@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/runtime/bootstrap-command-parts.ts

@@ -74,6 +74,7 @@ export interface BootstrapCommandActionOptions {
 
 export interface BootstrapCommandSectionOptions {
   readonly configManager: ConfigManager;
+  readonly pairingTokens?: import('@pellux/goodvibes-sdk/platform/pairing').PairingTokenManager;
   readonly featureFlagManager?: FeatureFlagManager;
   readonly providerRegistry: ProviderRegistry;
   readonly conversation: ConversationManager;
@@ -86,7 +87,7 @@ export interface BootstrapCommandSectionOptions {
   readonly mcpRegistry: McpRegistry;
   readonly voiceProviderRegistry?: VoiceProviderRegistry;
   readonly voiceService?: VoiceService;
-  /** B31: direct-command consumers (`/search`, `/image`) of already-constructed RuntimeServices. */
+  /** Direct-command consumers (`/search`, `/image`) of already-constructed RuntimeServices. */
   readonly webSearchService?: import('@pellux/goodvibes-sdk/platform/web-search').WebSearchService;
   readonly mediaProviders?: import('@pellux/goodvibes-sdk/platform/media').MediaProviderRegistry;
   readonly artifactStore?: import('@pellux/goodvibes-sdk/platform/artifacts').ArtifactStore;
@@ -139,6 +140,7 @@ export interface BootstrapCommandSectionOptions {
   readonly remoteRuntime?: RemoteCommandService;
   readonly planRuntime?: PlanRuntimeService;
   readonly operatorClient?: OperatorClient;
+  readonly userPermissionRuleStore?: import('@pellux/goodvibes-sdk/platform/permissions').UserPermissionRuleStore;
   readonly peerClient?: PeerClient;
   readonly providerApi?: ProviderApi;
   readonly knowledgeApi?: KnowledgeApi;
@@ -203,7 +205,7 @@ export function createBootstrapCommandActions(
   } = options;
 
   const showPanel = (panelId: string, pane?: 'top' | 'bottom', target?: PanelDeepLinkTarget) => {
-    // W6.1 (the purge): a MIGRATE-TO-MODAL id resolves to a modal, not a panel.
+    // (the purge): a MIGRATE-TO-MODAL id resolves to a modal, not a panel.
     // panelManager.open() fires the injected openModal callback and returns a
     // no-op sentinel — so skip panelManager.show() (which would reveal an empty
     // panel workspace behind the modal) when this id redirects. Keeps every
@@ -307,7 +309,7 @@ export function createBootstrapCommandActions(
     openMemoryPanel: () => {
       showPanel('memory');
     },
-    // W6.1: remote/subscription migrated to config-modal surfaces. open() hits
+    // remote/subscription migrated to config-modal surfaces. open() hits
     // the modal redirect and invokes the openModal callback — do NOT go through
     // showPanel here, which would additionally reveal + focus an (empty) panel
     // workspace behind the fullscreen modal.
@@ -395,13 +397,14 @@ export function createBootstrapCommandWorkspaceSection(
 export function createBootstrapCommandPlatformSection(
   options: Pick<
     BootstrapCommandSectionOptions,
-    'configManager' | 'featureFlagManager' | 'voiceProviderRegistry' | 'voiceService' | 'webSearchService' | 'mediaProviders' | 'artifactStore'
+    'configManager' | 'pairingTokens' | 'featureFlagManager' | 'voiceProviderRegistry' | 'voiceService' | 'webSearchService' | 'mediaProviders' | 'artifactStore'
   >,
   shellServices: BootstrapCommandShellServices,
 ): BootstrapCommandPlatformSection {
   return {
     config: getConfigSnapshot(options.configManager),
     configManager: options.configManager,
+    ...(options.pairingTokens ? { pairingTokens: options.pairingTokens } : {}),
     featureFlagManager: options.featureFlagManager,
     voiceProviderRegistry: options.voiceProviderRegistry,
     voiceService: options.voiceService,
@@ -435,11 +438,12 @@ export function createBootstrapCommandExtensionsSection(
 export function createBootstrapCommandClientsSection(
   options: Pick<
     BootstrapCommandSectionOptions,
-    'operatorClient' | 'peerClient' | 'providerApi' | 'knowledgeApi' | 'memorySpine' | 'hookApi' | 'mcpApi' | 'opsApi' | 'directTransport'
+    'operatorClient' | 'userPermissionRuleStore' | 'peerClient' | 'providerApi' | 'knowledgeApi' | 'memorySpine' | 'hookApi' | 'mcpApi' | 'opsApi' | 'directTransport'
   >,
 ): BootstrapCommandClientSection {
   return {
     operator: options.operatorClient,
+    userPermissionRuleStore: options.userPermissionRuleStore,
     peer: options.peerClient,
     providerApi: options.providerApi,
     knowledgeApi: options.knowledgeApi,

