@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/input/handler-modal-routes.ts

@@ -95,7 +95,7 @@ export function handleSelectionModalToken(state: SelectionRouteState, token: Inp
           dispatchSelectionAction(action, selected);
         }
       } else if (state.selectionModal.allowSearch) {
-        // UX-C instant filter: an unclaimed keystroke arms search AND starts
+        // instant filter: an unclaimed keystroke arms search AND starts
         // the query immediately, instead of silently doing nothing until the
         // user discovers '/' first (the "help search needs '/' arming while
         // the palette filters instantly" evaluator finding — /help has no
@@ -108,7 +108,7 @@ export function handleSelectionModalToken(state: SelectionRouteState, token: Inp
     }
   } else if (token.type === 'key') {
     if (token.logicalName === 'escape') {
-      // UX-C: ONE Escape always closes the modal, regardless of search state.
+      // ONE Escape always closes the modal, regardless of search state.
       // Clearing an in-progress query is Backspace's job, not Esc's — the old
       // two-stage contract (1st Esc clears query, 2nd blurs search, 3rd
       // finally closes) was the "help modal took 3 Escapes after searching"
@@ -234,6 +234,8 @@ type SettingsRouteState = {
     searchQuery: string;
     commitEdit: () => void;
     toggleSelectedFlag: () => void;
+    /** Scroll the documentation pane (PgUp/PgDn); the renderer clamps and shows honest markers. */
+    scrollContext?: (delta: number) => void;
     activateSelected: () => void;
     handleSubscriptionLogoutKey?: (key: string) => 'confirmed' | 'cancelled' | 'absorbed' | 'inactive';
     adjustSelected: (direction: 'left' | 'right', step?: number) => void;
@@ -415,6 +417,12 @@ export function handleSettingsModalToken(state: SettingsRouteState, token: Input
       const reset = state.settingsModal.resetSelected?.();
       if (reset) syncRuntimeAfterSettingReset(state.commandContext, reset.key, reset.value);
     }
+    else if (token.logicalName === 'pageup' && !state.settingsModal.editingMode) {
+      state.settingsModal.scrollContext?.(-3);
+    }
+    else if (token.logicalName === 'pagedown' && !state.settingsModal.editingMode) {
+      state.settingsModal.scrollContext?.(3);
+    }
     else if (token.logicalName === 'tab' && !state.settingsModal.searchFocused) {
       if (state.settingsModal.toggleFocusPane) state.settingsModal.toggleFocusPane();
       else if (focusPane === 'categories') state.settingsModal.focusSettings?.();
@@ -556,9 +564,9 @@ type ConfigModalRouteState = {
 };
 
 /**
- * Route a key to the generic config-modal host (W6.1 MIGRATE-TO-MODAL
+ * Route a key to the generic config-modal host (MIGRATE-TO-MODAL
  * surfaces). The host owns the reserved navigation keys (Esc, up/down/j/k tab
- * left/right, and now '/' — DEBT-5 item 1's type-to-filter, armed the same
+ * left/right, and now '/' — item 1's type-to-filter, armed the same
  * way as scrollable-list-panel.ts's opt-in filter and SettingsModal's own
  * '/'-armed search); every other key is offered to the active surface's
  * declarative action table (fireAction handles the two-press confirm for

package/src/input/handler-modal-token-routes.ts

@@ -227,7 +227,7 @@ export function handleModalTokenRoutes(state: ModalTokenRouteState, token: Input
     return withState(state, true);
   }
 
-  // W6.1 retirement: the live-tail, agent-detail, and process-modal token
+  // retirement: the live-tail, agent-detail, and process-modal token
   // routes were removed with those modals (F2 now opens Fleet, which subsumes
   // the live process tree; the three modals were structurally unreachable after
   // the F2 repoint and were deleted).

