@pellux/goodvibes-tui 1.16.1 → 1.17.0

package/src/runtime/bootstrap-core.ts

@@ -6,6 +6,7 @@ import { ConfigManager, getConfiguredSystemPrompt } from '../config/index.ts';
 import { getProviderIdFromModel } from '../config/provider-model.ts';
 import { ToolRegistry } from '@pellux/goodvibes-sdk/platform/tools';
 import { registerAllTools } from '@pellux/goodvibes-sdk/platform/tools';
+import { createSandboxContainmentNotice } from './daemon-attach-notices.ts';
 import { PermissionManager, createPermissionConfigReader } from '@pellux/goodvibes-sdk/platform/permissions';
 import { Notifier } from '@pellux/goodvibes-sdk/platform/integrations';
 import { Compositor } from '../renderer/compositor.ts';
@@ -17,7 +18,7 @@ import type { ControlPlaneRecentEvent } from '@pellux/goodvibes-sdk/platform/con
 import type { BootstrapOptions } from './context.ts';
 import { createRuntimeStore, createDomainDispatch, type RuntimeStore } from './store/index.ts';
 import {
-  type MutableRuntimeState, type SessionEvent, createFeatureFlagManager, RuntimeEventBus, ForensicsCollector,
+  type MutableRuntimeState, type SessionEvent, bindFeatureSettingsBridge, createFeatureFlagManager, deriveFeatureStates, RuntimeEventBus, ForensicsCollector,
   ForensicsRegistry, generateUserSessionId, loadBootstrapSystemPrompt, syncConfiguredServices,
   registerBootstrapHookBridge, registerBootstrapRuntimeEvents,
 } from '@/runtime/index.ts';
@@ -25,7 +26,7 @@ import { readExecEnvScrubAllowlist } from '../input/exec-env-scrub-config.ts';
 import { createSandboxExecAsk, sandboxExecAskDepsFromRuntime } from '../permissions/sandbox-exec-gate.ts';
 import { createRuntimeServices, type RuntimeServices } from './services.ts';
 import { runBootMemoryFold } from './memory-fold.ts';
-import { setPricingSource } from '../export/cost-utils.ts';
+import { wireCostPricing } from '../export/cost-utils.ts';
 import { createUiRuntimeServices, type UiRuntimeServices } from './ui-services.ts';
 import { join } from 'node:path';
 import { installWrfcAgentToolGuard } from '../tools/wrfc-agent-guard.ts';
@@ -33,7 +34,7 @@ import { createWrfcPersistence, type WrfcPersistence } from './wrfc-persistence.
 import type { SystemMessagePriority } from '../core/system-message-router.ts';
 import { SessionSpineClient, SessionUnionCache, TUI_SPINE_PARTICIPANT } from '@pellux/goodvibes-sdk/platform/runtime/session-spine';
 import { SessionInboundInputPoller, createBootstrapInboundInputPoller } from './session-inbound-inputs.ts';
-import { detectPriorWorkspaceState, trustGatedAsk } from './trust/workspace-trust.ts';
+import { trustGatedAsk, type WorkspaceTrustLevel } from './trust/workspace-trust.ts';
 import { syncNotifierQueueIntegrations } from './bootstrap-notifier-sync.ts';
 
 // ---------------------------------------------------------------------------
@@ -105,6 +106,7 @@ export interface BootstrapCoreState {
   readonly runtimeUnsubs: Array<() => void>;
   readonly agentStatusIntervalRef: { value: ReturnType<typeof setInterval> | null };
   readonly permissionPromptRef: { requestPermission: PermissionRequestHandler };
+  readonly trustPromptRef: { requestTrustDecision: () => Promise<WorkspaceTrustLevel> }; // trust-at-consequence-time bridge, patched with the real modal-driving impl once the UI layer exists
   readonly systemMessageRouterRef: { value: SystemMessageRouter | null };
   readonly conversationFollowUpRef: { value: ((item: ConversationFollowUpItem) => void) | null };
   /**
@@ -231,10 +233,12 @@ export async function initializeBootstrapCore(
   const homeDirectory = options.homeDirectory;
   const configManager = options.configManager;
 
