@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/input/onboarding/onboarding-wizard-apply.ts

@@ -1,6 +1,7 @@
 import type { OnboardingAcknowledgementTarget, OnboardingApplyOperation, OnboardingApplyRequest } from '../../runtime/onboarding/index.ts';
 import { formatProviderModel } from '../../config/provider-model.ts';
 import { getServerSurfaceFeatureFlags } from '../../runtime/surface-feature-flags.ts';
+import { featureEnablementWrite } from '../../runtime/feature-settings.ts';
 import {
   buildCloudflareApiTokenRef,
   buildCloudflareOperationalTokenRef,
@@ -17,13 +18,9 @@ import {
 } from './onboarding-wizard-external-surfaces.ts';
 import { applyFeatureUnitOperations } from './onboarding-feature-units.ts';
 import { buildGoodVibesSecretKey, buildGoodVibesSecretRef, isLoopbackAddress, isSecretReferenceValue } from './onboarding-wizard-helpers.ts';
+import { deriveProviderKeyCaptureTargets, providerKeyFieldId } from '../../runtime/onboarding/provider-key-capture.ts';
 import type { OnboardingWizardControllerLike } from './onboarding-wizard-types.ts';
 
-/** SDK schema default for behavior.hitlMode (schema-domain-core DEFAULT_CONFIG). */
-const HITL_MODE_SCHEMA_DEFAULT = 'balanced';
-/** Feature flag that gates behavior.hitlMode preset application in ModeManager. */
-const HITL_UX_MODES_FEATURE_FLAG = 'hitl-ux-modes';
-
 export function buildOnboardingApplyRequest(controller: OnboardingWizardControllerLike): OnboardingApplyRequest {
     const operations: OnboardingApplyOperation[] = [];
     // Accumulates feature-flag state that onboarding selections require, so the
@@ -132,21 +129,21 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
     setConfig('provider.reasoningEffort', controller.getStringFieldValue('default-model.reasoning', controller.runtimeSnapshot?.providerRouting.primaryReasoningEffort ?? 'medium'));
     const hitlMode = controller.getStringFieldValue('experience.hitl', controller.runtimeSnapshot?.runtimeDefaults.behavior.hitlMode ?? 'balanced');
     setConfig('behavior.hitlMode', hitlMode);
-    // behavior.hitlMode is gated by the hitl-ux-modes feature flag: ModeManager
-    // only applies the chosen preset to the notification router when the flag is
-    // on. Writing hitlMode without enabling the flag leaves the user's choice
-    // silently inert. When the user picks a non-default mode, enable the gating
-    // flag in the same apply batch so the selection actually takes effect. The
-    // SDK schema default is 'balanced' (schema-domain-core DEFAULT_CONFIG); a
-    // choice equal to the default is left to the flag's own default-off state.
-    if (hitlMode !== HITL_MODE_SCHEMA_DEFAULT) {
-      featureFlagOverrides.set(HITL_UX_MODES_FEATURE_FLAG, 'enabled');
-    }
+    // behavior.hitlMode IS the enablement key of the hitl-ux-modes capability
+    // (active for quiet/balanced/operator, off only at 'off'), so the write
+    // above already carries the enablement — no separate gating write exists,
+    // and adding one here would clobber a non-default choice with the stock
+    // mode when the batch flushes.
     setConfig('behavior.guidanceMode', controller.getStringFieldValue('experience.guidance', controller.runtimeSnapshot?.runtimeDefaults.behavior.guidanceMode ?? 'minimal'));
     setConfig('permissions.mode', controller.getStringFieldValue('experience.permissions', controller.runtimeSnapshot?.runtimeDefaults.permissionsMode ?? 'prompt'));
     setConfig('storage.secretPolicy', controller.getStringFieldValue('external-services.secret-policy', controller.runtimeSnapshot?.runtimeDefaults.secretStoragePolicy ?? 'preferred_secure'));
 