package/src/input/handler-onboarding-daemon-adopt.ts

@@ -138,10 +138,10 @@ export async function handleMigrateLegacyDaemonServiceForHandler(handler: InputH
       legacy,
     );
     handler.commandContext?.print?.(
-      ['Migrate legacy daemon service:', ...result.lines.map((line: string) => `  ${line}`)].join('\n'),
+      ['Migrate install-script daemon service:', ...result.lines.map((line: string) => `  ${line}`)].join('\n'),
     );
   } catch (error) {
-    handler.commandContext?.print?.(`Migrate legacy daemon service failed: ${summarizeError(error)}`);
+    handler.commandContext?.print?.(`Migrate install-script daemon service failed: ${summarizeError(error)}`);
   } finally {
     handler.onboardingApplyPending = false;
     handler.requestRender();

package/src/input/handler-onboarding.ts

@@ -3,6 +3,7 @@ import { beginOpenAICodexLogin, exchangeOpenAICodexCode } from '@pellux/goodvibe
 import { summarizeError, openExternalUrl } from '@pellux/goodvibes-sdk/platform/utils';
 import { getProviderIdFromModel } from '../config/provider-model.ts';
 import { buildProviderAccountSnapshot } from '@/runtime/index.ts';
+import { enrichProviderAccountsSnapshot } from '../runtime/onboarding/provider-key-capture.ts';
 import { handleConnectExistingDaemonForHandler, handleMigrateLegacyDaemonServiceForHandler } from './handler-onboarding-daemon-adopt.ts';
 import { detectLegacyUnit, resolveConfiguredServiceName } from '../runtime/legacy-daemon-migration.ts';
 import { OnboardingWizardController, type OnboardingWizardAction, type OnboardingWizardApplyFeedback } from './onboarding/onboarding-wizard.ts';
@@ -376,12 +377,12 @@ export async function refreshOnboardingHydrationForHandler(handler: InputHandler
           list: () => handler.uiServices.platform.surfaceRegistry.syncConfiguredSurfaces(),
         },
         providerAccounts: {
-          loadSnapshot: () => buildProviderAccountSnapshot({
+          loadSnapshot: async () => enrichProviderAccountsSnapshot(await buildProviderAccountSnapshot({
             providerRegistry: handler.uiServices.providers.providerRegistry,
             serviceRegistry: handler.uiServices.platform.serviceRegistry,
             subscriptionManager: handler.uiServices.platform.subscriptionManager,
             secretsManager: handler.uiServices.platform.secretsManager,
-          }),
+          }), handler.uiServices.providers.providerRegistry),
         },
         legacyDaemon: {
           detect: () => ({ ...detectLegacyUnit({ homeDir: handler.uiServices.environment.homeDirectory }), trackedServiceName: resolveConfiguredServiceName(handler.uiServices.platform.configManager) }),

