@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/input/settings-modal-data.ts

@@ -25,6 +25,7 @@ import {
 } from './worktree-setup-config.ts';
 import { BUDGET_ALERT_USD_CONFIG_KEY, BUDGET_ALERT_USD_DEFAULT, readBudgetAlertUsd } from '../export/cost-utils.ts';
 import { MEMORY_PROJECTION_DIR_CONFIG_KEY, buildMemoryProjectionDirSyntheticEntry } from './commands/recall-files-config.ts';
+import { MEMORY_SHOW_PROVENANCE_CONFIG_KEY, buildMemoryProvenanceSyntheticEntry } from '../core/memory-provenance.ts';
 import {
   injectSandboxExecSyntheticEntries,
   isSandboxExecListConfigKey,
@@ -52,16 +53,15 @@ import {
 } from './settings-modal-types.ts';
 import { enrichRelaySettingDescriptions } from './relay-settings-descriptions.ts';
 import { applyFeatureUnitLayout } from './feature-unit-layout.ts';
+import { FEATURE_SETTINGS_BY_ID } from '../runtime/feature-settings.ts';
 
 // ---------------------------------------------------------------------------
 // deepEqual — structural equality for isDefault comparisons
 // ---------------------------------------------------------------------------
 
 /**
- * Structural equality check for setting default comparisons.
- * Handles scalars, arrays, and plain objects. Does NOT support
- * circular references or non-plain prototypes — config defaults
- * are always JSON-safe primitives, arrays, or plain objects.
+ * Structural equality for setting-default comparisons: scalars, arrays, and
+ * plain objects (config defaults are always JSON-safe; no circular refs).
  */
 export function deepEqual(a: unknown, b: unknown): boolean {
   if (a === b) return true;
@@ -98,9 +98,8 @@ export function buildSettingGroups(
   featureFlagManager?: FeatureFlagManager | null,
 ): Map<SettingsCategory, SettingEntry[]> {
   const groups = new Map<SettingsCategory, SettingEntry[]>();
-  // Every category starts empty (including 'flags', now the Advanced Features
-  // bucket, and the new fetch/agents/security/integrations/policy/notifications
-  // namespaces) and is filled from CONFIG_SCHEMA below.
+  // Every category starts empty and is filled from CONFIG_SCHEMA below; the
+  // feature-unit layout pass then folds each capability's rows into one unit.
   for (const cat of SETTINGS_CATEGORIES) groups.set(cat, []);
 
   for (const setting of CONFIG_SCHEMA) {
@@ -122,11 +121,11 @@ export function buildSettingGroups(
     if ((rawCat === 'controlPlane' || rawCat === 'httpListener' || rawCat === 'web') && groups.has('network')) {
       groups.get('network')!.push(entry);
     }
+    // fleet.maxSize (was orchestration.maxActiveAgents) surfaces under orchestration.
+    if (rawCat === 'fleet' && groups.has('orchestration')) groups.get('orchestration')!.push(entry);
   }
 
-  // DEBT-2: inject the synthetic display.themeMode enum (auto|dark|light). TUI-local
-  // key stored under the existing `display` section (see theme-mode-config.ts for why
-  // not `appearance`), same rationale as the other synthetic settings below.
+  // Synthetic display.themeMode enum (auto|dark|light) — TUI-local, see theme-mode-config.ts.
   const displayEntries = groups.get('display');
   if (displayEntries && !displayEntries.some((e) => e.setting.key === (THEME_MODE_CONFIG_KEY as ConfigKey))) {
     displayEntries.push(buildThemeModeSyntheticEntry(configManager));
@@ -153,26 +152,19 @@ export function buildSettingGroups(
     }
   }
 
-  // Inject the synthetic tts.speed entry into the tts category.
-  // tts.speed is not yet a ConfigKey in the SDK schema (pending SDK addition).
-  // The entry is surfaced here with an honest description caveat so users can
-  // see and understand the setting before the SDK schema catches up.
+  // Synthetic tts.speed (not yet an SDK ConfigKey) — surfaced with an honest caveat.
   if (ttsEntries && !ttsEntries.some((e) => e.setting.key === ('tts.speed' as ConfigKey))) {
     ttsEntries.push(buildTtsSpeedSyntheticEntry(configManager));
   }
 
