@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/renderer/settings-modal.ts

@@ -6,8 +6,9 @@
  */
 
 import type { Line } from '../types/grid.ts';
-import type { SettingsModal, SettingEntry, FlagEntry, McpEntry, SubscriptionEntry, SettingsCategory } from '../input/settings-modal.ts';
+import type { SettingsModal, SettingEntry, McpEntry, SubscriptionEntry, SettingsCategory } from '../input/settings-modal.ts';
 import { SETTINGS_CATEGORIES, SETTINGS_CATEGORY_GROUPS } from '../input/settings-modal.ts';
+import { FEATURE_SETTINGS_BY_ID, isFeatureValueEnabled } from '../runtime/feature-settings.ts';
 import { getDisplayWidth, wrapText } from '../utils/terminal-width.ts';
 import { CATEGORY_LABELS, describeUiRouting, formatValue, getSettingLabel, inferSubscriptionRouteReason, valueColor } from './settings-modal-helpers.ts';
 import { isSecretConfigKey } from '../config/secret-config.ts';
@@ -27,6 +28,8 @@ const CATEGORY_INFO: Record<SettingsCategory, string> = {
   display: 'Presentation settings for the terminal transcript: streaming, line numbers, thinking visibility, reasoning summaries, token speed, and tool previews.',
   ui: 'Controls where operational messages render and whether voice surfaces are enabled. These settings change visibility, not provider behavior.',
   provider: 'Default model routing for normal chat turns, embeddings, reasoning effort, and persistent system prompt file.',
+  pricing: 'Manual model prices (USD per 1M tokens, keyed provider:model). Your price wins over provider-served and catalog prices in every cost display, immediately.',
+  update: 'Self-update posture: whether the daemon checks hourly and updates at an idle moment, the release source it checks, and the check cadence. Clients update at launch; every swap keeps the previous binary for one-command rollback.',
   subscriptions: 'Provider subscription login state and routing posture. Active sessions can be reviewed or signed out here; API keys remain managed through secrets.',
   behavior: 'Day-to-day shell behavior: approval posture, compaction, history, guidance, notifications, stale-context warnings, return context, and Human-in-the-Loop mode.',
   storage: 'Local storage posture, including secret storage policy and maximum artifact size for knowledge/home graph/document ingestion.',
@@ -37,6 +40,7 @@ const CATEGORY_INFO: Record<SettingsCategory, string> = {
   wrfc: 'Work-review-fix-cycle thresholds, retry limits, and automatic commit behavior.',
   helper: 'Helper model defaults used by helper subsystems when they do not use the main chat route.',
   tts: 'Text-to-speech provider, voice, and optional spoken-turn LLM overrides.',
+  voice: 'Free, offline local voice engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro. All empty by default — configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error). Once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension.',
   service: 'Background service posture: enabled state, autostart, restart behavior, service name, platform, and logs.',
   daemon: 'Local session daemon. It hosts the shared session broker and companion chat so a session started here is visible and steerable from other surfaces. On by default, bound to loopback (127.0.0.1) only.',
   controlPlane: 'Daemon control-plane settings for local admin/API access.',
@@ -55,9 +59,10 @@ const CATEGORY_INFO: Record<SettingsCategory, string> = {
   surfaces: 'External app surfaces such as Slack, Discord, ntfy, Home Assistant, Telegram, webhooks, chat bridges, and messaging providers.',
   cloudflare: 'Optional Cloudflare control plane, batch queue, Worker, Tunnel, Access, DNS, KV, Durable Objects, Secrets Store, and R2 settings.',
   release: 'Release-channel preference.',
+  power: 'Host sleep ownership. Keep-awake holds the host awake (the always-visible "sleep disabled" chip is the safety mechanism — no timer, no AC-only option); automatic inhibition keeps the host awake while real work runs, with an honest hard cap on that work hold.',
+  memory: 'Memory provenance surfacing. Whether turns that drew on your standing memories show a small "used N memories" chip with a drill-in listing them. Off by default — when off, nothing is rendered and no context is added.',
   danger: 'High-impact switches for daemon and HTTP listener behavior. These are operational overrides, not normal preferences.',
   tools: 'Tool LLM and helper model routing. Empty provider/model values inherit the active chat route unless a specific helper/tool route is set.',
-  flags: 'Advanced feature toggles with no tuning knobs — internal and startup-gated runtime gates. Features that DO have config sit as units (toggle + settings) in their topical category, not here.',
   network: 'Combined network view for daemon control-plane, HTTP listener, browser web surface, and general outbound network settings.',
   fetch: 'Fetch response sanitization and host trust tiers for the fetch tool: sanitize mode plus default trusted/blocked host lists. Gated by the Fetch Response Sanitization feature.',
   agents: 'Sub-agent context-window awareness and per-turn passive knowledge/code injection: token budget, relevance floor, code-chunk limit, and the compaction threshold. Gated by the agent context/injection features.',
@@ -65,7 +70,7 @@ const CATEGORY_INFO: Record<SettingsCategory, string> = {
   integrations: 'Integration delivery reliability (Slack/Discord/webhook): retry counts, backoff bounds, dead-letter queue size, and SLO enforcement. Gated by the Integration Delivery SLO feature.',
   policy: 'Policy-as-code bundle loading: where the startup policy bundle is loaded from and its file path. Gated by the Policy-as-Code feature.',
   notifications: 'Notification router burst-suppression tuning: burst window, threshold, and cooldown. Gated by the Adaptive Notification Suppression feature.',
-  relay: 'Outbound zero-knowledge relay reachability, for reaching this daemon from outside the LAN without opening an inbound port. Off by default; also gated by the relay-connect feature flag. The relay operator sees only ciphertext and connection metadata — self-host your own relay for full control.',
+  relay: 'Outbound zero-knowledge relay reachability, for reaching this daemon from outside the LAN without opening an inbound port. Off by default — relay.enabled is the switch. The relay operator sees only ciphertext and connection metadata — self-host your own relay for full control.',
   learning: 'Idle-time memory consolidation: merging duplicate standing memory records and decaying/archiving stale ones. Off by default — nothing runs until enabled.',
 };
 
