@pellux/goodvibes-tui 1.16.1 → 1.17.0

package/src/runtime/services.ts

@@ -2,8 +2,8 @@ import { join } from 'node:path';
 import { FocusTracker } from '../core/focus-tracker.ts';
 import { ConfigManager, ServiceRegistry, SubscriptionManager, ToolLLM } from '@pellux/goodvibes-sdk/platform/config';
 import { SecretsManager } from '../config/secrets.ts';
-import { AutomationDeliveryManager, AutomationManager, AutomationRouteStore } from '@pellux/goodvibes-sdk/platform/automation';
-import { ChannelDeliveryRouter, ChannelPluginRegistry, ChannelPolicyManager, RouteBindingManager, SurfaceRegistry } from '@pellux/goodvibes-sdk/platform/channels';
+import { AutomationDeliveryManager, AutomationManager } from '@pellux/goodvibes-sdk/platform/automation';
+import { ChannelDeliveryRouter, ChannelPolicyManager, type ChannelPluginRegistry, type RouteBindingManager, type SurfaceRegistry } from '@pellux/goodvibes-sdk/platform/channels';
 import { ApprovalBroker, GatewayMethodCatalog, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
 import { StepUpService } from '@pellux/goodvibes-sdk/daemon';
 import { attachWsOnlyGatewayVerbHandlers, createArchivableFleetRegistry } from '@pellux/goodvibes-terminal-shell';
@@ -26,6 +26,12 @@ import { MultimodalService } from '@pellux/goodvibes-sdk/platform/multimodal';
 import { AgentMessageBus, AgentOrchestrator, ArchetypeLoader, WrfcController } from '@pellux/goodvibes-sdk/platform/agents';
 import { AgentManager, ContextAccountingHolder, OverflowHandler, ProcessManager, createWorkflowServices, type WorkflowServices } from '@pellux/goodvibes-sdk/platform/tools';
 import { FileStateCache, FileUndoManager, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, resolveCanonicalMemoryDbPath, type CodeIndexStore, type CodeIndexReindexScheduler } from '@pellux/goodvibes-sdk/platform/state';
+import type { StoreSnapshotScheduler } from '@pellux/goodvibes-sdk/platform/state/store-snapshots';
+import type { UserPermissionRuleStore } from '@pellux/goodvibes-sdk/platform/permissions';
+import { buildExecPromptAnswerHandler } from '@pellux/goodvibes-sdk/platform/runtime/permissions/exec-prompt-wiring';
+import { buildLocalhostFetchApproval } from '@pellux/goodvibes-sdk/platform/runtime/permissions/localhost-fetch-approval';
+import { createNotificationDispatcher, wireRuntimeNotificationBridge, type NotificationDispatcher } from './notification-dispatch.ts';
+import { createDurabilityServices } from './durability-services.ts';
 import { MemorySpineClient, createLocalMemoryAccess } from '@pellux/goodvibes-sdk/platform/runtime/memory-spine';
 import { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
 import { createWorkspaceCheckpointing } from './workspace-checkpointing.ts';
@@ -49,20 +55,18 @@ import { SessionManager, CrossSessionTaskRegistry, SessionChangeTracker } from '
 import { ApiTokenAuditor, UserAuthManager } from '@pellux/goodvibes-sdk/platform/security';
 import { WebhookNotifier } from '@pellux/goodvibes-sdk/platform/integrations';
 import { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
-import { BenchmarkStore, CacheHitTracker, FavoritesStore, inferFallbackContextWindow, type ModelDefinition, ModelLimitsService, ProviderCapabilityRegistry, ProviderOptimizer, ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+import { BenchmarkStore, CacheHitTracker, computeUsageCostUsd, FavoritesStore, ModelLimitsService, ProviderCapabilityRegistry, ProviderOptimizer, ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
 import { KeybindingsManager } from '../input/keybindings.ts';
 import { AdaptivePlanner, DeterministicReplayEngine, ExecutionPlanManager, SessionLineageTracker, SessionMemoryStore } from '@pellux/goodvibes-sdk/platform/core';
-import { isFeatureFlagEnabled } from './surface-feature-flags.ts';
+import { deriveFeatureStates, bindFeatureSettingsBridge } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import { createChannelComposition } from './channel-composition.ts';
+import { applyProviderOptimizerConfigMode, bindProviderOptimizerFeatureFlag } from './provider-optimizer-wiring.ts';
 import { type ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
-import { calcSessionCost, isModelPriced } from '../export/cost-utils.ts';
 import { createWorkstreamServices, type OrchestrationEngine, type WorkstreamCommandService } from './workstream-services.ts';
 import { wireFleetNeedsInputPush } from './fleet-needs-input-push.ts';
 import { codeIndexDbPath, createCodeIndexServices, isCodeInjectionSettingEnabled } from './code-index-services.ts';
 import { WorkPlanStore } from '../work-plans/work-plan-store.ts';
-import {
-  registerDaemonHandlers,
-  type DaemonHandlerSurfaces,
-} from '../daemon/handlers/index.ts';
+import { registerDaemonHandlers, type DaemonHandlerSurfaces } from '../daemon/handlers/index.ts';
 import type { HandlerContext, HandlerLogger } from '../daemon/handlers/context.ts';
 import { createDaemonCredentialStore } from '../daemon/handlers/credentials.ts';
 import { registerRouting } from '../daemon/handlers/routing/index.ts';
@@ -73,58 +77,10 @@ import { registerCalendar } from '../daemon/handlers/calendar/index.ts';
 import { registerEmailMethods } from '../daemon/handlers/email/index.ts';
 import { registerRemoteSurface } from '../daemon/handlers/remote/index.ts';
 import { WorkspaceTrustManager } from './trust/workspace-trust.ts';
+import { ensureConfiguredModelIsRoutable } from './provider-fallback.ts';
 