package/src/runtime/bootstrap-core.ts

@@ -6,6 +6,7 @@ import { ConfigManager, getConfiguredSystemPrompt } from '../config/index.ts';
 import { getProviderIdFromModel } from '../config/provider-model.ts';
 import { ToolRegistry } from '@pellux/goodvibes-sdk/platform/tools';
 import { registerAllTools } from '@pellux/goodvibes-sdk/platform/tools';
+import { createSandboxContainmentNotice } from './daemon-attach-notices.ts';
 import { PermissionManager, createPermissionConfigReader } from '@pellux/goodvibes-sdk/platform/permissions';
 import { Notifier } from '@pellux/goodvibes-sdk/platform/integrations';
 import { Compositor } from '../renderer/compositor.ts';
@@ -17,15 +18,16 @@ import type { ControlPlaneRecentEvent } from '@pellux/goodvibes-sdk/platform/con
 import type { BootstrapOptions } from './context.ts';
 import { createRuntimeStore, createDomainDispatch, type RuntimeStore } from './store/index.ts';
 import {
-  type MutableRuntimeState, type SessionEvent, createFeatureFlagManager, RuntimeEventBus, ForensicsCollector,
+  type MutableRuntimeState, type SessionEvent, bindFeatureSettingsBridge, createFeatureFlagManager, deriveFeatureStates, RuntimeEventBus, ForensicsCollector,
   ForensicsRegistry, generateUserSessionId, loadBootstrapSystemPrompt, syncConfiguredServices,
   registerBootstrapHookBridge, registerBootstrapRuntimeEvents,
 } from '@/runtime/index.ts';
 import { readExecEnvScrubAllowlist } from '../input/exec-env-scrub-config.ts';
 import { createSandboxExecAsk, sandboxExecAskDepsFromRuntime } from '../permissions/sandbox-exec-gate.ts';
 import { createRuntimeServices, type RuntimeServices } from './services.ts';
+import { createHostPowerSeam } from '@pellux/goodvibes-sdk/platform/power';
 import { runBootMemoryFold } from './memory-fold.ts';
-import { setPricingSource } from '../export/cost-utils.ts';
+import { wireCostPricing } from '../export/cost-utils.ts';
 import { createUiRuntimeServices, type UiRuntimeServices } from './ui-services.ts';
 import { join } from 'node:path';
 import { installWrfcAgentToolGuard } from '../tools/wrfc-agent-guard.ts';
@@ -33,12 +35,10 @@ import { createWrfcPersistence, type WrfcPersistence } from './wrfc-persistence.
 import type { SystemMessagePriority } from '../core/system-message-router.ts';
 import { SessionSpineClient, SessionUnionCache, TUI_SPINE_PARTICIPANT } from '@pellux/goodvibes-sdk/platform/runtime/session-spine';
 import { SessionInboundInputPoller, createBootstrapInboundInputPoller } from './session-inbound-inputs.ts';
-import { detectPriorWorkspaceState, trustGatedAsk } from './trust/workspace-trust.ts';
+import { trustGatedAsk, type WorkspaceTrustLevel } from './trust/workspace-trust.ts';
 import { syncNotifierQueueIntegrations } from './bootstrap-notifier-sync.ts';
 
-// ---------------------------------------------------------------------------
-// Pre-router buffer
-// ---------------------------------------------------------------------------
+// --- Pre-router buffer ---
 
 const PRE_ROUTER_BUFFER_MAX = 100;
 
@@ -105,6 +105,7 @@ export interface BootstrapCoreState {
   readonly runtimeUnsubs: Array<() => void>;
   readonly agentStatusIntervalRef: { value: ReturnType<typeof setInterval> | null };
   readonly permissionPromptRef: { requestPermission: PermissionRequestHandler };
+  readonly trustPromptRef: { requestTrustDecision: () => Promise<WorkspaceTrustLevel> }; // trust-at-consequence-time bridge, patched with the real modal-driving impl once the UI layer exists
   readonly systemMessageRouterRef: { value: SystemMessageRouter | null };
   readonly conversationFollowUpRef: { value: ((item: ConversationFollowUpItem) => void) | null };
   /**
@@ -131,9 +132,7 @@ export interface BootstrapCoreState {
 
 export type CompanionMessagePayload = Extract<SessionEvent, { type: 'COMPANION_MESSAGE_RECEIVED' }>;
 
-// ---------------------------------------------------------------------------
-// Operator narration of inbound channel events
-// ---------------------------------------------------------------------------
+// --- Operator narration of inbound channel events ---
 
 /** Narrate an inbound channel event (GitHub, Slack, ntfy, etc.) that triggered an
  * agent turn, via the SystemMessageRouter — null for internal/companion sources. */
@@ -231,10 +230,12 @@ export async function initializeBootstrapCore(
   const homeDirectory = options.homeDirectory;
   const configManager = options.configManager;
 