@@ -181,6 +186,12 @@ function buildSettingContext(modal: SettingsModal, entry: SettingEntry): string[
   if (entry.locked) lines.push(`Locked: ${entry.lockReason ?? 'This setting is locked by a higher-priority layer.'}`);
   if (entry.conflict) lines.push(`Conflict: resolve with /settings-sync resolve ${entry.setting.key} local|synced.`);
 
+  // A settings sub-row owned by a feature unit names its feature so "what does this do" is answerable without scrolling back to the header row.
+  if (entry.ownerFlagId) {
+    const owner = FEATURE_SETTINGS_BY_ID.get(entry.ownerFlagId);
+    if (owner) lines.push(`Part of feature: ${owner.name} (the header row above).`);
+  }
+
   lines.push('', entry.setting.description);
 
   if (
@@ -225,26 +236,86 @@ function buildSettingContext(modal: SettingsModal, entry: SettingEntry): string[
   return lines;
 }
 
-function buildFlagContext(entry: FlagEntry | null): string[] {
-  if (!entry) return ['Feature flags', 'No feature flag is selected.'];
-  return [
-    entry.flag.name,
-    `ID: ${entry.flag.id}`,
-    `State: ${entry.state}`,
-    `Default: ${entry.flag.defaultState}`,
-    `Tier: ${entry.flag.tier}`,
-    `Runtime toggleable: ${entry.flag.runtimeToggleable ? 'yes' : 'no'}`,
-    ...(entry.pendingRestart
-      ? [`Pending restart: saved as ${entry.persistedState}; effective state stays ${entry.state} until the next launch.`]
+/**
+ * The option shape of a feature header, rendered from the same schema the
+ * write path uses: enum headers list every mode choice (marking the current
+ * value and which values keep the feature active), boolean headers state the
+ * two positions.
+ */
+function buildFeatureOptionLines(entry: SettingEntry): string[] {
+  const feature = entry.flag!.feature;
+  const setting = entry.setting;
+  const lines: string[] = [];
+  if (setting.type === 'enum' && setting.enumValues) {
+    lines.push('', `Mode choices for ${setting.key}:`);
+    const activeValues = feature.enablement.enabledValues ?? [];
+    const descriptions = ENUM_VALUE_DESCRIPTIONS[setting.key] ?? {};
+    for (const value of setting.enumValues) {
+      const marks: string[] = [];
+      if (value === String(entry.currentValue)) marks.push('current');
+      if (feature.enablement.kind === 'enum') {
+        marks.push(activeValues.includes(value) ? 'feature on' : 'feature off');
+      }
+      const suffix = marks.length > 0 ? ` (${marks.join(', ')})` : '';
+      lines.push(`${value}${suffix}: ${descriptions[value] ?? `Use ${value} for this setting.`}`);
+    }
+  } else if (setting.type === 'boolean') {
+    lines.push('');
+    lines.push('Possible values:');
+    lines.push('true: the feature is enabled.');
+    lines.push('false: the feature is disabled.');
+  }
+  return lines;
+}
+
+/**
+ * Under-cursor documentation for a feature-unit header, rendered entirely
+ * from the SDK's per-feature settings metadata: full behavior description,
+ * the real option shape, every settings key that tunes the feature, and the
+ * honest live/restart state from the gate manager.
+ */
+function buildFlagContext(entry: SettingEntry | null): string[] {
+  const flagEntry = entry?.flag ?? null;
+  if (!entry || !flagEntry) return ['Features', 'No feature is selected.'];
+  const { feature, flag, state, persistedState, pendingRestart } = flagEntry;
+  const configOn = isFeatureValueEnabled(feature, entry.currentValue);