-    setSecret('OPENAI_API_KEY', controller.getStringFieldValue('providers.openai-api-key', ''));
+    // Provider-agnostic key capture: store each entered key under the provider's
+    // own declared secret key. Empty fields are skipped (setSecret no-ops), so
+    // a blank field keeps any existing key untouched.
+    for (const target of deriveProviderKeyCaptureTargets(controller.runtimeSnapshot?.providerAccounts?.providers)) {
+      setSecret(target.apiKeyEnvVar, controller.getStringFieldValue(providerKeyFieldId(target.providerId), ''));
+    }
 
     if (shouldShowCloudflareStep(controller)) {
       addCloudflareOperations(controller, operations, setSecret);
@@ -190,12 +187,13 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
       }
     }
     // Feature units from the guided feature steps (safety, memory & context,
-    // telemetry, automation, provider, advanced): enable/disable each flag the
-    // user changed from its default and write its chosen sub-options.
+    // telemetry, automation, provider, advanced): enable/disable each feature
+    // the user changed from its default and write its chosen sub-options.
     applyFeatureUnitOperations(controller, setConfig, featureFlagOverrides);
 
-    // Surface/server flags are authoritative for the network-exposing flags they
-    // own — apply them last so they win over any feature-step override.
+    // Surface/server capabilities are authoritative for the network-exposing
+    // features they own — apply them last so they win over any feature-step
+    // override.
     for (const surfaceFlag of getServerSurfaceFeatureFlags({
       serverBacked: hasServers,
       web: browserAccess,
@@ -203,8 +201,11 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
     })) {
       featureFlagOverrides.set(surfaceFlag, 'enabled');
     }
+    // Each selection lands as a plain domain-settings write on the feature's
+    // real enablement key (e.g. sandbox.enabled, controlPlane.gateway).
     for (const flagId of [...featureFlagOverrides.keys()].sort((left, right) => left.localeCompare(right))) {
-      setConfig(`featureFlags.${flagId}`, featureFlagOverrides.get(flagId)!);
+      const write = featureEnablementWrite(flagId, featureFlagOverrides.get(flagId)! === 'enabled');
+      if (write) setConfig(write.key, write.value);
     }
 
     acknowledge('providers', 'providers.reviewed');

package/src/input/onboarding/onboarding-wizard-external-surfaces.ts

@@ -282,6 +282,23 @@ const SURFACE_OVERLAYS: readonly SurfaceOverlay[] = [
       { configKey: 'surfaces.mattermost.defaultChannelId', label: 'Mattermost default channel ID', hint: 'Fallback Mattermost channel for outbound messages.', placeholder: 'channel id' },
     ],
   },
+  {
+    onboardingId: 'telephony',
+    sdkSurface: 'telephony',
+    label: 'Telephony surface',
+    hint: 'Enable SMS/voice notification delivery — direct Twilio, or a self-hosted bridge.',
+    fields: [
+      { configKey: 'surfaces.telephony.provider', label: 'Telephony provider', hint: 'twilio for direct Twilio delivery, bridge for a self-hosted telephony bridge.', placeholder: 'twilio' },
+      { configKey: 'surfaces.telephony.mode', label: 'Telephony mode', hint: 'sms, voice (call with spoken text), or bridge.', placeholder: 'sms' },
+      { configKey: 'surfaces.telephony.accountSid', label: 'Twilio account SID', hint: 'Account SID for direct Twilio delivery.', placeholder: 'AC...' },
+      { configKey: 'surfaces.telephony.authToken', label: 'Twilio auth token', hint: 'Auth token for direct Twilio delivery.', placeholder: 'auth token' },
+      { configKey: 'surfaces.telephony.fromNumber', label: 'From number', hint: 'The E.164 number outbound SMS/calls originate from.', placeholder: '+15551234567' },
+      { configKey: 'surfaces.telephony.defaultRecipient', label: 'Default recipient', hint: 'Fallback E.164 number for outbound delivery.', placeholder: '+15557654321' },
+      { configKey: 'surfaces.telephony.bridgeUrl', label: 'Bridge URL', hint: 'Base URL of the self-hosted telephony bridge (bridge provider only).', placeholder: 'https://telephony-bridge.example.test' },
+      { configKey: 'surfaces.telephony.token', label: 'Bridge token', hint: 'Token used to authenticate with the telephony bridge.', placeholder: 'bridge token' },
+      { configKey: 'surfaces.telephony.webhookSecret', label: 'Webhook secret', hint: 'Secret used to verify inbound telephony webhooks.', placeholder: 'webhook secret' },
+    ],
+  },
   {
     onboardingId: 'matrix',
     sdkSurface: 'matrix',