-  // Inject the synthetic behavior.notifyAfterSeconds entry into the behavior
-  // category. This key is TUI-local (not in the SDK ConfigKey union) and
-  // controls the long-task push notification threshold.
+  // Synthetic behavior.notifyAfterSeconds (TUI-local): long-task push threshold.
   const behaviorEntries = groups.get('behavior');
   if (behaviorEntries && !behaviorEntries.some((e) => e.setting.key === ('behavior.notifyAfterSeconds' as ConfigKey))) {
     behaviorEntries.push(buildNotifyAfterSecondsSyntheticEntry(configManager));
   }
 
-  // Inject the synthetic behavior.budgetAlertUsd entry into the behavior
-  // category. This key is TUI-local (not in the SDK ConfigKey union), which
-  // previously left it with no schema-driven inspection surface at all: it
-  // never appeared in /config, and /settings-sync show rejects any key not
+  // Synthetic behavior.budgetAlertUsd (TUI-local): no schema surface previously,
+  // never in /config; /settings-sync show rejects any key not
   // in CONFIG_KEYS. The Cost panel's 'b' key and /cost budget <usd> remain
   // the primary way to change it; this entry makes the current effective
   // value (and whether it's still the "no budget configured" default)
@@ -181,7 +173,7 @@ export function buildSettingGroups(
     behaviorEntries.push(buildBudgetAlertUsdSyntheticEntry(configManager));
   }
 
-  // Inject the W2.3 alert-class toggles + master focus gate. TUI-local
+  // Inject the alert-class toggles + master focus gate. TUI-local
   // synthetic settings, same rationale as notifyAfterSeconds above.
   if (behaviorEntries) {
     for (const entry of buildNotifyAlertSyntheticEntries(configManager)) {
@@ -214,6 +206,12 @@ export function buildSettingGroups(
     storageEntries.push(buildMemoryProjectionDirSyntheticEntry(configManager));
   }
 
+  // Synthetic memory.showProvenance (TUI-local, default OFF — see memory-provenance.ts).
+  const memoryEntries = groups.get('memory');
+  if (memoryEntries && !memoryEntries.some((e) => e.setting.key === (MEMORY_SHOW_PROVENANCE_CONFIG_KEY as ConfigKey))) {
+    memoryEntries.push(buildMemoryProvenanceSyntheticEntry(configManager) as unknown as SettingEntry);
+  }
+
   // Inject the worktree.setup.commands / worktree.setup.carryOverGlobs
   // synthetic entries into the orchestration category (worktree isolation is
   // an orchestration-engine concern — see WorkstreamIsolation 'worktree').
@@ -240,11 +238,10 @@ export function buildSettingGroups(
   // the SDK's own descriptions don't carry (see relay-settings-descriptions.ts).
   enrichRelaySettingDescriptions(groups);
 
-  // Feature-unit presentation: turn each flag into ONE unit (toggle + the config
-  // keys it tunes) hosted in its topical category, folding no-config flags into
-  // the Advanced Features bucket. Sourced from FEATURE_FLAG_CONFIG. Runs AFTER
-  // synthetic injection so non-flag-owned rows stay as orphans; skipped on the
-  // flagless test path.
+  // Feature-unit presentation: each capability becomes ONE unit (its real
+  // enablement row + the settings keys it tunes) in its settings domain,
+  // sourced from FEATURE_SETTINGS. Runs AFTER synthetic injection so
+  // non-feature-owned rows stay orphans; skipped on the featureless path.
   if (featureFlagManager) applyFeatureUnitLayout(groups, buildFlagEntries(featureFlagManager));
 
   // learning.consolidation.* is a real SDK config domain now, so its keys arrive
@@ -301,7 +298,7 @@ export function buildTtsSpeedSyntheticEntry(configManager: Pick<ConfigManager, '
 }
 
 // ---------------------------------------------------------------------------
-// display.themeMode synthetic setting (DEBT-2 light theme)
+// display.themeMode synthetic setting (light theme)
 // ---------------------------------------------------------------------------
 
