@pellux/goodvibes-tui 1.16.1 → 1.17.0

package/src/input/handler-onboarding.ts

@@ -3,6 +3,7 @@ import { beginOpenAICodexLogin, exchangeOpenAICodexCode } from '@pellux/goodvibe
 import { summarizeError, openExternalUrl } from '@pellux/goodvibes-sdk/platform/utils';
 import { getProviderIdFromModel } from '../config/provider-model.ts';
 import { buildProviderAccountSnapshot } from '@/runtime/index.ts';
+import { enrichProviderAccountsSnapshot } from '../runtime/onboarding/provider-key-capture.ts';
 import { handleConnectExistingDaemonForHandler, handleMigrateLegacyDaemonServiceForHandler } from './handler-onboarding-daemon-adopt.ts';
 import { detectLegacyUnit, resolveConfiguredServiceName } from '../runtime/legacy-daemon-migration.ts';
 import { OnboardingWizardController, type OnboardingWizardAction, type OnboardingWizardApplyFeedback } from './onboarding/onboarding-wizard.ts';
@@ -376,12 +377,12 @@ export async function refreshOnboardingHydrationForHandler(handler: InputHandler
           list: () => handler.uiServices.platform.surfaceRegistry.syncConfiguredSurfaces(),
         },
         providerAccounts: {
-          loadSnapshot: () => buildProviderAccountSnapshot({
+          loadSnapshot: async () => enrichProviderAccountsSnapshot(await buildProviderAccountSnapshot({
             providerRegistry: handler.uiServices.providers.providerRegistry,
             serviceRegistry: handler.uiServices.platform.serviceRegistry,
             subscriptionManager: handler.uiServices.platform.subscriptionManager,
             secretsManager: handler.uiServices.platform.secretsManager,
-          }),
+          }), handler.uiServices.providers.providerRegistry),
         },
         legacyDaemon: {
           detect: () => ({ ...detectLegacyUnit({ homeDir: handler.uiServices.environment.homeDirectory }), trackedServiceName: resolveConfiguredServiceName(handler.uiServices.platform.configManager) }),

package/src/input/handler-picker-routes.ts

@@ -3,6 +3,7 @@ import type { InputToken } from '@pellux/goodvibes-sdk/platform/core';
 import type { CommandContext } from './command-registry.ts';
 import type { CapabilityFilter, CategoryFilter, ModelPickerModal } from './model-picker.ts';
 import { MODEL_PICKER_CHROME_LINES } from '../renderer/model-picker-overlay.ts';
+import { ensureProviderKeyThenSelect } from './provider-key-intake.ts';
 import { resolveAndValidatePath } from '@pellux/goodvibes-sdk/platform/utils';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import type { BlockActionId } from '../renderer/block-actions.ts';
@@ -66,15 +67,17 @@ export function handleModelPickerToken(state: ModelPickerRouteState, token: Inpu
           } else {
             const target = state.modelPicker.target;
             const handled = state.onModelPickerCommit?.() ?? false;
-            if (!handled) {
-              state.commandContext?.completeModelSelection?.({
-                model: selected,
-                effort: currentEffort,
-                target,
-              });
-            }
             state.modelPicker.close();
             if (state.modalStack[state.modalStack.length - 1] === 'modelPicker') state.modalStack.pop();
+            const ctx = state.commandContext;
+            if (!handled && ctx) {
+              // Selecting an unconfigured provider captures its key inline
+              // (concealed prompt → secrets manager → live re-register) and
+              // only then completes the original selection.
+              ensureProviderKeyThenSelect(ctx, selected.provider, () => {
+                ctx.completeModelSelection?.({ model: selected, effort: currentEffort, target });
+              });
+            }
           }
         }
       } else if (mode === 'provider') {
@@ -88,12 +91,16 @@ export function handleModelPickerToken(state: ModelPickerRouteState, token: Inpu
       } else if (mode === 'effort') {
         const model = state.modelPicker.pendingModel;
         const effort = state.modelPicker.effortLevels[idx];
-        if (model && effort) {
-          const handled = state.onModelPickerCommit?.() ?? false;
-          if (!handled) state.commandContext?.completeModelSelection?.({ model, effort, target: state.modelPicker.target });
-        }
+        const target = state.modelPicker.target;
+        const handled = model && effort ? (state.onModelPickerCommit?.() ?? false) : false;
         state.modelPicker.close();
         if (state.modalStack[state.modalStack.length - 1] === 'modelPicker') state.modalStack.pop();
+        const ctx = state.commandContext;
+        if (model && effort && !handled && ctx) {
+          ensureProviderKeyThenSelect(ctx, model.provider, () => {
+            ctx.completeModelSelection?.({ model, effort, target });
+          });
+        }
       } else if (mode === 'embeddingProvider') {
         const selectedProvider = state.modelPicker.embeddingProviders[idx];
         if (selectedProvider) {
@@ -113,10 +120,16 @@ export function handleModelPickerToken(state: ModelPickerRouteState, token: Inpu
             state.modelPicker.contextCapError = null;
             const validCap = parsedCap !== null && parsedCap > 0 && parsedCap <= 10_000_000 ? parsedCap : null;
             const effort = state.commandContext?.session.runtime.reasoningEffort ?? 'medium';
+            const target = state.modelPicker.target;
             const handled = state.onModelPickerCommit?.() ?? false;
-            if (!handled) state.commandContext?.completeModelSelection?.({ model: capModel, effort, contextCap: validCap, target: state.modelPicker.target });
             state.modelPicker.close();
             if (state.modalStack[state.modalStack.length - 1] === 'modelPicker') state.modalStack.pop();
+            const ctx = state.commandContext;
+            if (!handled && ctx) {
+              ensureProviderKeyThenSelect(ctx, capModel.provider, () => {
+                ctx.completeModelSelection?.({ model: capModel, effort, contextCap: validCap, target });
+              });
+            }
           }
         } else {
           state.modelPicker.close();
@@ -214,7 +227,7 @@ function cycleCapabilityFilter(modelPicker: ModelPickerModal): void {
   modelPicker.setCapabilityFilter(cycle[(cur + 1) % cycle.length]!);
 }
 
