@pellux/goodvibes-tui 1.16.0 → 1.17.0

package/src/input/commands/local-runtime.ts

@@ -4,6 +4,7 @@ import { readFile } from 'node:fs/promises';
 import type { CommandRegistry, CommandContext } from '../command-registry.ts';
 import type { SelectionItem } from '../selection-modal.ts';
 import type { ContentPart } from '@pellux/goodvibes-sdk/platform/providers';
+import { formatModelDiscoveryReport } from '@pellux/goodvibes-sdk/platform/providers';
 import { resolveAndValidatePath } from '@pellux/goodvibes-sdk/platform/utils';
 import { BUILTIN_SECRET_PROVIDER_SOURCES, describeSecretRef, isSecretRefInput, resolveSecretRef } from '@pellux/goodvibes-sdk/platform/config';
 import { openCommandPanel, requireBookmarkManager, requireProviderApi, requireSecretsManager } from './runtime-services.ts';
@@ -70,7 +71,7 @@ export function registerLocalRuntimeCommands(registry: CommandRegistry): void {
     handler(args, ctx) {
       const sub = (args[0] ?? '').toLowerCase();
       if (sub === 'panel' || sub === 'review') {
-        // W6.1 (the purge): 'tools'/ToolInspectorPanel was DELETE-disposition
+        // (the purge): 'tools'/ToolInspectorPanel was DELETE-disposition
         // (no surviving human surface — tool results render inline in the
         // transcript, plus a per-node tool list in Fleet). There is no alias
         // to resolve through, so this prints an honest notice and opens
@@ -200,10 +201,42 @@ export function registerLocalRuntimeCommands(registry: CommandRegistry): void {
         const flags = new Set(rest.filter((value) => value.startsWith('--')));
         const valueParts = rest.filter((value) => !value.startsWith('--'));
         const [key, ...rawValueParts] = valueParts;
-        if (!key || valueParts.length === 0) {
+        if (!key) {
           ctx.print(`[secrets] Usage: /secrets ${sub} <KEY> <${sub === 'link' ? 'secret-ref' : 'value'}> [--user|--project] [--secure|--plaintext]`);
           return;
         }
+        const scope = flags.has('--user') ? 'user' : 'project';
+        const medium = flags.has('--plaintext') ? 'plaintext' : 'secure';
+        // /secrets set KEY (no value) drops into the concealed prompt so the
+        // value is typed with the keystrokes masked and never enters history.
+        if (sub === 'set' && rawValueParts.length === 0) {
+          if (!ctx.beginConcealedInput) {
+            ctx.print('[secrets] Usage: /secrets set <KEY> <value> [--user|--project] [--secure|--plaintext]');
+            return;
+          }
+          ctx.print(`[secrets] Enter value for ${key} (input is masked; press Enter to store, Esc to cancel).`);
+          ctx.beginConcealedInput({
+            label: key,
+            onSubmit: (value) => {
+              if (value.length === 0) {
+                ctx.print(`[secrets] ${key} not set (empty value).`);
+                return;
+              }
+              void (async () => {
+                try {
+                  await mgr.set(key, value, { scope, medium });
+                  ctx.print(`[secrets] Stored: ${key} (${scope}, ${medium})`);
+                } catch (error) {
+                  ctx.print(`[secrets] Could not store ${key}: ${summarizeError(error)}`);
+                }
+              })();
+            },
+            onCancel: () => {
+              ctx.print(`[secrets] ${key} cancelled.`);
+            },
+          });
+          return;
+        }
         const value = rawValueParts.join(' ');
         if (sub === 'link' && !isGoodVibesSecretRefInput(value)) {
           ctx.print('[secrets] Invalid secret reference. Use /secrets providers for examples.');
@@ -213,8 +246,6 @@ export function registerLocalRuntimeCommands(registry: CommandRegistry): void {
           ctx.print('[secrets] Invalid secret reference. Use /secrets providers for examples.');
           return;
         }
-        const scope = flags.has('--user') ? 'user' : 'project';
-        const medium = flags.has('--plaintext') ? 'plaintext' : 'secure';
         await mgr.set(key, value, { scope, medium });
         ctx.print(sub === 'link'
           ? `[secrets] Linked: ${key} -> ${describeSecretRef(value)} (${scope}, ${medium})`
@@ -337,7 +368,24 @@ export function registerLocalRuntimeCommands(registry: CommandRegistry): void {
       } catch (e) {
         ctx.print(`Token limits refresh failed: ${summarizeError(e)}`);
       }
-      if (!catalogOk || !benchmarksOk || !limitsOk) ctx.print('Some refreshes failed — see messages above.');
+      ctx.print('Refreshing live provider model lists...');
+      let discoveryOk = false;
+      try {
+        // Explicit user refresh → force past each provider's TTL cache and
+        // report the delta ("3 new, 1 retired") or the honest fallback reason.
+        const reports = await providerApi.refreshLiveModelDiscovery(undefined, { force: true });
+        discoveryOk = true;
+        if (reports.length === 0) {
+          ctx.print('No providers perform live model discovery.');
+        } else {
+          for (const report of reports) {
+            ctx.print(`  ${formatModelDiscoveryReport(report.providerId, report)}`);
+          }
+        }
+      } catch (e) {
+        ctx.print(`Live model discovery failed: ${summarizeError(e)}`);
+      }
+      if (!catalogOk || !benchmarksOk || !limitsOk || !discoveryOk) ctx.print('Some refreshes failed — see messages above.');
     },
   });
 

