@pellux/goodvibes-tui 1.16.1 → 1.17.0

package/src/input/onboarding/onboarding-wizard-steps.ts

@@ -10,6 +10,8 @@ import {
 } from './onboarding-wizard-external-surfaces.ts';
 import { buildFeatureUnitSteps } from './onboarding-feature-units.ts';
 import { countSelected, modelSelectionLabel, normalizeText } from './onboarding-wizard-helpers.ts';
+import { deriveProviderKeyCaptureTargets } from '../../runtime/onboarding/provider-key-capture.ts';
+import { buildProviderKeyInventoryField, buildProviderKeyMaskedFields, buildSubscriptionPosture } from './onboarding-provider-key-fields.ts';
 import { getDaemonSource, pushDaemonAdoptionFields, pushLegacyDaemonMigrationFields } from './onboarding-wizard-network-adopt.ts';
 import type { OnboardingWizardControllerLike } from './onboarding-wizard-types.ts';
 import type { OnboardingWizardAcknowledgementFieldDefinition, OnboardingWizardActionFieldDefinition, OnboardingWizardChecklistFieldDefinition, OnboardingWizardExternalSurfaceStepId, OnboardingWizardFieldDefinition, OnboardingWizardModelPickerFieldDefinition, OnboardingWizardRadioFieldDefinition, OnboardingWizardRadioOption, OnboardingWizardStepDefinition } from './onboarding-wizard-types.ts';
@@ -150,10 +152,20 @@ export function buildProvidersStep(controller: OnboardingWizardControllerLike):
     const providerAck = controller.runtimeDerived.reopenEditAcknowledgements.providers;
     const activeSubscriptions = controller.runtimeSnapshot?.subscriptions.active ?? [];
     const pendingSubscriptions = controller.runtimeSnapshot?.subscriptions.pending ?? [];
-    const openAiActive = activeSubscriptions.some((subscription) => subscription.provider === 'openai');
-    const openAiPending = pendingSubscriptions.some((subscription) => subscription.provider === 'openai');
-    const providerSecretCount = controller.runtimeSnapshot?.secrets.records.filter((record) => record.key.endsWith('_API_KEY') || record.key.endsWith('_TOKEN')).length ?? 0;
-    const openAiApiKeyConfigured = controller.runtimeSnapshot?.secrets.records.some((record) => record.key === 'OPENAI_API_KEY') ?? false;
+    // Provider-agnostic subscription posture: one status row per
+    // subscription-capable provider (registration truth), plus any provider with
+    // a live/pending session, and which provider's in-wizard sign-in applies now.
+    const subscription = buildSubscriptionPosture(
+      activeSubscriptions.map((entry) => entry.provider),
+      pendingSubscriptions.map((entry) => entry.provider),
+      controller.runtimeSnapshot?.providerAccounts?.providers,
+    );
+    const signInPending = subscription.signInPending;
+    // Provider-agnostic key capture: one field per provider the registry knows
+    // accepts an API key (derived from registration truth — never a hardcoded
+    // vendor list). No provider is named as the only option.
+    const keyTargets = deriveProviderKeyCaptureTargets(controller.runtimeSnapshot?.providerAccounts?.providers);
+    const configuredKeyCount = keyTargets.filter((target) => target.configured).length;
     const providerReviewField: OnboardingWizardAcknowledgementFieldDefinition = {
       kind: 'acknowledgement',
       id: 'providers.reviewed',
@@ -166,46 +178,21 @@ export function buildProvidersStep(controller: OnboardingWizardControllerLike):
     };
 