-// W6.2 e / W6.1 retirement: the process-modal and live-tail-modal token routes
+// e / retirement: the process-modal and live-tail-modal token routes
 // were removed with those modals (F2 now opens Fleet, which subsumes the live
 // process tree). ProcessModal/AgentDetailModal/LiveTailModal were structurally
 // unreachable after the F2 repoint and were deleted.

package/src/input/handler-shortcuts.ts

@@ -84,7 +84,7 @@ export function handleGlobalShortcutToken(
   // unclaimed key once panelFocused is true and reports it handled). The
   // practical effect was that F2 could OPEN+focus the Fleet panel exactly
   // once; every subsequent press while already focused vanished silently —
-  // "F2 pressed 4x never closed the panel" (UX-C evaluator finding). Routing
+  // "F2 pressed 4x never closed the panel" (evaluator finding). Routing
   // it here, before handlePanelFocusToken ever sees the token, gives F2 the
   // same toggle semantics as Ctrl+O below, matching how Ctrl+P/panel-picker
   // was already reachable regardless of panelFocused.
@@ -139,7 +139,7 @@ export function handleGlobalShortcutToken(
       // in-panel action (FleetPanel session-tab detach) before it closes the
       // panel outright — see Panel.interceptPanelClose's doc comment.
       if (active?.interceptPanelClose?.()) {
-        // UX-C fix: a consumed Ctrl+X (the Fleet panel's session-tab detach)
+        // fix: a consumed Ctrl+X (the Fleet panel's session-tab detach)
         // used to leave panelFocused untouched, so focus stayed on the panel
         // — the evaluator's "Ctrl+X detach landed focus in the panel and a
         // typed question became nav keys". Detach is a leave-taking action:
@@ -203,7 +203,7 @@ export function handleGlobalShortcutToken(
       // Alt+1..9: jump directly to the Nth workspace tab. Routed globally (like
       // panel-tab-next/prev) so the jump works whether focus is on the prompt or
       // the workspace; gated on visibility, matching cyclePanelTab semantics.
-      // UX-C: a chord jump is "I'm going panel-driving" (focus rule 1a) — the
+      // a chord jump is "I'm going panel-driving" (focus rule 1a) — the
       // jump now also grabs keyboard focus, matching F2/Ctrl+O/Ctrl+P, so j/k
       // land in the newly-active tab immediately instead of the composer.
       const pm = state.panelManager;
@@ -218,9 +218,9 @@ export function handleGlobalShortcutToken(
     }
 