package/src/input/commands/memory.ts

@@ -24,7 +24,7 @@ import { handleRecallFilesApply, handleRecallFilesReview, handleRecallFilesSync
 // ── Top-level command ─────────────────────────────────────────────────────────
 
 /**
- * DEBT-5 item 3 divergence note (historical): the work order that shipped
+ * item 3 divergence note (historical): the work order that shipped
  * this command named its front door "/memory", but at the time `/memory` was
  * already a distinct, unrelated command (session-pinned sticky notes,
  * src/input/commands/session-content.ts) with no modal surface — so that
@@ -84,7 +84,7 @@ export const recallCommand: SlashCommand = {
   handler: async (args: string[], context: CommandContext): Promise<void> => {
     const [sub, ...rest] = args;
 
-    // DEBT-5 item 3: bare `/recall` opens the memory-modal surface — the old
+    // item 3: bare `/recall` opens the memory-modal surface — the old
     // bare/unknown-subcommand usage block moved to an explicit `report`
     // subcommand (scriptability preserved: /recall report).
     if (sub === undefined) {

package/src/input/commands/operator-panel-runtime.ts

@@ -5,7 +5,7 @@ import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 /**
  * Parse `--target <id>[:<kind>]` out of the args following `<panel-id>
- * [top|bottom]` (DEBT-5 item 4). Splits the args array in place (removing the
+ * [top|bottom]` (item 4). Splits the args array in place (removing the
  * flag + its value) so positional `pane` parsing downstream is unaffected by
  * where the flag appears. Only `open fleet` currently has a deep-link
  * consumer (FleetPanel.receiveDeepLink) — other panel ids just ignore an
@@ -32,7 +32,7 @@ export function registerOperatorPanelCommand(registry: CommandRegistry): void {
       const pm = requirePanelManager(ctx);
       const sub = args[0]?.toLowerCase() ?? '';
       if (!sub || sub === 'toggle') {
-        // W6.1 (the purge): 'panel-list' (the browse-all-panels picker) was
+        // (the purge): 'panel-list' (the browse-all-panels picker) was
         // DELETE-disposition — a picker over a handful of panels is dead
         // weight now (see the Ctrl+P selectionModal repoint in
         // shell/ui-openers.ts for its interactive replacement). Bare
@@ -71,9 +71,9 @@ export function registerOperatorPanelCommand(registry: CommandRegistry): void {
           // no panel lands in the workspace. Report that honestly rather than
           // claiming "Panel opened: <id>".
           const redirectTarget = pm.getModalRedirect(id);
-          // UX-C focus rule 1a: the command path leaves focus in the composer
+          // focus rule 1a: the command path leaves focus in the composer
           // ("mid-command-flow") — showPanel does not grab panel focus here.
-          // DEBT-5: forward the deep-link target so the panel lands on the row.
+          // forward the deep-link target so the panel lands on the row.
           if (ctx.showPanel) ctx.showPanel(id, pane as 'top' | 'bottom' | undefined, target);
           else {
             pm.open(id, pane as 'top' | 'bottom' | undefined, target);
@@ -169,7 +169,7 @@ export function registerOperatorPanelCommand(registry: CommandRegistry): void {
       } else {
         const id = args[0]!;
         try {
-          // UX-C: bare `/panel <id>` is the same command path as `/panel open
+          // bare `/panel <id>` is the same command path as `/panel open
           // <id>` — composer stays focused.
           if (ctx.showPanel) ctx.showPanel(id);
           else {