     const fields: OnboardingWizardFieldDefinition[] = [
-      {
-        kind: 'status',
-        id: 'providers.openai-subscription',
-        label: 'OpenAI subscription status',
-        hint: openAiActive
-          ? 'An OpenAI subscription session is already available.'
-          : openAiPending
-            ? 'An OpenAI subscription login is pending.'
-            : 'No OpenAI subscription session was found in the current runtime state.',
-        defaultValue: openAiActive ? 'Active' : openAiPending ? 'Pending' : 'Not detected',
-      },
-      {
-        kind: 'status',
-        id: 'providers.api-key-inventory',
-        label: 'Provider API key inventory',
-        hint: providerSecretCount > 0
-          ? `${providerSecretCount} provider credential reference(s) were found. Values stay masked.`
-          : 'No provider API key references were detected in the current runtime state.',
-        defaultValue: providerSecretCount > 0 ? `${providerSecretCount} configured` : 'None detected',
-      },
-      {
-        kind: 'masked',
-        id: 'providers.openai-api-key',
-        label: 'OpenAI API key',
-        hint: openAiApiKeyConfigured
-          ? 'An OpenAI API key is already stored. Leave blank to keep it; enter a new key to replace it through the secret manager.'
-          : 'Optional: enter an OpenAI API key now. The value is stored through the secret manager, not in config.',
-        placeholder: openAiApiKeyConfigured ? 'already configured' : 'sk-...',
-        defaultValue: '',
-      },
-      ...(openAiActive ? [] : [
+      ...subscription.statusFields,
+      buildProviderKeyInventoryField(keyTargets),
+      // One masked field per key-accepting provider. Entered values are stored
+      // through the secret manager at apply and the provider re-registers live.
+      ...buildProviderKeyMaskedFields(keyTargets),
+      ...(!subscription.signInProviderId ? [] : [
         {
           kind: 'action' as const,
           id: 'providers.openai-subscription-start',
           action: 'start-openai-subscription' as const,
-          label: openAiPending ? 'Restart OpenAI subscription sign-in' : 'Start OpenAI subscription sign-in',
+          label: signInPending ? 'Restart OpenAI subscription sign-in' : 'Start OpenAI subscription sign-in',
           hint: 'Opens the OpenAI sign-in flow from the wizard and records pending login state here.',
-          defaultValue: openAiPending ? 'Restart' : 'Start',
+          defaultValue: signInPending ? 'Restart' : 'Start',
         },
-        ...(openAiPending ? [
+        ...(signInPending ? [
           {
             kind: 'text' as const,
             id: 'providers.openai-authorization-url',
@@ -239,12 +226,13 @@ export function buildProvidersStep(controller: OnboardingWizardControllerLike):
       id: 'provider-access',
       title: 'AI provider access',
       shortLabel: 'Providers',
-      description: 'Review subscription posture and optionally add an OpenAI API key directly through the wizard.',
+      description: 'Review subscription posture and optionally add an API key for any provider that accepts one, directly through the wizard.',
       summaryTitle: 'Provider access summary',
       summaryLines: [
-        `OpenAI subscription: ${openAiActive ? 'active' : openAiPending ? 'pending' : 'not detected'}`,
-        `OpenAI API key: ${openAiApiKeyConfigured ? 'configured' : 'not detected'}`,
-        `Provider credential references: ${providerSecretCount}`,
+        subscription.summaryLine,
+        keyTargets.length === 0
+          ? 'Provider API keys: no key-accepting providers registered'
+          : `Provider API keys: ${configuredKeyCount}/${keyTargets.length} configured`,
         `Review: ${controller.getFieldValueLabel(providerReviewField)}`,
       ],
       fields,

package/src/input/panel-integration-actions.ts

@@ -2,14 +2,14 @@ import type { CommandContext } from './command-registry.ts';
 import type { Panel } from '../panels/types.ts';
 import type { PanelManager } from '../panels/panel-manager.ts';
 
-// W6.1 (the purge): every instanceof-routed branch this file used to carry
+// (the purge): every instanceof-routed branch this file used to carry
 // (FileExplorerPanel/FilePreviewPanel/SymbolOutlinePanel — DELETE;
 // ApprovalPanel/TasksPanel/OrchestrationPanel/AgentInspectorPanel —
 // RETIRE-INTO-FLEET) targeted a panel class that no longer exists. Panels
 // migrated onto the formal `Panel.handlePanelIntegrationAction` hook (the
 // preferred seam — see the comment below) are unaffected; this function now
 // only provides that passthrough. See
-// .goodvibes/audit/2026-07-04-wave6-briefs.json (W6.1) for the disposition
+// .goodvibes/audit/2026-07-04-wave6-briefs.json for the disposition
 // map.
 export function handlePanelIntegrationAction(
   panelManager: PanelManager,