 /**
@@ -415,11 +412,11 @@ export function buildBudgetAlertUsdSyntheticEntry(configManager: Pick<ConfigMana
 }
 
 // ---------------------------------------------------------------------------
-// W2.3 alert-class synthetic settings — behavior.notifyOn* + notifyOnlyWhenUnfocused
+// alert-class synthetic settings — behavior.notifyOn* + notifyOnlyWhenUnfocused
 // ---------------------------------------------------------------------------
 
 /**
- * The five W2.3 alert-gating booleans, all TUI-local (not yet in the SDK
+ * The five alert-gating booleans, all TUI-local (not yet in the SDK
  * ConfigKey union), all defaulting to on. Read/written generically by
  * core/alert-gating.ts (readBooleanConfig) and the per-alert-class modules
  * (budget-breach-notifier.ts, approval-alert.ts, turn-event-wiring.ts,
@@ -475,7 +472,7 @@ export function buildNotifyAlertSyntheticEntries(configManager: Pick<ConfigManag
 /**
  * The OSC 9 in-terminal desktop-notification toggles + the audible bell.
  * TUI-local synthetic booleans (not in the SDK ConfigKey union), each carrying
- * its OWN default (unlike the always-on W2.3 alert toggles above): approval-wait
+ * its OWN default (unlike the always-on alert toggles above): approval-wait
  * on, turn-end/agent-blocked off, bell off. Read generically by
  * core/terminal-notifier.ts (readBooleanConfig); this is only the
  * settings-modal-visible surface. These are independent of the master
@@ -537,9 +534,13 @@ export function buildCodeIndexEnabledSyntheticEntry(configManager: Pick<ConfigMa
 
 export function buildFlagEntries(featureFlagManager: FeatureFlagManager | null): FlagEntry[] {
   if (!featureFlagManager) return [];
-  return Array.from(featureFlagManager.getAll().values()).map(
-    ({ flag, state, persistedState, pendingRestart }) => ({ flag, state, persistedState, pendingRestart }),
-  );
+  const entries: FlagEntry[] = [];
+  for (const { flag, state, persistedState, pendingRestart } of featureFlagManager.getAll().values()) {
+    const feature = FEATURE_SETTINGS_BY_ID.get(flag.id);
+    if (!feature) continue; // gate with no settings surface (registry/binding drift is SDK test-guarded)
+    entries.push({ feature, flag, state, persistedState, pendingRestart });
+  }
+  return entries;
 }
 