+  // Gate states derive from the domain settings keys; the bridge keeps live
+  // config writes flowing (honest pending-restart markers for startup-gated
+  // features). Mirrors the SDK composition root's owned-manager wiring.
   const featureFlags = createFeatureFlagManager();
-  featureFlags.loadFromConfig({
-    flags: (configManager.getCategory('featureFlags') as Record<string, import('@/runtime/index.ts').FlagState>) ?? {},
-  });
+  featureFlags.loadFromConfig({ flags: deriveFeatureStates(configManager) });
+  bindFeatureSettingsBridge(configManager, featureFlags);
 
   const userSessionId = `user-${generateUserSessionId()}`;
   const runtimeBus = new RuntimeEventBus();
@@ -247,20 +248,19 @@ export async function initializeBootstrapCore(
     runtimeBus,
     runtimeStore: store,
     getConversationTitle: () => getConversationTitle(),
-    workingDir,
-    homeDirectory,
-    // Sampled BEFORE any service writes to <cwd>/.goodvibes so a new workspace isn't misread as used.
-    workspaceHadPriorState: detectPriorWorkspaceState(workingDir),
+    workingDir, homeDirectory,
+    // Embedded topology: the in-process runtime IS the daemon and holds its own OS
+    // inhibitor, so opt into the real host seam (fork default is non-spawning). See services.ts.
+    powerSeam: createHostPowerSeam(),
   });
-  await services.workspaceTrustManager.load(); // settle trust (+ grandfathering) before any tool runs
+  await services.workspaceTrustManager.load(); // settle any already-persisted trust decision before any tool runs
   const providerRegistry = services.providerRegistry;
   providerRegistry.initModelLimits();
   services.benchmarkStore.initBenchmarks();
   providerRegistry.initCatalog();
-  // Wire cost-utils to the live catalog so cost displays distinguish real
-  // pricing from unpriced (WO-315) instead of silently reading zero for any
-  // model the small static fallback table doesn't cover.
-  setPricingSource(() => providerRegistry.getRawCatalogModels());
+  // Wire cost-utils to the live catalog AND the ONE pricing resolver so every
+  // cost surface distinguishes real pricing from unpriced and names its source ("your price" vs "catalog price, as of <date>") — see cost-utils.
+  wireCostPricing(providerRegistry);
   services.keybindingsManager.loadFromDisk();
   domainDispatch.syncControlPlaneState({
     enabled: Boolean(configManager.get('controlPlane.enabled')),
@@ -351,6 +351,8 @@ export async function initializeBootstrapCore(
   const toolRegistry = new ToolRegistry();
   const { fileCache, projectIndex } = registerAllTools(toolRegistry, {
     surfaceRoot: 'tui',
+    localhostFetchApproval: services.localhostFetchApproval, // loopback-fetch ask, built once in the services composition
+    execPromptAnswerHandler: services.execPromptAnswerHandler, // terminal prompt-answer path, built once in the services composition
     fileUndoManager: services.fileUndoManager,
     modeManager: services.modeManager,
     processManager: services.processManager,
@@ -373,21 +375,19 @@ export async function initializeBootstrapCore(
     serviceRegistry: services.serviceRegistry,
     overflowHandler: services.overflowHandler,
     changeTracker: services.sessionChangeTracker,
-    // Master switch stays on (SDK default); this only widens the allowlist of
-    // variable NAMES kept even though they look credential-bearing. See
-    // exec-env-scrub-config.ts (permissions.execEnvScrubAllowlist).
+    // Widens the allowlist of credential-looking variable NAMES kept (master switch stays on). See exec-env-scrub-config.ts.
     credentialEnvScrub: { allowlist: readExecEnvScrubAllowlist(configManager) },
-    // Registers the context_accounting tool on this (the real, interactive)
-    // registry against OUR holder rather than a fresh internal one, so the
-    // Orchestrator-backed source bound at bootstrap.ts is what the tool
-    // actually reads from. See runtime/context-accounting-source.ts.
+    // Register context_accounting against OUR holder (the Orchestrator-backed source bound at bootstrap.ts). See runtime/context-accounting-source.ts.
     contextAccountingHolder: services.contextAccountingHolder,
+    // First contained (sandboxed) command run announces "commands now run contained" once — recorded and surfaced now.
+    onSandboxedRun: createSandboxContainmentNotice({ configManager, notify: (text) => conversation.log(`[Sandbox] ${text}`, { fg: '135' }) }),
   });
-  // Note: installWrfcAgentToolGuard is called after routeOrBuffer is defined
-  // (further below) so the onTrace callback can route guard decisions through
-  // the pre-router buffer.
+  // Note: installWrfcAgentToolGuard is called after routeOrBuffer is defined (further below) so the onTrace callback routes guard decisions through the pre-router buffer.
   services.agentOrchestrator.setDependencies({
     surfaceRoot: 'tui',
+    // setDependencies is a wholesale replace: re-install the prompt-answer handler and the loopback-fetch ask here or this rewire silently drops them.
+    execPromptAnswerHandler: services.execPromptAnswerHandler,
+    localhostFetchApproval: services.localhostFetchApproval,
     fileCache,
     projectIndex,
     workingDirectory: services.workingDirectory,
@@ -424,7 +424,7 @@ export async function initializeBootstrapCore(
   await runBootMemoryFold(memoryStore, services.memoryEmbeddingRegistry, workingDir, logger);
 