package/src/input/handler-picker-routes.ts

@@ -3,6 +3,7 @@ import type { InputToken } from '@pellux/goodvibes-sdk/platform/core';
 import type { CommandContext } from './command-registry.ts';
 import type { CapabilityFilter, CategoryFilter, ModelPickerModal } from './model-picker.ts';
 import { MODEL_PICKER_CHROME_LINES } from '../renderer/model-picker-overlay.ts';
+import { ensureProviderKeyThenSelect } from './provider-key-intake.ts';
 import { resolveAndValidatePath } from '@pellux/goodvibes-sdk/platform/utils';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import type { BlockActionId } from '../renderer/block-actions.ts';
@@ -66,15 +67,17 @@ export function handleModelPickerToken(state: ModelPickerRouteState, token: Inpu
           } else {
             const target = state.modelPicker.target;
             const handled = state.onModelPickerCommit?.() ?? false;
-            if (!handled) {
-              state.commandContext?.completeModelSelection?.({
-                model: selected,
-                effort: currentEffort,
-                target,
-              });
-            }
             state.modelPicker.close();
             if (state.modalStack[state.modalStack.length - 1] === 'modelPicker') state.modalStack.pop();
+            const ctx = state.commandContext;
+            if (!handled && ctx) {
+              // Selecting an unconfigured provider captures its key inline
+              // (concealed prompt → secrets manager → live re-register) and
+              // only then completes the original selection.
+              ensureProviderKeyThenSelect(ctx, selected.provider, () => {
+                ctx.completeModelSelection?.({ model: selected, effort: currentEffort, target });
+              });
+            }
           }
         }
       } else if (mode === 'provider') {
@@ -88,12 +91,16 @@ export function handleModelPickerToken(state: ModelPickerRouteState, token: Inpu
       } else if (mode === 'effort') {
         const model = state.modelPicker.pendingModel;
         const effort = state.modelPicker.effortLevels[idx];
-        if (model && effort) {
-          const handled = state.onModelPickerCommit?.() ?? false;
-          if (!handled) state.commandContext?.completeModelSelection?.({ model, effort, target: state.modelPicker.target });
-        }
+        const target = state.modelPicker.target;
+        const handled = model && effort ? (state.onModelPickerCommit?.() ?? false) : false;
         state.modelPicker.close();
         if (state.modalStack[state.modalStack.length - 1] === 'modelPicker') state.modalStack.pop();
+        const ctx = state.commandContext;
+        if (model && effort && !handled && ctx) {
+          ensureProviderKeyThenSelect(ctx, model.provider, () => {
+            ctx.completeModelSelection?.({ model, effort, target });
+          });
+        }
       } else if (mode === 'embeddingProvider') {
         const selectedProvider = state.modelPicker.embeddingProviders[idx];
         if (selectedProvider) {
@@ -113,10 +120,16 @@ export function handleModelPickerToken(state: ModelPickerRouteState, token: Inpu
             state.modelPicker.contextCapError = null;
             const validCap = parsedCap !== null && parsedCap > 0 && parsedCap <= 10_000_000 ? parsedCap : null;
             const effort = state.commandContext?.session.runtime.reasoningEffort ?? 'medium';
+            const target = state.modelPicker.target;
             const handled = state.onModelPickerCommit?.() ?? false;
-            if (!handled) state.commandContext?.completeModelSelection?.({ model: capModel, effort, contextCap: validCap, target: state.modelPicker.target });
             state.modelPicker.close();
             if (state.modalStack[state.modalStack.length - 1] === 'modelPicker') state.modalStack.pop();
+            const ctx = state.commandContext;
+            if (!handled && ctx) {
+              ensureProviderKeyThenSelect(ctx, capModel.provider, () => {
+                ctx.completeModelSelection?.({ model: capModel, effort, contextCap: validCap, target });
+              });
+            }
           }
         } else {
           state.modelPicker.close();
@@ -214,7 +227,7 @@ function cycleCapabilityFilter(modelPicker: ModelPickerModal): void {
   modelPicker.setCapabilityFilter(cycle[(cur + 1) % cycle.length]!);
 }
 
-// W6.2 e / W6.1 retirement: the process-modal and live-tail-modal token routes
+// e / retirement: the process-modal and live-tail-modal token routes
 // were removed with those modals (F2 now opens Fleet, which subsumes the live
 // process tree). ProcessModal/AgentDetailModal/LiveTailModal were structurally
 // unreachable after the F2 repoint and were deleted.

package/src/input/handler-shortcuts.ts

@@ -84,7 +84,7 @@ export function handleGlobalShortcutToken(
   // unclaimed key once panelFocused is true and reports it handled). The
   // practical effect was that F2 could OPEN+focus the Fleet panel exactly
   // once; every subsequent press while already focused vanished silently —
-  // "F2 pressed 4x never closed the panel" (UX-C evaluator finding). Routing
+  // "F2 pressed 4x never closed the panel" (evaluator finding). Routing
   // it here, before handlePanelFocusToken ever sees the token, gives F2 the
   // same toggle semantics as Ctrl+O below, matching how Ctrl+P/panel-picker
   // was already reachable regardless of panelFocused.
@@ -119,6 +119,29 @@ export function handleGlobalShortcutToken(
       state.handleCtrlC();
       return true;
 