 // ---------------------------------------------------------------------------
@@ -606,44 +607,34 @@ export function refreshEntryValues(
 ): void {
   for (const entries of groups.values()) {
     for (const entry of entries) {
-      // The worktree.setup.* keys read through a defensive helper. The SDK now
-      // registers the 'worktree' section in DEFAULT_CONFIG, so a plain
-      // configManager.get returns the empty default rather than throwing; the
-      // helper's guard (belt-and-suspenders for an older SDK) keeps this
-      // refresh from crashing for EVERY setting change if the section is ever
-      // absent (see worktree-setup-config.ts).
+      // worktree.setup.* read through a defensive array-normalizing helper (see worktree-setup-config.ts).
       if (isWorktreeSetupListConfigKey(entry.setting.key)) {
         entry.currentValue = readWorktreeSetupList(configManager, entry.setting.key);
         entry.isDefault = (entry.currentValue as string[]).length === 0;
         continue;
       }
-      // sandbox.egressAllowlist / sandbox.workspaceWritable: 'sandbox' IS a real
-      // DEFAULT_CONFIG section (has been since before this repack, backing the
-      // VM/REPL isolation settings), so a plain get() would not throw — but an
-      // unset leaf still reads back as `undefined`, not `[]`, so this still needs
-      // the same array-normalizing read as the worktree keys above (see
-      // sandbox-exec-config.ts).
+      // sandbox.* list leaves normalize an unset undefined to [] (see sandbox-exec-config.ts).
       if (isSandboxExecListConfigKey(entry.setting.key)) {
         entry.currentValue = readSandboxExecList(configManager, entry.setting.key);
         entry.isDefault = (entry.currentValue as string[]).length === 0;
         continue;
       }
-      // permissions.execEnvScrubAllowlist: same normalizing-read trap as above —
-      // 'permissions' is a real section but this leaf is TUI-local (see
-      // exec-env-scrub-config.ts).
+      // permissions.execEnvScrubAllowlist: same array-normalizing read (see exec-env-scrub-config.ts).
       if (isExecEnvScrubAllowlistConfigKey(entry.setting.key)) {
         entry.currentValue = readExecEnvScrubAllowlist(configManager);
         entry.isDefault = (entry.currentValue as string[]).length === 0;
         continue;
       }
-      // 'learning' is now a real DEFAULT_CONFIG section (schema-domain-learning.ts),
-      // so learning.consolidation.* keys read through the plain path below like any
-      // other schema-driven setting — no special case needed anymore.
-      // Same trap still applies here: 'memory' has no DEFAULT_CONFIG entry.
+      // 'memory' has no DEFAULT_CONFIG entry — its synthetic leaves read defensively below.
       if (entry.setting.key === MEMORY_PROJECTION_DIR_CONFIG_KEY) {
         const refreshed = buildMemoryProjectionDirSyntheticEntry(configManager);
-        entry.currentValue = refreshed.currentValue;
-        entry.isDefault = refreshed.isDefault;
+        entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
+        continue;
+      }
+      // memory.showProvenance: same 'memory'-has-no-DEFAULT_CONFIG trap — read defensively.
+      if (entry.setting.key === (MEMORY_SHOW_PROVENANCE_CONFIG_KEY as ConfigKey)) {
+        const refreshed = buildMemoryProvenanceSyntheticEntry(configManager);
+        entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
         continue;
       }
       const raw = configManager.get(entry.setting.key as ConfigKey);
@@ -676,8 +667,12 @@ export function updateEntryForKey(
     if (entry) {
       if (key === MEMORY_PROJECTION_DIR_CONFIG_KEY) {
         const refreshed = buildMemoryProjectionDirSyntheticEntry(configManager);
-        entry.currentValue = refreshed.currentValue;
-        entry.isDefault = refreshed.isDefault;
+        entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
+        continue;
+      }
+      if (key === (MEMORY_SHOW_PROVENANCE_CONFIG_KEY as ConfigKey)) {
+        const refreshed = buildMemoryProvenanceSyntheticEntry(configManager);
+        entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
         continue;
       }
       if (isSandboxExecListConfigKey(key)) {

package/src/input/settings-modal-mutations.ts

@@ -1,17 +1,18 @@
 /**
  * settings-modal-mutations — pure mutation helpers for SettingsModal.
  *
- * These functions encapsulate the side-effectful write operations:
- * applying config values, persisting feature flag state, and applying flag
- * runtime toggles. Each function takes its dependencies as explicit arguments
- * rather than accessing class-level state.
+ * These functions encapsulate the side-effectful write operations. Every
+ * write — feature-unit headers included — is a plain domain-settings config
+ * write; the SDK's settings bridge keeps the runtime gate manager in sync
+ * (flipping runtime-toggleable gates live and recording honest
+ * pending-restart markers for startup-gated ones). Each function takes its
+ * dependencies as explicit arguments rather than accessing class-level state.
  */
 
-import type { ConfigKey, PersistedFlagState } from '@pellux/goodvibes-sdk/platform/config';
+import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { FeatureFlagManager } from '@/runtime/index.ts';
-import type { FeatureFlag, FlagState } from '@/runtime/index.ts';
 import type { FlagEntry, SettingEntry } from './settings-modal-types.ts';
 import { deepEqual } from './settings-modal-data.ts';
 