     case 'panel-ops': {
-      // Ctrl+O: TOGGLE the Fleet panel (UX-C — same semantics as F2 above; see
+      // Ctrl+O: TOGGLE the Fleet panel (— same semantics as F2 above; see
       // toggleFleetPanel's doc comment). The former Ops Control panel was
-      // retired to an 'ops-control' -> 'fleet' alias (W6.1); rather than route
+      // retired to an 'ops-control' -> 'fleet' alias; rather than route
       // through the now-aliased openOpsPanel callback (which opens without
       // transferring focus), this operates on 'fleet' directly.
       toggleFleetPanel(state);
@@ -403,7 +403,7 @@ export function handleGlobalShortcutToken(
 }
 
 /**
- * toggleFleetPanel — the shared F2 / Ctrl+O TOGGLE (UX-C item 2): if the
+ * toggleFleetPanel — the shared F2 / Ctrl+O TOGGLE (item 2): if the
  * Fleet panel is open AND the panel workspace currently owns keyboard focus
  * with Fleet as the active tab, the chord CLOSES it and returns focus to the
  * composer; if Fleet is open but not the focused/active tab, the chord brings

package/src/input/handler.ts

@@ -194,7 +194,7 @@ export class InputHandler implements InputHandlerLike {
   public blockActionsMenu = new BlockActionsMenu();
   public settingsModal = new SettingsModal();
   public configModal = new ConfigModal();
-  /** DEBT-5 item 5 — paste-flood guard state, mutated in place across tokens (never reallocated). */
+  /** item 5 — paste-flood guard state, mutated in place across tokens (never reallocated). */
   private panelBurstGuard: PanelBurstGuardState = { timestamps: [], suspended: false, hintShown: false };
   public mcpWorkspace = new McpWorkspace();
   public onboardingWizard = new OnboardingWizardController();
@@ -277,7 +277,7 @@ export class InputHandler implements InputHandlerLike {
       uiServices.providers.benchmarkStore,
       uiServices.providers.providerRegistry,
     );
-    // W6.1 retirement: ProcessModal/LiveTailModal/AgentDetailModal were removed
+    // retirement: ProcessModal/LiveTailModal/AgentDetailModal were removed
     // — F2 now opens the Fleet panel, which subsumes the live process tree.
     this.bookmarkModal = new BookmarkModal(uiServices.shell.bookmarkManager);
     this.sessionPickerModal = new SessionPickerModal(uiServices.sessions.sessionManager, uiServices.sessions.sessionBroker);

package/src/input/keybindings.ts

@@ -147,8 +147,8 @@ export const DEFAULT_KEYBINDINGS: Record<KeyAction, KeyCombo[]> = {
   'panel-tab-8':           [{ key: '8', alt: true }],
   'panel-tab-9':           [{ key: '9', alt: true }],
   // Ctrl+O: TOGGLE the Fleet panel (open+focus / bring-to-front+focus / close
-  // — see toggleFleetPanel in handler-shortcuts.ts, UX-C). The former Ops
-  // Control panel was retired to an 'ops-control' -> 'fleet' alias (W6.1); the
+  // — see toggleFleetPanel in handler-shortcuts.ts). The former Ops
+  // Control panel was retired to an 'ops-control' -> 'fleet' alias; the
   // binding is KEPT (repointed, not removed) so the Ctrl+O muscle memory still
   // lands somewhere useful. Routed globally in handleGlobalShortcutToken.
   'panel-ops':             [{ key: 'o', ctrl: true }],