   const renderRequestRef = { value: (): void => {} };
-  // R1: Coalescing render scheduler — collapses N requestRender() calls into 1 and
+  // Coalescing render scheduler — collapses N requestRender() calls into 1 and
   // enforces a 16ms minimum interval to cap repaints at ~60fps. renderScheduled stays
   // set for the ENTIRE window (until run() executes), so requestRender() calls arriving
   // on later event-loop ticks within the same 16ms window coalesce into the one
@@ -467,6 +467,9 @@ export async function initializeBootstrapCore(
   const permissionPromptRef = {
     requestPermission: (async () => ({ approved: false, remember: false })) as PermissionRequestHandler,
   };
+  // Trust-at-consequence-time: raised by trustGatedAsk on the first non-read
+  // request in an undecided workspace; overridden once the UI layer exists — same ref-patching pattern as permissionPromptRef above.
+  const trustPromptRef = { requestTrustDecision: (async () => 'restricted') as () => Promise<WorkspaceTrustLevel> };
   approvalBroker.start().catch((err) => logger.warn('approval broker start failed at bootstrap', { err }));
   sharedSessionBroker.start().catch((err) => logger.warn('shared session broker start failed at bootstrap', { err }));
   const runtimeSessionIdRef = { value: userSessionId };
@@ -663,7 +666,7 @@ export async function initializeBootstrapCore(
 
   providerRegistry.startWatching(runtimeBus);
 
-  // W2.3: attach the SAME WebhookNotifier instance that `/notify add|remove|clear`
+  // attach the SAME WebhookNotifier instance that `/notify add|remove|clear`
   // (notify-runtime.ts) keeps live via ctx.services.webhookNotifier, rather than
   // constructing a second, boot-time-only instance here. Before this fix, a
   // webhook URL added mid-session reached long-task notifications (which read
@@ -696,8 +699,7 @@ export async function initializeBootstrapCore(
   await syncConfiguredServices(domainDispatch.syncIntegration, services.serviceRegistry);
 
   const permissionManager = new PermissionManager(
-    // Composed ask layer: the workspace trust gate (outer) wraps the sandbox-aware
-    // exec gate (inner); see sandbox-exec-gate.ts. The catastrophic block is untouched.
+    // Composed ask layer: the workspace trust gate (outer) wraps the sandbox-aware exec gate (inner); see sandbox-exec-gate.ts. The catastrophic block is untouched.
     trustGatedAsk(
       services.workspaceTrustManager,
       createSandboxExecAsk(
@@ -708,11 +710,13 @@ export async function initializeBootstrapCore(
           localPrompt: permissionPromptRef.requestPermission,
         }),
       ),
+      () => trustPromptRef.requestTrustDecision(), // indirection through the ref, not bound early — main.ts patches the real impl in later
     ),
     createPermissionConfigReader(configManager),
     policyRuntimeState,
     services.hookDispatcher,
     featureFlags,
+    services.userPermissionRuleStore, // durable remembered approvals (mirrors the SDK composition); permissions.rules.* lists/deletes them
   );
   await hookWorkbench.loadAndApplyManagedHooks();
 
@@ -757,11 +761,7 @@ export async function initializeBootstrapCore(
   }, 'bootstrap.session');
 
   runtimeUnsubs.push(
-    ...registerBootstrapHookBridge({
-      runtimeBus,
-      hookDispatcher,
-      runtime,
-    }),
+    ...registerBootstrapHookBridge({ runtimeBus, hookDispatcher, runtime }),
   );
 
   return {
@@ -783,7 +783,7 @@ export async function initializeBootstrapCore(
     bootstrapUnsubs,
     runtimeUnsubs,
     agentStatusIntervalRef,
-    permissionPromptRef,
+    permissionPromptRef, trustPromptRef,
     systemMessageRouterRef,
     conversationFollowUpRef,
     orchestratorHandleUserInputRef,