+  const displayState = state === 'killed' ? 'killed' : configOn ? 'enabled' : 'disabled';
+  const lines: string[] = [
+    feature.name,
+    `Feature: ${feature.id} (${feature.domain} domain)`,
+    `Setting: ${feature.enablement.key} = ${formatValue(entry)}`,
+    `State: ${displayState}`,
+    `Default: ${feature.defaultEnabled ? 'enabled' : 'disabled'}`,
+    `Applies: ${feature.restartRequired ? 'on next launch (startup-gated)' : 'immediately'}`,
+    ...(pendingRestart
+      ? [`Pending restart: saved as ${persistedState}; effective state stays ${state} until the next launch.`]
       : []),
     '',
-    entry.flag.description,
-    ...(entry.state === 'killed' && entry.flag.killReason ? ['', `Kill reason: ${entry.flag.killReason}`] : []),
-    '',
-    entry.flag.runtimeToggleable
-      ? 'Impact: changes apply immediately and are also persisted as an override when they differ from the default.'
-      : 'Impact: this flag is persisted as an override and requires restart before startup-only code sees the new state.',
+    feature.description,
   ];
+
+  lines.push(...buildFeatureOptionLines(entry));
+
+  lines.push('');
+  if (feature.enablement.kind === 'enum') {
+    lines.push(`How it turns on: active while ${feature.enablement.key} is ${(feature.enablement.enabledValues ?? []).join(' or ')}.`);
+  } else if (feature.enablement.kind === 'constant' && entry.setting.type !== 'boolean') {
+    lines.push('How it turns on: always active; the settings listed below tune its behavior directly.');
+  } else {
+    lines.push(`How it turns on: ${feature.enablement.key} set to true.`);
+  }
+
+  if (feature.settings.length > 1) {
+    lines.push('', 'Settings in this feature:');
+    for (const key of feature.settings) {
+      lines.push(key === feature.enablement.key ? `${key} (this row)` : key);
+    }
+  }
+
+  if (state === 'killed' && flag.killReason) {
+    lines.push('', `Kill reason: ${flag.killReason}`);
+  }
+  return lines;
 }
 
 function buildMcpContext(modal: SettingsModal, entry: McpEntry | null): string[] {
@@ -332,9 +403,10 @@ function buildContextLines(modal: SettingsModal, width: number): string[] {
     lines.push(...buildSubscriptionContext(modal, modal.getSelectedSubscription()));
   } else {
     const selected = modal.getSelected();
-    // A feature-unit toggle header shows flag context (tier, default, impact);
-    // its config sub-options and plain settings show the setting context.
-    if (selected?.flag) lines.push(...buildFlagContext(selected.flag));
+    // A feature-unit header shows the feature's documentation (full
+    // description, option shape, settings list, live/restart state); its
+    // settings sub-rows and plain settings show the setting context.
+    if (selected?.flag) lines.push(...buildFlagContext(selected));
     else if (selected) lines.push(...buildSettingContext(modal, selected));
     else lines.push('No setting is selected in this category.');
   }
@@ -355,7 +427,6 @@ function buildContextLines(modal: SettingsModal, width: number): string[] {
 function categoryItemCount(modal: SettingsModal, category: SettingsCategory): number {
   if (category === 'mcp') return modal.mcpEntries.length;
   if (category === 'subscriptions') return modal.subscriptionEntries.length;
-  // 'flags' (Advanced Features) now flows through the normal group path.
   return modal.groups.get(category)?.length ?? 0;
 }
 