package/src/input/onboarding/onboarding-feature-units.ts

@@ -15,7 +15,7 @@
  */
 
 import type { ConfigKey } from '../../config/index.ts';
-import { FEATURE_FLAG_MAP } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import { getFeatureSetting, isFeatureDefaultEnabled } from '../../runtime/feature-settings.ts';
 import type {
   OnboardingWizardControllerLike,
   OnboardingWizardFieldDefinition,
@@ -94,12 +94,13 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
         hint: 'When the exec sandbox leaves a command on ask, a model pass annotates the ask with stated reasons. Never converts allow to deny; never touches the frozen catastrophic block.',
         subOptions: [
           {
-            key: 'auto-approve',
-            configKey: 'sandbox.judgmentAutoApprove' as ConfigKey,
-            label: 'Auto-approve looks-safe verdicts',
-            hint: 'Yes lets a looks-safe judgment auto-approve the ask; No keeps annotate-only (default).',
-            valueType: 'boolean',
-            defaultValue: 'no',
+            key: 'mode',
+            configKey: 'sandbox.judgment' as ConfigKey,
+            label: 'Judgment mode',
+            hint: 'annotate (default) proposes a verdict with stated reasons and the human still decides; auto-approve additionally auto-approves looks-safe verdicts; off keeps plain asks.',
+            valueType: 'enum',
+            options: ['off', 'annotate', 'auto-approve'],
+            defaultValue: 'annotate',
           },
         ],
       },
@@ -283,23 +284,18 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
       {
         flagId: 'integration-delivery-slo',
         label: 'Integration delivery SLO',
-        hint: 'Retry with backoff and a dead-letter queue for Slack/Discord/webhook delivery. Exposes /notify dlq and /notify replay.',
-        subOptions: [
-          {
-            key: 'slo',
-            configKey: 'integrations.delivery.sloEnforced' as ConfigKey,
-            label: 'Enforce delivery SLO',
-            hint: 'Yes logs dead-letter events at error level and surfaces them in diagnostics; No is warn-level only (default).',
-            valueType: 'boolean',
-            defaultValue: 'no',
-          },
-        ],
+        hint: 'Retry with backoff and a dead-letter queue for Slack/Discord/webhook delivery, with dead-letter events surfaced in diagnostics. On by default; exposes /notify dlq and /notify replay. Retry bounds are tuned in /settings.',
       },
       {
         flagId: 'adaptive-execution-planner',
         label: 'Adaptive execution planner',
         hint: 'Score single/cohort/background/remote strategies each turn and pick the best. Exposes /plan commands.',
       },
+      {
+        flagId: 'daemon-auto-update',
+        label: 'Daemon auto-update',
+        hint: 'The daemon checks for a new release hourly, checksum-verifies it, swaps binaries only at a no-active-work moment, and keeps the previous binary for one-command rollback. On by default; update.auto turns it off and update.intervalMinutes tunes the cadence in /settings.',
+      },
       {
         flagId: 'relay-connect',
         label: 'Outbound zero-knowledge relay',
@@ -355,10 +351,10 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
             key: 'backend',
             configKey: 'tools.overflowSpillBackend' as ConfigKey,
             label: 'Spill backend',
-            hint: 'file (default), ledger, or diagnostics.',
+            hint: 'ledger (default when this feature is on) or diagnostics; file is the baseline used while the feature is off.',
             valueType: 'enum',
             options: ['file', 'ledger', 'diagnostics'],
-            defaultValue: 'file',
+            defaultValue: 'ledger',
           },
         ],
       },
@@ -398,9 +394,9 @@ export function featureSubOptionFieldId(flagId: string, key: string): string {
   return `feature.${flagId}.${key}`;
 }
 
-/** Whether a flag defaults to enabled (drives the toggle's default-checked state). */
+/** Whether a feature defaults to enabled (drives the toggle's default-checked state). */
 export function isFeatureDefaultOn(flagId: string): boolean {
-  return FEATURE_FLAG_MAP.get(flagId)?.defaultState === 'enabled';
+  return isFeatureDefaultEnabled(flagId);
 }
 
 /** Every flag id reachable through the guided feature steps. */
@@ -498,10 +494,12 @@ export function buildFeatureUnitSteps(
 