package/src/input/commands/permissions-provenance.ts

@@ -63,7 +63,7 @@ const PERMISSION_KEYS: readonly { readonly key: string; readonly label: string;
   { key: 'permissions.mode', label: 'Permission mode', note: 'also the current session mode' },
   { key: 'permissions.backgroundAgents', label: 'Background-agent mode' },
   { key: 'behavior.autoApprove', label: 'Auto-approve everything' },
-  { key: 'featureFlags.permissions-policy-engine', label: 'Runtime policy engine (flag)' },
+  { key: 'permissions.engine', label: 'Permission evaluator', note: 'baseline or policy-engine' },
   { key: 'permissions.tools.read', label: 'Tool rule: read' },
   { key: 'permissions.tools.write', label: 'Tool rule: write' },
   { key: 'permissions.tools.edit', label: 'Tool rule: edit' },

package/src/input/commands/permissions-runtime.ts

@@ -1,21 +1,112 @@
-import type { CommandRegistry } from '../command-registry.ts';
+import type { CommandContext, CommandRegistry } from '../command-registry.ts';
+import type { SelectionItem, SelectionAction } from '../selection-modal.ts';
 import { buildPermissionProvenance, renderPermissionProvenance } from './permissions-provenance.ts';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+
+/** One remembered-rule row: what it does, and how/when it was remembered. */
+function describeRuleRow(record: {
+  rule: { id: string; description?: string | undefined; effect: 'allow' | 'deny' };
+  tier: string;
+  tool: string;
+  createdAt: number;
+}): { label: string; detail: string } {
+  const what = record.rule.description ?? record.rule.id;
+  return {
+    label: `${record.tool}: ${what}`,
+    detail: `${record.rule.effect} · remembered ${record.tier} · ${new Date(record.createdAt).toLocaleString()}`,
+  };
+}
+
+function showRememberedRules(ctx: CommandContext): void {
+  const store = ctx.clients?.userPermissionRuleStore;
+  if (!store) {
+    ctx.print('Remembered permission rules are not available on this surface.');
+    return;
+  }
+  const records = store.list();
+  if (records.length === 0) {
+    ctx.print('No remembered permission rules. Approving an ask with a remember tier stores one here.');
+    return;
+  }
+  if (ctx.openSelection) {
+    const revoke = new Map<string, SelectionAction>([['d', 'delete']]);
+    const items: SelectionItem[] = records.map((record) => {
+      const { label, detail } = describeRuleRow(record);
+      return { id: record.rule.id, label, detail, actions: '[d] revoke' };
+    });
+    ctx.openSelection('Remembered permission rules', items, { allowSearch: true, customActions: revoke }, (result) => {
+      if (!result || result.action !== 'delete') return;
+      void (async () => {
+        try {
+          const removed = await store.delete(result.item.id);
+          ctx.print(removed ? `Revoked remembered rule: ${result.item.label}` : `Rule already gone: ${result.item.label}`);
+        } catch (error) {
+          ctx.print(`Could not revoke the rule: ${summarizeError(error)}`);
+        }
+      })();
+    });
+    return;
+  }
+  // No selection surface: list them honestly with the revoke command to run.
+  ctx.print([
+    'Remembered permission rules:',
+    ...records.map((record) => {
+      const { label, detail } = describeRuleRow(record);
+      return `  ${record.rule.id}  ${label}  (${detail})`;
+    }),
+    '',
+    'Revoke one with: /permissions revoke <rule-id>',
+  ].join('\n'));
+}
+
+async function revokeRememberedRule(ctx: CommandContext, ruleId: string): Promise<void> {
+  const store = ctx.clients?.userPermissionRuleStore;
+  if (!store) {
+    ctx.print('Remembered permission rules are not available on this surface.');
+    return;
+  }
+  if (!ruleId) {
+    ctx.print('Usage: /permissions revoke <rule-id>  (see /permissions rules for ids)');
+    return;
+  }
+  try {
+    const removed = await store.delete(ruleId);
+    ctx.print(removed ? `Revoked remembered rule: ${ruleId}` : `No remembered rule with id: ${ruleId}`);
+  } catch (error) {
+    ctx.print(`Could not revoke the rule: ${summarizeError(error)}`);
+  }
+}
 
