@pellux/goodvibes-tui 1.16.0 → 1.17.0

package/src/cli/tui-startup.ts

@@ -1,6 +1,7 @@
 import type { CommandContext, CommandRegistry } from '../input/command-registry.ts';
 import type { InputHandler } from '../input/handler.ts';
 import type { SelectionItem } from '../input/selection-modal.ts';
+import type { WorkspaceRegistrationManager } from '../runtime/trust/workspace-registration.ts';
 import { hasResumableWizardProgress, readOnboardingCheckMarker, readWizardProgress } from '../runtime/onboarding/index.ts';
 import { startOnboardingFastPath } from '../runtime/onboarding/fast-path.ts';
 import { readLastSessionPointer } from '@/runtime/index.ts';
@@ -13,111 +14,62 @@ export type TuiStartupShellPaths = Parameters<typeof readOnboardingCheckMarker>[
 
 export type FirstOpenTrustLevel = 'trusted' | 'restricted';
 
-/** The decisions a first-open prompt choice resolves to. Absent halves were not asked. */
-export interface FirstOpenDecision {
-  readonly trust?: FirstOpenTrustLevel;
-  readonly register?: 'yes' | 'no';
-}
-
 /**
- * decodeFirstOpenChoice — pure mapping from a chosen selection-item id (or null
- * on Escape/enter-through) to the trust + registration decisions, given which
- * halves the prompt actually offered. Kept pure so the combined-prompt semantics
- * are unit-testable without a live modal.
- *
- * Escape/enter-through (id === null) is the safe default: an offered trust half
- * settles to 'restricted' (matching the standalone trust prompt), and an offered
- * register half defaults to NO — recorded as a subtree-scoped decline so the
- * directory is not re-asked every startup.
+ * decodeFirstOpenChoice — pure mapping from a chosen selection-item id (or
+ * null on Escape/enter-through) to the trust decision. Kept pure so the
+ * consequence-time trust prompt's semantics (raised by trustGatedAsk, wired
+ * in main.ts's trustPromptRef.requestTrustDecision) are unit-testable
+ * without a live modal. Escape/enter-through (id === null) is the safe
+ * default: 'restricted'.
  */
-export function decodeFirstOpenChoice(
-  id: string | null,
-  offered: { readonly trustNeeded: boolean; readonly registerNeeded: boolean },
-): FirstOpenDecision {
-  const decision: { trust?: FirstOpenTrustLevel; register?: 'yes' | 'no' } = {};
-  if (offered.trustNeeded && offered.registerNeeded) {
-    // Combined 2x2 choice.
-    const trust: FirstOpenTrustLevel = id === 'trust-register' || id === 'trust-only' ? 'trusted' : 'restricted';
-    const register: 'yes' | 'no' = id === 'trust-register' || id === 'restrict-register' ? 'yes' : 'no';
-    decision.trust = trust;
-    decision.register = register;
-  } else if (offered.trustNeeded) {
-    decision.trust = id === 'trusted' ? 'trusted' : 'restricted';
-  } else if (offered.registerNeeded) {
-    decision.register = id === 'register' ? 'yes' : 'no';
-  }
-  return decision;
+export function decodeFirstOpenChoice(id: string | null): FirstOpenTrustLevel {
+  return id === 'trusted' ? 'trusted' : 'restricted';
 }
 