package/src/runtime/bootstrap-hook-bridge.ts

@@ -32,7 +32,7 @@ export interface ResumeSessionOptions {
   readonly sessionManager: SessionManager;
   readonly panelManager: PanelManager;
   readonly configManager: Pick<ConfigManager, 'get' | 'getCategory'>;
-  readonly providerRegistry: Pick<ProviderRegistry, 'get' | 'getCurrentModel' | 'getForModel' | 'require'>;
+  readonly providerRegistry: Pick<ProviderRegistry, 'get' | 'getCurrentModel' | 'getForModel' | 'require' | 'resolveModelPricing'>;
   readonly homeDirectory: string;
   /** See CommandSessionServices.hydrateSessionUsage (command-registry.ts). */
   readonly hydrateSessionUsage?: () => void;

package/src/runtime/bootstrap-shell.ts

@@ -93,7 +93,7 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     completeModelSelectionSideEffect,
   } = options;
 
-  // W0.9: after any resume seam replays historical messages into `conversation`,
+  // after any resume seam replays historical messages into `conversation`,
   // the freshly-constructed `orchestrator` still has its zeroed default usage
   // (SDK gap — Orchestrator.usage is never persisted/reseeded). Recompute it
   // from the replayed history so the footer doesn't show Input: 0 post-resume.
@@ -140,11 +140,11 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     runtimeBus,
   });
 
-  // WO-139: initial cost-budget alert threshold (USD; 0/unset = disabled).
+  // initial cost-budget alert threshold (USD; 0/unset = disabled).
   // Once the session starts, the real control surface is the CostTrackerPanel
   // itself — the in-panel 'b' key and /cost budget <usd> both call
   // CostTrackerPanel.setBudgetThreshold() directly on the live panel instance,
-  // which (W2.3) now writes through to the behavior.budgetAlertUsd config key
+  // which now writes through to the behavior.budgetAlertUsd config key
   // so the background budget-breach notifier reads the same value. The env
   // var remains a first-run convenience only: it seeds the config key when
   // that key has never been set, so it doesn't silently override a value the
@@ -206,6 +206,12 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     runtimeStore,
     openPanel: (panelId: string) => { services.panelManager.open(panelId); },
     knowledgeApi,
+    // Fleet acts (pick / conflict / discard) surface receipts through the command
+    // context's print and reuse its one-key jump affordance — both late-bound
+    // (the command context is assigned to commandContextRef after bootstrap, and
+    // main.ts patches armFixSessionAttach onto it).
+    fleetActsNotify: (message: string) => { commandContextRef?.print?.(message); requestRender(); },
+    armFixSessionAttach: (sessionId: string) => { commandContextRef?.armFixSessionAttach?.(sessionId); },
   });
   services.panelManager.prewarmRegistered();
 
@@ -220,7 +226,7 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     {
       // Suppress stale WRFC replay re-notifications for chains that can no
       // longer act — gone (killed/removed → getChain null) or terminal
-      // (passed/failed). (UX-B item 1c.)
+      // (passed/failed). (item 1c.)
       isChainTerminal: (chainId) => {
         const chain = services.wrfcController.getChain(chainId);
         return chain === null || chain.state === 'passed' || chain.state === 'failed';
@@ -239,6 +245,7 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
 
   const commandContext: CommandContext = createBootstrapCommandContext({
     configManager,
+    pairingTokens: services.pairingTokens,
     providerRegistry: services.providerRegistry,
     conversation,
     runtime,
@@ -307,6 +314,7 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     adaptivePlanner: services.adaptivePlanner,
     sessionOrchestration: services.sessionOrchestration,
     operatorClient: directTransport.operator,
+    userPermissionRuleStore: services.userPermissionRuleStore,
     peerClient: directTransport.peer,
     knowledgeApi,
     // /recall's browse/link/queue/export/import subcommands and the per-turn
@@ -345,7 +353,7 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     lastGitInfoRef.value = info;
     requestRender();
   }).catch(() => { /* non-fatal */ });
-  // W1.6 FIX 2: the header's git segment otherwise only refreshes on
+  // FIX 2: the header's git segment otherwise only refreshes on
   // TURN_COMPLETED/TOOL_SUCCEEDED/TOOL_FAILED (see turn-event-wiring.ts's
   // refreshGit()) — if the user runs `git init` externally and never submits
   // another turn, the header stays stuck on the startup-time fallback