package/src/input/panel-mouse-geometry.ts

@@ -3,7 +3,7 @@
 //
 // Pure mouse-geometry helpers for the panel workspace, extracted from
 // handler-feed-routes.ts so that file stays under the 800-line architecture
-// cap once the UX-C focus verbs and the DEBT-5 paste-flood guard both live in
+// cap once the focus verbs and the paste-flood guard both live in
 // it. These map a terminal (row, col) onto the panel/pane/workspace-tab under
 // the cursor. No dependency on the feed-route state types, so no import cycle.
 // ---------------------------------------------------------------------------

package/src/input/panel-paste-flood-guard.ts

@@ -1,5 +1,5 @@
 // ---------------------------------------------------------------------------
-// panel-paste-flood-guard.ts — DEBT-5 item 5.
+// panel-paste-flood-guard.ts — item 5.
 //
 // A terminal WITHOUT bracketed paste delivers a pasted block as a burst of
 // discrete 1-char 'text' tokens (isPasteToken stays false for every one of

package/src/input/provider-key-intake.ts

@@ -0,0 +1,167 @@
+/**
+ * Provider key intake — capture a provider's API key at the moment the user
+ * selects an unconfigured provider or model, store it through the secrets
+ * manager (never env-only, never cleartext into config or provider JSON), let
+ * the provider re-register live, then complete the user's original selection.
+ *
+ * The decision of whether a key is needed is read from the provider's own
+ * registration-time auth state (describeAuthState / isConfigured) — never a
+ * hardcoded vendor list — so this works for any provider the registry knows
+ * accepts a key. The secrets-store key name is the provider's declared auth env
+ * var; it is used only as the storage key and is never shown to the user.
+ */
+
+import type { LLMProvider } from '@pellux/goodvibes-sdk/platform/providers';
+import type { ConcealedInputRequest } from './concealed-input.ts';
+import type { CommandContext } from './command-registry.ts';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+
+/** The intake decision derived purely from a provider's registration truth. */
+export interface ProviderKeyIntakeDecision {
+  /** True when the provider accepts a key and does not yet have one. */
+  readonly needsKey: boolean;
+  /** Secrets-store key to write the value under (the provider's auth env var). */
+  readonly secretKey?: string;
+  /** True when the provider already has a credential (no prompt needed). */
+  readonly alreadyConfigured: boolean;
+}
+
+/**
+ * Decide whether to prompt for a key, reading only the provider's own auth
+ * state. A provider that is already configured, works anonymously, or declares
+ * no accepted env var is left alone (proceed straight through). A provider that
+ * does not declare an auth state at all is treated per isConfigured(), and an
+ * unknown state is assumed configured so a working selection is never nagged.
+ */
+export function decideProviderKeyIntake(provider: LLMProvider | undefined): ProviderKeyIntakeDecision {
+  if (!provider) return { needsKey: false, alreadyConfigured: false };
+  const state = provider.describeAuthState?.();
+  if (state) {
+    if (state.configured) return { needsKey: false, alreadyConfigured: true };
+    if (state.anonymousReady) return { needsKey: false, alreadyConfigured: false };
+    const secretKey = state.authEnvVars[0];
+    if (secretKey) return { needsKey: true, secretKey, alreadyConfigured: false };
+    return { needsKey: false, alreadyConfigured: false };
+  }
+  const configured = provider.isConfigured?.() ?? true;
+  return { needsKey: false, alreadyConfigured: configured };
+}
+
+/** Human-facing name for a provider — plain, vendor-neutral, never an env var. */
+export function providerIntakeLabel(providerId: string): string {
+  return `the ${providerId} provider`;
+}
+
+/** Dependencies the intake orchestrator needs, decoupled from the command context for testing. */
+export interface ProviderKeyIntakeDeps {
+  /** The provider instance whose registration-time auth state drives the decision. */
+  readonly provider: LLMProvider | undefined;
+  /** Canonical secret store — the same path /secrets set writes through. */
+  readonly secretsManager?: {
+    set(key: string, value: string, options?: { scope?: 'project' | 'user'; medium?: 'secure' | 'plaintext' }): Promise<void>;
+  } | undefined;
+  /** Re-resolves credentials and re-registers providers live (no restart). */
+  readonly refreshProviderCredentials?: (() => Promise<void>) | undefined;
+  /** Begins one line of concealed composer input for the key. */
+  readonly beginConcealedInput?: ((request: ConcealedInputRequest) => void) | undefined;