+  // Gate states derive from the domain settings keys; the bridge keeps live
+  // config writes flowing (honest pending-restart markers for startup-gated
+  // features). Mirrors the SDK composition root's owned-manager wiring.
   const featureFlags = createFeatureFlagManager();
-  featureFlags.loadFromConfig({
-    flags: (configManager.getCategory('featureFlags') as Record<string, import('@/runtime/index.ts').FlagState>) ?? {},
-  });
+  featureFlags.loadFromConfig({ flags: deriveFeatureStates(configManager) });
+  bindFeatureSettingsBridge(configManager, featureFlags);
 
   const userSessionId = `user-${generateUserSessionId()}`;
   const runtimeBus = new RuntimeEventBus();
@@ -247,20 +251,16 @@ export async function initializeBootstrapCore(
     runtimeBus,
     runtimeStore: store,
     getConversationTitle: () => getConversationTitle(),
-    workingDir,
-    homeDirectory,
-    // Sampled BEFORE any service writes to <cwd>/.goodvibes so a new workspace isn't misread as used.
-    workspaceHadPriorState: detectPriorWorkspaceState(workingDir),
+    workingDir, homeDirectory,
   });
-  await services.workspaceTrustManager.load(); // settle trust (+ grandfathering) before any tool runs
+  await services.workspaceTrustManager.load(); // settle any already-persisted trust decision before any tool runs
   const providerRegistry = services.providerRegistry;
   providerRegistry.initModelLimits();
   services.benchmarkStore.initBenchmarks();
   providerRegistry.initCatalog();
-  // Wire cost-utils to the live catalog so cost displays distinguish real
-  // pricing from unpriced (WO-315) instead of silently reading zero for any
-  // model the small static fallback table doesn't cover.
-  setPricingSource(() => providerRegistry.getRawCatalogModels());
+  // Wire cost-utils to the live catalog AND the ONE pricing resolver so every
+  // cost surface distinguishes real pricing from unpriced and names its source ("your price" vs "catalog price, as of <date>") — see cost-utils.
+  wireCostPricing(providerRegistry);
   services.keybindingsManager.loadFromDisk();
   domainDispatch.syncControlPlaneState({
     enabled: Boolean(configManager.get('controlPlane.enabled')),
@@ -351,6 +351,8 @@ export async function initializeBootstrapCore(
   const toolRegistry = new ToolRegistry();
   const { fileCache, projectIndex } = registerAllTools(toolRegistry, {
     surfaceRoot: 'tui',
+    localhostFetchApproval: services.localhostFetchApproval, // loopback-fetch ask, built once in the services composition
+    execPromptAnswerHandler: services.execPromptAnswerHandler, // terminal prompt-answer path, built once in the services composition
     fileUndoManager: services.fileUndoManager,
     modeManager: services.modeManager,
     processManager: services.processManager,
@@ -373,21 +375,19 @@ export async function initializeBootstrapCore(
     serviceRegistry: services.serviceRegistry,
     overflowHandler: services.overflowHandler,
     changeTracker: services.sessionChangeTracker,
-    // Master switch stays on (SDK default); this only widens the allowlist of
-    // variable NAMES kept even though they look credential-bearing. See
-    // exec-env-scrub-config.ts (permissions.execEnvScrubAllowlist).
+    // Widens the allowlist of credential-looking variable NAMES kept (master switch stays on). See exec-env-scrub-config.ts.
     credentialEnvScrub: { allowlist: readExecEnvScrubAllowlist(configManager) },
-    // Registers the context_accounting tool on this (the real, interactive)
-    // registry against OUR holder rather than a fresh internal one, so the
-    // Orchestrator-backed source bound at bootstrap.ts is what the tool
-    // actually reads from. See runtime/context-accounting-source.ts.
+    // Register context_accounting against OUR holder (the Orchestrator-backed source bound at bootstrap.ts). See runtime/context-accounting-source.ts.
     contextAccountingHolder: services.contextAccountingHolder,
+    // First contained (sandboxed) command run announces "commands now run contained" once — recorded and surfaced now.
+    onSandboxedRun: createSandboxContainmentNotice({ configManager, notify: (text) => conversation.log(`[Sandbox] ${text}`, { fg: '135' }) }),
   });
-  // Note: installWrfcAgentToolGuard is called after routeOrBuffer is defined
-  // (further below) so the onTrace callback can route guard decisions through
-  // the pre-router buffer.
+  // Note: installWrfcAgentToolGuard is called after routeOrBuffer is defined (further below) so the onTrace callback routes guard decisions through the pre-router buffer.
   services.agentOrchestrator.setDependencies({
     surfaceRoot: 'tui',
+    // setDependencies is a wholesale replace: re-install the prompt-answer handler and the loopback-fetch ask here or this rewire silently drops them.
+    execPromptAnswerHandler: services.execPromptAnswerHandler,
+    localhostFetchApproval: services.localhostFetchApproval,
     fileCache,
     projectIndex,
     workingDirectory: services.workingDirectory,
@@ -424,7 +424,7 @@ export async function initializeBootstrapCore(
   await runBootMemoryFold(memoryStore, services.memoryEmbeddingRegistry, workingDir, logger);
 