@@ -83,10 +84,12 @@ export function applySettingValue({
     };
   }
 
-  // Update the entry in the groups map
+  // Update every entry carrying this key: cross-listed rows (the network
+  // combined view) and feature-unit headers that share one enablement key
+  // (e.g. both compaction features read behavior.compactionStrategy).
   for (const entries of groups.values()) {
-    const entry = entries.find((candidate) => candidate.setting.key === key);
-    if (entry) {
+    for (const entry of entries) {
+      if (entry.setting.key !== key) continue;
       entry.currentValue = configManager.get(key);
       entry.isDefault = deepEqual(entry.currentValue, entry.setting.default);
     }
@@ -112,65 +115,6 @@ export function applySettingValue({
   return { restartDomain, effectMessage, changed: previousValue !== value };
 }
 
-// ---------------------------------------------------------------------------
-// persistFlagState — write a flag override to config
-// ---------------------------------------------------------------------------
-
-export function persistFlagState(
-  configManager: ConfigManager,
-  flagId: string,
-  newState: FlagState,
-  defaultState: FlagState,
-): void {
-  if (newState === 'killed') return; // never persist killed state
-
-  try {
-    if (newState === defaultState) {
-      // Back at the default: the override must be REMOVED, not merged.
-      // getCategory clones and mergeCategory only sets keys, so the old
-      // delete-then-merge approach left the stale override on disk and the
-      // flag silently reloaded in the overridden state on the next start.
-      configManager.removeCategoryKey('featureFlags', flagId);
-    } else {
-      configManager.mergeCategory('featureFlags', { [flagId]: newState } as Record<string, PersistedFlagState>);
-    }
-  } catch (e) {
-    logger.error('SettingsModal: failed to persist flag state', { flagId, error: summarizeError(e) });
-  }
-}
-
-// ---------------------------------------------------------------------------
-// applyFlagState — toggle a feature flag (runtime + persist)
-// ---------------------------------------------------------------------------
-
-export function applyFlagState(
-  flagEntry: FlagEntry,
-  newState: FlagState,
-  featureFlagManager: FeatureFlagManager,
-  configManager: ConfigManager,
-): void {
-  const flag: FeatureFlag = flagEntry.flag;
-
-  try {
-    // Persist first so the on-disk override is the source of truth, then apply
-    // the same value to the live manager through applyConfigState. That single
-    // call keeps both paths consistent with the SDK's config→flag bridge:
-    //   - runtime-toggleable flags apply immediately (firing flag subscribers
-    //     exactly as a direct enable()/disable() would), and
-    //   - startup-gated flags are NOT faked live — the effective state is left
-    //     untouched and a pending-restart marker is recorded instead.
-    persistFlagState(configManager, flag.id, newState, flag.defaultState as FlagState);
-    featureFlagManager.applyConfigState(flag.id, newState);
-  } catch (e) {
-    logger.error('SettingsModal: failed to toggle feature flag', { flag: flag.id, error: summarizeError(e) });
-  }
-
-  // Reflect the manager's real state, never the requested target: for a
-  // startup-gated flag `state` stays at the unchanged effective value and
-  // `pendingRestart` reports that a restart is needed for `persistedState`.
-  syncFlagEntryFromManager(flagEntry, featureFlagManager);
-}
-
 /**
  * Refresh a FlagEntry's live/persisted/pending fields from the manager's
  * authoritative snapshot so the settings UI never displays a guessed state.

package/src/input/settings-modal-types.ts

@@ -1,11 +1,12 @@
 import type { ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
 import type { ProviderAuthFreshness, ProviderAuthRoute } from '@/runtime/index.ts';
-import type { FeatureFlag, FlagState } from '@/runtime/index.ts';
+import type { FeatureFlag, FeatureSetting, FlagState } from '@/runtime/index.ts';
 
 export type SettingsCategory =
   | 'display'
   | 'ui'
   | 'provider'
+  | 'pricing'
   | 'subscriptions'
   | 'behavior'
   | 'storage'
@@ -17,6 +18,7 @@ export type SettingsCategory =
   | 'tools'
   | 'helper'
   | 'tts'
+  | 'voice'
   | 'service'
   | 'daemon'
   | 'controlPlane'
@@ -43,8 +45,10 @@ export type SettingsCategory =
   | 'integrations'
   | 'policy'
   | 'notifications'
-  | 'flags'
   | 'release'
+  | 'update'
+  | 'power'
+  | 'memory'
   | 'danger';
 