+    case 'cancel-tool-call':
+      // Cancel JUST the currently-running tool call (the live transcript row).
+      // No-op (still consumed) when nothing is running — the composer keeps the
+      // keystroke rather than letting it fall through as text.
+      state.commandContext?.cancelToolCall?.();
+      return true;
+
+    case 'toggle-memory-provenance':
+      // Expand/collapse the provenance chip's drill-in. No-op when the chip is
+      // not showing; still consumed so the composer never sees a stray Alt+M.
+      state.commandContext?.toggleMemoryProvenance?.();
+      return true;
+
+    case 'toggle-keep-awake': {
+      // Flip the daemon-held keep-awake toggle; the always-visible "sleep
+      // disabled" chip is the confirmation. Fire-and-forget (the seam renders on
+      // completion); errors are swallowed so a keystroke never throws.
+      const power = state.commandContext;
+      const current = power?.getPowerState?.().keepAwake ?? false;
+      void power?.setKeepAwake?.(!current);
+      return true;
+    }
+
     case 'screen-clear':
       state.commandContext?.clearScreen?.();
       return true;
@@ -139,7 +162,7 @@ export function handleGlobalShortcutToken(
       // in-panel action (FleetPanel session-tab detach) before it closes the
       // panel outright — see Panel.interceptPanelClose's doc comment.
       if (active?.interceptPanelClose?.()) {
-        // UX-C fix: a consumed Ctrl+X (the Fleet panel's session-tab detach)
+        // fix: a consumed Ctrl+X (the Fleet panel's session-tab detach)
         // used to leave panelFocused untouched, so focus stayed on the panel
         // — the evaluator's "Ctrl+X detach landed focus in the panel and a
         // typed question became nav keys". Detach is a leave-taking action:
@@ -203,7 +226,7 @@ export function handleGlobalShortcutToken(
       // Alt+1..9: jump directly to the Nth workspace tab. Routed globally (like
       // panel-tab-next/prev) so the jump works whether focus is on the prompt or
       // the workspace; gated on visibility, matching cyclePanelTab semantics.
-      // UX-C: a chord jump is "I'm going panel-driving" (focus rule 1a) — the
+      // a chord jump is "I'm going panel-driving" (focus rule 1a) — the
       // jump now also grabs keyboard focus, matching F2/Ctrl+O/Ctrl+P, so j/k
       // land in the newly-active tab immediately instead of the composer.
       const pm = state.panelManager;
@@ -218,9 +241,9 @@ export function handleGlobalShortcutToken(
     }
 
     case 'panel-ops': {
-      // Ctrl+O: TOGGLE the Fleet panel (UX-C — same semantics as F2 above; see
+      // Ctrl+O: TOGGLE the Fleet panel (— same semantics as F2 above; see
       // toggleFleetPanel's doc comment). The former Ops Control panel was
-      // retired to an 'ops-control' -> 'fleet' alias (W6.1); rather than route
+      // retired to an 'ops-control' -> 'fleet' alias; rather than route
       // through the now-aliased openOpsPanel callback (which opens without
       // transferring focus), this operates on 'fleet' directly.
       toggleFleetPanel(state);
@@ -403,7 +426,7 @@ export function handleGlobalShortcutToken(
 }
 
 /**
- * toggleFleetPanel — the shared F2 / Ctrl+O TOGGLE (UX-C item 2): if the
+ * toggleFleetPanel — the shared F2 / Ctrl+O TOGGLE (item 2): if the
  * Fleet panel is open AND the panel workspace currently owns keyboard focus
  * with Fleet as the active tab, the chord CLOSES it and returns focus to the
  * composer; if Fleet is open but not the focused/active tab, the chord brings