   const renderRequestRef = { value: (): void => {} };
-  // R1: Coalescing render scheduler — collapses N requestRender() calls into 1 and
+  // Coalescing render scheduler — collapses N requestRender() calls into 1 and
   // enforces a 16ms minimum interval to cap repaints at ~60fps. renderScheduled stays
   // set for the ENTIRE window (until run() executes), so requestRender() calls arriving
   // on later event-loop ticks within the same 16ms window coalesce into the one
@@ -467,6 +467,9 @@ export async function initializeBootstrapCore(
   const permissionPromptRef = {
     requestPermission: (async () => ({ approved: false, remember: false })) as PermissionRequestHandler,
   };
+  // Trust-at-consequence-time: raised by trustGatedAsk on the first non-read
+  // request in an undecided workspace; overridden once the UI layer exists — same ref-patching pattern as permissionPromptRef above.
+  const trustPromptRef = { requestTrustDecision: (async () => 'restricted') as () => Promise<WorkspaceTrustLevel> };
   approvalBroker.start().catch((err) => logger.warn('approval broker start failed at bootstrap', { err }));
   sharedSessionBroker.start().catch((err) => logger.warn('shared session broker start failed at bootstrap', { err }));
   const runtimeSessionIdRef = { value: userSessionId };
@@ -663,7 +666,7 @@ export async function initializeBootstrapCore(
 
   providerRegistry.startWatching(runtimeBus);
 
-  // W2.3: attach the SAME WebhookNotifier instance that `/notify add|remove|clear`
+  // attach the SAME WebhookNotifier instance that `/notify add|remove|clear`
   // (notify-runtime.ts) keeps live via ctx.services.webhookNotifier, rather than
   // constructing a second, boot-time-only instance here. Before this fix, a
   // webhook URL added mid-session reached long-task notifications (which read
@@ -696,8 +699,7 @@ export async function initializeBootstrapCore(
   await syncConfiguredServices(domainDispatch.syncIntegration, services.serviceRegistry);
 
   const permissionManager = new PermissionManager(
-    // Composed ask layer: the workspace trust gate (outer) wraps the sandbox-aware
-    // exec gate (inner); see sandbox-exec-gate.ts. The catastrophic block is untouched.
+    // Composed ask layer: the workspace trust gate (outer) wraps the sandbox-aware exec gate (inner); see sandbox-exec-gate.ts. The catastrophic block is untouched.
     trustGatedAsk(
       services.workspaceTrustManager,
       createSandboxExecAsk(
@@ -708,11 +710,13 @@ export async function initializeBootstrapCore(
           localPrompt: permissionPromptRef.requestPermission,
         }),
       ),
+      () => trustPromptRef.requestTrustDecision(), // indirection through the ref, not bound early — main.ts patches the real impl in later
     ),
     createPermissionConfigReader(configManager),
     policyRuntimeState,
     services.hookDispatcher,
     featureFlags,
+    services.userPermissionRuleStore, // durable remembered approvals (mirrors the SDK composition); permissions.rules.* lists/deletes them
   );
   await hookWorkbench.loadAndApplyManagedHooks();
 
@@ -757,11 +761,7 @@ export async function initializeBootstrapCore(
   }, 'bootstrap.session');
 
   runtimeUnsubs.push(
-    ...registerBootstrapHookBridge({
-      runtimeBus,
-      hookDispatcher,
-      runtime,
-    }),
+    ...registerBootstrapHookBridge({ runtimeBus, hookDispatcher, runtime }),
   );
 
   return {
@@ -783,7 +783,7 @@ export async function initializeBootstrapCore(
     bootstrapUnsubs,
     runtimeUnsubs,
     agentStatusIntervalRef,
-    permissionPromptRef,
+    permissionPromptRef, trustPromptRef,
     systemMessageRouterRef,
     conversationFollowUpRef,
     orchestratorHandleUserInputRef,

package/src/runtime/bootstrap-hook-bridge.ts

@@ -32,7 +32,7 @@ export interface ResumeSessionOptions {
   readonly sessionManager: SessionManager;
   readonly panelManager: PanelManager;
   readonly configManager: Pick<ConfigManager, 'get' | 'getCategory'>;
-  readonly providerRegistry: Pick<ProviderRegistry, 'get' | 'getCurrentModel' | 'getForModel' | 'require'>;
+  readonly providerRegistry: Pick<ProviderRegistry, 'get' | 'getCurrentModel' | 'getForModel' | 'require' | 'resolveModelPricing'>;
   readonly homeDirectory: string;
   /** See CommandSessionServices.hydrateSessionUsage (command-registry.ts). */
   readonly hydrateSessionUsage?: () => void;

package/src/runtime/bootstrap-shell.ts

@@ -93,7 +93,7 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     completeModelSelectionSideEffect,
   } = options;
 