 /**
- * `/permissions` — the permission provenance panel. Prints every
- * permission-relevant setting in effect and where each value came from
- * (default / config file / runtime override / session mode), plus the current
- * session mode. Read-only: it changes no config. See permissions-provenance.ts
- * for how origin is resolved from the platform's own ConfigManager.
+ * `/permissions` — the permission settings surface. With no arguments it prints
+ * every permission-relevant setting in effect and where each value came from
+ * (provenance; read-only). `rules` lists the durable remembered approvals with a
+ * press-Enter revoke; `revoke <id>` removes one by id. Revokes hit the same
+ * in-process rule store the evaluator reads, so they take effect live.
  */
 export function registerPermissionsRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'permissions',
     aliases: ['perms'],
-    description: 'Show permission settings in effect and where each value came from (provenance)',
-    handler(_args, ctx) {
+    description: 'Show permission settings and provenance, and list or revoke remembered approval rules',
+    usage: '[rules | revoke <rule-id>]',
+    argsHint: '[rules|revoke]',
+    async handler(args, ctx) {
+      const sub = (args[0] ?? '').toLowerCase();
+      if (sub === 'rules' || sub === 'rule') {
+        showRememberedRules(ctx);
+        return;
+      }
+      if (sub === 'revoke' || sub === 'forget') {
+        await revokeRememberedRule(ctx, args[1] ?? '');
+        return;
+      }
       const provenance = buildPermissionProvenance(ctx.platform.configManager);
       ctx.print(renderPermissionProvenance(provenance));
+      const ruleCount = ctx.clients?.userPermissionRuleStore?.list().length ?? 0;
+      ctx.print(ruleCount > 0
+        ? `\n${ruleCount} remembered approval rule${ruleCount === 1 ? '' : 's'} in effect. Use /permissions rules to review or revoke them.`
+        : '\nNo remembered approval rules. Use /permissions rules once you have some.');
     },
   });
 }

package/src/input/commands/planning-runtime.ts

@@ -13,7 +13,7 @@ import { togglePlanMode, permissionModeLabel, type PermissionModeValue } from '.
  * A lone one of these is refused rather than seeded as a goal, so a stray verb
  * can never overwrite the project goal with itself.
  *
- * DEBT-3: `dismiss` and `answer` are now REAL subcommands (handled above this
+ * `dismiss` and `answer` are now REAL subcommands (handled above this
  * guard), so they were removed from the refuse-list. `pause`/`stop`/`cancel`
  * remain here — they still have no backing verb and must not seed a goal.
  */
@@ -178,7 +178,7 @@ export function registerPlanningRuntimeCommands(registry: CommandRegistry): void
         return;
       }
 
-      // DEBT-3: /plan dismiss — archive the current plan. Dismisses the active
+      // /plan dismiss — archive the current plan. Dismisses the active
       // execution plan (ExecutionPlanManager.dismiss, honest per-state) AND
       // deactivates the project-planning interview state shown in the modal so a
       // later /plan <goal> starts fresh. Mid-execution is refused outright.
@@ -223,7 +223,7 @@ export function registerPlanningRuntimeCommands(registry: CommandRegistry): void
         return;
       }
 