package/src/input/onboarding/onboarding-wizard-network-adopt.ts

@@ -106,7 +106,7 @@ export function pushLegacyDaemonMigrationFields(
   fields.push({
     kind: 'status',
     id: 'network.migrate-legacy-daemon-detected',
-    label: 'Legacy daemon service detected',
+    label: 'Separate install-script daemon service detected',
     // Follow-up: name the unit this host actually resolves (carried on the
     // snapshot from `resolveConfiguredServiceName` at collection time) — the
     // MANAGED_SERVICE_NAME fallback only covers snapshots built without it.
@@ -126,7 +126,7 @@ export function pushLegacyDaemonMigrationFields(
   fields.push({
     kind: 'action',
     id: 'network.migrate-legacy-daemon',
-    label: confirmed ? 'Migrate legacy daemon service now' : 'Preview migration plan',
+    label: confirmed ? 'Migrate the install-script daemon service now' : 'Preview migration plan',
     hint: confirmed
       ? 'Executes the migration now: new-up-then-old-down, never touching the legacy unit until the new one is verified healthy. Result prints to the feed below.'
       : 'Prints the migration plan without changing anything. Check "Confirm migration execution" above to arm the real migration.',

package/src/input/onboarding/onboarding-wizard-steps.ts

@@ -10,6 +10,8 @@ import {
 } from './onboarding-wizard-external-surfaces.ts';
 import { buildFeatureUnitSteps } from './onboarding-feature-units.ts';
 import { countSelected, modelSelectionLabel, normalizeText } from './onboarding-wizard-helpers.ts';
+import { deriveProviderKeyCaptureTargets } from '../../runtime/onboarding/provider-key-capture.ts';
+import { buildProviderKeyInventoryField, buildProviderKeyMaskedFields, buildSubscriptionPosture } from './onboarding-provider-key-fields.ts';
 import { getDaemonSource, pushDaemonAdoptionFields, pushLegacyDaemonMigrationFields } from './onboarding-wizard-network-adopt.ts';
 import type { OnboardingWizardControllerLike } from './onboarding-wizard-types.ts';
 import type { OnboardingWizardAcknowledgementFieldDefinition, OnboardingWizardActionFieldDefinition, OnboardingWizardChecklistFieldDefinition, OnboardingWizardExternalSurfaceStepId, OnboardingWizardFieldDefinition, OnboardingWizardModelPickerFieldDefinition, OnboardingWizardRadioFieldDefinition, OnboardingWizardRadioOption, OnboardingWizardStepDefinition } from './onboarding-wizard-types.ts';
@@ -150,10 +152,20 @@ export function buildProvidersStep(controller: OnboardingWizardControllerLike):
     const providerAck = controller.runtimeDerived.reopenEditAcknowledgements.providers;
     const activeSubscriptions = controller.runtimeSnapshot?.subscriptions.active ?? [];
     const pendingSubscriptions = controller.runtimeSnapshot?.subscriptions.pending ?? [];
-    const openAiActive = activeSubscriptions.some((subscription) => subscription.provider === 'openai');
-    const openAiPending = pendingSubscriptions.some((subscription) => subscription.provider === 'openai');
-    const providerSecretCount = controller.runtimeSnapshot?.secrets.records.filter((record) => record.key.endsWith('_API_KEY') || record.key.endsWith('_TOKEN')).length ?? 0;
-    const openAiApiKeyConfigured = controller.runtimeSnapshot?.secrets.records.some((record) => record.key === 'OPENAI_API_KEY') ?? false;
+    // Provider-agnostic subscription posture: one status row per
+    // subscription-capable provider (registration truth), plus any provider with
+    // a live/pending session, and which provider's in-wizard sign-in applies now.
+    const subscription = buildSubscriptionPosture(
+      activeSubscriptions.map((entry) => entry.provider),
+      pendingSubscriptions.map((entry) => entry.provider),
+      controller.runtimeSnapshot?.providerAccounts?.providers,
+    );
+    const signInPending = subscription.signInPending;
+    // Provider-agnostic key capture: one field per provider the registry knows
+    // accepts an API key (derived from registration truth — never a hardcoded
+    // vendor list). No provider is named as the only option.
+    const keyTargets = deriveProviderKeyCaptureTargets(controller.runtimeSnapshot?.providerAccounts?.providers);
+    const configuredKeyCount = keyTargets.filter((target) => target.configured).length;
     const providerReviewField: OnboardingWizardAcknowledgementFieldDefinition = {
       kind: 'acknowledgement',
       id: 'providers.reviewed',
@@ -166,46 +178,21 @@ export function buildProvidersStep(controller: OnboardingWizardControllerLike):
     };
 