-/** Build the selection rows for a first-open prompt given which halves apply. */
-export function buildFirstOpenItems(offered: {
-  readonly trustNeeded: boolean;
-  readonly registerNeeded: boolean;
-}): { readonly title: string; readonly items: SelectionItem[] } {
-  if (offered.trustNeeded && offered.registerNeeded) {
-    return {
-      title: 'New workspace — trust level and registration',
-      items: [
-        { id: 'trust-register', label: 'Trust & register this workspace', detail: 'Full capability, and track it in your workspace registry', primaryAction: 'select' },
-        { id: 'trust-only', label: 'Trust, don\'t register', detail: 'Full capability; leave it out of the registry', primaryAction: 'select' },
-        { id: 'restrict-register', label: 'Keep restricted, register', detail: 'Read-only for now; still track it in the registry', primaryAction: 'select' },
-        { id: 'restrict-only', label: 'Keep restricted, don\'t register', detail: 'Read-only exploration; nothing recorded (default)', primaryAction: 'select' },
-      ],
-    };
-  }
-  if (offered.trustNeeded) {
-    return {
-      title: 'New workspace — choose a trust level',
-      items: [
-        { id: 'trusted', label: 'Trust this workspace', detail: 'Full capability — all tools may run', primaryAction: 'select' },
-        { id: 'restricted', label: 'Keep restricted (read-only)', detail: 'Explore safely; writes and commands are denied until trusted', primaryAction: 'select' },
-      ],
-    };
-  }
+/**
+ * Build the selection rows for the trust prompt. This used to also offer a
+ * "register this directory?" half (a combined 2x2 when both were needed) —
+ * that half is gone: registration self-records (see
+ * selfRecordWorkspaceRegistration below) rather than ever asking a question
+ * about a registry the user hasn't met yet.
+ */
+export function buildFirstOpenItems(): { readonly title: string; readonly items: SelectionItem[] } {
   return {
-    title: 'Register this directory as a workspace?',
+    title: 'New workspace — choose a trust level',
     items: [
-      { id: 'register', label: 'Register this workspace', detail: 'Track this project root in your workspace registry', primaryAction: 'select' },
-      { id: 'skip', label: 'Don\'t register', detail: 'Leave it out; not asked again for this directory (default)', primaryAction: 'select' },
+      { id: 'trusted', label: 'Trust this workspace', detail: 'Full capability — all tools may run', primaryAction: 'select' },
+      { id: 'restricted', label: 'Keep restricted (read-only)', detail: 'Explore safely; writes and commands are denied until trusted', primaryAction: 'select' },
     ],
   };
 }
 
 /**
- * First-open workspace prompt — one surface folding the TUI-local trust gate and
- * the platform-wide registration half. When GoodVibes opens a workspace it has
- * no trust decision for, and/or one whose registration resolves UNKNOWN, ask
- * once (never two stacked modals): trust level AND "register this directory?".
+ * Registration self-records: a workspace the user actually works in becomes
+ * its own registry entry with no question ever asked (the former "Register
+ * this directory as a workspace?" prompt — sometimes a four-option 2x2 when
+ * trust was undecided too — is gone entirely).
+ *
+ * "Actually works in" is anchored to TRUST, not mere directory-open: this is
+ * only ever called for a workspace that is (or has just become) trusted,
+ * never for one that's merely been glanced at read-only. Labeled 'via TUI'
+ * in the shared registry so its provenance is honest.
  *
- * The two records are independent: a grandfathered-trusted workspace skips the
- * trust half but may still see the register half once; a covered/declined/broad
- * directory skips the register half. Escape/enter-through takes the safe default
- * (restricted, and a recorded decline for the register half).
+ * OWNER-BOUNDARY RIDER (binding): self-recording must not widen the
+ * checkpoint-owning consumer's boundary. That boundary now reads the SAME
+ * shared registration store this writes to, gated by each record's
+ * `checkpointEligible` flag (absent means false). So the separation is no
+ * longer "a separate list the agent owns" — it is one store, and this self
+ * record stays out of scope by stamping its `origin` ('tui') for honest
+ * provenance while NEVER setting `checkpointEligible`. Only the consumer that
+ * owns checkpointing re-stamps its own roots eligible on boot.
  */
-async function promptWorkspaceFirstOpen(commandContext: CommandContext, render: () => void): Promise<void> {
-  const trustManager = commandContext.workspace?.workspaceTrustManager;
-  const registrationManager = commandContext.workspace?.workspaceRegistrationManager;
-  const trustNeeded = Boolean(trustManager && !trustManager.isDecided());
-  const evaluation = registrationManager ? await registrationManager.evaluate() : null;
-  const registerNeeded = Boolean(evaluation?.offerRegister);
-  if (!trustNeeded && !registerNeeded) return;
-
-  const offered = { trustNeeded, registerNeeded };
-  const { title, items } = buildFirstOpenItems(offered);
-  commandContext.openSelection?.(
-    title,
-    items,
-    { allowSearch: false, primaryVerbLabel: 'Choose' },
-    (result) => {
-      const decision = decodeFirstOpenChoice(result?.item.id ?? null, offered);
-      const apply = async () => {
-        if (decision.trust && trustManager) await trustManager.setLevel(decision.trust);
-        if (decision.register === 'yes' && registrationManager) await registrationManager.register();
-        else if (decision.register === 'no' && registrationManager) await registrationManager.decline();
-      };
-      void apply().finally(render);
-    },
-  );
+export async function selfRecordWorkspaceRegistration(
+  registrationManager: Pick<WorkspaceRegistrationManager, 'evaluate' | 'register'> | undefined,
+): Promise<void> {
+  if (!registrationManager) return;
+  const evaluation = await registrationManager.evaluate();
+  if (!evaluation.offerRegister) return;
+  await registrationManager.register('via TUI', 'tui');
 }
 