-      // DEBT-3: /plan answer <n|question-id> <text> — record a real answer to an
+      // /plan answer <n|question-id> <text> — record a real answer to an
       // open planning question (moves open → answered, consumed on next refine).
       if (args[0] === 'answer') {
         if (!projectPlanningService || !projectId) {

package/src/input/commands/platform-sandbox-runtime.ts

@@ -98,7 +98,7 @@ export function registerPlatformSandboxRuntimeCommands(registry: CommandRegistry
       const shellPaths = requireShellPaths(ctx);
       const sub = args[0] ?? 'open';
       if (sub === 'open' || sub === 'panel') {
-        ctx.openModal?.('sandbox-modal'); // W6.1: sandbox panel -> config modal
+        ctx.openModal?.('sandbox-modal'); // sandbox panel -> config modal
         return;
       }
       if (sub === 'review') {

package/src/input/commands/provider-accounts-runtime.ts

@@ -3,11 +3,13 @@ import type {
   ProviderAccountRecord,
   ProviderAccountSnapshot,
 } from '@/runtime/index.ts';
+import type { SelectionItem } from '../selection-modal.ts';
 import {
-  openCommandPanel,
   requireOperatorClient,
 } from './runtime-services.ts';
 
+type RecommendedAction = ProviderAccountRecord['recommendedActions'][number];
+
 async function loadProviderAccountSnapshot(context: CommandContext): Promise<ProviderAccountSnapshot> {
   return await requireOperatorClient(context).providers.accountSnapshot();
 }
@@ -20,6 +22,71 @@ function findProviderAccountRecord(
   return snapshot.providers.find((entry) => entry.providerId === providerId);
 }
 
+/**
+ * Present a record's recommended actions as executable rows. A recommended
+ * action that carries a structured command becomes a press-Enter row that RUNS
+ * that command through the command registry — never a line the user has to
+ * retype. Actions with no command are genuinely out-of-product steps, so they
+ * stay as plain (non-executing) rows. When there is no interactive selection
+ * surface, each action is printed honestly instead.
+ */
+export function presentRecommendedActions(
+  ctx: CommandContext,
+  providerId: string,
+  actions: readonly RecommendedAction[],
+): void {
+  if (actions.length === 0) {
+    ctx.print('No active repair actions suggested.');
+    return;
+  }
+  if (ctx.openSelection) {
+    const items: SelectionItem[] = actions.map((action, index) => {
+      if (action.command) {
+        const argsPart = action.command.args.length > 0 ? ` ${action.command.args.join(' ')}` : '';
+        return {
+          id: String(index),
+          label: action.description,
+          detail: `runs /${action.command.name}${argsPart}`,
+          primaryAction: 'select',
+        };
+      }
+      return {
+        id: String(index),
+        label: action.description,
+        detail: 'manual step (nothing to run)',
+        primaryAction: 'select',
+      };
+    });
+    ctx.openSelection(
+      `Repair ${providerId}`,
+      items,
+      { allowSearch: false, primaryVerbLabel: 'Run' },
+      (result) => {
+        if (!result) return;
+        const action = actions[Number(result.item.id)];
+        if (!action) return;
+        if (action.command) {
+          const args = [...action.command.args];
+          void (ctx.executeCommand?.(action.command.name, args)
+            ?? Promise.resolve(ctx.print(`Cannot run /${action.command.name} — command execution is unavailable here.`)));
+          return;
+        }
+        ctx.print(action.description);
+      },
+    );
+    return;
+  }
+  // No selection surface (headless/command-only): list actions honestly.
+  ctx.print([
+    'Recommended actions:',
+    ...actions.map((action) => (
+      action.command
+        ? `  • ${action.description} — /${action.command.name}${action.command.args.length > 0 ? ` ${action.command.args.join(' ')}` : ''}`
+        : `  • ${action.description} (manual step)`
+    )),
+  ].join('\n'));
+}
+
 export function registerProviderAccountsRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'accounts',
@@ -29,7 +96,7 @@ export function registerProviderAccountsRuntimeCommands(registry: CommandRegistr
     async handler(args, ctx) {
       const sub = (args[0] ?? 'review').toLowerCase();
       if (sub === 'panel' || sub === 'open') {
-        ctx.openModal?.('providers-modal'); // W6.1: accounts alias -> provider-health modal
+        ctx.openModal?.('providers-modal'); // accounts alias -> provider-health modal
         return;
       }
       const snapshot = await loadProviderAccountSnapshot(ctx);
@@ -63,10 +130,8 @@ export function registerProviderAccountsRuntimeCommands(registry: CommandRegistr
           `  preferred route: ${record.preferredRoute}`,
           ...(record.fallbackRisk ? [`  fallback: ${record.fallbackRisk}`] : []),
           ...(record.issues.map((issue) => `  issue: ${issue}`)),
-          ...(record.recommendedActions.length > 0
-            ? ['  next:', ...record.recommendedActions.map((action) => `    ${action}`)]
-            : ['  No active repair actions suggested.']),
         ].join('\n'));
+        presentRecommendedActions(ctx, record.providerId, record.recommendedActions);
         return;
       }
       if (sub === 'show') {
@@ -95,8 +160,8 @@ export function registerProviderAccountsRuntimeCommands(registry: CommandRegistr
           ...record.usageWindows.map((entry) => `  window: ${entry.label} — ${entry.detail}`),
           ...record.issues.map((issue) => `  issue: ${issue}`),
           ...record.notes.map((note) => `  note: ${note}`),
-          ...record.recommendedActions.map((action) => `  next: ${action}`),
         ].join('\n'));
+        presentRecommendedActions(ctx, record.providerId, record.recommendedActions);
         return;
       }
       ctx.print([