 const REGULAR_KNOWLEDGE_DB_FILE = 'knowledge-wiki.sqlite';
 const HOME_GRAPH_KNOWLEDGE_DB_FILE = 'knowledge-home-graph.sqlite';
-
-function buildFallbackModelDefinition(provider: string, modelId: string): ModelDefinition {
-  const providerLower = provider.toLowerCase();
-  const isReasoningProvider = providerLower.includes('openai')
-    || providerLower.includes('anthropic')
-    || providerLower.includes('gemini')
-    || providerLower.includes('google');
-
-  return {
-    id: modelId,
-    provider,
-    registryKey: `${provider}:${modelId}`,
-    displayName: modelId,
-    description: 'Configured model available before the model catalog cache has loaded.',
-    capabilities: {
-      toolCalling: true,
-      codeEditing: true,
-      reasoning: isReasoningProvider,
-      multimodal: isReasoningProvider,
-    },
-    // Pre-catalog fallback uses the SDK's family-aware inference (SDK 0.35.0+),
-    // matching the post-catalog window so the meter/compaction denominator agrees.
-    contextWindow: inferFallbackContextWindow(provider, modelId),
-    contextWindowProvenance: 'fallback',
-    selectable: true,
-    tier: 'standard',
-    ...(isReasoningProvider ? { reasoningEffort: ['instant', 'low', 'medium', 'high'] } : {}),
-  };
-}
-
-function ensureConfiguredModelIsRoutable(providerRegistry: ProviderRegistry, configManager: ConfigManager): void {
-  const configuredModel = String(configManager.get('provider.model') ?? '').trim();
-  if (!configuredModel.includes(':')) return;
-  if (providerRegistry.listModels().some((model) => model.registryKey === configuredModel)) return;
-
-  const [providerId, ...modelParts] = configuredModel.split(':');
-  const modelId = modelParts.join(':').trim();
-  if (!providerId || !modelId) return;
-
-  const provider = providerRegistry.tryGet(providerId);
-  if (!provider) return;
-
-  providerRegistry.registerRuntimeProvider({
-    provider,
-    replace: true,
-    models: [buildFallbackModelDefinition(providerId, modelId)],
-  });
-}
-
 export interface RuntimeServicesOptions {
   readonly runtimeBus: RuntimeEventBus;
   readonly runtimeStore: RuntimeStore;
@@ -134,8 +90,6 @@ export interface RuntimeServicesOptions {
   readonly getConversationTitle?: () => string | undefined;
   readonly workingDir: string;
   readonly homeDirectory: string;
-  /** Prior GoodVibes runtime state existed at startup — sampled before any write; seeds the trust gate's grandfathering. */
-  readonly workspaceHadPriorState?: boolean;
 }
 