     const fields: OnboardingWizardFieldDefinition[] = [
-      {
-        kind: 'status',
-        id: 'providers.openai-subscription',
-        label: 'OpenAI subscription status',
-        hint: openAiActive
-          ? 'An OpenAI subscription session is already available.'
-          : openAiPending
-            ? 'An OpenAI subscription login is pending.'
-            : 'No OpenAI subscription session was found in the current runtime state.',
-        defaultValue: openAiActive ? 'Active' : openAiPending ? 'Pending' : 'Not detected',
-      },
-      {
-        kind: 'status',
-        id: 'providers.api-key-inventory',
-        label: 'Provider API key inventory',
-        hint: providerSecretCount > 0
-          ? `${providerSecretCount} provider credential reference(s) were found. Values stay masked.`
-          : 'No provider API key references were detected in the current runtime state.',
-        defaultValue: providerSecretCount > 0 ? `${providerSecretCount} configured` : 'None detected',
-      },
-      {
-        kind: 'masked',
-        id: 'providers.openai-api-key',
-        label: 'OpenAI API key',
-        hint: openAiApiKeyConfigured
-          ? 'An OpenAI API key is already stored. Leave blank to keep it; enter a new key to replace it through the secret manager.'
-          : 'Optional: enter an OpenAI API key now. The value is stored through the secret manager, not in config.',
-        placeholder: openAiApiKeyConfigured ? 'already configured' : 'sk-...',
-        defaultValue: '',
-      },
-      ...(openAiActive ? [] : [
+      ...subscription.statusFields,
+      buildProviderKeyInventoryField(keyTargets),
+      // One masked field per key-accepting provider. Entered values are stored
+      // through the secret manager at apply and the provider re-registers live.
+      ...buildProviderKeyMaskedFields(keyTargets),
+      ...(!subscription.signInProviderId ? [] : [
         {
           kind: 'action' as const,
           id: 'providers.openai-subscription-start',
           action: 'start-openai-subscription' as const,
-          label: openAiPending ? 'Restart OpenAI subscription sign-in' : 'Start OpenAI subscription sign-in',
+          label: signInPending ? 'Restart OpenAI subscription sign-in' : 'Start OpenAI subscription sign-in',
           hint: 'Opens the OpenAI sign-in flow from the wizard and records pending login state here.',
-          defaultValue: openAiPending ? 'Restart' : 'Start',
+          defaultValue: signInPending ? 'Restart' : 'Start',
         },
-        ...(openAiPending ? [
+        ...(signInPending ? [
           {
             kind: 'text' as const,
             id: 'providers.openai-authorization-url',
@@ -239,12 +226,13 @@ export function buildProvidersStep(controller: OnboardingWizardControllerLike):
       id: 'provider-access',
       title: 'AI provider access',
       shortLabel: 'Providers',
-      description: 'Review subscription posture and optionally add an OpenAI API key directly through the wizard.',
+      description: 'Review subscription posture and optionally add an API key for any provider that accepts one, directly through the wizard.',
       summaryTitle: 'Provider access summary',
       summaryLines: [
-        `OpenAI subscription: ${openAiActive ? 'active' : openAiPending ? 'pending' : 'not detected'}`,
-        `OpenAI API key: ${openAiApiKeyConfigured ? 'configured' : 'not detected'}`,
-        `Provider credential references: ${providerSecretCount}`,
+        subscription.summaryLine,
+        keyTargets.length === 0
+          ? 'Provider API keys: no key-accepting providers registered'
+          : `Provider API keys: ${configuredKeyCount}/${keyTargets.length} configured`,
         `Review: ${controller.getFieldValueLabel(providerReviewField)}`,
       ],
       fields,