+  /** Surfaces short status lines to the transcript. */
+  readonly print: (text: string) => void;
+}
+
+/**
+ * If the selected provider needs a key, open the concealed prompt, store the
+ * pasted value through the secrets manager, re-register the provider live, then
+ * run `proceed` (the user's original selection). If no key is needed — or the
+ * concealed surface is unavailable — `proceed` runs immediately. `proceed`
+ * always runs exactly once, including when the user skips (empty/Escape), so a
+ * selection is never stranded.
+ */
+export function runProviderKeyIntake(
+  providerId: string,
+  deps: ProviderKeyIntakeDeps,
+  proceed: () => void,
+): void {
+  const decision = decideProviderKeyIntake(deps.provider);
+  if (!decision.needsKey || !decision.secretKey) {
+    proceed();
+    return;
+  }
+  const { secretsManager, beginConcealedInput } = deps;
+  if (!secretsManager || !beginConcealedInput) {
+    // No canonical store or no concealed surface here — keep the selection
+    // rather than blocking it; the user can add the key via /secrets set later.
+    proceed();
+    return;
+  }
+  const secretKey = decision.secretKey;
+  const label = providerIntakeLabel(providerId);
+  let completed = false;
+  const finishOnce = (): void => {
+    if (completed) return;
+    completed = true;
+    proceed();
+  };
+  deps.print(`Enter the API key for ${label} (input is masked; press Enter to store, Esc to skip).`);
+  beginConcealedInput({
+    label: providerId,
+    onSubmit: (value) => {
+      if (value.length === 0) {
+        deps.print(`No key entered for ${label}; selection kept, no key stored.`);
+        finishOnce();
+        return;
+      }
+      void (async () => {
+        try {
+          await secretsManager.set(secretKey, value, { scope: 'user', medium: 'secure' });
+          await deps.refreshProviderCredentials?.();
+          deps.print(`Stored the API key for ${label} and registered it live (value hidden). No restart needed.`);
+        } catch (error) {
+          deps.print(`Could not store the key for ${label}: ${summarizeError(error)}`);
+        }
+        finishOnce();
+      })();
+    },
+    onCancel: () => {
+      deps.print(`Key entry skipped for ${label}; selection kept, no key stored.`);
+      finishOnce();
+    },
+  });
+}
+
+/**
+ * Command-context adapter for {@link runProviderKeyIntake}: resolves the live
+ * provider, secrets manager, live re-registration hook, and concealed-input
+ * surface from the shell command context, then runs the intake before
+ * completing the user's original selection (`proceed`).
+ */
+export function ensureProviderKeyThenSelect(
+  ctx: CommandContext,
+  providerId: string,
+  proceed: () => void,
+): void {
+  // Resolve the live provider defensively: a command context that routes only
+  // through the provider API (no raw registry access) leaves the intake a no-op
+  // and the selection completes unchanged.
+  let registry: CommandContext['provider']['providerRegistry'] | undefined;
+  let provider: ReturnType<CommandContext['provider']['providerRegistry']['tryGet']> | undefined;
+  try {
+    registry = ctx.provider?.providerRegistry;
+    provider = registry?.tryGet?.(providerId);
+  } catch {
+    registry = undefined;
+    provider = undefined;
+  }
+  runProviderKeyIntake(
+    providerId,
+    {
+      provider,
+      secretsManager: ctx.platform?.secretsManager,
+      refreshProviderCredentials: registry
+        ? () => registry!.refreshProviderCredentials()
+        : undefined,
+      beginConcealedInput: ctx.beginConcealedInput,
+      print: (text) => ctx.print(text),
+    },
+    proceed,
+  );
+}

package/src/input/sandbox-exec-config.ts

@@ -59,14 +59,14 @@ export const SANDBOX_EGRESS_ALLOWLIST_SYNTHETIC_SETTING: ConfigSetting = {
   key: SANDBOX_EGRESS_ALLOWLIST_CONFIG_KEY,
   type: 'string',
   default: [],
-  description: 'Comma-separated command base names (or "*" for all) whose network access is re-enabled inside the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants network"). Empty = the sandbox disables network for every command. Only takes effect when sandbox.enabled is on, the graduation-tracked exec-sandbox feature flag is on, and bubblewrap is available (Linux only — reports unavailable elsewhere).',
+  description: 'Comma-separated command base names (or "*" for all) whose network access is re-enabled inside the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants network"). Empty = the sandbox disables network for every command. Only takes effect when sandbox.enabled is on, the exec-sandbox setting is on, and bubblewrap is available (Linux only — reports unavailable elsewhere).',
 };
 