@@ -454,15 +525,18 @@ function renderSettingTableRow(
   defaultWidth: number,
 ): string {
   if (entry.flag) {
-    const { flag, state, pendingRestart, persistedState } = entry.flag;
-    const stateMark = state === 'enabled' ? '●' : state === 'killed' ? '✕' : '○';
-    const label = `${stateMark} ${flag.name}`;
-    const source = `tier ${flag.tier} ${flag.runtimeToggleable ? 'live' : 'restart'}`;
-    // A startup-gated flag toggled this session keeps its effective state and
-    // shows the pending value it will take on restart, so the row never implies
-    // the change already took effect.
-    const value = pendingRestart ? `${state} → ${persistedState} on restart` : state;
-    return `${marker} ${padDisplay(label, keyWidth)}  ${padDisplay(value, valueWidth)}  ${padDisplay('feature', typeWidth)}  ${padDisplay(source, sourceWidth)}  ${padDisplay(flag.defaultState, defaultWidth)}`;
+    const { feature, state, pendingRestart } = entry.flag;
+    const configOn = isFeatureValueEnabled(feature, entry.currentValue);
+    const stateMark = state === 'killed' ? '✕' : configOn ? '●' : '○';
+    const label = `${stateMark} ${feature.name}`;
+    const source = feature.restartRequired ? 'restart' : 'live';
+    // A startup-gated feature changed this session shows its saved value with
+    // a compact restart-pending marker (⟳), so the row never implies the
+    // change already took effect; the documentation pane spells out the full
+    // "Pending restart: ..." sentence.
+    const rawValue = currentSettingValue(modal, entry, selected);
+    const value = pendingRestart ? `${rawValue} ⟳` : rawValue;
+    return `${marker} ${padDisplay(label, keyWidth)}  ${padDisplay(value, valueWidth)}  ${padDisplay('feature', typeWidth)}  ${padDisplay(source, sourceWidth)}  ${padDisplay(feature.defaultEnabled ? 'enabled' : 'disabled', defaultWidth)}`;
   }
   const value = currentSettingValue(modal, entry, selected);
   const source = `${entry.effectiveSource ?? 'default'}${entry.locked ? ' locked' : ''}${entry.conflict ? ' conflict' : ''}`;
@@ -626,9 +700,9 @@ function footerText(modal: SettingsModal, width: number): string {
       { key: 'Enter', verb: 'Edit trust' },
       { key: 'Esc', verb: 'Close' },
     ]));
-  // 'flags' (Advanced Features) and every topical category that now hosts feature
-  // units flow through the default settings footer below — Enter/Space toggles a
-  // feature-unit header exactly as it edits/toggles any setting row.
+  // Every topical category that hosts feature units flows through the default
+  // settings footer below — Enter/Space toggles a feature-unit header exactly
+  // as it edits/toggles any setting row.
   // Default settings pane: tier the reset affordances by available width.
   // W<80:  minimal — only the most critical action survives.
   // W<160: compact but still shows both reset affordances.
@@ -639,6 +713,7 @@ function footerText(modal: SettingsModal, width: number): string {
     return formatHints([
       { key: 'Up/Down', verb: 'Move' },
       { key: 'Enter/Space', verb: 'Edit' },
+      { key: 'PgUp/PgDn', verb: 'docs' },
       { key: '⇧R', verb: 'reset cat' },
       { key: '^⇧R', verb: 'reset all' },
       { key: 'Esc', verb: 'Close' },
@@ -647,6 +722,7 @@ function footerText(modal: SettingsModal, width: number): string {
     { key: 'Up/Down', verb: 'Setting' },
     { key: 'Left', verb: 'Categories' },
     { key: 'Enter/Space', verb: 'Edit/toggle' },
+    { key: 'PgUp/PgDn', verb: 'Scroll docs' },
     { key: '⇧R', verb: 'reset cat' },
     { key: '^⇧R', verb: 'reset all' },
     { key: 'Esc', verb: 'Close' },
@@ -664,12 +740,26 @@ export function renderSettingsModal(
   ];
   const metrics = getFullscreenWorkspaceMetrics({ width, height: viewportHeight });
   const categoryRows = renderCategories(modal, metrics.leftWidth - 2, metrics.bodyRows);
-  const contextRows = buildContextLines(modal, metrics.contextWidth).map((text, row): WorkspaceRow => {
+  // Documentation pane: long content SCROLLS (PgUp/PgDn) with honest
+  // more-above/below markers — it is never silently clipped.
+  const allContextLines = buildContextLines(modal, metrics.contextWidth);
+  const visibleContext = metrics.contextRows;
+  const maxContextScroll = Math.max(0, allContextLines.length - visibleContext);
+  const contextOffset = Math.min(Math.max(0, modal.contextScroll ?? 0), maxContextScroll);
+  const windowedContext = allContextLines.slice(contextOffset, contextOffset + visibleContext);
+  if (contextOffset > 0) {
+    windowedContext[0] = `${GLYPHS.navigation.moreAbove} ${contextOffset} more line(s) above — PgUp`;
+  }
+  if (contextOffset + visibleContext < allContextLines.length) {
+    const below = allContextLines.length - contextOffset - visibleContext;
+    windowedContext[windowedContext.length - 1] = `${GLYPHS.navigation.moreBelow} ${below} more line(s) below — PgDn`;
+  }
+  const contextRows = windowedContext.map((text, row): WorkspaceRow => {
     const selectedSetting = modal.getSelected();
-    const isTitle = row === 0 || (selectedSetting !== null && text === getSettingLabel(selectedSetting));
+    const isTitle = (row === 0 && contextOffset === 0) || (selectedSetting !== null && text === getSettingLabel(selectedSetting));
     return {
       text,
-      fg: row === 0 ? PALETTE.title : text.endsWith(':') ? PALETTE.subtitle : PALETTE.text,
+      fg: row === 0 && contextOffset === 0 ? PALETTE.title : text.endsWith(':') ? PALETTE.subtitle : PALETTE.text,
       bold: isTitle,
       dim: text.length === 0,
     };