 export interface RuntimeServices {
@@ -155,6 +109,14 @@ export interface RuntimeServices {
   readonly channelDeliveryRouter: ChannelDeliveryRouter;
   readonly watcherRegistry: WatcherRegistry;
   readonly approvalBroker: ApprovalBroker;
+  /** Loopback-fetch approval that rides the approval broker; shared by the tool registry and orchestrator so every surface asks the same way. */
+  readonly localhostFetchApproval: ReturnType<typeof buildLocalhostFetchApproval>;
+  /** Terminal prompt-answer handler that rides the approval broker; shared by the tool registry and orchestrator so an interactive command's prompt gets an ask/card on every surface. */
+  readonly execPromptAnswerHandler: ReturnType<typeof buildExecPromptAnswerHandler>;
+  /** Routes curated runtime-domain events into the panel_only notification feed (the panel's live producer). */
+  readonly notificationDispatcher: NotificationDispatcher;
+  /** Durable user-origin permission rules (remembered approvals); permissions.rules.* surface. Mirrors the SDK composition. */
+  readonly userPermissionRuleStore: UserPermissionRuleStore;
   readonly sessionBroker: SharedSessionBroker;
   readonly deliveryManager: AutomationDeliveryManager;
   readonly automationManager: AutomationManager;
@@ -198,7 +160,7 @@ export interface RuntimeServices {
   readonly worktreeRegistry: WorktreeRegistry;
   readonly sandboxSessionRegistry: SandboxSessionRegistry;
   readonly webhookNotifier: WebhookNotifier;
-  /** Terminal focus tracker (W2.3) — fed by input/handler-feed.ts, read by the alert notifiers in core/. */
+  /** Terminal focus tracker — fed by input/handler-feed.ts, read by the alert notifiers in core/. */
   readonly focusTracker: FocusTracker;
   readonly replayEngine: DeterministicReplayEngine;
   readonly providerOptimizer: ProviderOptimizer;
@@ -234,6 +196,8 @@ export interface RuntimeServices {
   /** The repo source-tree code index — see runtime/code-index-services.ts. */
   readonly codeIndexStore: CodeIndexStore;
   readonly codeIndexReindexScheduler: CodeIndexReindexScheduler; // tool-site reindex
+  /** Daily snapshots of every SQLite store this runtime writes, with bounded retention; unref'd timers (mirrors the SDK composition — hosts that tear down a runtime stop() it themselves). */
+  readonly storeSnapshotScheduler: StoreSnapshotScheduler;
   /** Unified live process registry (agents, WRFC chains, workflows, watchers, background processes) backing the Fleet panel; archive-aware — finished subtrees can be moved to the session archive view. */
   readonly processRegistry: ArchivableProcessRegistry;
   readonly modeManager: ModeManager;
@@ -253,26 +217,31 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     workingDirectory,
     homeDirectory,
   });
-  const workspaceTrustManager = new WorkspaceTrustManager({ shellPaths, hadPriorState: options.workspaceHadPriorState ?? false });
+  const workspaceTrustManager = new WorkspaceTrustManager({ shellPaths });
   const configManager = options.configManager;
   const featureFlags = options.featureFlags ?? createFeatureFlagManager();
+  if (options.featureFlags === undefined) {
+    // Owned manager: gate states derive from domain settings keys + live
+    // bridge (mirrors the SDK composition root; a passed manager is the caller's to wire).
+    featureFlags.loadFromConfig({ flags: deriveFeatureStates(configManager) });
+    bindFeatureSettingsBridge(configManager, featureFlags);
+  }
   const runtimeDispatch = createDomainDispatch(options.runtimeStore);
   const gatewayMethods = new GatewayMethodCatalog();
   const panelManager = new PanelManager();
-  // W6.1 (the purge): MIGRATE-TO-MODAL surface + redirect registration moved to
+  // (the purge): MIGRATE-TO-MODAL surface + redirect registration moved to
   // registerBuiltinPanels (builtin-panels.ts), where the panels' resolved deps
   // are available for the surfaces to close over.
   const keybindingsManager = new KeybindingsManager({
     configPath: shellPaths.resolveUserPath('tui', 'keybindings.json'),
   });
-  const routeBindings = new RouteBindingManager({
-    store: new AutomationRouteStore({ configManager }),
+  // Channel/surface wiring: see channel-composition.ts (incl. the recorded surface-gating divergence note).
+  const { routeBindings, surfaceRegistry, channelPlugins } = createChannelComposition({
+    configManager,
     runtimeStore: options.runtimeStore,
     runtimeBus: options.runtimeBus,
+    featureFlags,
   });
-  const surfaceRegistry = new SurfaceRegistry(configManager, options.runtimeStore);
-  const channelPlugins = new ChannelPluginRegistry();
-  surfaceRegistry.attachPluginRegistry(channelPlugins);
   const secretsManager = new SecretsManager({
     projectRoot: workingDirectory,
     globalHome: homeDirectory,
@@ -307,6 +276,10 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   });
   ensureConfiguredModelIsRoutable(providerRegistry, configManager);
   providerRegistry.initCustomProviders();
+  // Kick off the background, TTL-respecting live model discovery sweep so
+  // provider model lists refresh from their own listing APIs — matching the
+  // SDK and agent compositions (this call was the one omitted here).
+  providerRegistry.initProviderModelDiscovery();
   const toolLLM = new ToolLLM({
     configManager,
     providerRegistry,
@@ -341,6 +314,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     messageBus: agentMessageBus,
     executor: agentOrchestrator,
     configManager,
+    // The live registry lets a bare model id in a spawn() override resolve
+    // through the shared resolver instead of being rejected as unqualified.
+    providerRegistry,
   });
   const contextAccountingHolder = new ContextAccountingHolder();
   agentOrchestrator.setConversationSink({ // Conversation-snapshot bridge (mirrors the SDK's own createRuntimeServices)
@@ -418,6 +394,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     runtimeStore: options.runtimeStore,
     runtimeBus: options.runtimeBus,
     deliveryManager,
+    // Same live registry: a bare model id on an automation job resolves through
+    // the shared resolver instead of a format-only rejection.
+    providerRegistry,
     spawnTask: (input) => {
       const record = agentManager.spawn({
         mode: 'spawn',
@@ -578,11 +557,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const webhookNotifier = new WebhookNotifier();
   const focusTracker = new FocusTracker();
   const replayEngine = new DeterministicReplayEngine(workingDirectory);
-  const providerOptimizer = new ProviderOptimizer(
-    providerRegistry,
-    providerCapabilityRegistry,
-    isFeatureFlagEnabled(configManager, 'provider-optimizer'),
-  );
+  const providerOptimizer = new ProviderOptimizer(providerRegistry, providerCapabilityRegistry, false); // dark until its gate flips it (see provider-optimizer-wiring.ts)
+  bindProviderOptimizerFeatureFlag(featureFlags, providerOptimizer);
+  applyProviderOptimizerConfigMode(configManager, providerOptimizer);
   const sessionMemoryStore = new SessionMemoryStore();
   const sessionLineageTracker = new SessionLineageTracker();
   const sessionChangeTracker = new SessionChangeTracker();
@@ -611,6 +588,11 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // with MemoryStore above. Auto-build is config-gated (default off) — see
   // code-index-services.ts's header doc.
   const { codeIndexStore, codeIndexReindexScheduler } = createCodeIndexServices({ workingDirectory, configManager, memoryEmbeddingRegistry });
+  // Store snapshots + durable remembered-approval rules + the live credential
+  // chain, mirroring the SDK composition — see durability-services.ts.
+  const { storeSnapshotScheduler, userPermissionRuleStore } = createDurabilityServices({
+    configManager, secretsManager, providerRegistry, memoryDbPath, codeIndexDbPath: codeIndexDbPath(workingDirectory),
+  });
   const codeInjectionOrchestratorDeps = { codeIndex: codeIndexStore, isCodeInjectionSettingEnabled: () => isCodeInjectionSettingEnabled(configManager), codeIndexReindexScheduler }; // Code-injection seam (agent here; main via orchestrator-core-services.ts)
   // Shared, archive-aware fleet registry — see gateway-verbs.ts's factory doc.
   const processRegistry = createArchivableFleetRegistry({
@@ -626,12 +608,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     messageBus: agentMessageBus, // Backs steer()/`steerable` (the Fleet steer composer builds on top)
     automationManager, // Folds /schedule AutomationJobs into the fleet as 'schedule' nodes
     runtimeBus: options.runtimeBus,
-    // Honest pricing: never fabricate a cost for an unrecognized model.
-    priceUsage: (model, usage) => {
-      const modelId = model ?? 'unknown';
-      if (!isModelPriced(modelId)) return null;
-      return calcSessionCost(usage.inputTokens, usage.outputTokens, usage.cacheReadTokens, usage.cacheWriteTokens, modelId);
-    },
+    // Honest-unpriced through the ONE pricing resolver (manual -> registration -> provider-served
+    // -> catalog -> unknown); unknown/subscription yields null, never $0. Mirrors the SDK composition.
+    priceUsage: (model, usage) => (model ? computeUsageCostUsd(providerRegistry.resolveModelPricing(model), usage) : null),
   });
   const modeManager = new ModeManager();
   const fileUndoManager = new FileUndoManager();
@@ -641,7 +620,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // family without it. principals.*/channels.profiles.*/ci.* register unconditionally; checkin.* only with
   // channelDeliveryRouter/providerRegistry/automationManager/sessionLister ALL present; fleet needs-input push gated by
   // runtimeBus/sessionPresence (fleet-needs-input-push.ts). conversationRewindPort serves conversation-scope rewind live.
-  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
+  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input), watcherRegistry, userPermissionRuleStore, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, sessionIntake: sessionBroker, workingDirectory, memoryRegistry, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
   const integrationHelpers = new IntegrationHelperService({
     workingDirectory,
     homeDirectory,
@@ -662,8 +641,16 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     subscriptionManager,
     secretsManager,
   });
+  // A loopback fetch that isn't allow-listed asks once through the approval
+  // broker; "allow for this project" persists and later fetches never ask. Built
+  // once and shared with the tool registry (bootstrap-core) so both ask alike.
+  const localhostFetchApproval = buildLocalhostFetchApproval({ requestApproval: (input) => approvalBroker.requestApproval(input), configManager });
+  // Exec stuck on a terminal prompt rides the approval broker; the typed answer feeds the continuing run. Built once and shared (like localhostFetchApproval) so the tool registry AND every setDependencies site — incl. the post-clobber rewire in bootstrap-core — install the SAME handler; otherwise a wholesale replace drops it and interactive prompts hang.
+  const execPromptAnswerHandler = buildExecPromptAnswerHandler({ requestApproval: (input) => approvalBroker.requestApproval(input) });
   agentOrchestrator.setDependencies({
     surfaceRoot: 'tui',
+    execPromptAnswerHandler,
+    localhostFetchApproval,
     fileCache,
     projectIndex,
     workingDirectory,
@@ -691,6 +678,12 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     contextAccountingHolder,
   });
 