 export function applyInitialTuiCliState(options: {
@@ -131,6 +83,16 @@ export function applyInitialTuiCliState(options: {
   const { cli, input, commandRegistry, commandContext, shellPaths, render } = options;
   const globalOnboardingMarker = readOnboardingCheckMarker(shellPaths, 'user');
 
+  // Registration self-records on every launch of an already-trusted
+  // workspace (fire-and-forget — never blocks or gates startup, never a
+  // modal). A workspace that is undecided or restricted is never
+  // self-registered here; for one that becomes trusted just now (via the
+  // consequence-time trust prompt), main.ts's trustPromptRef wiring calls
+  // this same helper right after the decision.
+  if (commandContext.workspace?.workspaceTrustManager?.isTrusted()) {
+    void selfRecordWorkspaceRegistration(commandContext.workspace.workspaceRegistrationManager);
+  }
+
   // Seeded prompt is always applied synchronously, regardless of session branch.
   const seededPrompt = cli.flags.prompt ?? (cli.rawCommand === undefined && cli.positionals.length > 0 ? cli.positionals.join(' ') : undefined);
   if (seededPrompt) {
@@ -183,6 +145,9 @@ export function applyInitialTuiCliState(options: {
   } else if (!globalOnboardingMarker.exists) {
     // Fast path: get a brand-new user to a working session in the fewest steps.
     // Falls back to the full wizard when the surface can't detect providers.
+    // Trust stays undecided here on purpose — the first non-read tool
+    // request is what raises the trust question now (see main.ts's
+    // trustPromptRef), not this startup branch.
     startOnboardingFastPath({ input, commandContext, shellPaths, render });
   } else {
     // User has completed onboarding before but left a wizard session in progress.
@@ -202,11 +167,9 @@ export function applyInitialTuiCliState(options: {
           },
         });
       }
-    } else {
-      // Returning user, no wizard to resume: this is the moment to ask, in one
-      // surface, about a genuinely new workspace's trust level and whether to
-      // register it — before they run anything here.
-      void promptWorkspaceFirstOpen(commandContext, render);
     }
+    // Returning user, no wizard to resume, nothing else to do at startup:
+    // trust (if still undecided) is asked at the first non-read tool
+    // request, not here — see main.ts's trustPromptRef wiring.
   }
 }

package/src/cli/types.ts

@@ -60,6 +60,8 @@ export interface GoodVibesCliFlags {
   readonly fork: string | true | undefined;
   readonly yes: boolean;
   readonly nonInteractive: boolean;
+  /** `doctor --strict`: advisory findings also fail (exit 1), for CI. Ignored by every other command. */
+  readonly strict: boolean;
 }
 
 export interface GoodVibesCliParseResult {

package/src/config/index.ts

@@ -8,7 +8,7 @@
 
 export { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 export type { DeepReadonly } from '@pellux/goodvibes-sdk/platform/config';
-export type { GoodVibesConfig, ConfigKey, ConfigValue, ConfigSetting, PermissionMode, PermissionAction, PermissionsToolConfig, NotificationsConfig, PersistedFlagState } from '@pellux/goodvibes-sdk/platform/config';
+export type { GoodVibesConfig, ConfigKey, ConfigValue, ConfigSetting, PermissionMode, PermissionAction, PermissionsToolConfig, NotificationsConfig } from '@pellux/goodvibes-sdk/platform/config';
 export { DEFAULT_CONFIG, CONFIG_SCHEMA } from '@pellux/goodvibes-sdk/platform/config';
 export { ConfigError } from '@pellux/goodvibes-sdk/platform/types';
 

package/src/config/tui-extension-settings.ts

@@ -99,6 +99,39 @@ export function readStatuslineSettings(configManager: Pick<ConfigManager, 'getRa
   return out;
 }
 