package/src/input/handler.ts

@@ -194,7 +194,7 @@ export class InputHandler implements InputHandlerLike {
   public blockActionsMenu = new BlockActionsMenu();
   public settingsModal = new SettingsModal();
   public configModal = new ConfigModal();
-  /** DEBT-5 item 5 — paste-flood guard state, mutated in place across tokens (never reallocated). */
+  /** item 5 — paste-flood guard state, mutated in place across tokens (never reallocated). */
   private panelBurstGuard: PanelBurstGuardState = { timestamps: [], suspended: false, hintShown: false };
   public mcpWorkspace = new McpWorkspace();
   public onboardingWizard = new OnboardingWizardController();
@@ -277,7 +277,7 @@ export class InputHandler implements InputHandlerLike {
       uiServices.providers.benchmarkStore,
       uiServices.providers.providerRegistry,
     );
-    // W6.1 retirement: ProcessModal/LiveTailModal/AgentDetailModal were removed
+    // retirement: ProcessModal/LiveTailModal/AgentDetailModal were removed
     // — F2 now opens the Fleet panel, which subsumes the live process tree.
     this.bookmarkModal = new BookmarkModal(uiServices.shell.bookmarkManager);
     this.sessionPickerModal = new SessionPickerModal(uiServices.sessions.sessionManager, uiServices.sessions.sessionBroker);

package/src/input/keybindings.ts

@@ -68,7 +68,10 @@ export type KeyAction =
   | 'kill-to-start'
   | 'kill-word-forward'
   | 'yank'
-  | 'yank-pop';
+  | 'yank-pop'
+  | 'cancel-tool-call'
+  | 'toggle-keep-awake'
+  | 'toggle-memory-provenance';
 
 /** Human-readable description for each action (used in /keybindings display). */
 export const ACTION_DESCRIPTIONS: Record<KeyAction, string> = {
@@ -111,6 +114,9 @@ export const ACTION_DESCRIPTIONS: Record<KeyAction, string> = {
   'kill-word-forward':     'Kill word forward into kill ring (Alt+D)',
   'yank':                  'Yank (paste) from kill ring (Ctrl+Shift+Y)',
   'yank-pop':              'Rotate kill ring and yank next entry (Alt+Y)',
+  'cancel-tool-call':      'Cancel the running tool call (the turn continues)',
+  'toggle-keep-awake':     'Toggle keep-awake (the "sleep disabled" chip)',
+  'toggle-memory-provenance': 'List/hide the memories a turn used (provenance chip drill-in)',
 };
 
 /** Default key bindings for all actions. */
@@ -147,8 +153,8 @@ export const DEFAULT_KEYBINDINGS: Record<KeyAction, KeyCombo[]> = {
   'panel-tab-8':           [{ key: '8', alt: true }],
   'panel-tab-9':           [{ key: '9', alt: true }],
   // Ctrl+O: TOGGLE the Fleet panel (open+focus / bring-to-front+focus / close
-  // — see toggleFleetPanel in handler-shortcuts.ts, UX-C). The former Ops
-  // Control panel was retired to an 'ops-control' -> 'fleet' alias (W6.1); the
+  // — see toggleFleetPanel in handler-shortcuts.ts). The former Ops
+  // Control panel was retired to an 'ops-control' -> 'fleet' alias; the
   // binding is KEPT (repointed, not removed) so the Ctrl+O muscle memory still
   // lands somewhere useful. Routed globally in handleGlobalShortcutToken.
   'panel-ops':             [{ key: 'o', ctrl: true }],
@@ -189,6 +195,18 @@ export const DEFAULT_KEYBINDINGS: Record<KeyAction, KeyCombo[]> = {
   'yank':                  [{ key: 'y', ctrl: true, shift: true }],
   // Alt+Y: yank-pop (rotate ring after yank)
   'yank-pop':              [{ key: 'y', alt: true }],
+  // Alt+C: cancel the currently-running tool call (the turn continues). Alt+C
+  // is unused by any other default and representable by the tokenizer's
+  // { key, alt } combo form. Ctrl+C stays whole-input clear/cancel; this is the
+  // narrower per-tool stop.
+  'cancel-tool-call':      [{ key: 'c', alt: true }],
+  // Alt+A: toggle keep-awake (the one-key affordance for the "sleep disabled"
+  // chip). Alt+A is unused by any other default. The always-visible chip is the
+  // confirmation of the toggle's state.
+  'toggle-keep-awake':     [{ key: 'a', alt: true }],
+  // Alt+M: expand/collapse the "used N memories" provenance chip's drill-in.
+  // Alt+M is unused by any other default. A no-op when the chip is not showing.
+  'toggle-memory-provenance': [{ key: 'm', alt: true }],
 };
 