+  // Give the panel_only notification target a live producer: curated
+  // runtime-domain events route through the notification router into the shared
+  // panel feed (panel_only and burst-collapsed decisions land there).
+  const notificationDispatcher = createNotificationDispatcher(configManager);
+  wireRuntimeNotificationBridge(options.runtimeBus, notificationDispatcher);
+
   return {
     workingDirectory,
     homeDirectory,
@@ -709,6 +702,10 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     channelDeliveryRouter,
     watcherRegistry,
     approvalBroker,
+    localhostFetchApproval,
+    execPromptAnswerHandler,
+    notificationDispatcher,
+    userPermissionRuleStore,
     sessionBroker,
     deliveryManager,
     automationManager,
@@ -784,6 +781,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     workstreamCommands,
     codeIndexStore,
     codeIndexReindexScheduler,
+    storeSnapshotScheduler,
     processRegistry,
     modeManager,
     fileUndoManager,
@@ -791,8 +789,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     integrationHelpers,
     async rerootStores(newWorkingDir: string): Promise<void> {
       // The memory store is the home-scoped canonical cross-surface store and
-      // deliberately does NOT reroot per-project (that would re-silo memory, the E6
-      // regression). Only working-tree-bound stores (code index, project index) reroot.
+      // deliberately does NOT reroot per-project (that would re-silo memory back
+      // into per-project stores). Only working-tree-bound stores (code index,
+      // project index) reroot.
       await codeIndexStore.reroot(newWorkingDir, codeIndexDbPath(newWorkingDir));
       await projectIndex.reroot(newWorkingDir);
     },