 export type SettingsFocusPane = 'categories' | 'settings';
@@ -54,12 +58,12 @@ export const SETTINGS_CATEGORY_GROUPS: ReadonlyArray<{
   readonly categories: readonly SettingsCategory[];
 }> = [
   { label: 'Interface', categories: ['display', 'ui', 'behavior', 'notifications', 'permissions', 'policy', 'security'] },
-  { label: 'AI Routing', categories: ['provider', 'subscriptions', 'helper', 'tools', 'tts'] },
+  { label: 'AI Routing', categories: ['provider', 'pricing', 'subscriptions', 'helper', 'tools', 'tts', 'voice'] },
   { label: 'Service & Network', categories: ['service', 'daemon', 'network', 'controlPlane', 'httpListener', 'web', 'relay'] },
   { label: 'Surfaces & Cloud', categories: ['surfaces', 'integrations', 'mcp', 'cloudflare'] },
   { label: 'Automation', categories: ['batch', 'automation', 'checkin', 'watchers', 'orchestration', 'planner', 'wrfc'] },
-  { label: 'Runtime & Data', categories: ['storage', 'atRest', 'sandbox', 'fetch', 'agents', 'runtime', 'cache', 'telemetry', 'diagnostics', 'learning'] },
-  { label: 'Advanced', categories: ['flags', 'release', 'danger'] },
+  { label: 'Runtime & Data', categories: ['storage', 'atRest', 'sandbox', 'fetch', 'agents', 'runtime', 'power', 'memory', 'cache', 'telemetry', 'diagnostics', 'learning'] },
+  { label: 'Advanced', categories: ['release', 'update', 'danger'] },
 ];
 
 export const SETTINGS_CATEGORIES: SettingsCategory[] = SETTINGS_CATEGORY_GROUPS.flatMap(group => group.categories);
@@ -74,34 +78,40 @@ export interface SettingEntry {
   sourceLabel?: string;
   lockReason?: string;
   /**
-   * Present when this row is a feature-unit toggle header (a feature flag
-   * rendered as one unit with its config keys beneath it). The row's
-   * setting.key is `featureFlags.<id>` and setting.type is 'boolean'; toggling
-   * routes to the feature-flag manager, not a plain config write.
+   * Present when this row is a feature-unit header (a platform capability
+   * rendered as one unit with the settings that tune it beneath). The row IS
+   * the real config row for the feature's enablement key — boolean headers
+   * toggle and enum headers cycle their mode choices through the ordinary
+   * settings write path (a plain config write; the settings bridge keeps the
+   * runtime gate in sync).
    */
   flag?: FlagEntry;
   /**
-   * Present when this row is a config sub-option OWNED by a feature unit — the
-   * id of the owning flag. Drives the indented rendering beneath its header and
-   * marks the row as claimed so it does not double-list as an orphan.
+   * Present when this row is a settings sub-option OWNED by a feature unit —
+   * the id of the owning feature. Drives the indented rendering beneath its
+   * header and marks the row as claimed so it does not double-list as an
+   * orphan.
    */
   ownerFlagId?: string;
 }
 
 export interface FlagEntry {
+  /** The per-feature settings metadata (domain, enablement shape, settings keys, real description). */
+  feature: FeatureSetting;
+  /** The internal gate declaration (kill state/reason live here). */
   flag: FeatureFlag;
   /** Live effective state as the runtime currently sees it. */
   state: FlagState;
   /**
    * Last known config-layer (persisted) value. Equals `state` unless a
-   * startup-gated flag was toggled this session — then it holds the value that
-   * will take effect on the next launch.
+   * startup-gated feature was changed this session — then it holds the value
+   * that will take effect on the next launch.
    */
   persistedState: FlagState;
   /**
-   * True when a startup-gated flag's persisted value differs from its effective
-   * state, i.e. a restart is required before the change takes effect. Sourced
-   * from FeatureFlagManager.getAll(), never guessed.
+   * True when a startup-gated feature's persisted value differs from its
+   * effective state, i.e. a restart is required before the change takes
+   * effect. Sourced from FeatureFlagManager.getAll(), never guessed.
    */
   pendingRestart: boolean;
 }