-  // W0.9: after any resume seam replays historical messages into `conversation`,
+  // after any resume seam replays historical messages into `conversation`,
   // the freshly-constructed `orchestrator` still has its zeroed default usage
   // (SDK gap — Orchestrator.usage is never persisted/reseeded). Recompute it
   // from the replayed history so the footer doesn't show Input: 0 post-resume.
@@ -140,11 +140,11 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     runtimeBus,
   });
 
-  // WO-139: initial cost-budget alert threshold (USD; 0/unset = disabled).
+  // initial cost-budget alert threshold (USD; 0/unset = disabled).
   // Once the session starts, the real control surface is the CostTrackerPanel
   // itself — the in-panel 'b' key and /cost budget <usd> both call
   // CostTrackerPanel.setBudgetThreshold() directly on the live panel instance,
-  // which (W2.3) now writes through to the behavior.budgetAlertUsd config key
+  // which now writes through to the behavior.budgetAlertUsd config key
   // so the background budget-breach notifier reads the same value. The env
   // var remains a first-run convenience only: it seeds the config key when
   // that key has never been set, so it doesn't silently override a value the
@@ -220,7 +220,7 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     {
       // Suppress stale WRFC replay re-notifications for chains that can no
       // longer act — gone (killed/removed → getChain null) or terminal
-      // (passed/failed). (UX-B item 1c.)
+      // (passed/failed). (item 1c.)
       isChainTerminal: (chainId) => {
         const chain = services.wrfcController.getChain(chainId);
         return chain === null || chain.state === 'passed' || chain.state === 'failed';
@@ -307,6 +307,7 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     adaptivePlanner: services.adaptivePlanner,
     sessionOrchestration: services.sessionOrchestration,
     operatorClient: directTransport.operator,
+    userPermissionRuleStore: services.userPermissionRuleStore,
     peerClient: directTransport.peer,
     knowledgeApi,
     // /recall's browse/link/queue/export/import subcommands and the per-turn
@@ -345,7 +346,7 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     lastGitInfoRef.value = info;
     requestRender();
   }).catch(() => { /* non-fatal */ });
-  // W1.6 FIX 2: the header's git segment otherwise only refreshes on
+  // FIX 2: the header's git segment otherwise only refreshes on
   // TURN_COMPLETED/TOOL_SUCCEEDED/TOOL_FAILED (see turn-event-wiring.ts's
   // refreshGit()) — if the user runs `git init` externally and never submits
   // another turn, the header stays stuck on the startup-time fallback

package/src/runtime/bootstrap.ts

@@ -15,6 +15,7 @@ import { AcpManager } from '@pellux/goodvibes-sdk/platform/acp';
 import { getTierPromptSupplement, getTierForContextWindow } from '@pellux/goodvibes-sdk/platform/providers';
 import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { PermissionRequestHandler } from '@pellux/goodvibes-sdk/platform/permissions';
+import type { WorkspaceTrustLevel } from './trust/workspace-trust.ts';
 import type { CommandContext } from '../input/command-registry.ts';
 import type { InputHistory } from '../input/input-history.ts';
 import type { GitStatusProvider, GitHeaderInfo } from '../renderer/git-status.ts';
@@ -40,9 +41,9 @@ import { createBootstrapShell } from './bootstrap-shell.ts';
 import { announceResumeState } from './resume-notice.ts';
 import { announceInstallSelfCheck } from './install-self-check-startup.ts';
 import { buildSharedOrchestratorCoreServices, refreshMemoryRecallSnapshot } from './orchestrator-core-services.ts';
+import { consumeDaemonAttachNotices, consumeExternalDaemonAttachNotices } from './daemon-attach-notices.ts';
 import { createContextAccountingSource } from './context-accounting-source.ts';
-import { DaemonServer, HttpListener } from '@pellux/goodvibes-sdk/platform/daemon';
-import { createSafeHostServeFactory } from '../daemon/safe-serve.ts';
+import { createEmbeddedServiceFactories } from './embedded-service-factories.ts';
 import { buildRelayExternalServiceMethods } from './relay-reachability-bridge.ts';
 import { startMcpConfigAutoReload } from '../mcp/runtime-reload.ts';
 