+// ─── update.* — launch-time self-update behavior ─────────────────────────────
+
+/**
+ * User-settable launch-time self-update behavior. The feature itself (check at
+ * launch, install via the checksum-verified download/verify/swap path, restart
+ * onto the new binary) defaults ON for binary installs; the defaults live in
+ * the consumer (src/cli/launch-auto-update.ts), matching this file's rule that
+ * readers return only what the user actually set.
+ */
+export interface UpdateSettings {
+  /** Check for a newer release at TUI launch and install it before starting. Default: true. */
+  readonly autoUpdateAtLaunch?: boolean;
+  /** How long the launch-time version check may take before it is skipped. Defaults to 2500; clamped to [250, 30000]. */
+  readonly launchCheckTimeoutMs?: number;
+}
+
+const LAUNCH_CHECK_MIN_TIMEOUT_MS = 250;
+const LAUNCH_CHECK_MAX_TIMEOUT_MS = 30_000;
+
+/** Read `update.*` from settings.json, validating and clamping the timeout. */
+export function readUpdateSettings(configManager: Pick<ConfigManager, 'getRaw'>): UpdateSettings {
+  const src = readNamespace(configManager, 'update');
+  if (!src) return {};
+  const out: { autoUpdateAtLaunch?: boolean; launchCheckTimeoutMs?: number } = {};
+  const autoUpdateAtLaunch = readBoolean(src, 'autoUpdateAtLaunch');
+  if (autoUpdateAtLaunch !== undefined) out.autoUpdateAtLaunch = autoUpdateAtLaunch;
+  const launchCheckTimeoutMs = readPositiveInt(src, 'launchCheckTimeoutMs');
+  if (launchCheckTimeoutMs !== undefined) {
+    out.launchCheckTimeoutMs = Math.min(LAUNCH_CHECK_MAX_TIMEOUT_MS, Math.max(LAUNCH_CHECK_MIN_TIMEOUT_MS, launchCheckTimeoutMs));
+  }
+  return out;
+}
+
 // ─── checkpoints.* — workspace checkpoint root-guard options ─────────────────
 
 /**

package/src/core/composer-state.ts

@@ -24,7 +24,7 @@ export function deriveComposerState(input: ComposerStateInput): ComposerState {
   // status tag: `risk:approval-wait`. It is therefore NOT also duplicated as a
   // `approval` flag, and (below) it suppresses the competing `state:` turn tag —
   // the turn is blocked on the user, not really streaming. Precedence:
-  // approval-wait > live turn state. (UX-B item 4.)
+  // approval-wait > live turn state. (item 4.)
   const approvalWait = input.pendingApproval === true;
   if (approvalWait) {
     pendingRisk = 'approval-wait';

package/src/core/conversation-line-cache.ts

@@ -1,5 +1,5 @@
 /**
- * conversation-line-cache.ts — per-message Line[] production cache (WO-209).
+ * conversation-line-cache.ts — per-message Line[] production cache.
  *
  * The measured defect (perf baseline 2026-07-03, transcript.build_1k): appending
  * ONE message to an N-message conversation re-rendered all N messages
@@ -98,7 +98,7 @@ interface KeyMeta {
   /**
    * True when this (assistant) message has a tool call with no result yet — it
    * renders as pending rather than done. Keyed so the entry invalidates and
-   * re-renders ✓ once the tool result arrives. (UX-B item 2c.)
+   * re-renders ✓ once the tool result arrives. (item 2c.)
    */
   readonly hasPendingTool: boolean;
 }
@@ -286,7 +286,7 @@ export class MessageLineCache {
     };
 
     // Tool calls with no matching tool-result message are still pending; the
-    // render context and the cache key both depend on this. (UX-B item 2c.)
+    // render context and the cache key both depend on this. (item 2c.)
     const completedToolCallIds = collectCompletedToolCallIds(messages);
     const renderContext: ConversationRenderContext = { ...context, completedToolCallIds };
 