package/src/renderer/shell-surface.ts

@@ -65,6 +65,10 @@ export interface ShellFooterBuildOptions {
    * embedded/local mode so no segment renders.
    */
   readonly sessionSpineStatus?: 'online' | 'offline';
+  /** The web surface's reachable URL, when that surface is enabled; a persistent footer segment. */
+  readonly webSurfaceUrl?: string;
+  /** True while power.keepAwake holds — renders the always-visible "sleep disabled" chip. */
+  readonly powerKeepAwake?: boolean;
 }
 
 export interface ShellFooterBuildResult {
@@ -144,6 +148,8 @@ export function buildShellFooter(
     options.compact ?? false,
     options.sessionSpineStatus,
     options.permissionMode,
+    options.webSurfaceUrl,
+    options.powerKeepAwake,
   );
   // Compact posture drops the process indicator and context hint entirely so
   // the footer fits within ~5 rows on short terminals.

package/src/renderer/terminal-bg-probe.ts

@@ -1,7 +1,7 @@
 /**
  * terminal-bg-probe — OSC 11 terminal-background detection for `auto` theme mode.
  *
- * DEBT-2. On startup, when appearance is `auto` and stdout is a TTY, we ask
+ *. On startup, when appearance is `auto` and stdout is a TTY, we ask
  * the terminal for its background colour with an OSC 11 query and classify the
  * reply as light or dark. Everything about this is best-effort and conservative:
  * any timeout, any unparseable reply, any ambiguity resolves to DARK, which is

package/src/renderer/theme.ts

@@ -21,7 +21,7 @@
  * DEFAULT_PANEL_PALETTE, DEFAULT_STYLE, FULLSCREEN_PALETTE and
  * DEFAULT_OVERLAY_PALETTE all read through ONE mode-resolved path instead of
  * importing the static UI_TONES constant directly. Mode stays 'dark'
- * everywhere until the terminal-bg-probe lands (see WO-001) — the light
+ * everywhere until the terminal-bg-probe lands (see) — the light
  * entry is type-complete, not a shipped light theme.
  */
 
@@ -173,7 +173,7 @@ export const DARK_THEME: Readonly<ThemeTokens> = DARK;
 //
 // UI_TONES (ui-primitives.ts) is the dark entry. The light entry mirrors
 // dark for every role that has no light-appropriate equivalent yet — the
-// WO-001 deliverable is the mode dimension and single read path, not a
+// deliverable is the mode dimension and single read path, not a
 // shipped light chrome theme (see module doc comment above).
 // ---------------------------------------------------------------------------
 
@@ -242,7 +242,7 @@ export function resolveUiTones(mode: ThemeMode): Readonly<UiToneTokens> {
 }
 
 // ===========================================================================
-// Active-mode runtime (DEBT-2 terminal-bg-probe landing).
+// Active-mode runtime (terminal-bg-probe landing).
 //
 // The mode is decided ONCE at startup — from appearance config (display.themeMode
 // forced dark/light) or the terminal-background probe (auto) — and is then stable

package/src/renderer/tool-call.ts

@@ -147,7 +147,7 @@ function extractKeyArg(toolCall: ToolCall): string {
  * Layout: [margin] [icon] [space] [tool name padded] [key arg] [summary] [duration]
  *
  * @param toolCall - The tool call being executed
- * @param status - 'executing' | 'done' | 'error'
+ * @param status - 'executing' | 'done' | 'error' | 'pending' | 'cancelled'
  * @param resultSummary - Optional brief summary (e.g., "3 files", "exit 0")
  * @param width - Terminal width
  * @param durationMs - Optional duration in milliseconds
@@ -157,7 +157,7 @@ function extractKeyArg(toolCall: ToolCall): string {
  */
 export function renderToolCallBlock(
   toolCall: ToolCall,
-  status: 'executing' | 'done' | 'error' | 'pending',
+  status: 'executing' | 'done' | 'error' | 'pending' | 'cancelled',
   resultSummary: string | undefined,
   width: number,
   durationMs?: number,
@@ -173,13 +173,17 @@ export function renderToolCallBlock(
 