package/src/input/panel-integration-actions.ts

@@ -2,14 +2,14 @@ import type { CommandContext } from './command-registry.ts';
 import type { Panel } from '../panels/types.ts';
 import type { PanelManager } from '../panels/panel-manager.ts';
 
-// W6.1 (the purge): every instanceof-routed branch this file used to carry
+// (the purge): every instanceof-routed branch this file used to carry
 // (FileExplorerPanel/FilePreviewPanel/SymbolOutlinePanel — DELETE;
 // ApprovalPanel/TasksPanel/OrchestrationPanel/AgentInspectorPanel —
 // RETIRE-INTO-FLEET) targeted a panel class that no longer exists. Panels
 // migrated onto the formal `Panel.handlePanelIntegrationAction` hook (the
 // preferred seam — see the comment below) are unaffected; this function now
 // only provides that passthrough. See
-// .goodvibes/audit/2026-07-04-wave6-briefs.json (W6.1) for the disposition
+// .goodvibes/audit/2026-07-04-wave6-briefs.json for the disposition
 // map.
 export function handlePanelIntegrationAction(
   panelManager: PanelManager,

package/src/input/panel-mouse-geometry.ts

@@ -3,7 +3,7 @@
 //
 // Pure mouse-geometry helpers for the panel workspace, extracted from
 // handler-feed-routes.ts so that file stays under the 800-line architecture
-// cap once the UX-C focus verbs and the DEBT-5 paste-flood guard both live in
+// cap once the focus verbs and the paste-flood guard both live in
 // it. These map a terminal (row, col) onto the panel/pane/workspace-tab under
 // the cursor. No dependency on the feed-route state types, so no import cycle.
 // ---------------------------------------------------------------------------

package/src/input/panel-paste-flood-guard.ts

@@ -1,5 +1,5 @@
 // ---------------------------------------------------------------------------
-// panel-paste-flood-guard.ts — DEBT-5 item 5.
+// panel-paste-flood-guard.ts — item 5.
 //
 // A terminal WITHOUT bracketed paste delivers a pasted block as a burst of
 // discrete 1-char 'text' tokens (isPasteToken stays false for every one of