 /** Resolved overrides type: each key can be a single combo or array. */

package/src/input/onboarding/onboarding-feature-units.ts

@@ -15,7 +15,7 @@
  */
 
 import type { ConfigKey } from '../../config/index.ts';
-import { FEATURE_FLAG_MAP } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import { getFeatureSetting, isFeatureDefaultEnabled } from '../../runtime/feature-settings.ts';
 import type {
   OnboardingWizardControllerLike,
   OnboardingWizardFieldDefinition,
@@ -94,12 +94,13 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
         hint: 'When the exec sandbox leaves a command on ask, a model pass annotates the ask with stated reasons. Never converts allow to deny; never touches the frozen catastrophic block.',
         subOptions: [
           {
-            key: 'auto-approve',
-            configKey: 'sandbox.judgmentAutoApprove' as ConfigKey,
-            label: 'Auto-approve looks-safe verdicts',
-            hint: 'Yes lets a looks-safe judgment auto-approve the ask; No keeps annotate-only (default).',
-            valueType: 'boolean',
-            defaultValue: 'no',
+            key: 'mode',
+            configKey: 'sandbox.judgment' as ConfigKey,
+            label: 'Judgment mode',
+            hint: 'annotate (default) proposes a verdict with stated reasons and the human still decides; auto-approve additionally auto-approves looks-safe verdicts; off keeps plain asks.',
+            valueType: 'enum',
+            options: ['off', 'annotate', 'auto-approve'],
+            defaultValue: 'annotate',
           },
         ],
       },
@@ -283,23 +284,18 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
       {
         flagId: 'integration-delivery-slo',
         label: 'Integration delivery SLO',
-        hint: 'Retry with backoff and a dead-letter queue for Slack/Discord/webhook delivery. Exposes /notify dlq and /notify replay.',
-        subOptions: [
-          {
-            key: 'slo',
-            configKey: 'integrations.delivery.sloEnforced' as ConfigKey,
-            label: 'Enforce delivery SLO',
-            hint: 'Yes logs dead-letter events at error level and surfaces them in diagnostics; No is warn-level only (default).',
-            valueType: 'boolean',
-            defaultValue: 'no',
-          },
-        ],
+        hint: 'Retry with backoff and a dead-letter queue for Slack/Discord/webhook delivery, with dead-letter events surfaced in diagnostics. On by default; exposes /notify dlq and /notify replay. Retry bounds are tuned in /settings.',
       },
       {
         flagId: 'adaptive-execution-planner',
         label: 'Adaptive execution planner',
         hint: 'Score single/cohort/background/remote strategies each turn and pick the best. Exposes /plan commands.',
       },
+      {
+        flagId: 'daemon-auto-update',
+        label: 'Daemon auto-update',
+        hint: 'The daemon checks for a new release hourly, checksum-verifies it, swaps binaries only at a no-active-work moment, and keeps the previous binary for one-command rollback. On by default; update.auto turns it off and update.intervalMinutes tunes the cadence in /settings.',
+      },
       {
         flagId: 'relay-connect',
         label: 'Outbound zero-knowledge relay',
@@ -355,10 +351,10 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
             key: 'backend',
             configKey: 'tools.overflowSpillBackend' as ConfigKey,
             label: 'Spill backend',
-            hint: 'file (default), ledger, or diagnostics.',
+            hint: 'ledger (default when this feature is on) or diagnostics; file is the baseline used while the feature is off.',
             valueType: 'enum',
             options: ['file', 'ledger', 'diagnostics'],
-            defaultValue: 'file',
+            defaultValue: 'ledger',
           },
         ],
       },
@@ -398,9 +394,9 @@ export function featureSubOptionFieldId(flagId: string, key: string): string {
   return `feature.${flagId}.${key}`;
 }
 