package/src/runtime/session-continuity-hints.ts

@@ -0,0 +1,38 @@
+/**
+ * session-continuity-hints — the recovery snapshot's continuity summary.
+ *
+ * Extracted from main.ts (which sits at the architecture line cap) so the
+ * startup wiring there stays within budget. Builds the small counts/paths
+ * bundle written into the recovery file so a resumed session can describe what
+ * was in flight (pending approvals, active/blocked tasks, remotes, worktrees,
+ * open panels) without re-reading live state.
+ */
+import type { UiReadModels } from './ui-read-models.ts';
+import type { PanelManager } from '../panels/panel-manager.ts';
+
+/**
+ * The continuity summary written into the recovery file. A loose serializable
+ * bag (Record) because it is JSON-persisted and read back by the recovery
+ * continuity-hints consumer, which types it structurally.
+ */
+export function createSessionContinuityHintsBuilder(deps: {
+  readonly readModels: UiReadModels;
+  readonly panelManager: Pick<PanelManager, 'getAllOpen'>;
+}): () => Record<string, unknown> {
+  return () => {
+    const sessionSnapshot = deps.readModels.session.getSnapshot();
+    const tasksSnapshot = deps.readModels.tasks.getSnapshot();
+    const remoteSnapshot = deps.readModels.remote.getSnapshot();
+    const worktreeSnapshot = deps.readModels.worktrees.getSnapshot();
+    return {
+      pendingApprovals: sessionSnapshot.pendingApproval ? 1 : 0,
+      activeTasks: tasksSnapshot.tasks.filter((task) => task.status === 'running' || task.status === 'queued').length,
+      blockedTasks: tasksSnapshot.tasks.filter((task) => task.status === 'blocked').length,
+      remoteContracts: remoteSnapshot.contracts.length,
+      remoteRunners: remoteSnapshot.contracts.slice(0, 4).map((contract) => contract.runnerId),
+      worktreeCount: worktreeSnapshot.records.length,
+      worktreePaths: worktreeSnapshot.records.slice(0, 3).map((record) => record.path),
+      openPanels: deps.panelManager.getAllOpen().map((panel) => panel.id),
+    };
+  };
+}