   // Status icon. 'pending' means the tool is still awaiting a decision
   // (e.g. an approval prompt) and has NOT run yet — it uses the hollow idle
-  // glyph so a not-yet-run tool never shows the completed green ✓ (UX-B 2c).
+  // glyph so a not-yet-run tool never shows the completed green ✓ (2c).
+  // 'cancelled' means the user stopped THIS call mid-flight — the blocked glyph
+  // in the warn tone, distinct from both success and a real error.
   const icon = status === 'done' ? TOOL_STATUS.SUCCESS_ICON
     : status === 'error' ? TOOL_STATUS.FAIL_ICON
+    : status === 'cancelled' ? GLYPHS.status.blocked
     : status === 'pending' ? GLYPHS.status.idle
     : TOOL_STATUS.SPINNER_FRAMES[(frameIndex ?? 0) % TOOL_STATUS.SPINNER_FRAMES.length];
   const iconColor = status === 'done' ? t.chrome.good
     : status === 'error' ? t.chrome.bad
+    : status === 'cancelled' ? t.chrome.warn
     : '244';
   const rightText = (() => {
     if (durationMs !== undefined && status === 'done') {
@@ -204,7 +208,7 @@ export function renderToolCallBlock(
   let col: number = leftStart;
 
   if (col < leftEndExclusive) {
-    line[col] = createStyledCell(icon, { fg: iconColor, bold: status === 'done' || status === 'error' });
+    line[col] = createStyledCell(icon, { fg: iconColor, bold: status === 'done' || status === 'error' || status === 'cancelled' });
   }
   col += 2; // icon + space
 
@@ -215,9 +219,11 @@ export function renderToolCallBlock(
   const keyArg = stripDangerousAnsi(extractKeyArg(toolCall));
   const suffixText = status === 'error' && errorMsg
     ? `- ${stripDangerousAnsi(errorMsg).slice(0, 40)}`
-    : status === 'done' && resultSummary
-      ? `(${stripDangerousAnsi(resultSummary)})`
-      : '';
+    : status === 'cancelled'
+      ? '- cancelled'
+      : status === 'done' && resultSummary
+        ? `(${stripDangerousAnsi(resultSummary)})`
+        : '';
   const leftBudget = Math.max(0, leftEndExclusive - col);
   const leftSegments = buildLeftSegments(rawName, keyArg, suffixText, leftBudget);
   for (const segment of leftSegments) {

package/src/renderer/tool-result-summary.ts

@@ -4,7 +4,7 @@
  * in conversation-rendering.ts) shows "wrote haiku.txt (532 B)" instead of a
  * raw `{"files_written":1,"bytes_written":532,...}` JSON blob. The full payload
  * stays reachable behind the existing collapse/expand toggle — this only
- * changes the collapsed preview line, never destroys data. (UX-B item 3.)
+ * changes the collapsed preview line, never destroys data. (item 3.)
  *
  * Returning `null` means "no honest summary for this shape" — the caller then
  * falls back to the previous raw-first-line preview, so an unrecognised tool or

package/src/renderer/turn-injection.ts

@@ -1,8 +1,8 @@
 /**
  * Per-turn knowledge injection record rendering.
  *
- * The SDK's passive per-turn retrieval engine (wo801, W5.1 —
- * packages/sdk/src/platform/agents/turn-knowledge-injection.ts) stores one
+ * The SDK's passive per-turn retrieval engine
+ * (packages/sdk/src/platform/agents/turn-knowledge-injection.ts) stores one
  * `TurnInjectionRecord` per turn on `AgentRecord.turnInjections` (a bounded
  * ring, default 20 entries) and appends the same record to the agent's
  * session transcript as `{type:'knowledge_injection', turn, ...record}`.
@@ -34,10 +34,11 @@ function fmtN(n: number): string {
 }
 
