Enter/Space handler above: feature-unit headers toggle through
+        // activateSelected now, so no flags-category special case is needed.
         state.settingsModal.activateSelected();
         consumeSettingsPickerRequest(state);
       }

package/src/input/handler-shortcuts.ts

@@ -8,6 +8,7 @@ import type { PanelManager } from '../panels/panel-manager.ts';
 import type { KeybindingsManager } from './keybindings.ts';
 import type { KillRing } from './kill-ring.ts';
 import { wordBoundaryBack, wordBoundaryForward } from './kill-ring.ts';
+import { nextPermissionMode, permissionModeLabel, type PermissionModeValue } from '../core/permission-mode.ts';
 
 type WrappedPromptInfo = {
   wrappedLines: string[];
@@ -92,6 +93,19 @@ export function handleGlobalShortcutToken(
     return true;
   }
 
+  // Shift+Tab cycles the session permission mode (normal → accept-edits → plan
+  // → auto → normal), the settled convention. Handled here — hardcoded, like
+  // escape/f2 — because it is not in the keybinding table and bare Tab is
+  // already heavily overloaded. Arrives as the legacy xterm backtab literal
+  // ('\x1b[Z') OR, under a kitty/CSI-u terminal, as tab-with-shift. Only when
+  // the composer owns focus (a focused panel keeps its own Shift+Tab, e.g. the
+  // diff panel's previous-file); modal/picker routes run earlier and swallow
+  // the token before it reaches here, so overlays keep their reverse-tab too.
+  if (!state.panelFocused && (token.logicalName === '\x1b[Z' || (token.logicalName === 'tab' && token.shift))) {
+    cycleSessionPermissionMode(state);
+    return true;
+  }
+
   // O(1) lookup via inverted map.
   const kb = state.keybindingsManager;
   const action = kb.lookup(token);
@@ -143,6 +157,11 @@ export function handleGlobalShortcutToken(
       return true;
     }
 
+    case 'command-palette':
+      state.commandContext?.openCommandPalette?.();
+      state.requestRender();
+      return true;
+
     case 'panel-picker':
       state.commandContext?.openPanelPicker?.();
       state.panelFocused = state.panelManager.isVisible() && state.panelManager.getAllOpen().length > 0;
@@ -394,6 +413,24 @@ export function handleGlobalShortcutToken(
  * the mocked PanelManager test doubles in global-shortcuts.test.ts actually
  * implement.
  */
+/**
+ * Cycle the session permission mode (Shift+Tab). The change goes through the
+ * SDK config surface — configManager.set('permissions.mode', ...) — which is
+ * what the SDK PermissionManager reads and what the orchestrator consults for
+ * its standing plan-mode instruction, so every attached surface converges on
+ * the same mode. The footer pill re-renders off the config-key subscription
+ * wired in turn-event-wiring; the printed line narrates the change inline.
+ */
+function cycleSessionPermissionMode(state: GlobalShortcutRouteState): void {
+  const configManager = state.commandContext?.platform?.configManager;
+  if (!configManager) return;
+  const current = configManager.get('permissions.mode') as PermissionModeValue | undefined;
+  const next = nextPermissionMode(current);
+  configManager.set('permissions.mode', next);
+  state.commandContext?.print(`[Permissions] Mode: ${permissionModeLabel(next)}`);
+  state.requestRender();
+}
+
 function toggleFleetPanel(state: GlobalShortcutRouteState): void {
   const pm = state.panelManager;
   const fleetOpen = pm.getAllOpen().some((p) => p.id === 'fleet');

package/src/input/handler.ts

@@ -81,6 +81,7 @@ import {
   type WrappedPromptInfo,
 } from './handler-prompt-buffer.ts';
 import { KillRing } from './kill-ring.ts';
+import { maskConcealedText, beginConcealedInputFor, submitConcealedInputFor, cancelConcealedInputFor, type ConcealedInputRequest } from './concealed-input.ts';
 import { clearModalStack, handleEscape, modalOpened } from './handler-modal-stack.ts';
 import { handleModalTokenRoutes } from './handler-modal-token-routes.ts';
 import {
@@ -128,6 +129,13 @@ export class InputHandler implements InputHandlerLike {
   public prompt = '';
   public cursorPos = 0;
   public showExitNotice = false;
+  /**
+   * Active concealed-input request, or null. When set, the composer masks its
+   * echo (see getWrappedPromptInfo) and diverts submission to the request's
+   * onSubmit (see submitConcealedInput) instead of the normal chat/command path,
+   * so the plaintext never reaches input history or the transcript.
+   */
+  public concealedInput: ConcealedInputRequest | null = null;
   /** Max visible rows for the input area. Content beyond this scrolls internally. */
   public static readonly MAX_INPUT_ROWS = 8;
   /** Internal scroll offset for the input area when content exceeds MAX_INPUT_ROWS. */
@@ -331,7 +339,8 @@ export class InputHandler implements InputHandlerLike {
       },
       {
         modalOpened: (name: string) => this.modalOpened(name),
-        handleEscape: () => { this.handleEscape(); this.syncFeedContextMutableFields(); },
+        handleEscape: () => { if (!this.cancelConcealedInput()) this.handleEscape(); this.syncFeedContextMutableFields(); },
+        submitConcealedInput: (value: string) => this.submitConcealedInput(value),
         handleCopy: () => this.handleCopy(),
         handleCtrlC: () => { this.handleCtrlC(); this.syncFeedContextMutableFields(); },
         handleBlockCopy: () => this.handleBlockCopy(),
@@ -637,8 +646,12 @@ export class InputHandler implements InputHandlerLike {
    * and the visible slice respecting inputScrollTop.
    */
   public getWrappedPromptInfo(contentWidth: number): WrappedPromptInfo {
+    // In concealed mode, wrap the MASKED buffer. maskConcealedText preserves
+    // length and newlines, so wrapping and cursor coordinates are identical to
+    // the plaintext while no plaintext character reaches the screen buffer.
+    const displayPrompt = this.concealedInput ? maskConcealedText(this.prompt) : this.prompt;
     return getWrappedPromptInfo(
-      this.prompt,
+      displayPrompt,
       this.cursorPos,
       this.inputScrollTop,
       contentWidth,
@@ -646,6 +659,15 @@ export class InputHandler implements InputHandlerLike {
     );
   }
 