 export const SANDBOX_WORKSPACE_WRITABLE_SYNTHETIC_SETTING: ConfigSetting = {
   key: SANDBOX_WORKSPACE_WRITABLE_CONFIG_KEY,
   type: 'string',
   default: [],
-  description: 'Comma-separated absolute paths outside the workspace bound writable into the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants path outside workspace"). Empty = only the workspace (and an isolated /tmp) is writable. Only takes effect when sandbox.enabled is on, the graduation-tracked exec-sandbox feature flag is on, and bubblewrap is available (Linux only — reports unavailable elsewhere).',
+  description: 'Comma-separated absolute paths outside the workspace bound writable into the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants path outside workspace"). Empty = only the workspace (and an isolated /tmp) is writable. Only takes effect when sandbox.enabled is on, the exec-sandbox setting is on, and bubblewrap is available (Linux only — reports unavailable elsewhere).',
 };
 
 function buildSandboxExecListEntry(configManager: Pick<ConfigManager, 'get'>, setting: ConfigSetting): SettingEntry {

package/src/input/selection-modal.ts

@@ -37,7 +37,7 @@ export class SelectionModal {
   public allowSearch = true;
   public customActions: Map<string, SelectionAction> = new Map();
   /**
-   * UX-C vocab unification: overrides the default per-primaryAction Enter
+   * vocab unification: overrides the default per-primaryAction Enter
    * verb ("Select"/"Toggle"/"Edit"/"Delete") shown in the footer hint. Used by
    * callers whose items are really commands (e.g. /help) so the hint reads
    * "[Enter] Run", matching the slash-command palette's own verb, instead of

package/src/input/settings-modal-activation.ts

@@ -92,6 +92,11 @@ export function activateSelected(ctx: ActivateSelectedContext): void {
     const idx = setting.enumValues.indexOf(entry.currentValue as string);
     const nextIdx = (idx + 1) % setting.enumValues.length;
     ctx.setValue(setting.key as ConfigKey, setting.enumValues[nextIdx]);
+  } else if (setting.type === 'object') {
+    // Object-typed keys (e.g. pricing.modelPrices) edit as JSON: seed the
+    // buffer with the current value's JSON so the edit starts from truth.
+    ctx.setEditingMode(true);
+    ctx.setEditBuffer(JSON.stringify(entry.currentValue ?? {}));
   } else if (setting.type === 'string' || setting.type === 'number') {
     // Enter inline edit mode
     ctx.setEditingMode(true);

package/src/input/settings-modal-adjustment.ts

@@ -1,9 +1,8 @@
 /**
  * settings-modal-adjustment — pure adjustment helpers for SettingsModal.
  *
- * These functions encapsulate the two directional-adjustment operations:
+ * These functions encapsulate the directional-adjustment operation:
  *   - adjustSelected: cycle enum/boolean/number values via left/right arrow keys
- *   - toggleSelectedFlag: toggle a feature flag between enabled and disabled
  *
  * Each function takes its dependencies as explicit arguments rather than
  * accessing class-level state directly, following the same pattern as
@@ -13,11 +12,9 @@
 import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { FeatureFlagManager } from '@/runtime/index.ts';
-import type { FlagState } from '@/runtime/index.ts';
 import type { FlagEntry, McpEntry, SettingEntry } from './settings-modal-types.ts';
 import { buildMcpEntries } from './settings-modal-data.ts';
 import { getNumericAdjustmentMeta, roundToPrecision } from './settings-modal-behavior.ts';
-import { applyFlagState } from './settings-modal-mutations.ts';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
 
 // ---------------------------------------------------------------------------
@@ -45,10 +42,9 @@ export function adjustSelected(
 ): void {
   if (ctx.editingMode) return;
 