 /**
  * Fold the guided feature selections into apply operations: for each unit, when
- * the user's choice differs from the flag's default, record the flag override;
- * when the feature is enabled, write its implied config, prerequisite flags, and
- * chosen sub-options. Flag overrides are collected into `overrides` (flushed by
- * the caller with the surface flags); config writes go straight to setConfig.
+ * the user's choice differs from the feature's default, record the desired
+ * state; when the feature is enabled, write its implied config, prerequisite
+ * features, and chosen sub-options. Desired states are collected into
+ * `overrides` (flushed by the caller as plain domain-settings writes on each
+ * feature's enablement key, together with the surface capabilities); other
+ * config writes go straight to setConfig.
  */
 export function applyFeatureUnitOperations(
   controller: OnboardingWizardControllerLike,
@@ -521,15 +519,24 @@ export function applyFeatureUnitOperations(
       for (const prerequisite of unit.requiresFlags ?? []) overrides.set(prerequisite, 'enabled');
       for (const implied of unit.impliedConfig ?? []) setConfig(implied.key, implied.value);
 
+      const enablementKey = getFeatureSetting(unit.flagId)?.enablement.key;
       for (const sub of unit.subOptions ?? []) {
         const raw = controller.getStringFieldValue(featureSubOptionFieldId(unit.flagId, sub.key), sub.defaultValue);
+        let wrote = true;
         if (sub.valueType === 'boolean') {
           setConfig(sub.configKey, raw === 'yes');
         } else if (sub.valueType === 'text') {
-          if (raw.length > 0) setConfig(sub.configKey, raw);
+          wrote = raw.length > 0;
+          if (wrote) setConfig(sub.configKey, raw);
         } else {
           setConfig(sub.configKey, raw);
         }
+        // A sub-option that writes the unit's OWN enablement key (e.g. the
+        // provider-optimizer routing mode) is the authoritative enablement
+        // value — drop the pending override so the flush cannot clobber it.
+        if (wrote && enablementKey !== undefined && sub.configKey === enablementKey) {
+          overrides.delete(unit.flagId);
+        }
       }
     }
   }