package/src/runtime/bootstrap.ts

@@ -15,6 +15,7 @@ import { AcpManager } from '@pellux/goodvibes-sdk/platform/acp';
 import { getTierPromptSupplement, getTierForContextWindow } from '@pellux/goodvibes-sdk/platform/providers';
 import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { PermissionRequestHandler } from '@pellux/goodvibes-sdk/platform/permissions';
+import type { WorkspaceTrustLevel } from './trust/workspace-trust.ts';
 import type { CommandContext } from '../input/command-registry.ts';
 import type { InputHistory } from '../input/input-history.ts';
 import type { GitStatusProvider, GitHeaderInfo } from '../renderer/git-status.ts';
@@ -40,9 +41,9 @@ import { createBootstrapShell } from './bootstrap-shell.ts';
 import { announceResumeState } from './resume-notice.ts';
 import { announceInstallSelfCheck } from './install-self-check-startup.ts';
 import { buildSharedOrchestratorCoreServices, refreshMemoryRecallSnapshot } from './orchestrator-core-services.ts';
+import { consumeDaemonAttachNotices, consumeExternalDaemonAttachNotices } from './daemon-attach-notices.ts';
 import { createContextAccountingSource } from './context-accounting-source.ts';
-import { DaemonServer, HttpListener } from '@pellux/goodvibes-sdk/platform/daemon';
-import { createSafeHostServeFactory } from '../daemon/safe-serve.ts';
+import { createEmbeddedServiceFactories } from './embedded-service-factories.ts';
 import { buildRelayExternalServiceMethods } from './relay-reachability-bridge.ts';
 import { startMcpConfigAutoReload } from '../mcp/runtime-reload.ts';
 
@@ -95,6 +96,8 @@ export type BootstrapContext = RuntimeContext & {
   setRenderRequest: (fn: () => void) => void;
   /** Shell-owned permission prompt bridge that main.ts patches after UI setup. */
   permissionPromptRef: { requestPermission: PermissionRequestHandler };
+  /** Shell-owned trust-decision bridge that main.ts patches after UI setup (trust asks at consequence time). */
+  trustPromptRef: { requestTrustDecision: () => Promise<WorkspaceTrustLevel> };
   /** Load the most recently saved conversation from disk. */
   loadLastConversation: () => { messages: Array<Record<string, unknown>> } | null;
   /** Write the last-session pointer file (used after session resume). */
@@ -172,7 +175,7 @@ export async function bootstrapRuntime(
     bootstrapUnsubs,
     runtimeUnsubs,
     agentStatusIntervalRef,
-    permissionPromptRef,
+    permissionPromptRef, trustPromptRef,
     systemMessageRouterRef,
     conversationFollowUpRef,
     orchestratorHandleUserInputRef,
@@ -192,9 +195,8 @@ export async function bootstrapRuntime(
     pluginManager,
   } = services;
 
-  // A liveness flip is only PAINTED once something calls requestRender();
-  // without this, the footer's spine segment sat correct-but-undrawn until
-  // incidental activity redrew it (minutes, during an idle stretch).
+  // A liveness flip is only PAINTED once something calls requestRender(); without
+  // this, the footer's spine segment sat correct-but-undrawn until incidental activity redrew it (minutes, during an idle stretch).
   sessionUnionCache.setOnTransition(() => requestRender());
 
   // ── Phase 6: Orchestrator + AcpManager ───────────────────────────────────
@@ -237,7 +239,7 @@ export async function bootstrapRuntime(
       logger.debug('companion handleUserInput safety catch', { error: String(err) });
     });
   };
-  // Shared payload (single source of truth, includes wo805's memoryRegistry —
+  // Shared payload (single source of truth, includes the memoryRegistry —
   // see orchestrator-core-services.ts) plus this site's cacheHitTracker.
   orchestrator.setCoreServices({
     ...buildSharedOrchestratorCoreServices({ services, configManager, providerRegistry }),
@@ -254,8 +256,7 @@ export async function bootstrapRuntime(
 
   const acpManager = new AcpManager({
     requestPermission: (request) => permissionPromptRef.requestPermission(request),
-    runtimeBus,
-    hookDispatcher: services.hookDispatcher,
+    runtimeBus, hookDispatcher: services.hookDispatcher,
   });
   const acpTaskAdapter = new AcpTaskAdapter(store);
   const ACP_TASK_SYNC_INTERVAL_MS = 1_000;
@@ -265,7 +266,9 @@ export async function bootstrapRuntime(
   bootstrapUnsubs.push(() => clearInterval(acpTaskSyncInterval));
   orchestrator.registerDelegateTool(acpManager);
   const opsTaskManager = createTaskManager(store, runtimeBus, userSessionId);
-  const opsControlPlane = services.featureFlags.isEnabled('operator-control-plane')
+  // Operator interventions ride the control-plane gateway capability
+  // (controlPlane.gateway, on by default; the old never-registered gate id shipped this dead).
+  const opsControlPlane = services.featureFlags.isEnabled('control-plane-gateway')
     ? new OpsControlPlane(opsTaskManager, runtimeBus, store, userSessionId)
     : undefined;
 