@@ -95,6 +96,8 @@ export type BootstrapContext = RuntimeContext & {
   setRenderRequest: (fn: () => void) => void;
   /** Shell-owned permission prompt bridge that main.ts patches after UI setup. */
   permissionPromptRef: { requestPermission: PermissionRequestHandler };
+  /** Shell-owned trust-decision bridge that main.ts patches after UI setup (trust asks at consequence time). */
+  trustPromptRef: { requestTrustDecision: () => Promise<WorkspaceTrustLevel> };
   /** Load the most recently saved conversation from disk. */
   loadLastConversation: () => { messages: Array<Record<string, unknown>> } | null;
   /** Write the last-session pointer file (used after session resume). */
@@ -172,7 +175,7 @@ export async function bootstrapRuntime(
     bootstrapUnsubs,
     runtimeUnsubs,
     agentStatusIntervalRef,
-    permissionPromptRef,
+    permissionPromptRef, trustPromptRef,
     systemMessageRouterRef,
     conversationFollowUpRef,
     orchestratorHandleUserInputRef,
@@ -192,9 +195,8 @@ export async function bootstrapRuntime(
     pluginManager,
   } = services;
 
-  // A liveness flip is only PAINTED once something calls requestRender();
-  // without this, the footer's spine segment sat correct-but-undrawn until
-  // incidental activity redrew it (minutes, during an idle stretch).
+  // A liveness flip is only PAINTED once something calls requestRender(); without
+  // this, the footer's spine segment sat correct-but-undrawn until incidental activity redrew it (minutes, during an idle stretch).
   sessionUnionCache.setOnTransition(() => requestRender());
 
   // ── Phase 6: Orchestrator + AcpManager ───────────────────────────────────
@@ -237,7 +239,7 @@ export async function bootstrapRuntime(
       logger.debug('companion handleUserInput safety catch', { error: String(err) });
     });
   };
-  // Shared payload (single source of truth, includes wo805's memoryRegistry —
+  // Shared payload (single source of truth, includes the memoryRegistry —
   // see orchestrator-core-services.ts) plus this site's cacheHitTracker.
   orchestrator.setCoreServices({
     ...buildSharedOrchestratorCoreServices({ services, configManager, providerRegistry }),
@@ -254,8 +256,7 @@ export async function bootstrapRuntime(
 
   const acpManager = new AcpManager({
     requestPermission: (request) => permissionPromptRef.requestPermission(request),
-    runtimeBus,
-    hookDispatcher: services.hookDispatcher,
+    runtimeBus, hookDispatcher: services.hookDispatcher,
   });
   const acpTaskAdapter = new AcpTaskAdapter(store);
   const ACP_TASK_SYNC_INTERVAL_MS = 1_000;
@@ -265,7 +266,9 @@ export async function bootstrapRuntime(
   bootstrapUnsubs.push(() => clearInterval(acpTaskSyncInterval));
   orchestrator.registerDelegateTool(acpManager);
   const opsTaskManager = createTaskManager(store, runtimeBus, userSessionId);
-  const opsControlPlane = services.featureFlags.isEnabled('operator-control-plane')
+  // Operator interventions ride the control-plane gateway capability
+  // (controlPlane.gateway, on by default; the old never-registered gate id shipped this dead).
+  const opsControlPlane = services.featureFlags.isEnabled('control-plane-gateway')
     ? new OpsControlPlane(opsTaskManager, runtimeBus, store, userSessionId)
     : undefined;
 
@@ -300,7 +303,7 @@ export async function bootstrapRuntime(
   wrfcPersistence.rehydrate();
   const commandRegistry = shell.commandRegistry;
   const commandContext = shell.commandContext;
-  // Boot resume notice (UX-D item 1): after rehydrate() so chain history is ready, before
+  // Boot resume notice (item 1): after rehydrate() so chain history is ready, before
   // the operator can type anything. Fire-and-forget, same as main.ts's non-blocking
   // `void workspaceCheckpointManager.init().catch(() => {})` — local file I/O only,
   // resolves well before a human can react to the first rendered frame.
@@ -318,7 +321,7 @@ export async function bootstrapRuntime(
   });
   announceInstallSelfCheck(systemMessageRouter);
   const { gitStatusProvider, inputHistory, lastGitInfoRef } = shell;
-  // W1.6 FIX 2: dispose the header's live-repo-state poll (git-status.ts
+  // FIX 2: dispose the header's live-repo-state poll (git-status.ts
   // startPolling) on shutdown, same pattern as acpTaskSyncInterval above.
   bootstrapUnsubs.push(() => gitStatusProvider.stopPolling());
   const pluginCommandRegistry = {
@@ -475,21 +478,9 @@ export async function bootstrapRuntime(
     ]);
   };
 