package/src/input/onboarding/onboarding-provider-key-fields.ts

@@ -0,0 +1,112 @@
+/**
+ * Provider-agnostic API-key fields for the onboarding provider step.
+ *
+ * Kept out of onboarding-wizard-steps.ts so the step file stays focused on step
+ * assembly. Both pieces read from the same registration-truth targets so the
+ * inventory line and the per-provider masked fields never disagree.
+ */
+
+import type { ProviderKeyCaptureTarget, SubscriptionStatusTarget } from '../../runtime/onboarding/provider-key-capture.ts';
+import { deriveSubscriptionStatusTargets, providerKeyFieldId, subscriptionStatusFieldId } from '../../runtime/onboarding/provider-key-capture.ts';
+import type { OnboardingProviderAccountRecord } from '../../runtime/onboarding/types.ts';
+import type {
+  OnboardingWizardMaskedFieldDefinition,
+  OnboardingWizardStatusFieldDefinition,
+} from './onboarding-wizard-types.ts';
+
+/**
+ * Providers with a wired in-wizard subscription sign-in flow. This is DATA — the
+ * set of providers whose OAuth login the wizard can start/finish itself — not an
+ * assumption that any one vendor is the only subscription option.
+ */
+const SUBSCRIPTION_SIGN_IN_PROVIDER_IDS = new Set<string>(['openai']);
+
+/**
+ * One subscription-status row per subscription-capable provider. The row's copy
+ * names the provider from data — never a vendor hardcoded in the field set — so
+ * the status surface tracks whatever subscription-capable providers the runtime
+ * reports, not a single assumed one.
+ */
+export function buildSubscriptionStatusFields(
+  targets: readonly SubscriptionStatusTarget[],
+): OnboardingWizardStatusFieldDefinition[] {
+  return targets.map((target) => ({
+    kind: 'status',
+    id: subscriptionStatusFieldId(target.providerId),
+    label: `${target.providerId} subscription status`,
+    hint: target.active
+      ? `A ${target.providerId} subscription session is already available.`
+      : target.pending
+        ? `A ${target.providerId} subscription login is pending.`
+        : `No ${target.providerId} subscription session was found in the current runtime state.`,
+    defaultValue: target.active ? 'Active' : target.pending ? 'Pending' : 'Not detected',
+  }));
+}
+
+/** The provider-agnostic subscription posture the provider step renders. */
+export interface SubscriptionPosture {
+  readonly statusFields: OnboardingWizardStatusFieldDefinition[];
+  /** The provider whose in-wizard sign-in flow applies now, or null. */
+  readonly signInProviderId: string | null;
+  readonly signInPending: boolean;
+  readonly summaryLine: string;
+}
+
+/**
+ * Derive the subscription posture for the provider step: one status row per
+ * subscription-capable provider, plus which (if any) provider's in-wizard OAuth
+ * sign-in flow applies right now (a subscription-capable, sign-in-wired provider
+ * that is not already active).
+ */
+export function buildSubscriptionPosture(
+  activeProviderIds: readonly string[],
+  pendingProviderIds: readonly string[],
+  providers: readonly OnboardingProviderAccountRecord[] | undefined,
+): SubscriptionPosture {
+  const targets = deriveSubscriptionStatusTargets(providers, activeProviderIds, pendingProviderIds);
+  const signIn = targets.find((target) => SUBSCRIPTION_SIGN_IN_PROVIDER_IDS.has(target.providerId) && !target.active);
+  const activeCount = targets.filter((target) => target.active).length;
+  const pendingCount = targets.filter((target) => target.pending).length;
+  return {
+    statusFields: buildSubscriptionStatusFields(targets),
+    signInProviderId: signIn?.providerId ?? null,
+    signInPending: signIn?.pending ?? false,
+    summaryLine: targets.length === 0
+      ? 'Subscriptions: none detected'
+      : `Subscriptions: ${activeCount} active, ${pendingCount} pending across ${targets.length} provider(s)`,
+  };
+}
+
+/** The status line summarizing how many key-accepting providers are configured. */
+export function buildProviderKeyInventoryField(
+  targets: readonly ProviderKeyCaptureTarget[],
+): OnboardingWizardStatusFieldDefinition {
+  const configuredCount = targets.filter((target) => target.configured).length;
+  return {
+    kind: 'status',
+    id: 'providers.api-key-inventory',
+    label: 'Provider API keys',
+    hint: targets.length === 0
+      ? 'No key-accepting providers are registered yet in the current runtime state.'
+      : `${targets.length} provider(s) accept an API key; ${configuredCount} already configured. Values stay masked.`,
+    defaultValue: targets.length === 0
+      ? 'None detected'
+      : `${configuredCount}/${targets.length} configured`,
+  };
+}
+
+/** One masked field per key-accepting provider, keyed off registration truth. */
+export function buildProviderKeyMaskedFields(
+  targets: readonly ProviderKeyCaptureTarget[],
+): OnboardingWizardMaskedFieldDefinition[] {
+  return targets.map((target) => ({
+    kind: 'masked',
+    id: providerKeyFieldId(target.providerId),
+    label: `${target.providerId} API key`,
+    hint: target.configured
+      ? `A key for ${target.providerId} is already stored. Leave blank to keep it; enter a new key to replace it through the secret manager.`
+      : `Optional: enter an API key for ${target.providerId} now. The value is stored through the secret manager, not in config.`,
+    placeholder: target.configured ? 'already configured' : 'paste key',
+    defaultValue: '',
+  }));
+}

package/src/input/onboarding/onboarding-wizard-apply.ts

@@ -1,6 +1,7 @@
 import type { OnboardingAcknowledgementTarget, OnboardingApplyOperation, OnboardingApplyRequest } from '../../runtime/onboarding/index.ts';
 import { formatProviderModel } from '../../config/provider-model.ts';
 import { getServerSurfaceFeatureFlags } from '../../runtime/surface-feature-flags.ts';
+import { featureEnablementWrite } from '../../runtime/feature-settings.ts';
 import {
   buildCloudflareApiTokenRef,
   buildCloudflareOperationalTokenRef,
@@ -17,13 +18,9 @@ import {
 } from './onboarding-wizard-external-surfaces.ts';
 import { applyFeatureUnitOperations } from './onboarding-feature-units.ts';
 import { buildGoodVibesSecretKey, buildGoodVibesSecretRef, isLoopbackAddress, isSecretReferenceValue } from './onboarding-wizard-helpers.ts';
+import { deriveProviderKeyCaptureTargets, providerKeyFieldId } from '../../runtime/onboarding/provider-key-capture.ts';
 import type { OnboardingWizardControllerLike } from './onboarding-wizard-types.ts';
 