package/src/input/provider-key-intake.ts

@@ -0,0 +1,167 @@
+/**
+ * Provider key intake — capture a provider's API key at the moment the user
+ * selects an unconfigured provider or model, store it through the secrets
+ * manager (never env-only, never cleartext into config or provider JSON), let
+ * the provider re-register live, then complete the user's original selection.
+ *
+ * The decision of whether a key is needed is read from the provider's own
+ * registration-time auth state (describeAuthState / isConfigured) — never a
+ * hardcoded vendor list — so this works for any provider the registry knows
+ * accepts a key. The secrets-store key name is the provider's declared auth env
+ * var; it is used only as the storage key and is never shown to the user.
+ */
+
+import type { LLMProvider } from '@pellux/goodvibes-sdk/platform/providers';
+import type { ConcealedInputRequest } from './concealed-input.ts';
+import type { CommandContext } from './command-registry.ts';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+
+/** The intake decision derived purely from a provider's registration truth. */
+export interface ProviderKeyIntakeDecision {
+  /** True when the provider accepts a key and does not yet have one. */
+  readonly needsKey: boolean;
+  /** Secrets-store key to write the value under (the provider's auth env var). */
+  readonly secretKey?: string;
+  /** True when the provider already has a credential (no prompt needed). */
+  readonly alreadyConfigured: boolean;
+}
+
+/**
+ * Decide whether to prompt for a key, reading only the provider's own auth
+ * state. A provider that is already configured, works anonymously, or declares
+ * no accepted env var is left alone (proceed straight through). A provider that
+ * does not declare an auth state at all is treated per isConfigured(), and an
+ * unknown state is assumed configured so a working selection is never nagged.
+ */
+export function decideProviderKeyIntake(provider: LLMProvider | undefined): ProviderKeyIntakeDecision {
+  if (!provider) return { needsKey: false, alreadyConfigured: false };
+  const state = provider.describeAuthState?.();
+  if (state) {
+    if (state.configured) return { needsKey: false, alreadyConfigured: true };
+    if (state.anonymousReady) return { needsKey: false, alreadyConfigured: false };
+    const secretKey = state.authEnvVars[0];
+    if (secretKey) return { needsKey: true, secretKey, alreadyConfigured: false };
+    return { needsKey: false, alreadyConfigured: false };
+  }
+  const configured = provider.isConfigured?.() ?? true;
+  return { needsKey: false, alreadyConfigured: configured };
+}
+
+/** Human-facing name for a provider — plain, vendor-neutral, never an env var. */
+export function providerIntakeLabel(providerId: string): string {
+  return `the ${providerId} provider`;
+}
+
+/** Dependencies the intake orchestrator needs, decoupled from the command context for testing. */
+export interface ProviderKeyIntakeDeps {
+  /** The provider instance whose registration-time auth state drives the decision. */
+  readonly provider: LLMProvider | undefined;
+  /** Canonical secret store — the same path /secrets set writes through. */
+  readonly secretsManager?: {
+    set(key: string, value: string, options?: { scope?: 'project' | 'user'; medium?: 'secure' | 'plaintext' }): Promise<void>;
+  } | undefined;
+  /** Re-resolves credentials and re-registers providers live (no restart). */
+  readonly refreshProviderCredentials?: (() => Promise<void>) | undefined;
+  /** Begins one line of concealed composer input for the key. */
+  readonly beginConcealedInput?: ((request: ConcealedInputRequest) => void) | undefined;
+  /** Surfaces short status lines to the transcript. */
+  readonly print: (text: string) => void;
+}
+
+/**
+ * If the selected provider needs a key, open the concealed prompt, store the
+ * pasted value through the secrets manager, re-register the provider live, then
+ * run `proceed` (the user's original selection). If no key is needed — or the
+ * concealed surface is unavailable — `proceed` runs immediately. `proceed`
+ * always runs exactly once, including when the user skips (empty/Escape), so a
+ * selection is never stranded.
+ */
+export function runProviderKeyIntake(
+  providerId: string,
+  deps: ProviderKeyIntakeDeps,
+  proceed: () => void,
+): void {
+  const decision = decideProviderKeyIntake(deps.provider);
+  if (!decision.needsKey || !decision.secretKey) {
+    proceed();
+    return;
+  }
+  const { secretsManager, beginConcealedInput } = deps;
+  if (!secretsManager || !beginConcealedInput) {
+    // No canonical store or no concealed surface here — keep the selection
+    // rather than blocking it; the user can add the key via /secrets set later.
+    proceed();
+    return;
+  }
+  const secretKey = decision.secretKey;
+  const label = providerIntakeLabel(providerId);
+  let completed = false;
+  const finishOnce = (): void => {
+    if (completed) return;
+    completed = true;
+    proceed();
+  };
+  deps.print(`Enter the API key for ${label} (input is masked; press Enter to store, Esc to skip).`);
+  beginConcealedInput({
+    label: providerId,
+    onSubmit: (value) => {
+      if (value.length === 0) {
+        deps.print(`No key entered for ${label}; selection kept, no key stored.`);
+        finishOnce();
+        return;
+      }
+      void (async () => {
+        try {
+          await secretsManager.set(secretKey, value, { scope: 'user', medium: 'secure' });
+          await deps.refreshProviderCredentials?.();
+          deps.print(`Stored the API key for ${label} and registered it live (value hidden). No restart needed.`);
+        } catch (error) {
+          deps.print(`Could not store the key for ${label}: ${summarizeError(error)}`);
+        }
+        finishOnce();
+      })();
+    },
+    onCancel: () => {
+      deps.print(`Key entry skipped for ${label}; selection kept, no key stored.`);
+      finishOnce();
+    },
+  });
+}
+
+/**
+ * Command-context adapter for {@link runProviderKeyIntake}: resolves the live
+ * provider, secrets manager, live re-registration hook, and concealed-input
+ * surface from the shell command context, then runs the intake before
+ * completing the user's original selection (`proceed`).
+ */
+export function ensureProviderKeyThenSelect(
+  ctx: CommandContext,
+  providerId: string,
+  proceed: () => void,
+): void {
+  // Resolve the live provider defensively: a command context that routes only
+  // through the provider API (no raw registry access) leaves the intake a no-op
+  // and the selection completes unchanged.
+  let registry: CommandContext['provider']['providerRegistry'] | undefined;
+  let provider: ReturnType<CommandContext['provider']['providerRegistry']['tryGet']> | undefined;
+  try {
+    registry = ctx.provider?.providerRegistry;
+    provider = registry?.tryGet?.(providerId);
+  } catch {
+    registry = undefined;
+    provider = undefined;
+  }
+  runProviderKeyIntake(
+    providerId,
+    {
+      provider,
+      secretsManager: ctx.platform?.secretsManager,
+      refreshProviderCredentials: registry
+        ? () => registry!.refreshProviderCredentials()
+        : undefined,
+      beginConcealedInput: ctx.beginConcealedInput,
+      print: (text) => ctx.print(text),
+    },
+    proceed,
+  );
+}