 /**
- * Annotate each injected id with its source (Stage B). Code-index hits get a
+ * Annotate each injected id with its source. Code-index hits get a
  * ` [code]` tag; memory records are left bare so a memory-only line renders
- * byte-identically to the pre-Stage-B output. `injectedSources` is parallel to
- * `injectedIds`; a missing/short entry defaults to memory (no tag).
+ * byte-identically to the output from before code-index hits existed.
+ * `injectedSources` is parallel to `injectedIds`; a missing/short entry
+ * defaults to memory (no tag).
  */
 function labelInjectedIds(entry: TurnInjectionEntry): string {
   const sources = entry.injectedSources ?? [];
@@ -107,7 +108,7 @@ export function buildTurnInjectionsText(agentId: string, entries: readonly TurnI
 
 /**
  * Render the MAIN interactive session's per-turn injection ring
- * (`Orchestrator.getTurnInjections()`, wo805), most-recent-turn first, with the
+ * (`Orchestrator.getTurnInjections()`), most-recent-turn first, with the
  * same honest empty state as the per-agent path. The main-session counterpart
  * to {@link buildTurnInjectionsText}: no agent id, main-session-appropriate
  * wording, but the identical per-entry rendering (`formatTurnInjectionEntry`).

package/src/renderer/ui-factory.ts

@@ -10,6 +10,8 @@ import { formatElapsed } from '../utils/format-elapsed.ts';
 import { abbreviateCount } from '../utils/format-number.ts';
 import { computeContextUsage } from '../core/context-usage.ts';
 import { permissionModeLabel, permissionModeTone } from '../core/permission-mode.ts';
+import { SLEEP_DISABLED_CHIP } from '../core/power-status.ts';
+import { renderQueuedMessageList, renderMemoryProvenanceChip, type MemoryProvenanceEntry } from './composer-fragments.ts';
 import { calcSessionCost, isModelPriced } from '../export/cost-utils.ts';
 import { buildFooterTip, isAgentActive } from './footer-tips.ts';
 import type { StreamMetrics } from '../core/stream-event-wiring.ts';
@@ -173,6 +175,16 @@ export class UIFactory {
     });
   }
 
+  /** The mid-turn queue as an editable list — see composer-fragments.ts. */
+  public static createQueuedMessageList(width: number, items: readonly { readonly id: string; readonly text: string }[]): Line[] {
+    return renderQueuedMessageList(width, items);
+  }
+
+  /** The optional "used N memories" provenance chip — see composer-fragments.ts. */
+  public static createMemoryProvenanceChip(width: number, count: number, entries: readonly MemoryProvenanceEntry[], expanded: boolean): Line[] {
+    return renderMemoryProvenanceChip(width, count, entries, expanded);
+  }
+
   public static createFooter(
     width: number,
     prompt: string,
@@ -202,6 +214,13 @@ export class UIFactory {
     // Session permission mode (config value). Rendered as a leading pill in the
     // posture block; undefined suppresses the pill (e.g. bare test callers).
     permissionMode?: string,
+    // The web surface's reachable URL, when that surface is enabled — a
+    // persistent low-priority context segment; undefined suppresses it.
+    webSurfaceUrl?: string,
+    // True while power.keepAwake holds — renders the always-visible
+    // "sleep disabled" chip in the posture block (the danger-mode idiom: a
+    // persistent, colored surface indicator, the safety mechanism itself).
+    powerKeepAwake?: boolean,
   ): Line[] {
     const lines: Line[] = [];
     const promptLines = prompt.split('\n');
@@ -265,7 +284,7 @@ export class UIFactory {
         }
       }
 