-  const createExternalServiceFactories = (sharedDaemonToken: string): ExternalServiceFactories => ({
-    sharedDaemonToken,
-    createDaemonServer: (bus, userAuth, runtimeServices) => new DaemonServer({
-      runtimeBus: bus,
-      userAuth,
-      runtimeServices,
-      serveFactory: createSafeHostServeFactory('Embedded daemon'),
-    }),
-    createHttpListener: (dispatcher, userAuth, configManager) => new HttpListener({
-      hookDispatcher: dispatcher,
-      userAuth,
-      configManager,
-      serveFactory: createSafeHostServeFactory('Embedded HTTP listener'),
-    }),
-  });
+  // Embedded DaemonServer/HttpListener factories (incl. the facade auto-update
+  // suppression) — see embedded-service-factories.ts.
+  const createExternalServiceFactories = createEmbeddedServiceFactories;
 
   let externalServices: ExternalServicesHandle = {
     daemonServer: null, httpListener: null,
@@ -505,6 +496,9 @@ export async function bootstrapRuntime(
   platformExternalServices.externalServices = {
     ...buildRelayExternalServiceMethods(() => externalServices.daemonServer),
     inspect: inspectExternalServices,
+    // Undelivered daemon receipts (update/crash/migration) for the attach-time
+    // consuming read; empty when no daemon runs. Marked delivered once served.
+    collectDaemonReceipts: () => (externalServices.daemonServer as { collectDaemonReceipts?: () => readonly { id: string; text: string; at: number }[] } | null)?.collectDaemonReceipts?.() ?? [],
     restart: async () => {
       if (externalServicesPromise) {
         try {
@@ -527,10 +521,19 @@ export async function bootstrapRuntime(
       externalServices = await externalServicesPromise;
       controlPlaneRecentEventsRef.value = (limit) => externalServices.listRecentControlPlaneEvents(limit);
       syncSessionSpineToHostStatus(externalServices.daemonStatus, companionTokenRecord.token);
+      await renderDaemonAttachNotices(companionTokenRecord.token);
       requestRender();
       return inspectExternalServices();
     },
   };
+  // The attach-time consuming read, exactly once as notices. An adopted EXTERNAL daemon has no in-process handle (daemonServer null), so read its own /status?receipts=consume over HTTP; the embedded daemon keeps the in-process fold.
+  const renderDaemonAttachNotices = async (daemonToken: string): Promise<void> => {
+    const daemonStatus = externalServices.daemonStatus;
+    const notices = daemonStatus.mode === 'external' && daemonStatus.baseUrl
+      ? await consumeExternalDaemonAttachNotices({ baseUrl: daemonStatus.baseUrl, authToken: daemonToken })
+      : consumeDaemonAttachNotices({ configManager, collectReceipts: () => platformExternalServices.externalServices.collectDaemonReceipts() });
+    for (const notice of notices) systemMessageRouter.high(`[Daemon] ${notice}`);
+  };
   deferredStartup.schedule({
     label: 'plugins',
     run: async () => {
@@ -591,6 +594,7 @@ export async function bootstrapRuntime(
       externalServices = await externalServicesPromise;
       controlPlaneRecentEventsRef.value = (limit) => externalServices.listRecentControlPlaneEvents(limit);
       syncSessionSpineToHostStatus(externalServices.daemonStatus, companionTokenRecord.token);
+      await renderDaemonAttachNotices(companionTokenRecord.token);
       requestRender();
     },
     onError: (error) => {
@@ -713,7 +717,7 @@ export async function bootstrapRuntime(
     agentStatusIntervalRef,
     orchestratorRefs,
     setRenderRequest,
-    permissionPromptRef,
+    permissionPromptRef, trustPromptRef,
     loadLastConversation: () => loadLastConversation({
       workingDirectory: services.workingDirectory,
       homeDirectory: services.homeDirectory,
@@ -774,10 +778,8 @@ export async function bootstrapRuntime(
     },
   };
 
-  // ── Phase 12b: Operator Control Plane wiring (feature-gated) ──────────────
-  // Wire the OpsControlPlane into CommandContext when the feature flag is enabled.
-  // The store and task manager are created unconditionally so they reflect the
-  // real runtime state (tasks registered before the flag check are visible).
+  // ── Phase 12b: Operator Control Plane wiring (capability-gated); store and
+  // task manager exist unconditionally so pre-gate tasks stay visible. ───────
   ctx.commandContext.ops.acpManager = acpManager;
   if (opsControlPlane) {
     ctx.commandContext.openOpsPanel = () => {