package/src/input/commands/provider.ts

@@ -15,14 +15,13 @@
  */
 
 import type { SlashCommand, CommandContext } from '../command-registry.ts';
-import type { ConfigKey } from '../../config/index.ts';
 import type { RouteExplanation } from '@pellux/goodvibes-sdk/platform/providers';
 import type { FallbackTestResult, FallbackTransition } from '@pellux/goodvibes-sdk/platform/providers';
 import type { ProviderApiModelRecord } from '@pellux/goodvibes-sdk/platform/providers';
 import { requireProviderApi } from './runtime-services.ts';
+import { featureEnablementWrite } from '../../runtime/feature-settings.ts';
 
 const PROVIDER_OPTIMIZER_FLAG = 'provider-optimizer';
-const PROVIDER_OPTIMIZER_CONFIG_KEY = `featureFlags.${PROVIDER_OPTIMIZER_FLAG}` as ConfigKey;
 
 // ---------------------------------------------------------------------------
 // Formatting helpers
@@ -95,9 +94,12 @@ function handleOptimizerToggle(
   const wasEnabled = optimizer.enabled;
   optimizer.setEnabled(enable);
 
-  // Persist to config so the setting survives restart.
-  const flagValue = enable ? 'enabled' : 'disabled';
-  context.platform.configManager.setDynamic(PROVIDER_OPTIMIZER_CONFIG_KEY, flagValue);
+  // Persist to config so the setting survives restart: the optimizer is
+  // governed by the provider.optimizerMode settings key (off = disabled;
+  // manual/auto/pinned = active), and the settings bridge forwards the same
+  // write to the runtime gate.
+  const write = featureEnablementWrite(PROVIDER_OPTIMIZER_FLAG, enable);
+  if (write) context.platform.configManager.setDynamic(write.key, write.value);
 
   if (enable && !wasEnabled) {
     context.print('[provider] Optimizer enabled.');

package/src/input/commands/recall-files-git.ts

@@ -1,57 +1,19 @@
 /**
- * recall-files-git.ts — the synchronous git seam for memory file projection.
+ * recall-files-git.ts — the git seam for memory file projection.
  *
- * `projectMemoryToFiles(records, dir, { git })` (SDK, platform/state) is a
- * pure synchronous function and its `MemoryProjectionGit` seam is declared
- * synchronous (`add(dir): void`, `commit(dir, message): void`) — it throws on
- * failure rather than returning a result. The TUI's existing git wrapper,
- * `GitService` (platform/git), is async (wraps simple-git), so it cannot
- * satisfy this seam directly. `GitService`'s own static helpers
- * (initRepo/isGitRepo/getRepoRoot) ARE synchronous, using `Bun.spawnSync`
- * directly (see service.ts) — this file follows the exact same convention
- * for `add`/`commit` so the seam matches the SDK's synchronous contract.
+ * The SDK owns the production seam now (`createMemoryProjectionGit`,
+ * platform/state): it shells out to the system git, commits with a neutral
+ * projection identity (never the operator's), tolerates an unchanged tree,
+ * and — through `projectMemoryToFiles`'s ownership gate — only ever commits
+ * to a repository whose toplevel IS the projection directory, initializing
+ * one there when needed. A projection directory nested inside some other
+ * checkout can never pollute that checkout. This module is a thin local
+ * seam factory so command code keeps a single import site.
  */
+import { createMemoryProjectionGit } from '@pellux/goodvibes-sdk/platform/state';
 import type { MemoryProjectionGit } from '@pellux/goodvibes-sdk/platform/state';
-import { GitService } from '@pellux/goodvibes-sdk/platform/git';
 