-      // UX-C focus visibility (item 1c): when the panel workspace owns focus
+      // focus visibility (item 1c): when the panel workspace owns focus
       // and the composer is empty, name the state and the way back — the
       // dimmed prompt alone (TEXT_COLOR/BG_COLOR above) told you nothing was
       // wrong, but not why keystrokes weren't landing here.
@@ -365,6 +384,10 @@ export class UIFactory {
             : t.chrome.warn;
       composerTokens.push({ text: ` risk:${composerPendingRisk} `, fg: riskColor, bold: true });
     }
+    // "sleep disabled" chip — always visible while keep-awake holds, in the
+    // danger-mode idiom (a persistent warn-tone indicator; the chip is the
+    // safety mechanism, so there is no timer and no AC-only variant).
+    if (powerKeepAwake) composerTokens.push({ text: ` ${SLEEP_DISABLED_CHIP} `, fg: t.chrome.warn, bold: true });
     if (composerStatus && composerStatus !== 'idle') composerTokens.push({ text: ` state:${composerStatus} `, fg: '244', dim: true });
     if (composerFlags && composerFlags.length > 0) composerTokens.push({ text: ` flags:${composerFlags.join(',')} `, fg: '244', dim: true });
     if (!compact && composerTokens.length > 0) {
@@ -388,6 +411,18 @@ export class UIFactory {
         if (px >= width) break;
       }
       lines.push(postureLine);
+    } else if (compact && powerKeepAwake) {
+      // The keep-awake chip is a safety indicator — it survives compact height
+      // even though the rest of the posture row (mode/ctx/risk/state/flags) is
+      // dropped at height < 30. Its own compact-surviving slot.
+      const chipLine = createBaseLine();
+      let cx = 2;
+      for (const ch of ` ${SLEEP_DISABLED_CHIP} `) {
+        if (cx >= width) break;
+        chipLine[cx] = { char: ch, fg: t.chrome.warn, bg: '', bold: true, dim: false, underline: false, italic: false, strikethrough: false };
+        cx += getDisplayWidth(ch);
+      }
+      lines.push(chipLine);
     }
     const isRecentlyCopied = Date.now() - lastCopyTime < 2000;
     // Token usage line + running ~$ cost estimate (derived from the usage
@@ -466,6 +501,8 @@ export class UIFactory {
       }
       // Cross-surface spine posture — plain words, no blame. Adopted mode only.
       if (sessionSpineStatus) ctxParts.push({ text: `spine:${sessionSpineStatus}`, priority: 1 });
+      // Web surface reachability — plain, persistent; dropped first under width pressure.
+      if (webSurfaceUrl) ctxParts.push({ text: `web:${webSurfaceUrl}`, priority: 2 });
       if (toolCount) ctxParts.push({ text: `${toolCount} tools`, priority: 2 });
       // Labeled "notify" (not "hitl") — /mode (aliased /hitl) governs UX
       // notification verbosity (quiet/balanced/operator), not tool

package/src/runtime/bootstrap-command-context.ts

@@ -56,6 +56,7 @@ import {
 
 export type CreateBootstrapCommandContextOptions = {
   configManager: ConfigManager;
+  pairingTokens?: import('@pellux/goodvibes-sdk/platform/pairing').PairingTokenManager;
   featureFlagManager?: import('@/runtime/index.ts').FeatureFlagManager;
   providerRegistry: ProviderRegistry;
   conversation: ConversationManager;
@@ -67,7 +68,7 @@ export type CreateBootstrapCommandContextOptions = {
   mcpRegistry: McpRegistry;
   voiceProviderRegistry?: VoiceProviderRegistry;
   voiceService?: VoiceService;
-  /** B31: direct-command consumers (`/search`, `/image`) of already-constructed RuntimeServices. */
+  /** Direct-command consumers (`/search`, `/image`) of already-constructed RuntimeServices. */
   webSearchService?: import('@pellux/goodvibes-sdk/platform/web-search').WebSearchService;
   mediaProviders?: import('@pellux/goodvibes-sdk/platform/media').MediaProviderRegistry;
   artifactStore?: import('@pellux/goodvibes-sdk/platform/artifacts').ArtifactStore;
@@ -113,6 +114,7 @@ export type CreateBootstrapCommandContextOptions = {
   adaptivePlanner?: AdaptivePlanner;
   sessionOrchestration?: ShellSessionOrchestrationService;
   operatorClient?: OperatorClient;
+  userPermissionRuleStore?: import('@pellux/goodvibes-sdk/platform/permissions').UserPermissionRuleStore;
   peerClient?: PeerClient;
   knowledgeApi?: KnowledgeApi;
   memorySpine?: MemorySpineClient;
@@ -143,6 +145,7 @@ export function createBootstrapCommandContext(
   const {
     providerRegistry,
     configManager,
+    pairingTokens,
     featureFlagManager,
     conversation,
     runtime,
@@ -206,6 +209,7 @@ export function createBootstrapCommandContext(
     adaptivePlanner,
     sessionOrchestration,
     operatorClient,
+    userPermissionRuleStore,
     peerClient,
     knowledgeApi,
     memorySpine,
@@ -286,13 +290,14 @@ export function createBootstrapCommandContext(
     projectPlanningProjectId,
     workPlanStore,
   }, shellServices);
-  const platform = createBootstrapCommandPlatformSection({ configManager, featureFlagManager, voiceProviderRegistry, voiceService, webSearchService, mediaProviders, artifactStore }, shellServices);
+  const platform = createBootstrapCommandPlatformSection({ configManager, pairingTokens, featureFlagManager, voiceProviderRegistry, voiceService, webSearchService, mediaProviders, artifactStore }, shellServices);
   const extensions = createBootstrapCommandExtensionsSection({
     toolRegistry,
     mcpRegistry,
   }, shellServices);
   const clients = createBootstrapCommandClientsSection({
     operatorClient,
+    userPermissionRuleStore,
     peerClient,
     providerApi,
     knowledgeApi,