package/src/core/conversation-rendering.ts

@@ -46,7 +46,7 @@ type Message = ConversationMessageSnapshot;
  * Collect the ids of tool calls that have a matching tool-result message in the
  * given slice — i.e. the tools that actually ran. Used to decide whether an
  * assistant tool call still shows as pending (awaiting approval) or done.
- * (UX-B item 2c.)
+ * (item 2c.)
  */
 export function collectCompletedToolCallIds(messages: readonly Message[]): Set<string> {
   const ids = new Set<string>();
@@ -79,7 +79,7 @@ export interface ConversationRenderContext {
    * awaiting a decision (e.g. an approval prompt) and renders with a pending
    * glyph instead of the completed ✓. When undefined (single-message callers
    * without sibling context), every tool call renders as done — the prior
-   * behaviour. (UX-B item 2c.)
+   * behaviour. (item 2c.)
    */
   readonly completedToolCallIds?: ReadonlySet<string>;
 }
@@ -273,7 +273,7 @@ export function renderConversationToolMessage(
   // Human one-line summary for tool results (write/read/exec/edit): shown as the
   // collapsed line so the transcript reads "wrote foo.txt (532 B)" instead of a
   // raw JSON blob; the full payload stays behind the expand toggle. Only for
-  // 'tool' blocks (diffs render their own view). (UX-B item 3.)
+  // 'tool' blocks (diffs render their own view). (item 3.)
   const resultSummary = blockType === 'tool'
     ? summarizeToolResult(message.toolName, message.content)
     : null;
@@ -379,7 +379,7 @@ export function appendConversationMessages(
   const lineNumberMode = context.configManager?.get('display.lineNumbers') ?? 'off';
   const collapseThreshold = context.configManager?.get('display.collapseThreshold') ?? 30;
   // Derive pending vs done for tool calls from sibling tool-result messages,
-  // unless the caller already supplied the set. (UX-B item 2c.)
+  // unless the caller already supplied the set. (item 2c.)
   const renderContext: ConversationRenderContext = context.completedToolCallIds !== undefined
     ? context
     : { ...context, completedToolCallIds: collectCompletedToolCallIds(messages) };

package/src/core/conversation.ts

@@ -67,7 +67,7 @@ export interface OrchestratorUsageTotals {
  * TUI-side counterpart to SDK Orchestrator.usage: after a session resume
  * replays historical messages into a freshly-constructed Orchestrator (whose
  * `usage` starts at all zeros — bootstrap.ts always constructs a fresh
- * instance, see W0.9), this lets the caller hydrate the footer's token
+ * instance, see), this lets the caller hydrate the footer's token
  * counters from messages that already carry real usage data instead of
  * waiting for the first new turn to populate them.
  */
@@ -98,7 +98,7 @@ export class ConversationManager extends SdkConversationManager {
   /** When true the buffer needs to be rebuilt before the next display. */
   private dirty = true;
   /**
-   * Per-message Line[] cache (WO-209). rebuildHistory() reuses cached lines for
+   * Per-message Line[] cache. rebuildHistory() reuses cached lines for
    * messages whose complete render inputs are unchanged, so appending one message
    * to an N-message conversation no longer re-renders all N. A cache-served
    * rebuild is byte-identical to a cold one (pure memoisation).

package/src/core/long-task-notifier.ts

@@ -18,12 +18,12 @@
  * When neither target is available the function is an honest no-op (debug log
  * only; no user-facing error spam).
  *
- * Focus tracking (W2.3): when `focusTracker` is supplied, notifications are
+ * Focus tracking: when `focusTracker` is supplied, notifications are
  * gated the same way as the other unfocused-user alert classes (see
  * alert-gating.ts) — they fire when the terminal is unfocused or focus state
  * was never observed, and are suppressed when it's known to be focused,
  * unless `behavior.notifyOnlyWhenUnfocused` is turned off. `focusTracker` is
- * optional and defaults to "always fire" (the pre-W2.3 behavior) when
+ * optional and defaults to "always fire" (the behavior before focus gating existed) when
  * omitted, so existing callers that don't have a FocusTracker in scope are
  * unaffected.
  */
@@ -82,11 +82,11 @@ export interface MaybeNotifyLongTaskOptions {
   readonly webhookNotifier?: WebhookNotifier | null;
 
   /**
-   * Terminal focus tracker (W2.3). When supplied together with `configGet`,
+   * Terminal focus tracker. When supplied together with `configGet`,
    * the notification additionally respects behavior.notifyOnlyWhenUnfocused
    * (default on): suppressed when the terminal is known to be focused, fires
    * when unfocused or when focus was never observed. Omit both to preserve
-   * pre-W2.3 behavior (always fire once the threshold is met).
+   * the behavior before focus gating existed (always fire once the threshold is met).
    */
   readonly focusTracker?: Pick<FocusTracker, 'shouldAlertWhenUnfocused'> | null;
 
@@ -121,9 +121,9 @@ export function maybeNotifyLongTask(opts: MaybeNotifyLongTaskOptions): boolean {
     return false;
   }
 