-/** Whether a flag defaults to enabled (drives the toggle's default-checked state). */
+/** Whether a feature defaults to enabled (drives the toggle's default-checked state). */
 export function isFeatureDefaultOn(flagId: string): boolean {
-  return FEATURE_FLAG_MAP.get(flagId)?.defaultState === 'enabled';
+  return isFeatureDefaultEnabled(flagId);
 }
 
 /** Every flag id reachable through the guided feature steps. */
@@ -498,10 +494,12 @@ export function buildFeatureUnitSteps(
 
 /**
  * Fold the guided feature selections into apply operations: for each unit, when
- * the user's choice differs from the flag's default, record the flag override;
- * when the feature is enabled, write its implied config, prerequisite flags, and
- * chosen sub-options. Flag overrides are collected into `overrides` (flushed by
- * the caller with the surface flags); config writes go straight to setConfig.
+ * the user's choice differs from the feature's default, record the desired
+ * state; when the feature is enabled, write its implied config, prerequisite
+ * features, and chosen sub-options. Desired states are collected into
+ * `overrides` (flushed by the caller as plain domain-settings writes on each
+ * feature's enablement key, together with the surface capabilities); other
+ * config writes go straight to setConfig.
  */
 export function applyFeatureUnitOperations(
   controller: OnboardingWizardControllerLike,
@@ -521,15 +519,24 @@ export function applyFeatureUnitOperations(
       for (const prerequisite of unit.requiresFlags ?? []) overrides.set(prerequisite, 'enabled');
       for (const implied of unit.impliedConfig ?? []) setConfig(implied.key, implied.value);
 
+      const enablementKey = getFeatureSetting(unit.flagId)?.enablement.key;
       for (const sub of unit.subOptions ?? []) {
         const raw = controller.getStringFieldValue(featureSubOptionFieldId(unit.flagId, sub.key), sub.defaultValue);
+        let wrote = true;
         if (sub.valueType === 'boolean') {
           setConfig(sub.configKey, raw === 'yes');
         } else if (sub.valueType === 'text') {
-          if (raw.length > 0) setConfig(sub.configKey, raw);
+          wrote = raw.length > 0;
+          if (wrote) setConfig(sub.configKey, raw);
         } else {
           setConfig(sub.configKey, raw);
         }
+        // A sub-option that writes the unit's OWN enablement key (e.g. the
+        // provider-optimizer routing mode) is the authoritative enablement
+        // value — drop the pending override so the flush cannot clobber it.
+        if (wrote && enablementKey !== undefined && sub.configKey === enablementKey) {
+          overrides.delete(unit.flagId);
+        }
       }
     }
   }