-  // Feature-unit toggle headers (setting.type === 'boolean', key featureFlags.<id>)
-  // now live across topical categories, not a single flags tab. They fall through
-  // to the boolean branch below, which routes through setValue → the modal's
-  // flag-toggle chokepoint. No category-special-case is needed here anymore.
+  // Feature-unit headers are the real config rows for their enablement keys
+  // (boolean or enum), so they fall through to the ordinary branches below —
+  // a plain config write the settings bridge forwards to the gate manager.
 
   if (ctx.currentCategory === 'mcp') {
     const entry = ctx.getSelectedMcp();
@@ -96,26 +92,3 @@ export function adjustSelected(
     ctx.setValue(setting.key as ConfigKey, nextValue);
   }
 }
-
-// ---------------------------------------------------------------------------
-// toggleSelectedFlag
-// ---------------------------------------------------------------------------
-
-export interface ToggleSelectedFlagContext {
-  readonly featureFlagManager: FeatureFlagManager | null;
-  readonly configManager: ConfigManager | null;
-  getSelectedFlag(): FlagEntry | null;
-}
-
-export function toggleSelectedFlag(ctx: ToggleSelectedFlagContext): void {
-  const flagEntry = ctx.getSelectedFlag();
-  if (!flagEntry || !ctx.featureFlagManager || !ctx.configManager) return;
-
-  const { state } = flagEntry;
-
-  // Killed flags are blocked
-  if (state === 'killed') return;
-
-  const newState: FlagState = state === 'enabled' ? 'disabled' : 'enabled';
-  applyFlagState(flagEntry, newState, ctx.featureFlagManager, ctx.configManager);
-}

package/src/input/settings-modal-data.ts

@@ -52,16 +52,15 @@ import {
 } from './settings-modal-types.ts';
 import { enrichRelaySettingDescriptions } from './relay-settings-descriptions.ts';
 import { applyFeatureUnitLayout } from './feature-unit-layout.ts';
+import { FEATURE_SETTINGS_BY_ID } from '../runtime/feature-settings.ts';
 
 // ---------------------------------------------------------------------------
 // deepEqual — structural equality for isDefault comparisons
 // ---------------------------------------------------------------------------
 
 /**
- * Structural equality check for setting default comparisons.
- * Handles scalars, arrays, and plain objects. Does NOT support
- * circular references or non-plain prototypes — config defaults
- * are always JSON-safe primitives, arrays, or plain objects.
+ * Structural equality for setting-default comparisons: scalars, arrays, and
+ * plain objects (config defaults are always JSON-safe; no circular refs).
  */
 export function deepEqual(a: unknown, b: unknown): boolean {
   if (a === b) return true;
@@ -98,9 +97,8 @@ export function buildSettingGroups(
   featureFlagManager?: FeatureFlagManager | null,
 ): Map<SettingsCategory, SettingEntry[]> {
   const groups = new Map<SettingsCategory, SettingEntry[]>();
-  // Every category starts empty (including 'flags', now the Advanced Features
-  // bucket, and the new fetch/agents/security/integrations/policy/notifications
-  // namespaces) and is filled from CONFIG_SCHEMA below.
+  // Every category starts empty and is filled from CONFIG_SCHEMA below; the
+  // feature-unit layout pass then folds each capability's rows into one unit.
   for (const cat of SETTINGS_CATEGORIES) groups.set(cat, []);
 
   for (const setting of CONFIG_SCHEMA) {
@@ -124,7 +122,7 @@ export function buildSettingGroups(
     }
   }
 
-  // DEBT-2: inject the synthetic display.themeMode enum (auto|dark|light). TUI-local
+  // inject the synthetic display.themeMode enum (auto|dark|light). TUI-local
   // key stored under the existing `display` section (see theme-mode-config.ts for why
   // not `appearance`), same rationale as the other synthetic settings below.
   const displayEntries = groups.get('display');
@@ -181,7 +179,7 @@ export function buildSettingGroups(
     behaviorEntries.push(buildBudgetAlertUsdSyntheticEntry(configManager));
   }
 
-  // Inject the W2.3 alert-class toggles + master focus gate. TUI-local
+  // Inject the alert-class toggles + master focus gate. TUI-local
   // synthetic settings, same rationale as notifyAfterSeconds above.
   if (behaviorEntries) {
     for (const entry of buildNotifyAlertSyntheticEntries(configManager)) {
@@ -240,11 +238,10 @@ export function buildSettingGroups(
   // the SDK's own descriptions don't carry (see relay-settings-descriptions.ts).
   enrichRelaySettingDescriptions(groups);
 