@@ -300,7 +303,7 @@ export async function bootstrapRuntime(
   wrfcPersistence.rehydrate();
   const commandRegistry = shell.commandRegistry;
   const commandContext = shell.commandContext;
-  // Boot resume notice (UX-D item 1): after rehydrate() so chain history is ready, before
+  // Boot resume notice (item 1): after rehydrate() so chain history is ready, before
   // the operator can type anything. Fire-and-forget, same as main.ts's non-blocking
   // `void workspaceCheckpointManager.init().catch(() => {})` — local file I/O only,
   // resolves well before a human can react to the first rendered frame.
@@ -318,7 +321,7 @@ export async function bootstrapRuntime(
   });
   announceInstallSelfCheck(systemMessageRouter);
   const { gitStatusProvider, inputHistory, lastGitInfoRef } = shell;
-  // W1.6 FIX 2: dispose the header's live-repo-state poll (git-status.ts
+  // FIX 2: dispose the header's live-repo-state poll (git-status.ts
   // startPolling) on shutdown, same pattern as acpTaskSyncInterval above.
   bootstrapUnsubs.push(() => gitStatusProvider.stopPolling());
   const pluginCommandRegistry = {
@@ -475,21 +478,9 @@ export async function bootstrapRuntime(
     ]);
   };
 
-  const createExternalServiceFactories = (sharedDaemonToken: string): ExternalServiceFactories => ({
-    sharedDaemonToken,
-    createDaemonServer: (bus, userAuth, runtimeServices) => new DaemonServer({
-      runtimeBus: bus,
-      userAuth,
-      runtimeServices,
-      serveFactory: createSafeHostServeFactory('Embedded daemon'),
-    }),
-    createHttpListener: (dispatcher, userAuth, configManager) => new HttpListener({
-      hookDispatcher: dispatcher,
-      userAuth,
-      configManager,
-      serveFactory: createSafeHostServeFactory('Embedded HTTP listener'),
-    }),
-  });
+  // Embedded DaemonServer/HttpListener factories (incl. the facade auto-update
+  // suppression) — see embedded-service-factories.ts.
+  const createExternalServiceFactories = createEmbeddedServiceFactories;
 
   let externalServices: ExternalServicesHandle = {
     daemonServer: null, httpListener: null,
@@ -505,6 +496,9 @@ export async function bootstrapRuntime(
   platformExternalServices.externalServices = {
     ...buildRelayExternalServiceMethods(() => externalServices.daemonServer),
     inspect: inspectExternalServices,
+    // Undelivered daemon receipts (update/crash/migration) for the attach-time
+    // consuming read; empty when no daemon runs. Marked delivered once served.
+    collectDaemonReceipts: () => (externalServices.daemonServer as { collectDaemonReceipts?: () => readonly { id: string; text: string; at: number }[] } | null)?.collectDaemonReceipts?.() ?? [],
     restart: async () => {
       if (externalServicesPromise) {
         try {
@@ -527,10 +521,19 @@ export async function bootstrapRuntime(
       externalServices = await externalServicesPromise;
       controlPlaneRecentEventsRef.value = (limit) => externalServices.listRecentControlPlaneEvents(limit);
       syncSessionSpineToHostStatus(externalServices.daemonStatus, companionTokenRecord.token);
+      await renderDaemonAttachNotices(companionTokenRecord.token);
       requestRender();
       return inspectExternalServices();
     },
   };
+  // The attach-time consuming read, exactly once as notices. An adopted EXTERNAL daemon has no in-process handle (daemonServer null), so read its own /status?receipts=consume over HTTP; the embedded daemon keeps the in-process fold.
+  const renderDaemonAttachNotices = async (daemonToken: string): Promise<void> => {
+    const daemonStatus = externalServices.daemonStatus;
+    const notices = daemonStatus.mode === 'external' && daemonStatus.baseUrl
+      ? await consumeExternalDaemonAttachNotices({ baseUrl: daemonStatus.baseUrl, authToken: daemonToken })
+      : consumeDaemonAttachNotices({ configManager, collectReceipts: () => platformExternalServices.externalServices.collectDaemonReceipts() });
+    for (const notice of notices) systemMessageRouter.high(`[Daemon] ${notice}`);
+  };
   deferredStartup.schedule({
     label: 'plugins',
     run: async () => {
@@ -591,6 +594,7 @@ export async function bootstrapRuntime(
       externalServices = await externalServicesPromise;
       controlPlaneRecentEventsRef.value = (limit) => externalServices.listRecentControlPlaneEvents(limit);
       syncSessionSpineToHostStatus(externalServices.daemonStatus, companionTokenRecord.token);
+      await renderDaemonAttachNotices(companionTokenRecord.token);
       requestRender();
     },
     onError: (error) => {
@@ -713,7 +717,7 @@ export async function bootstrapRuntime(
     agentStatusIntervalRef,
     orchestratorRefs,
     setRenderRequest,
-    permissionPromptRef,
+    permissionPromptRef, trustPromptRef,
     loadLastConversation: () => loadLastConversation({
       workingDirectory: services.workingDirectory,
       homeDirectory: services.homeDirectory,
@@ -774,10 +778,8 @@ export async function bootstrapRuntime(
     },
   };
 