package/src/runtime/channel-composition.ts

@@ -0,0 +1,46 @@
+/**
+ * channel-composition — route bindings, surface registry, and channel plugin
+ * registry for the TUI composition root (split out of services.ts for the
+ * line cap).
+ *
+ * RECORDED DIVERGENCE from the SDK composition root: SurfaceRegistry and
+ * ChannelPluginRegistry are constructed WITHOUT the gate manager. The SDK's
+ * surface gate map only names six surfaces (web/slack/discord/ntfy/webhook/
+ * homeassistant) and reads every other adapter (telegram, whatsapp, signal,
+ * imessage, msteams, ...) as OFF whenever a manager is present — no settings
+ * key could re-enable them. Until the gate map covers every adapter, the
+ * honest governing switch here stays the surfaces.<id>.enabled config each
+ * adapter already reads, exactly as the feature surface's own
+ * constant-binding rule states. RouteBindingManager keeps its manager — its
+ * route-binding gate is a real registry feature.
+ */
+
+import { AutomationRouteStore } from '@pellux/goodvibes-sdk/platform/automation';
+import { ChannelPluginRegistry, RouteBindingManager, SurfaceRegistry } from '@pellux/goodvibes-sdk/platform/channels';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { FeatureFlagManager, RuntimeEventBus } from '@/runtime/index.ts';
+import type { RuntimeStore } from './store/index.ts';
+
+export interface ChannelComposition {
+  readonly routeBindings: RouteBindingManager;
+  readonly surfaceRegistry: SurfaceRegistry;
+  readonly channelPlugins: ChannelPluginRegistry;
+}
+
+export function createChannelComposition(options: {
+  readonly configManager: ConfigManager;
+  readonly runtimeStore: RuntimeStore;
+  readonly runtimeBus: RuntimeEventBus;
+  readonly featureFlags: FeatureFlagManager;
+}): ChannelComposition {
+  const routeBindings = new RouteBindingManager({
+    store: new AutomationRouteStore({ configManager: options.configManager }),
+    runtimeStore: options.runtimeStore,
+    runtimeBus: options.runtimeBus,
+    featureFlags: options.featureFlags,
+  });
+  const surfaceRegistry = new SurfaceRegistry(options.configManager, options.runtimeStore);
+  const channelPlugins = new ChannelPluginRegistry();
+  surfaceRegistry.attachPluginRegistry(channelPlugins);
+  return { routeBindings, surfaceRegistry, channelPlugins };
+}

package/src/runtime/code-index-services.ts

@@ -2,8 +2,7 @@
 // code-index-services.ts — repo source-tree code index (TUI wiring)
 //
 // Constructs the TUI's repo source-tree code index: CodeIndexStore
-// (@pellux/goodvibes-sdk/platform/state, landed on SDK main as wo802/W5.3
-// Stage A). Extracted into its own module rather than built inline in
+// (@pellux/goodvibes-sdk/platform/state). Extracted into its own module rather than built inline in
 // services.ts: services.ts sits at the architecture check's 800-line cap
 // (scripts/check-architecture.ts), so any new service gets its own
 // construction module and a single wiring call there (mirrors
@@ -28,7 +27,7 @@
 // (interactive main.ts, the daemon, and every test fixture) shares one
 // honest, user-visible on/off switch rather than needing to thread a new
 // boolean through every call site. With it off (the default), `/codebase
-// build` is the explicit, visible trigger — exactly the shape wo804's brief
+// build` is the explicit, visible trigger — exactly the shape this design
 // asks for.
 //
 // Shares memoryEmbeddingRegistry with MemoryStore (constructed in
@@ -68,7 +67,7 @@ export interface CodeIndexServicesDeps {
 }
 
 /**
- * Whether Stage B code auto-injection / tool-site reindex may run: the SAME
+ * Whether code auto-injection / tool-site reindex may run: the SAME
  * storage.codeIndexEnabled switch that gates auto-build. Read live so a runtime
  * /config toggle takes effect without restart. (The separate, default-off
  * `agent-passive-code-injection` feature flag gates injection additionally; this