-  // Focus gate (W2.3): only applied when both a tracker and a config reader
-  // are supplied. Absent either one, behavior is unchanged from pre-W2.3
-  // (always fire once the threshold is met).
+  // Focus gate: only applied when both a tracker and a config reader
+  // are supplied. Absent either one, behavior is unchanged from before focus
+  // gating existed (always fire once the threshold is met).
   if (focusTracker && configGet && readNotifyOnlyWhenUnfocused(configGet) && !focusTracker.shouldAlertWhenUnfocused()) {
     logger.debug('long-task-notifier: suppressed — terminal focused');
     return false;

package/src/core/stream-event-wiring.ts

@@ -115,11 +115,11 @@ function isStreamRetryLikePayload(payload: unknown): payload is StreamRetryLikeP
 
 /**
  * Minimal cost lookup surface for attaching cost-delta information to failover notices.
- * Returns USD-per-1M-token pricing for the given model ID.
- * The implementation may consult a catalog; if the model is unknown both fields are 0.
+ * Returns USD-per-1M-token pricing for the given model ID, or null when the
+ * catalog honestly does not know the model (never a fabricated zero).
  */
 export interface FailoverCostLookup {
-  getCostFromCatalog(modelId: string): { readonly input: number; readonly output: number };
+  getCostFromCatalog(modelId: string): { readonly input: number; readonly output: number } | null;
 }
 
 export interface WireStreamEventMetricsOptions {
@@ -219,9 +219,11 @@ function buildCostDeltaSuffix(
   // Registry key format: `provider:modelId` — modelId may itself contain `:`.
   const fromModelId = fromRegistryKey ? fromRegistryKey.split(':').slice(1).join(':') : '';
   const toModelId = toRegistryKey.split(':').slice(1).join(':');
-  const fromCost = fromModelId ? lookup.getCostFromCatalog(fromModelId) : { input: 0, output: 0 };
-  const toCost = lookup.getCostFromCatalog(toModelId);
-  // Report unavailable when either side has zero pricing (unknown model).
+  // A null catalog answer means honestly unknown — treated exactly like the
+  // legacy zero-pricing sentinel below.
+  const fromCost = (fromModelId ? lookup.getCostFromCatalog(fromModelId) : null) ?? { input: 0, output: 0 };
+  const toCost = lookup.getCostFromCatalog(toModelId) ?? { input: 0, output: 0 };
+  // Report unavailable when either side has no pricing (unknown model).
   if (fromCost.input === 0 && fromCost.output === 0 && !fromModelId) {
     return ' [cost data unavailable]';
   }

package/src/core/system-message-noise.ts

@@ -4,7 +4,7 @@
  * source these rules catch is emitted (from the SDK) through
  * SystemMessageRouter, so this one funnel is where first-run plumbing is kept
  * out of the user's stream while the information stays reachable elsewhere
- * (fleet panel, /health, /model, activity log). (UX-B item 1.)
+ * (fleet panel, /health, /model, activity log). (item 1.)
  */
 
 export interface NoiseGateDeps {

package/src/core/system-message-router.ts

@@ -9,7 +9,7 @@
  * that target — plus whether a panel is attached — into a { toPanel,
  * toConversation } decision.
  *
- * W6.1 (the purge): the SystemMessagesPanel this router used to optionally
+ * (the purge): the SystemMessagesPanel this router used to optionally
  * push into was DELETE-disposition (no surviving human surface — a picker
  * over the old panel registry, not something worth a dedicated console) and
  * has been removed entirely, so this router now always resolves with
@@ -61,7 +61,7 @@ export type {
   SystemMessageTarget,
 } from '@/runtime/index.ts';
 
-/** Panel emphasis level. Panel delivery was removed in W6.1 (see file doc); kept as the priority vocabulary for callers and for the SDK's delivery-resolution signature. */
+/** Panel emphasis level. Panel delivery was removed in (see file doc); kept as the priority vocabulary for callers and for the SDK's delivery-resolution signature. */
 export type SystemMessagePriority = 'high' | 'low';
 