-/** SDK schema default for behavior.hitlMode (schema-domain-core DEFAULT_CONFIG). */
-const HITL_MODE_SCHEMA_DEFAULT = 'balanced';
-/** Feature flag that gates behavior.hitlMode preset application in ModeManager. */
-const HITL_UX_MODES_FEATURE_FLAG = 'hitl-ux-modes';
-
 export function buildOnboardingApplyRequest(controller: OnboardingWizardControllerLike): OnboardingApplyRequest {
     const operations: OnboardingApplyOperation[] = [];
     // Accumulates feature-flag state that onboarding selections require, so the
@@ -132,21 +129,21 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
     setConfig('provider.reasoningEffort', controller.getStringFieldValue('default-model.reasoning', controller.runtimeSnapshot?.providerRouting.primaryReasoningEffort ?? 'medium'));
     const hitlMode = controller.getStringFieldValue('experience.hitl', controller.runtimeSnapshot?.runtimeDefaults.behavior.hitlMode ?? 'balanced');
     setConfig('behavior.hitlMode', hitlMode);
-    // behavior.hitlMode is gated by the hitl-ux-modes feature flag: ModeManager
-    // only applies the chosen preset to the notification router when the flag is
-    // on. Writing hitlMode without enabling the flag leaves the user's choice
-    // silently inert. When the user picks a non-default mode, enable the gating
-    // flag in the same apply batch so the selection actually takes effect. The
-    // SDK schema default is 'balanced' (schema-domain-core DEFAULT_CONFIG); a
-    // choice equal to the default is left to the flag's own default-off state.
-    if (hitlMode !== HITL_MODE_SCHEMA_DEFAULT) {
-      featureFlagOverrides.set(HITL_UX_MODES_FEATURE_FLAG, 'enabled');
-    }
+    // behavior.hitlMode IS the enablement key of the hitl-ux-modes capability
+    // (active for quiet/balanced/operator, off only at 'off'), so the write
+    // above already carries the enablement — no separate gating write exists,
+    // and adding one here would clobber a non-default choice with the stock
+    // mode when the batch flushes.
     setConfig('behavior.guidanceMode', controller.getStringFieldValue('experience.guidance', controller.runtimeSnapshot?.runtimeDefaults.behavior.guidanceMode ?? 'minimal'));
     setConfig('permissions.mode', controller.getStringFieldValue('experience.permissions', controller.runtimeSnapshot?.runtimeDefaults.permissionsMode ?? 'prompt'));
     setConfig('storage.secretPolicy', controller.getStringFieldValue('external-services.secret-policy', controller.runtimeSnapshot?.runtimeDefaults.secretStoragePolicy ?? 'preferred_secure'));
 
-    setSecret('OPENAI_API_KEY', controller.getStringFieldValue('providers.openai-api-key', ''));
+    // Provider-agnostic key capture: store each entered key under the provider's
+    // own declared secret key. Empty fields are skipped (setSecret no-ops), so
+    // a blank field keeps any existing key untouched.
+    for (const target of deriveProviderKeyCaptureTargets(controller.runtimeSnapshot?.providerAccounts?.providers)) {
+      setSecret(target.apiKeyEnvVar, controller.getStringFieldValue(providerKeyFieldId(target.providerId), ''));
+    }
 
     if (shouldShowCloudflareStep(controller)) {
       addCloudflareOperations(controller, operations, setSecret);
@@ -190,12 +187,13 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
       }
     }
     // Feature units from the guided feature steps (safety, memory & context,
-    // telemetry, automation, provider, advanced): enable/disable each flag the
-    // user changed from its default and write its chosen sub-options.
+    // telemetry, automation, provider, advanced): enable/disable each feature
+    // the user changed from its default and write its chosen sub-options.
     applyFeatureUnitOperations(controller, setConfig, featureFlagOverrides);
 