-function decode(bytes: Uint8Array | undefined): string {
-  return bytes ? new TextDecoder().decode(bytes).trim() : '';
-}
-
-/**
- * Build a synchronous git seam rooted at `repoRoot`. `commit()` treats a
- * "nothing to commit" exit as a benign no-op (not an error) so
- * `/recall files sync` stays safely re-runnable when the projection files
- * did not actually change since the last sync — any OTHER commit failure
- * (no git identity configured, hook rejection, etc.) still throws, since the
- * seam's contract has no way to report partial failure back to the caller
- * other than throwing.
- */
-export function createSyncGitSeam(repoRoot: string): MemoryProjectionGit {
-  return {
-    add(dir: string): void {
-      const result = Bun.spawnSync(['git', 'add', dir], { cwd: repoRoot });
-      if (result.exitCode !== 0) {
-        throw new Error(`git add failed: ${decode(result.stderr) || 'unknown error'}`);
-      }
-    },
-    commit(dir: string, message: string): void {
-      const result = Bun.spawnSync(['git', 'commit', '-m', message, '--', dir], { cwd: repoRoot });
-      if (result.exitCode === 0) return;
-      const output = `${decode(result.stdout)} ${decode(result.stderr)}`;
-      if (/nothing to commit/i.test(output)) return; // benign — no new/changed files this run
-      throw new Error(`git commit failed: ${output.trim() || 'unknown error'}`);
-    },
-  };
-}
-
-/**
- * Resolve the git seam for `dir`, or null when `dir` is not inside a git
- * repository. Never auto-initializes a repository — that is a much bigger
- * side effect than a memory sync command should take unasked.
- */
-export function resolveSyncGitSeam(dir: string): { seam: MemoryProjectionGit; repoRoot: string } | null {
-  const repoRoot = GitService.getRepoRoot(dir);
-  if (!repoRoot) return null;
-  return { seam: createSyncGitSeam(repoRoot), repoRoot };
+/** The projection git seam (see module note — SDK-owned behavior). */
+export function createSyncGitSeam(): MemoryProjectionGit {
+  return createMemoryProjectionGit();
 }

package/src/input/commands/recall-files.ts

@@ -39,7 +39,7 @@ import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import { requireShellPaths } from './runtime-services.ts';
 import { getMemorySpine } from './recall-query.ts';
 import { readMemoryProjectionDir } from './recall-files-config.ts';
-import { resolveSyncGitSeam } from './recall-files-git.ts';
+import { createSyncGitSeam } from './recall-files-git.ts';
 
 const PROJECTION_LIST_LIMIT = 5000;
 
@@ -58,19 +58,16 @@ export async function handleRecallFilesSync(args: string[], context: CommandCont
 
   const dir = resolveProjectionDir(args, context);
   const records = await memory.list({ limit: PROJECTION_LIST_LIMIT });
-  // Resolve the git seam from the project working directory, not `dir` itself
-  // — `dir` may not exist yet on a first sync, and `git -C <dir>` requires the
-  // directory to already exist. The working directory is always real.
-  const gitSeam = resolveSyncGitSeam(requireShellPaths(context).workingDirectory);
 