 /**
@@ -88,7 +88,7 @@ function mustReachConversation(message: string): boolean {
 
 /**
  * Routes system messages to the conversation based on priority level and
- * configured target. See file doc for the W6.1 panel removal.
+ * configured target. See file doc for the panel removal.
  */
 export class SystemMessageRouter {
   /** Buffered provider "from last session" replay lines, folded on a microtask. */
@@ -123,7 +123,7 @@ export class SystemMessageRouter {
     kind: SystemMessageKind,
   ): void {
     // Noise gate — keep first-run plumbing out of the transcript while the
-    // information stays reachable via other live surfaces. (UX-B item 1.)
+    // information stays reachable via other live surfaces. (item 1.)
     const verdict = classifyNoise(message, this.noiseDeps);
     if (verdict.action === 'drop') return;
     if (verdict.action === 'foldProviderReplay') {
@@ -137,7 +137,7 @@ export class SystemMessageRouter {
   /** Post-noise-gate delivery: resolve target and append to the conversation. */
   private deliver(message: string, kind: SystemMessageKind): void {
     const target = this.getTargetForKind(kind);
-    // hasPanel is always false post-W6.1 — resolveSystemMessageDelivery's own
+    // hasPanel is always false now that panel delivery was removed — resolveSystemMessageDelivery's own
     // contract means every target ('panel' | 'conversation' | 'both')
     // resolves toConversation: true in that case (see file doc).
     const delivery = resolveSystemMessageDelivery(target, false);
@@ -153,7 +153,7 @@ export class SystemMessageRouter {
    * Buffer a provider "from last session" replay line and schedule a microtask
    * flush. The SDK emits the whole persisted-provider burst synchronously, so a
    * single microtask captures the full burst and folds it to one quiet line.
-   * (UX-B item 1b.)
+   * (item 1b.)
    */
   private bufferProviderReplay(message: string): void {
     this.providerReplayBuffer.push(message);

package/src/core/turn-cancellation.ts

@@ -5,7 +5,7 @@ import type { SpokenTurnRuntime } from '../audio/spoken-turn-wiring.ts';
  * Builds the shared "cancel the active turn" action: stops any in-flight
  * spoken output, then aborts the orchestrator's turn if one is actively
  * streaming. Extracted from main.ts so the file can stay under its 800-line
- * cap while still wiring `commandContext.isGenerating` (see W1.6 FIX 1).
+ * cap while still wiring `commandContext.isGenerating` (see FIX 1).
  *
  * Returns whether SPEECH was actively stopped — a Ctrl+C that silenced live
  * TTS is consumed by that job (an earlier replay fix), same as a press that

package/src/core/turn-event-wiring.ts

@@ -78,12 +78,12 @@ export interface WireTurnEventHandlersOptions {
    */
   readonly webhookNotifier?: WebhookNotifier | null;
   /**
-   * Terminal focus tracker (W2.3). Gates the long-task, budget-breach, and
+   * Terminal focus tracker. Gates the long-task, budget-breach, and
    * agent/chain-failure desktop alerts wired in this module — see
-   * alert-gating.ts. Optional; when absent, none of the new W2.3 alert
-   * behavior is gated by focus (long-task keeps its pre-W2.3 always-fire
-   * behavior, and budget-breach/failure alerts are skipped entirely, since
-   * they are new-in-W2.3 and have no pre-existing unconditional-fire path
+   * alert-gating.ts. Optional; when absent, none of the new alert
+   * behavior is gated by focus (long-task keeps its always-fire
+   * behavior from before focus gating existed, and budget-breach/failure alerts are
+   * skipped entirely, since they have no pre-existing unconditional-fire path
    * to fall back to).
    */
   readonly focusTracker?: Pick<FocusTracker, 'shouldAlertWhenUnfocused'> | null;
@@ -152,7 +152,7 @@ export function wireTurnEventHandlers(
   // Track turn start time for long-task notification threshold.
   let turnStartTime: number | null = null;
 
-  // Budget-breach edge-trigger checker (W2.3) — one instance per session,
+  // Budget-breach edge-trigger checker — one instance per session,
   // piggybacking on the same TURN_COMPLETED handler as the long-task
   // notification below rather than adding a second TURN_COMPLETED subscription.
   const budgetBreachNotifier: BudgetBreachNotifier | null = focusTracker
@@ -193,7 +193,7 @@ export function wireTurnEventHandlers(
       focusTracker,
       configGet,
     });
-    // Budget-breach alert (W2.3): edge-triggered, piggybacks on this same
+    // Budget-breach alert: edge-triggered, piggybacks on this same
     // TURN_COMPLETED handler rather than a second subscription.
     if (budgetBreachNotifier) {
       const sessionModel = providerRegistry.getCurrentModel().id ?? 'unknown';
@@ -264,7 +264,7 @@ export function wireTurnEventHandlers(
     refreshGit();
   }));
 