-  // Feature-unit presentation: turn each flag into ONE unit (toggle + the config
-  // keys it tunes) hosted in its topical category, folding no-config flags into
-  // the Advanced Features bucket. Sourced from FEATURE_FLAG_CONFIG. Runs AFTER
-  // synthetic injection so non-flag-owned rows stay as orphans; skipped on the
-  // flagless test path.
+  // Feature-unit presentation: each capability becomes ONE unit (its real
+  // enablement row + the settings keys it tunes) in its settings domain,
+  // sourced from FEATURE_SETTINGS. Runs AFTER synthetic injection so
+  // non-feature-owned rows stay orphans; skipped on the featureless path.
   if (featureFlagManager) applyFeatureUnitLayout(groups, buildFlagEntries(featureFlagManager));
 
   // learning.consolidation.* is a real SDK config domain now, so its keys arrive
@@ -301,7 +298,7 @@ export function buildTtsSpeedSyntheticEntry(configManager: Pick<ConfigManager, '
 }
 
 // ---------------------------------------------------------------------------
-// display.themeMode synthetic setting (DEBT-2 light theme)
+// display.themeMode synthetic setting (light theme)
 // ---------------------------------------------------------------------------
 
 /**
@@ -415,11 +412,11 @@ export function buildBudgetAlertUsdSyntheticEntry(configManager: Pick<ConfigMana
 }
 
 // ---------------------------------------------------------------------------
-// W2.3 alert-class synthetic settings — behavior.notifyOn* + notifyOnlyWhenUnfocused
+// alert-class synthetic settings — behavior.notifyOn* + notifyOnlyWhenUnfocused
 // ---------------------------------------------------------------------------
 
 /**
- * The five W2.3 alert-gating booleans, all TUI-local (not yet in the SDK
+ * The five alert-gating booleans, all TUI-local (not yet in the SDK
  * ConfigKey union), all defaulting to on. Read/written generically by
  * core/alert-gating.ts (readBooleanConfig) and the per-alert-class modules
  * (budget-breach-notifier.ts, approval-alert.ts, turn-event-wiring.ts,
@@ -475,7 +472,7 @@ export function buildNotifyAlertSyntheticEntries(configManager: Pick<ConfigManag
 /**
  * The OSC 9 in-terminal desktop-notification toggles + the audible bell.
  * TUI-local synthetic booleans (not in the SDK ConfigKey union), each carrying
- * its OWN default (unlike the always-on W2.3 alert toggles above): approval-wait
+ * its OWN default (unlike the always-on alert toggles above): approval-wait
  * on, turn-end/agent-blocked off, bell off. Read generically by
  * core/terminal-notifier.ts (readBooleanConfig); this is only the
  * settings-modal-visible surface. These are independent of the master
@@ -537,9 +534,13 @@ export function buildCodeIndexEnabledSyntheticEntry(configManager: Pick<ConfigMa
 
 export function buildFlagEntries(featureFlagManager: FeatureFlagManager | null): FlagEntry[] {
   if (!featureFlagManager) return [];
-  return Array.from(featureFlagManager.getAll().values()).map(
-    ({ flag, state, persistedState, pendingRestart }) => ({ flag, state, persistedState, pendingRestart }),
-  );
+  const entries: FlagEntry[] = [];
+  for (const { flag, state, persistedState, pendingRestart } of featureFlagManager.getAll().values()) {
+    const feature = FEATURE_SETTINGS_BY_ID.get(flag.id);
+    if (!feature) continue; // gate with no settings surface (registry/binding drift is SDK test-guarded)
+    entries.push({ feature, flag, state, persistedState, pendingRestart });
+  }
+  return entries;
 }
 