package/src/input/sandbox-exec-config.ts

@@ -59,14 +59,14 @@ export const SANDBOX_EGRESS_ALLOWLIST_SYNTHETIC_SETTING: ConfigSetting = {
   key: SANDBOX_EGRESS_ALLOWLIST_CONFIG_KEY,
   type: 'string',
   default: [],
-  description: 'Comma-separated command base names (or "*" for all) whose network access is re-enabled inside the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants network"). Empty = the sandbox disables network for every command. Only takes effect when sandbox.enabled is on, the graduation-tracked exec-sandbox feature flag is on, and bubblewrap is available (Linux only — reports unavailable elsewhere).',
+  description: 'Comma-separated command base names (or "*" for all) whose network access is re-enabled inside the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants network"). Empty = the sandbox disables network for every command. Only takes effect when sandbox.enabled is on, the exec-sandbox setting is on, and bubblewrap is available (Linux only — reports unavailable elsewhere).',
 };
 
 export const SANDBOX_WORKSPACE_WRITABLE_SYNTHETIC_SETTING: ConfigSetting = {
   key: SANDBOX_WORKSPACE_WRITABLE_CONFIG_KEY,
   type: 'string',
   default: [],
-  description: 'Comma-separated absolute paths outside the workspace bound writable into the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants path outside workspace"). Empty = only the workspace (and an isolated /tmp) is writable. Only takes effect when sandbox.enabled is on, the graduation-tracked exec-sandbox feature flag is on, and bubblewrap is available (Linux only — reports unavailable elsewhere).',
+  description: 'Comma-separated absolute paths outside the workspace bound writable into the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants path outside workspace"). Empty = only the workspace (and an isolated /tmp) is writable. Only takes effect when sandbox.enabled is on, the exec-sandbox setting is on, and bubblewrap is available (Linux only — reports unavailable elsewhere).',
 };
 
 function buildSandboxExecListEntry(configManager: Pick<ConfigManager, 'get'>, setting: ConfigSetting): SettingEntry {