+  /** Begin one line of concealed (masked) composer input. See concealed-input.ts. */
+  public beginConcealedInput(request: ConcealedInputRequest): void { beginConcealedInputFor(this, request); }
+  /** True while a concealed-input request is active. */
+  public isConcealedInput(): boolean { return this.concealedInput !== null; }
+  /** Deliver a concealed submission; returns true when concealed mode consumed it. */
+  public submitConcealedInput(value: string): boolean { return submitConcealedInputFor(this, value); }
+  /** Cancel an active concealed-input request without submitting (Escape). */
+  public cancelConcealedInput(): boolean { return cancelConcealedInputFor(this); }
+
   // ── Undo / Redo methods ─────────────────────────────────────────────────
 
   /**

package/src/input/keybindings.ts

@@ -33,6 +33,7 @@ export type KeyAction =
   | 'copy-selection'
   | 'clear-cancel'
   | 'screen-clear'
+  | 'command-palette'
   | 'panel-picker'
   | 'panel-close'
   | 'panel-close-all'
@@ -74,6 +75,7 @@ export const ACTION_DESCRIPTIONS: Record<KeyAction, string> = {
   'copy-selection':        'Copy selected text to clipboard',
   'clear-cancel':          'Clear input / cancel generation / exit (double)',
   'screen-clear':          'Repaint the screen',
+  'command-palette':       'Open the command palette (search & run any command)',
   'panel-picker':          'Open, focus, or hide the panel workspace',
   'panel-close':            'Close the currently active panel',
   'panel-close-all':         'Close all open panels',
@@ -116,6 +118,10 @@ export const DEFAULT_KEYBINDINGS: Record<KeyAction, KeyCombo[]> = {
   'copy-selection':        [{ key: 'c', ctrl: true, shift: true }],
   'clear-cancel':          [{ key: 'c', ctrl: true }],
   'screen-clear':          [{ key: 'l', ctrl: true }],
+  // Ctrl+K opens the command palette (the standard palette chord across editors).
+  // The readline kill-to-end-of-line that historically owned Ctrl+K is repointed
+  // to Alt+K below so the capability is kept, not lost.
+  'command-palette':       [{ key: 'k', ctrl: true }],
   'panel-picker':          [{ key: 'p', ctrl: true }],
   'panel-close':            [{ key: 'x', ctrl: true }],
   'panel-close-all':         [{ key: 'x', ctrl: true, shift: true }],
@@ -157,7 +163,10 @@ export const DEFAULT_KEYBINDINGS: Record<KeyAction, KeyCombo[]> = {
   'delete-word':           [{ key: 'w', ctrl: true }],
   'apply-diff-line-start': [{ key: 'a', ctrl: true }],
   'next-error-line-end':   [{ key: 'e', ctrl: true }],
-  'kill-line':             [{ key: 'k', ctrl: true }],
+  // Alt+K: kill to end of line. Ctrl+K was reassigned to the command palette
+  // (the standard palette chord); Alt+K keeps kill-to-end available and is
+  // otherwise unused in the default table.
+  'kill-line':             [{ key: 'k', alt: true }],
   // Alt+U: clear entire prompt. Ctrl+U is owned by kill-to-start (readline
   // convention). Alt+U is unused by any other default and is representable by
   // the tokenizer's { key, alt } combo form.
@@ -169,7 +178,7 @@ export const DEFAULT_KEYBINDINGS: Record<KeyAction, KeyCombo[]> = {
   'word-back':             [{ key: 'b', alt: true }],
   'word-forward':          [{ key: 'f', alt: true }],
   // Kill-ring operations.
-  // Note: 'kill-line' (Ctrl+K) kills to end; 'kill-to-start' (Ctrl+U) kills to start.
+  // Note: 'kill-line' (Alt+K) kills to end; 'kill-to-start' (Ctrl+U) kills to start.
   // 'clear-prompt' (Alt+U) clears the entire buffer regardless of cursor position.
   // kill-to-start owns Ctrl+U (readline convention); clear-prompt uses Alt+U.
   'kill-to-start':         [{ key: 'u', ctrl: true }],