package/src/runtime/surface-feature-flags.ts

@@ -1,5 +1,16 @@
-import type { ConfigKey, ConfigManager, PersistedFlagState } from '../config/index.ts';
+/**
+ * surface-feature-flags — which platform capabilities a surface/server setup
+ * needs, and how to switch them on through their real domain settings keys.
+ *
+ * Capabilities are configured through first-class domain settings (see
+ * feature-settings.ts); enabling a surface writes keys like
+ * `controlPlane.gateway` or `surfaces.slack.enabled`, never a separate
+ * enablement namespace.
+ */
+
+import type { ConfigManager } from '../config/index.ts';
 import { surfaceFeatureGateId } from '@/runtime/index.ts';
+import { featureEnablementWrite, getFeatureSetting, isFeatureConfigEnabled } from './feature-settings.ts';
 
 export const CONTROL_PLANE_FEATURE_FLAG = 'control-plane-gateway';
 export const ROUTE_BINDING_FEATURE_FLAG = 'route-binding';
@@ -12,10 +23,15 @@ const CORE_CHANNEL_FEATURE_FLAGS = [
   DELIVERY_ENGINE_FEATURE_FLAG,
 ] as const;
 
-export type FeatureFlagConfigKey = 'featureFlags' | `featureFlags.${string}`;
-
 export function getSurfaceFeatureFlag(surfaceId: string): string | null {
-  return surfaceFeatureGateId(surfaceId);
+  // Onboarding surface ids may be camelCase ('googleChat'); the SDK's gate
+  // map is keyed by the kebab-case ChannelSurface id ('google-chat'). Try the
+  // literal id first, then the kebab-case form, so choosing Google Chat in
+  // onboarding really flips google-chat-surface.
+  const literal = surfaceFeatureGateId(surfaceId);
+  if (literal) return literal;
+  const kebab = surfaceId.replace(/[A-Z]/g, (ch) => `-${ch.toLowerCase()}`);
+  return kebab === surfaceId ? null : surfaceFeatureGateId(kebab);
 }
 
 export function getServerSurfaceFeatureFlags(options: {
@@ -46,20 +62,35 @@ export function getServerSurfaceFeatureFlags(options: {
   return [...flags].sort((left, right) => left.localeCompare(right));
 }
 
-export function isFeatureFlagEnabled(config: Pick<ConfigManager, 'getCategory'>, flagId: string): boolean {
-  const flags = (config.getCategory('featureFlags') as Record<string, PersistedFlagState | undefined>) ?? {};
-  return flags[flagId] === 'enabled';
+/** Whether the live config has the capability on, derived from its domain settings key. */
+export function isFeatureFlagEnabled(config: Pick<ConfigManager, 'get'>, flagId: string): boolean {
+  return isFeatureConfigEnabled(config, flagId);
+}
+
+/**
+ * Translate internal feature-gate ids (e.g. 'control-plane-gateway') to the
+ * canonical domain settings keys the user actually sets (e.g.
+ * 'controlPlane.gateway') — matching the SDK's own gate errors, which name the
+ * settings key. A gate with no mapped setting falls back to its id. Deduped and
+ * sorted for stable output.
+ */
+export function surfaceFeatureGateSettingsKeys(flagIds: readonly string[]): string[] {
+  const keys = new Set<string>();
+  for (const flagId of flagIds) keys.add(getFeatureSetting(flagId)?.enablement.key ?? flagId);
+  return [...keys].sort((left, right) => left.localeCompare(right));
 }
 
-export function getMissingSurfaceFeatureFlags(config: Pick<ConfigManager, 'getCategory'>, surfaceId: string): readonly string[] {
+export function getMissingSurfaceFeatureFlags(config: Pick<ConfigManager, 'get'>, surfaceId: string): readonly string[] {
   const required = surfaceId === 'web'
     ? getServerSurfaceFeatureFlags({ web: true })
     : getServerSurfaceFeatureFlags({ externalSurfaces: [surfaceId] });
   return required.filter((flagId) => !isFeatureFlagEnabled(config, flagId));
 }
 