-    // Surface/server flags are authoritative for the network-exposing flags they
-    // own — apply them last so they win over any feature-step override.
+    // Surface/server capabilities are authoritative for the network-exposing
+    // features they own — apply them last so they win over any feature-step
+    // override.
     for (const surfaceFlag of getServerSurfaceFeatureFlags({
       serverBacked: hasServers,
       web: browserAccess,
@@ -203,8 +201,11 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
     })) {
       featureFlagOverrides.set(surfaceFlag, 'enabled');
     }
+    // Each selection lands as a plain domain-settings write on the feature's
+    // real enablement key (e.g. sandbox.enabled, controlPlane.gateway).
     for (const flagId of [...featureFlagOverrides.keys()].sort((left, right) => left.localeCompare(right))) {
-      setConfig(`featureFlags.${flagId}`, featureFlagOverrides.get(flagId)!);
+      const write = featureEnablementWrite(flagId, featureFlagOverrides.get(flagId)! === 'enabled');
+      if (write) setConfig(write.key, write.value);
     }
 
     acknowledge('providers', 'providers.reviewed');

package/src/input/onboarding/onboarding-wizard-external-surfaces.ts

@@ -282,6 +282,23 @@ const SURFACE_OVERLAYS: readonly SurfaceOverlay[] = [
       { configKey: 'surfaces.mattermost.defaultChannelId', label: 'Mattermost default channel ID', hint: 'Fallback Mattermost channel for outbound messages.', placeholder: 'channel id' },
     ],
   },
+  {
+    onboardingId: 'telephony',
+    sdkSurface: 'telephony',
+    label: 'Telephony surface',
+    hint: 'Enable SMS/voice notification delivery — direct Twilio, or a self-hosted bridge.',
+    fields: [
+      { configKey: 'surfaces.telephony.provider', label: 'Telephony provider', hint: 'twilio for direct Twilio delivery, bridge for a self-hosted telephony bridge.', placeholder: 'twilio' },
+      { configKey: 'surfaces.telephony.mode', label: 'Telephony mode', hint: 'sms, voice (call with spoken text), or bridge.', placeholder: 'sms' },
+      { configKey: 'surfaces.telephony.accountSid', label: 'Twilio account SID', hint: 'Account SID for direct Twilio delivery.', placeholder: 'AC...' },
+      { configKey: 'surfaces.telephony.authToken', label: 'Twilio auth token', hint: 'Auth token for direct Twilio delivery.', placeholder: 'auth token' },
+      { configKey: 'surfaces.telephony.fromNumber', label: 'From number', hint: 'The E.164 number outbound SMS/calls originate from.', placeholder: '+15551234567' },
+      { configKey: 'surfaces.telephony.defaultRecipient', label: 'Default recipient', hint: 'Fallback E.164 number for outbound delivery.', placeholder: '+15557654321' },
+      { configKey: 'surfaces.telephony.bridgeUrl', label: 'Bridge URL', hint: 'Base URL of the self-hosted telephony bridge (bridge provider only).', placeholder: 'https://telephony-bridge.example.test' },
+      { configKey: 'surfaces.telephony.token', label: 'Bridge token', hint: 'Token used to authenticate with the telephony bridge.', placeholder: 'bridge token' },
+      { configKey: 'surfaces.telephony.webhookSecret', label: 'Webhook secret', hint: 'Secret used to verify inbound telephony webhooks.', placeholder: 'webhook secret' },
+    ],
+  },
   {
     onboardingId: 'matrix',
     sdkSurface: 'matrix',

package/src/input/onboarding/onboarding-wizard-network-adopt.ts

@@ -106,7 +106,7 @@ export function pushLegacyDaemonMigrationFields(
   fields.push({
     kind: 'status',
     id: 'network.migrate-legacy-daemon-detected',
-    label: 'Legacy daemon service detected',
+    label: 'Separate install-script daemon service detected',
     // Follow-up: name the unit this host actually resolves (carried on the
     // snapshot from `resolveConfiguredServiceName` at collection time) — the
     // MANAGED_SERVICE_NAME fallback only covers snapshots built without it.
@@ -126,7 +126,7 @@ export function pushLegacyDaemonMigrationFields(
   fields.push({
     kind: 'action',
     id: 'network.migrate-legacy-daemon',
-    label: confirmed ? 'Migrate legacy daemon service now' : 'Preview migration plan',
+    label: confirmed ? 'Migrate the install-script daemon service now' : 'Preview migration plan',
     hint: confirmed
       ? 'Executes the migration now: new-up-then-old-down, never touching the legacy unit until the new one is verified healthy. Result prints to the feed below.'
       : 'Prints the migration plan without changing anything. Check "Confirm migration execution" above to arm the real migration.',