package/src/runtime/daemon-attach-notices.ts

@@ -0,0 +1,120 @@
+/**
+ * daemon-attach-notices — the attach-time consuming read.
+ *
+ * On daemon attach a surface reads the daemon's undelivered receipts
+ * (update/crash/migration) AND the pending feature-announcement queue
+ * (web-surface URL, the sandbox first-contained-run line, …) exactly once,
+ * rendering each as a one-line notice. Both sources clear on read — the
+ * facade's receipt queue marks its entries delivered, and drainPending() clears
+ * the announcement queue — so a second attach with nothing new shows nothing.
+ * This mirrors the daemon's own /status?receipts=consume fold, done in-process
+ * for the embedded daemon.
+ */
+import { FeatureAnnouncementStore, featureAnnouncementsPath, createSandboxContainmentAnnouncer } from '@pellux/goodvibes-sdk/platform/runtime/feature-announcements';
+import type { ConfigManager } from '../config/index.ts';
+
+/** A daemon receipt line (already a human one-liner, e.g. "restarted after a crash at 14:32"). */
+export interface DaemonReceiptLike {
+  readonly id: string;
+  readonly text: string;
+  readonly at: number;
+}
+
+/** The minimal announcement-store surface this consume drains. */
+export interface DrainableAnnouncementStore {
+  drainPending(): readonly { readonly id: string; readonly text: string; readonly at: number }[];
+}
+
+export interface DaemonAttachNoticesDeps {
+  readonly configManager: Pick<ConfigManager, 'getControlPlaneConfigDir'>;
+  /** Reads (and marks delivered) the daemon's undelivered receipts. */
+  readonly collectReceipts: () => readonly DaemonReceiptLike[];
+  /** Injectable announcement store; defaults to the shared control-plane file store. */
+  readonly announcementStore?: DrainableAnnouncementStore;
+}
+
+/**
+ * Consume — exactly once — the daemon's receipts and the pending announcement
+ * queue, returning the one-line notices to render. Receipts first (crash /
+ * update / migration), then announcements (web-surface URL, sandbox line, …).
+ */
+export function consumeDaemonAttachNotices(deps: DaemonAttachNoticesDeps): string[] {
+  const store = deps.announcementStore
+    ?? new FeatureAnnouncementStore(featureAnnouncementsPath(deps.configManager));
+  const notices: string[] = [];
+  for (const receipt of deps.collectReceipts()) {
+    if (receipt.text.trim().length > 0) notices.push(receipt.text);
+  }
+  for (const announcement of store.drainPending()) {
+    if (announcement.text.trim().length > 0) notices.push(announcement.text);
+  }
+  return notices;
+}
+
+/** Milliseconds an external-daemon receipts read waits before giving up. */
+const EXTERNAL_RECEIPTS_TIMEOUT_MS = 1500;
+
+export interface ExternalDaemonAttachNoticesDeps {
+  /** The adopted daemon's base URL, e.g. "http://127.0.0.1:3421". */
+  readonly baseUrl: string;
+  /** The shared bearer the adopted daemon authenticates (the companion-pairing token). */
+  readonly authToken: string;
+  /** Injectable fetch for tests; defaults to the global fetch. */
+  readonly fetchImpl?: typeof fetch;
+  /** Injectable timeout (ms); defaults to EXTERNAL_RECEIPTS_TIMEOUT_MS. */
+  readonly timeoutMs?: number;
+}
+
+/**
+ * Consume — exactly once — a separately-hosted (external/systemd) daemon's
+ * undelivered receipts AND drained announcements over HTTP, returning the
+ * one-line notices to render. The default deployment adopts such a daemon with
+ * no in-process handle (daemonServer is null), so the embedded in-process fold
+ * sees nothing; this hits the daemon's own consuming endpoint instead —
+ * GET <baseUrl>/status?receipts=consume with the shared bearer. The daemon
+ * marks the served receipts delivered as it responds (its own exactly-once
+ * store), so a second attach with nothing new returns []. Any transport, auth,
+ * or parse failure yields no notices rather than throwing into the attach path.
+ */
+export async function consumeExternalDaemonAttachNotices(
+  deps: ExternalDaemonAttachNoticesDeps,
+): Promise<string[]> {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? EXTERNAL_RECEIPTS_TIMEOUT_MS);
+  try {
+    const headers = new Headers();
+    if (deps.authToken.trim()) headers.set('Authorization', `Bearer ${deps.authToken.trim()}`);
+    const url = `${deps.baseUrl.replace(/\/+$/, '')}/status?receipts=consume`;
+    const response = await fetchImpl(url, { headers, signal: controller.signal });
+    if (!response.ok) return [];
+    const body = (await response.json()) as { receipts?: unknown } | null;
+    const receipts = Array.isArray(body?.receipts) ? body.receipts : [];
+    const notices: string[] = [];
+    for (const entry of receipts) {
+      if (entry && typeof (entry as { text?: unknown }).text === 'string') {
+        const text = (entry as { text: string }).text;
+        if (text.trim().length > 0) notices.push(text);
+      }
+    }
+    return notices;
+  } catch {
+    return [];
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * The "commands now run contained" first-run announcer for the sandboxed exec
+ * path. Returns the callback registerAllTools calls on each contained run: the
+ * FIRST call records the announce-once line (so any later attach-time consume
+ * also sees it) and surfaces it now via `notify`; every later run is silent.
+ */
+export function createSandboxContainmentNotice(deps: {
+  readonly configManager: Pick<ConfigManager, 'getControlPlaneConfigDir'>;
+  readonly notify: (text: string) => void;
+}): () => void {
+  const store = new FeatureAnnouncementStore(featureAnnouncementsPath(deps.configManager));
+  return createSandboxContainmentAnnouncer(store, (announcement) => deps.notify(announcement.text));
+}