package/src/input/onboarding/onboarding-provider-key-fields.ts

@@ -0,0 +1,112 @@
+/**
+ * Provider-agnostic API-key fields for the onboarding provider step.
+ *
+ * Kept out of onboarding-wizard-steps.ts so the step file stays focused on step
+ * assembly. Both pieces read from the same registration-truth targets so the
+ * inventory line and the per-provider masked fields never disagree.
+ */
+
+import type { ProviderKeyCaptureTarget, SubscriptionStatusTarget } from '../../runtime/onboarding/provider-key-capture.ts';
+import { deriveSubscriptionStatusTargets, providerKeyFieldId, subscriptionStatusFieldId } from '../../runtime/onboarding/provider-key-capture.ts';
+import type { OnboardingProviderAccountRecord } from '../../runtime/onboarding/types.ts';
+import type {
+  OnboardingWizardMaskedFieldDefinition,
+  OnboardingWizardStatusFieldDefinition,
+} from './onboarding-wizard-types.ts';
+
+/**
+ * Providers with a wired in-wizard subscription sign-in flow. This is DATA — the
+ * set of providers whose OAuth login the wizard can start/finish itself — not an
+ * assumption that any one vendor is the only subscription option.
+ */
+const SUBSCRIPTION_SIGN_IN_PROVIDER_IDS = new Set<string>(['openai']);
+
+/**
+ * One subscription-status row per subscription-capable provider. The row's copy
+ * names the provider from data — never a vendor hardcoded in the field set — so
+ * the status surface tracks whatever subscription-capable providers the runtime
+ * reports, not a single assumed one.
+ */
+export function buildSubscriptionStatusFields(
+  targets: readonly SubscriptionStatusTarget[],
+): OnboardingWizardStatusFieldDefinition[] {
+  return targets.map((target) => ({
+    kind: 'status',
+    id: subscriptionStatusFieldId(target.providerId),
+    label: `${target.providerId} subscription status`,
+    hint: target.active
+      ? `A ${target.providerId} subscription session is already available.`
+      : target.pending
+        ? `A ${target.providerId} subscription login is pending.`
+        : `No ${target.providerId} subscription session was found in the current runtime state.`,
+    defaultValue: target.active ? 'Active' : target.pending ? 'Pending' : 'Not detected',
+  }));
+}
+
+/** The provider-agnostic subscription posture the provider step renders. */
+export interface SubscriptionPosture {
+  readonly statusFields: OnboardingWizardStatusFieldDefinition[];
+  /** The provider whose in-wizard sign-in flow applies now, or null. */
+  readonly signInProviderId: string | null;
+  readonly signInPending: boolean;
+  readonly summaryLine: string;
+}
+
+/**
+ * Derive the subscription posture for the provider step: one status row per
+ * subscription-capable provider, plus which (if any) provider's in-wizard OAuth
+ * sign-in flow applies right now (a subscription-capable, sign-in-wired provider
+ * that is not already active).
+ */
+export function buildSubscriptionPosture(
+  activeProviderIds: readonly string[],
+  pendingProviderIds: readonly string[],
+  providers: readonly OnboardingProviderAccountRecord[] | undefined,
+): SubscriptionPosture {
+  const targets = deriveSubscriptionStatusTargets(providers, activeProviderIds, pendingProviderIds);
+  const signIn = targets.find((target) => SUBSCRIPTION_SIGN_IN_PROVIDER_IDS.has(target.providerId) && !target.active);
+  const activeCount = targets.filter((target) => target.active).length;
+  const pendingCount = targets.filter((target) => target.pending).length;
+  return {
+    statusFields: buildSubscriptionStatusFields(targets),
+    signInProviderId: signIn?.providerId ?? null,
+    signInPending: signIn?.pending ?? false,
+    summaryLine: targets.length === 0
+      ? 'Subscriptions: none detected'
+      : `Subscriptions: ${activeCount} active, ${pendingCount} pending across ${targets.length} provider(s)`,
+  };
+}
+
+/** The status line summarizing how many key-accepting providers are configured. */
+export function buildProviderKeyInventoryField(
+  targets: readonly ProviderKeyCaptureTarget[],
+): OnboardingWizardStatusFieldDefinition {
+  const configuredCount = targets.filter((target) => target.configured).length;
+  return {
+    kind: 'status',
+    id: 'providers.api-key-inventory',
+    label: 'Provider API keys',
+    hint: targets.length === 0
+      ? 'No key-accepting providers are registered yet in the current runtime state.'
+      : `${targets.length} provider(s) accept an API key; ${configuredCount} already configured. Values stay masked.`,
+    defaultValue: targets.length === 0
+      ? 'None detected'
+      : `${configuredCount}/${targets.length} configured`,
+  };
+}
+
+/** One masked field per key-accepting provider, keyed off registration truth. */
+export function buildProviderKeyMaskedFields(
+  targets: readonly ProviderKeyCaptureTarget[],
+): OnboardingWizardMaskedFieldDefinition[] {
+  return targets.map((target) => ({
+    kind: 'masked',
+    id: providerKeyFieldId(target.providerId),
+    label: `${target.providerId} API key`,
+    hint: target.configured
+      ? `A key for ${target.providerId} is already stored. Leave blank to keep it; enter a new key to replace it through the secret manager.`
+      : `Optional: enter an API key for ${target.providerId} now. The value is stored through the secret manager, not in config.`,
+    placeholder: target.configured ? 'already configured' : 'paste key',
+    defaultValue: '',
+  }));
+}