+/** Switch each capability on by writing its real enablement settings key. */
 export function enableFeatureFlags(config: Pick<ConfigManager, 'setDynamic'>, flagIds: readonly string[]): void {
   for (const flagId of flagIds) {
-    config.setDynamic(`featureFlags.${flagId}` as ConfigKey, 'enabled');
+    const write = featureEnablementWrite(flagId, true);
+    if (write) config.setDynamic(write.key, write.value);
   }
 }

package/src/runtime/terminal-output-guard.ts

@@ -45,7 +45,7 @@ export type TuiTerminalOutputGuardOptions = {
    * writes captured this session, so an honest quiet counter (e.g. /debug) can
    * refresh. The per-write detail is already recorded to the activity log via
    * logger.warn — this callback intentionally does NOT push transcript lines.
-   * (UX-B item 1a.)
+   * (item 1a.)
    */
   readonly onCapture?: (total: number) => void;
 };
@@ -224,7 +224,7 @@ export function installTuiTerminalOutputGuard(options: TuiTerminalOutputGuardOpt
     onIntercept: () => {
       // Each intercept is already logged (logger.warn in record()). Here we only
       // maintain a cumulative counter and, rate-limited, refresh a quiet counter
-      // surface — no repeated transcript lines. (UX-B item 1a.)
+      // surface — no repeated transcript lines. (item 1a.)
       totalInterceptedWrites++;
       const now = Date.now();
       if (now - lastNoticeAt < 5_000) return;

package/src/runtime/trust/workspace-registration.ts

@@ -137,13 +137,21 @@ export class WorkspaceRegistrationManager {
    * Register the current working directory at its resolved project root. The
    * store refuses broad roots (WorkspaceRegistrationError) — we surface that
    * honestly rather than record a phantom registration.
+   *
+   * `origin` stamps which surface wrote the record (honest provenance). This
+   * NEVER passes `checkpointEligible`: absent means false, so a TUI self-record
+   * can never widen the checkpoint-owning consumer's boundary — only that
+   * consumer stamps its own roots eligible on boot.
    */
-  async register(label?: string): Promise<
+  async register(label?: string, origin?: string): Promise<
     | { readonly registered: true; readonly result: RegisterWorkspaceResult }
     | { readonly registered: false; readonly refusedReason: string }
   > {
+    const opts = label || origin
+      ? { ...(label ? { label } : {}), ...(origin ? { origin } : {}) }
+      : undefined;
     try {
-      const result = await this.store.add(this.workingDirectory, label ? { label } : undefined);
+      const result = await this.store.add(this.workingDirectory, opts);
       return { registered: true, result };
     } catch (error) {
       if (error instanceof WorkspaceRegistrationError) {

package/src/runtime/trust/workspace-trust.ts

@@ -2,18 +2,24 @@
  * workspace-trust.ts — per-workspace trust gate.
  *
  * The first time GoodVibes opens a workspace (a cwd / project root it has no
- * prior state for), that workspace is "restricted": only read-category tools
- * run; write, execute, and delegate tools are denied until the user marks the
- * workspace trusted. This is NOT a parallel permission checker — the decision
- * is consulted by the real permission machinery at its final ask layer (the
- * requestPermission callback wired in bootstrap-core.ts), so it composes with,
- * and cannot drift from, the existing PermissionManager layer chain.
+ * prior decision for), that workspace is "undecided": only read-category
+ * tools run; the first write, execute, or delegate tool request raises the
+ * trust question AT THAT MOMENT — the exact point it has a real consequence —
+ * instead of silently failing or being decided by a side effect of the
+ * product's own droppings. This is NOT a parallel permission checker — the
+ * decision is consulted by the real permission machinery at its final ask
+ * layer (the requestPermission callback wired in bootstrap-core.ts), so it
+ * composes with, and cannot drift from, the existing PermissionManager layer
+ * chain.
  *
- * Trust is persisted per-workspace in <cwd>/.goodvibes/tui/trust.json. A
- * workspace that already carries GoodVibes runtime state (prior sessions,
- * checkpoints, state, memory, or a project onboarding marker) is grandfathered
- * as trusted on first load, so the gate only ever prompts for genuinely new
- * places.
+ * Trust is persisted per-workspace in <cwd>/.goodvibes/tui/trust.json. There
+ * is no more grandfathering: a workspace that already carries prior GoodVibes
+ * runtime state gets no special treatment (that side-effect-based shortcut
+ * used to paper over the fact that the first session's write attempts were
+ * silently denied without ever recording a real decision — now that the first
+ * attempt properly raises the question and persists the answer, the shortcut
+ * is unnecessary and would only hide a decision the user should actually see
+ * once, even on an upgrade).
  */
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
@@ -25,13 +31,41 @@ type AskCallback = (request: PermissionPromptRequest) => Promise<PermissionPromp
 