   try {
-    const report = projectMemoryToFiles(records, dir, gitSeam ? { git: gitSeam.seam } : {});
+    // The SDK's ownership gate commits only to a repository whose toplevel IS
+    // the projection directory (initializing one there when needed) — never
+    // to a checkout the directory merely sits inside.
+    const report = projectMemoryToFiles(records, dir, { git: createSyncGitSeam() });
     context.print(`[recall] Projected ${report.written.length} record(s) to ${report.dir}`);
-    if (gitSeam) {
-      context.print(report.committed ? `  committed in ${gitSeam.repoRoot}` : '  not committed (git seam did not run)');
-    } else {
-      context.print(`  not committed: ${dir} is not inside a git repository`);
-    }
+    context.print(report.committed
+      ? `  committed in ${report.dir} (the projection's own repository)`
+      : '  not committed (git seam did not run)');
   } catch (error) {
     context.print(`[recall] Projection sync failed: ${summarizeError(error)}`);
   }

package/src/input/commands/recall-review.ts

@@ -112,9 +112,9 @@ export function handleRecallExplain(args: string[], context: CommandContext): vo
  * `exportState()` returns the same full `AgentRecord[]` (it's what
  * compactConversation() already uses for the same reason).
  *
- * With NO agent id (wo805 wiring), renders the MAIN interactive session's own
+ * With NO agent id (wiring), renders the MAIN interactive session's own
  * per-turn injection ring — `Orchestrator.getTurnInjections()`, threaded onto
- * the command context as `session.getMainSessionTurnInjections`. As of wo805 the
+ * the command context as `session.getMainSessionTurnInjections`. As of the
  * main session DOES route through the passive-injection engine, so this is the
  * honest main-session default (previously there was no record source, so the
  * no-id path could only print a usage hint). When the accessor isn't wired

package/src/input/commands/relay-runtime.ts

@@ -47,7 +47,7 @@ async function renderStatus(ctx: CommandContext): Promise<void> {
 async function renderPair(ctx: CommandContext): Promise<void> {
   const cfg = relayConfigured(ctx);
   if (!cfg.enabled || !cfg.flagOn) {
-    ctx.print('Relay is disabled — enable relay.enabled and the relay-connect feature flag first (see /config relay, /flags).');
+    ctx.print('Relay is disabled — turn on relay.enabled in /config relay first.');
     return;
   }
   const externalServices = ctx.platform.externalServices;

package/src/input/commands/remote-runtime.ts

@@ -48,7 +48,7 @@ export function registerRemoteRuntimeCommands(registry: CommandRegistry): void {
     async handler(args, ctx) {
       if (args.length === 0) {
         if (ctx.openModal) {
-          ctx.openModal('remote-modal'); // W6.1: remote panel -> config modal
+          ctx.openModal('remote-modal'); // remote panel -> config modal
           return;
         }
         ctx.print('Remote surface is not available in this runtime.');

package/src/input/commands/runtime-services.ts

@@ -104,8 +104,8 @@ export function openCommandPanel(
 }
 
 /**
- * W6.1 (group-B migration): open a config-modal surface by name via the
- * ctx.openModal seam (ui-openers wires it; the WO-A host replaces the interim
+ * (group-B migration): open a config-modal surface by name via the
+ * ctx.openModal seam (ui-openers wires it; the host replaces the interim
  * "not available yet" implementation with real dispatch). Front-doors for
  * panels that migrated to modals call this instead of openCommandPanel — the
  * modal is the surface's new home. Stubbed in tests by setting ctx.openModal.
@@ -256,7 +256,7 @@ export function requireProviderApi(context: CommandContext): ProviderApi {
 }
 
 /** Result of a manual /compact run: the SDK's CompactionEvent, plus an
- * out-of-band quality score (W5.4/B28) when one could be computed. */
+ * out-of-band quality score () when one could be computed. */
 export interface CompactionRunResult {
   readonly event: CompactionEvent;
   readonly qualityScore: CompactionQualityScore | null;
@@ -328,7 +328,7 @@ export async function compactConversation(context: CommandContext): Promise<Comp
   const eventAfter = getLastCompactionEvent();
   // Return the new event only if it differs from the one recorded before the call.
   if (eventAfter !== null && eventAfter !== eventBefore) {
-    // W5.4/B28: score this run out-of-band (see compaction-quality.ts for why
+    //: score this run out-of-band (see compaction-quality.ts for why
     // this can't just subscribe to the SDK's own CompactionManager pipeline)
     // and keep the score keyed by this event's timestamp for /compact-history.
     const qualityScore = scoreCompactionRun({