package/src/input/selection-modal.ts

@@ -37,7 +37,7 @@ export class SelectionModal {
   public allowSearch = true;
   public customActions: Map<string, SelectionAction> = new Map();
   /**
-   * UX-C vocab unification: overrides the default per-primaryAction Enter
+   * vocab unification: overrides the default per-primaryAction Enter
    * verb ("Select"/"Toggle"/"Edit"/"Delete") shown in the footer hint. Used by
    * callers whose items are really commands (e.g. /help) so the hint reads
    * "[Enter] Run", matching the slash-command palette's own verb, instead of

package/src/input/settings-modal-activation.ts

@@ -92,6 +92,11 @@ export function activateSelected(ctx: ActivateSelectedContext): void {
     const idx = setting.enumValues.indexOf(entry.currentValue as string);
     const nextIdx = (idx + 1) % setting.enumValues.length;
     ctx.setValue(setting.key as ConfigKey, setting.enumValues[nextIdx]);
+  } else if (setting.type === 'object') {
+    // Object-typed keys (e.g. pricing.modelPrices) edit as JSON: seed the
+    // buffer with the current value's JSON so the edit starts from truth.
+    ctx.setEditingMode(true);
+    ctx.setEditBuffer(JSON.stringify(entry.currentValue ?? {}));
   } else if (setting.type === 'string' || setting.type === 'number') {
     // Enter inline edit mode
     ctx.setEditingMode(true);

package/src/input/settings-modal-adjustment.ts

@@ -1,9 +1,8 @@
 /**
  * settings-modal-adjustment — pure adjustment helpers for SettingsModal.
  *
- * These functions encapsulate the two directional-adjustment operations:
+ * These functions encapsulate the directional-adjustment operation:
  *   - adjustSelected: cycle enum/boolean/number values via left/right arrow keys
- *   - toggleSelectedFlag: toggle a feature flag between enabled and disabled
  *
  * Each function takes its dependencies as explicit arguments rather than
  * accessing class-level state directly, following the same pattern as
@@ -13,11 +12,9 @@
 import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { FeatureFlagManager } from '@/runtime/index.ts';
-import type { FlagState } from '@/runtime/index.ts';
 import type { FlagEntry, McpEntry, SettingEntry } from './settings-modal-types.ts';
 import { buildMcpEntries } from './settings-modal-data.ts';
 import { getNumericAdjustmentMeta, roundToPrecision } from './settings-modal-behavior.ts';
-import { applyFlagState } from './settings-modal-mutations.ts';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
 
 // ---------------------------------------------------------------------------
@@ -45,10 +42,9 @@ export function adjustSelected(
 ): void {
   if (ctx.editingMode) return;
 
-  // Feature-unit toggle headers (setting.type === 'boolean', key featureFlags.<id>)
-  // now live across topical categories, not a single flags tab. They fall through
-  // to the boolean branch below, which routes through setValue → the modal's
-  // flag-toggle chokepoint. No category-special-case is needed here anymore.
+  // Feature-unit headers are the real config rows for their enablement keys
+  // (boolean or enum), so they fall through to the ordinary branches below —
+  // a plain config write the settings bridge forwards to the gate manager.
 
   if (ctx.currentCategory === 'mcp') {
     const entry = ctx.getSelectedMcp();
@@ -96,26 +92,3 @@ export function adjustSelected(
     ctx.setValue(setting.key as ConfigKey, nextValue);
   }
 }
-
-// ---------------------------------------------------------------------------
-// toggleSelectedFlag
-// ---------------------------------------------------------------------------
-
-export interface ToggleSelectedFlagContext {
-  readonly featureFlagManager: FeatureFlagManager | null;
-  readonly configManager: ConfigManager | null;
-  getSelectedFlag(): FlagEntry | null;
-}
-
-export function toggleSelectedFlag(ctx: ToggleSelectedFlagContext): void {
-  const flagEntry = ctx.getSelectedFlag();
-  if (!flagEntry || !ctx.featureFlagManager || !ctx.configManager) return;
-
-  const { state } = flagEntry;
-
-  // Killed flags are blocked
-  if (state === 'killed') return;
-
-  const newState: FlagState = state === 'enabled' ? 'disabled' : 'enabled';
-  applyFlagState(flagEntry, newState, ctx.featureFlagManager, ctx.configManager);
-}