 /**
  * Wrap the permission machinery's final ask callback with the workspace trust
- * gate: in an untrusted workspace, deny any non-read tool outright instead of
- * asking. This runs inside PermissionManager's own layer chain (it IS the ask
+ * gate. This runs inside PermissionManager's own layer chain (it IS the ask
  * layer), so it composes with — and cannot drift from — the real machinery.
+ *
+ * - Trusted workspace: every category passes through to `ask` unchanged.
+ * - Restricted workspace with an EXPLICIT prior decision: non-read categories
+ *   are denied outright, same as before — that IS what "restricted" means
+ *   once the user has actually chosen it.
+ * - Undecided workspace (no decision yet, ever): the first non-read request
+ *   raises `requestTrustDecision()` — one modal, persisted via `setLevel` —
+ *   and, if the answer is 'trusted', the ORIGINAL request is forwarded to
+ *   `ask` so the very thing the user just approved actually happens instead
+ *   of failing anyway. Concurrent requests that arrive before the first
+ *   decision resolves await the same in-flight prompt rather than opening a
+ *   second one.
  */
-export function trustGatedAsk(manager: Pick<WorkspaceTrustManager, 'isCategoryAllowed'>, ask: AskCallback): AskCallback {
-  return (request) =>
-    manager.isCategoryAllowed(request.category) ? ask(request) : Promise.resolve({ approved: false });
+export function trustGatedAsk(
+  manager: Pick<WorkspaceTrustManager, 'isCategoryAllowed' | 'isDecided' | 'setLevel'>,
+  ask: AskCallback,
+  requestTrustDecision: () => Promise<WorkspaceTrustLevel>,
+): AskCallback {
+  let pendingDecision: Promise<WorkspaceTrustLevel> | null = null;
+  return async (request) => {
+    if (manager.isCategoryAllowed(request.category)) return ask(request);
+    if (!manager.isDecided()) {
+      if (!pendingDecision) {
+        pendingDecision = requestTrustDecision().finally(() => {
+          pendingDecision = null;
+        });
+      }
+      const level = await pendingDecision;
+      await manager.setLevel(level);
+      if (manager.isCategoryAllowed(request.category)) return ask(request);
+    }
+    return { approved: false };
+  };
 }
 
 export type WorkspaceTrustLevel = 'trusted' | 'restricted';
@@ -115,8 +149,6 @@ export function readPersistedWorkspaceTrust(paths: WorkspaceTrustPaths): Persist
 
 export interface WorkspaceTrustManagerOptions {
   readonly shellPaths: WorkspaceTrustPaths;
-  /** Whether the workspace already had prior GoodVibes runtime state at startup. */
-  readonly hadPriorState: boolean;
 }
 
 export class WorkspaceTrustManager {
@@ -124,20 +156,22 @@ export class WorkspaceTrustManager {
   private grandfathered = false;
   private loaded = false;
   private readonly store: JsonFileStore<PersistedWorkspaceTrust>;
-  private readonly hadPriorState: boolean;
 
   constructor(options: WorkspaceTrustManagerOptions) {
     this.store = new JsonFileStore<PersistedWorkspaceTrust>(
       options.shellPaths.resolveProjectPath('tui', TRUST_FILE),
     );
-    this.hadPriorState = options.hadPriorState;
   }
 
   /**
-   * Load the persisted decision. If none exists, grandfather a workspace that
-   * already had prior GoodVibes state (persisting the decision so it is never
-   * re-evaluated); otherwise the workspace stays undecided and the gate treats
-   * it as restricted until the user chooses.
+   * Load the persisted decision, if one exists. No grandfathering: a
+   * workspace with no persisted decision stays undecided (the gate treats it
+   * as restricted, and the first non-read tool request raises the trust
+   * question via `trustGatedAsk`'s `requestTrustDecision` callback) — even
+   * one that already carries prior GoodVibes runtime state. `grandfathered`
+   * on an already-persisted decision is read-only history from before this
+   * fix (status/doctor still report it honestly); nothing new is ever
+   * grandfathered.
    */
   async load(): Promise<void> {
     if (this.loaded) return;
@@ -145,13 +179,6 @@ export class WorkspaceTrustManager {
     if (persisted && (persisted.level === 'trusted' || persisted.level === 'restricted')) {
       this.level = persisted.level;
       this.grandfathered = persisted.grandfathered ?? false;
-      this.loaded = true;
-      return;
-    }
-    if (this.hadPriorState) {
-      this.level = 'trusted';
-      this.grandfathered = true;
-      await this.persist();
     }
     this.loaded = true;
   }