-  // Agent/chain-failure desktop alerts (W2.3). The SDK's WebhookNotifier and
+  // Agent/chain-failure desktop alerts. The SDK's WebhookNotifier and
   // Notifier already fire webhook/Slack/Discord notifications for these two
   // events unconditionally (attachToRuntimeBus in the SDK's
   // platform/integrations — pre-existing, not focus-gated: an out-of-band

package/src/daemon/cli.ts

@@ -4,8 +4,7 @@ import { readFileSync } from 'node:fs';
 import { ConfigManager, resolveDaemonEnabled } from '@pellux/goodvibes-sdk/platform/config';
 import { formatProviderModel, getModelIdFromProviderModel, getProviderIdFromModel } from '../config/provider-model.ts';
 import { RuntimeEventBus, GlobalNetworkTransportInstaller } from '@/runtime/index.ts';
-import { createFeatureFlagManager } from '@/runtime/index.ts';
-import type { FlagState } from '@/runtime/index.ts';
+import { bindFeatureSettingsBridge, createFeatureFlagManager, deriveFeatureStates } from '@/runtime/index.ts';
 import { createRuntimeStore } from '../runtime/store/index.ts';
 import { createRuntimeServices } from '../runtime/services.ts';
 import { DaemonServer, HttpListener } from '@pellux/goodvibes-sdk/platform/daemon';
@@ -28,6 +27,8 @@ import {
 } from '@pellux/goodvibes-sdk/platform/discovery';
 import { createSafeHostServeFactory } from './safe-serve.ts';
 import { isDaemonServiceSubcommand, resolveInstalledDaemonBinary, runDaemonServiceCli } from './service-commands.ts';
+import { resolveDaemonUpdateArtifact } from './lifecycle.ts';
+import { VERSION } from '../version.ts';
 
 import {
   parseGoodVibesCli,
@@ -190,10 +191,11 @@ async function main(): Promise<void> {
 
   const runtimeBus = new RuntimeEventBus();
   const runtimeStore = createRuntimeStore();
+  // Gate states derive from the domain settings keys; the bridge keeps live
+  // config changes flowing into the manager for the daemon's lifetime.
   const featureFlags = createFeatureFlagManager();
-  featureFlags.loadFromConfig({
-    flags: (config.getCategory('featureFlags') as Record<string, FlagState>) ?? {},
-  });
+  featureFlags.loadFromConfig({ flags: deriveFeatureStates(config) });
+  bindFeatureSettingsBridge(config, featureFlags);
   const runtimeServices = createRuntimeServices({
     configManager: config,
     featureFlags,
@@ -233,6 +235,11 @@ async function main(): Promise<void> {
     userAuth,
     runtimeServices,
     serveFactory: createSafeHostServeFactory('Standalone daemon'),
+    // Hand the facade this binary's real version + exec path so its self-update
+    // lifecycle compares the HOST's version (not the sdk package's). Resolves to
+    // undefined for a non-binary install, so a dev run stays host-managed and
+    // never swaps the interpreter. See lifecycle.ts.
+    updateArtifact: resolveDaemonUpdateArtifact({ version: VERSION }),
   });
   const listener = new HttpListener({
     hookDispatcher: runtimeServices.hookDispatcher,
@@ -268,6 +275,11 @@ async function main(): Promise<void> {
     config.get('danger.httpListener') ? listener.start() : Promise.resolve(),
   ]);
 
+  // The DaemonServer facade owns the hourly self-update loop now (fed this
+  // binary's version + exec path via updateArtifact above); it checks hourly,
+  // swaps only at an idle moment, keeps the outgoing binary at `<path>.previous`,
+  // and stops with the daemon. No separate host loop.
+
   const abortController = new AbortController();
 
   const shutdown = async (): Promise<void> => {
@@ -313,6 +325,9 @@ async function main(): Promise<void> {
     daemonUrl,
     token: companionTokenRecord.token,
     password: bootstrapPassword,
+    // Without this the SDK defaults the printed banner header to v0.0.0 —
+    // the visible version must be this binary's real version.
+    version: VERSION,
     surface: 'tui',
   });
   const payload = encodeConnectionPayload(connectionInfo);