-  // ── Phase 12b: Operator Control Plane wiring (feature-gated) ──────────────
-  // Wire the OpsControlPlane into CommandContext when the feature flag is enabled.
-  // The store and task manager are created unconditionally so they reflect the
-  // real runtime state (tasks registered before the flag check are visible).
+  // ── Phase 12b: Operator Control Plane wiring (capability-gated); store and
+  // task manager exist unconditionally so pre-gate tasks stay visible. ───────
   ctx.commandContext.ops.acpManager = acpManager;
   if (opsControlPlane) {
     ctx.commandContext.openOpsPanel = () => {

package/src/runtime/channel-composition.ts

@@ -0,0 +1,46 @@
+/**
+ * channel-composition — route bindings, surface registry, and channel plugin
+ * registry for the TUI composition root (split out of services.ts for the
+ * line cap).
+ *
+ * RECORDED DIVERGENCE from the SDK composition root: SurfaceRegistry and
+ * ChannelPluginRegistry are constructed WITHOUT the gate manager. The SDK's
+ * surface gate map only names six surfaces (web/slack/discord/ntfy/webhook/
+ * homeassistant) and reads every other adapter (telegram, whatsapp, signal,
+ * imessage, msteams, ...) as OFF whenever a manager is present — no settings
+ * key could re-enable them. Until the gate map covers every adapter, the
+ * honest governing switch here stays the surfaces.<id>.enabled config each
+ * adapter already reads, exactly as the feature surface's own
+ * constant-binding rule states. RouteBindingManager keeps its manager — its
+ * route-binding gate is a real registry feature.
+ */
+
+import { AutomationRouteStore } from '@pellux/goodvibes-sdk/platform/automation';
+import { ChannelPluginRegistry, RouteBindingManager, SurfaceRegistry } from '@pellux/goodvibes-sdk/platform/channels';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { FeatureFlagManager, RuntimeEventBus } from '@/runtime/index.ts';
+import type { RuntimeStore } from './store/index.ts';
+
+export interface ChannelComposition {
+  readonly routeBindings: RouteBindingManager;
+  readonly surfaceRegistry: SurfaceRegistry;
+  readonly channelPlugins: ChannelPluginRegistry;
+}
+
+export function createChannelComposition(options: {
+  readonly configManager: ConfigManager;
+  readonly runtimeStore: RuntimeStore;
+  readonly runtimeBus: RuntimeEventBus;
+  readonly featureFlags: FeatureFlagManager;
+}): ChannelComposition {
+  const routeBindings = new RouteBindingManager({
+    store: new AutomationRouteStore({ configManager: options.configManager }),
+    runtimeStore: options.runtimeStore,
+    runtimeBus: options.runtimeBus,
+    featureFlags: options.featureFlags,
+  });
+  const surfaceRegistry = new SurfaceRegistry(options.configManager, options.runtimeStore);
+  const channelPlugins = new ChannelPluginRegistry();
+  surfaceRegistry.attachPluginRegistry(channelPlugins);
+  return { routeBindings, surfaceRegistry, channelPlugins };
+}

package/src/runtime/code-index-services.ts

@@ -2,8 +2,7 @@
 // code-index-services.ts — repo source-tree code index (TUI wiring)
 //
 // Constructs the TUI's repo source-tree code index: CodeIndexStore
-// (@pellux/goodvibes-sdk/platform/state, landed on SDK main as wo802/W5.3
-// Stage A). Extracted into its own module rather than built inline in
+// (@pellux/goodvibes-sdk/platform/state). Extracted into its own module rather than built inline in
 // services.ts: services.ts sits at the architecture check's 800-line cap
 // (scripts/check-architecture.ts), so any new service gets its own
 // construction module and a single wiring call there (mirrors
@@ -28,7 +27,7 @@
 // (interactive main.ts, the daemon, and every test fixture) shares one
 // honest, user-visible on/off switch rather than needing to thread a new
 // boolean through every call site. With it off (the default), `/codebase
-// build` is the explicit, visible trigger — exactly the shape wo804's brief
+// build` is the explicit, visible trigger — exactly the shape this design
 // asks for.
 //
 // Shares memoryEmbeddingRegistry with MemoryStore (constructed in
@@ -68,7 +67,7 @@ export interface CodeIndexServicesDeps {
 }
 
 /**
- * Whether Stage B code auto-injection / tool-site reindex may run: the SAME
+ * Whether code auto-injection / tool-site reindex may run: the SAME
  * storage.codeIndexEnabled switch that gates auto-build. Read live so a runtime
  * /config toggle takes effect without restart. (The separate, default-off
  * `agent-passive-code-injection` feature flag gates injection additionally; this