 // ---------------------------------------------------------------------------

package/src/input/settings-modal-mutations.ts

@@ -1,17 +1,18 @@
 /**
  * settings-modal-mutations — pure mutation helpers for SettingsModal.
  *
- * These functions encapsulate the side-effectful write operations:
- * applying config values, persisting feature flag state, and applying flag
- * runtime toggles. Each function takes its dependencies as explicit arguments
- * rather than accessing class-level state.
+ * These functions encapsulate the side-effectful write operations. Every
+ * write — feature-unit headers included — is a plain domain-settings config
+ * write; the SDK's settings bridge keeps the runtime gate manager in sync
+ * (flipping runtime-toggleable gates live and recording honest
+ * pending-restart markers for startup-gated ones). Each function takes its
+ * dependencies as explicit arguments rather than accessing class-level state.
  */
 
-import type { ConfigKey, PersistedFlagState } from '@pellux/goodvibes-sdk/platform/config';
+import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { FeatureFlagManager } from '@/runtime/index.ts';
-import type { FeatureFlag, FlagState } from '@/runtime/index.ts';
 import type { FlagEntry, SettingEntry } from './settings-modal-types.ts';
 import { deepEqual } from './settings-modal-data.ts';
 
@@ -83,10 +84,12 @@ export function applySettingValue({
     };
   }
 
-  // Update the entry in the groups map
+  // Update every entry carrying this key: cross-listed rows (the network
+  // combined view) and feature-unit headers that share one enablement key
+  // (e.g. both compaction features read behavior.compactionStrategy).
   for (const entries of groups.values()) {
-    const entry = entries.find((candidate) => candidate.setting.key === key);
-    if (entry) {
+    for (const entry of entries) {
+      if (entry.setting.key !== key) continue;
       entry.currentValue = configManager.get(key);
       entry.isDefault = deepEqual(entry.currentValue, entry.setting.default);
     }
@@ -112,65 +115,6 @@ export function applySettingValue({
   return { restartDomain, effectMessage, changed: previousValue !== value };
 }
 
-// ---------------------------------------------------------------------------
-// persistFlagState — write a flag override to config
-// ---------------------------------------------------------------------------
-
-export function persistFlagState(
-  configManager: ConfigManager,
-  flagId: string,
-  newState: FlagState,
-  defaultState: FlagState,
-): void {
-  if (newState === 'killed') return; // never persist killed state
-
-  try {
-    if (newState === defaultState) {
-      // Back at the default: the override must be REMOVED, not merged.
-      // getCategory clones and mergeCategory only sets keys, so the old
-      // delete-then-merge approach left the stale override on disk and the
-      // flag silently reloaded in the overridden state on the next start.
-      configManager.removeCategoryKey('featureFlags', flagId);
-    } else {
-      configManager.mergeCategory('featureFlags', { [flagId]: newState } as Record<string, PersistedFlagState>);
-    }
-  } catch (e) {
-    logger.error('SettingsModal: failed to persist flag state', { flagId, error: summarizeError(e) });
-  }
-}
-
-// ---------------------------------------------------------------------------
-// applyFlagState — toggle a feature flag (runtime + persist)
-// ---------------------------------------------------------------------------
-
-export function applyFlagState(
-  flagEntry: FlagEntry,
-  newState: FlagState,
-  featureFlagManager: FeatureFlagManager,
-  configManager: ConfigManager,
-): void {
-  const flag: FeatureFlag = flagEntry.flag;
-
-  try {
-    // Persist first so the on-disk override is the source of truth, then apply
-    // the same value to the live manager through applyConfigState. That single
-    // call keeps both paths consistent with the SDK's config→flag bridge:
-    //   - runtime-toggleable flags apply immediately (firing flag subscribers
-    //     exactly as a direct enable()/disable() would), and
-    //   - startup-gated flags are NOT faked live — the effective state is left
-    //     untouched and a pending-restart marker is recorded instead.
-    persistFlagState(configManager, flag.id, newState, flag.defaultState as FlagState);
-    featureFlagManager.applyConfigState(flag.id, newState);
-  } catch (e) {
-    logger.error('SettingsModal: failed to toggle feature flag', { flag: flag.id, error: summarizeError(e) });
-  }
-
-  // Reflect the manager's real state, never the requested target: for a
-  // startup-gated flag `state` stays at the unchanged effective value and
-  // `pendingRestart` reports that a restart is needed for `persistedState`.
-  syncFlagEntryFromManager(flagEntry, featureFlagManager);
-}
-
 /**
  * Refresh a FlagEntry's live/persisted/pending fields from the manager's
  * authoritative snapshot so the settings UI never displays a guessed state.