@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/runtime/services.ts

@@ -2,11 +2,15 @@ import { join } from 'node:path';
 import { FocusTracker } from '../core/focus-tracker.ts';
 import { ConfigManager, ServiceRegistry, SubscriptionManager, ToolLLM } from '@pellux/goodvibes-sdk/platform/config';
 import { SecretsManager } from '../config/secrets.ts';
-import { AutomationDeliveryManager, AutomationManager, AutomationRouteStore } from '@pellux/goodvibes-sdk/platform/automation';
-import { ChannelDeliveryRouter, ChannelPluginRegistry, ChannelPolicyManager, RouteBindingManager, SurfaceRegistry } from '@pellux/goodvibes-sdk/platform/channels';
-import { ApprovalBroker, GatewayMethodCatalog, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
+import { AutomationDeliveryManager, AutomationManager } from '@pellux/goodvibes-sdk/platform/automation';
+import { ChannelDeliveryRouter, ChannelPolicyManager, type ChannelPluginRegistry, type RouteBindingManager, type SurfaceRegistry } from '@pellux/goodvibes-sdk/platform/channels';
+import { ApprovalBroker, GatewayMethodCatalog, SessionLiveTurnControlsHolder, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { PowerManager } from '@pellux/goodvibes-sdk/platform/power';
+import { wireIdlePowerAndLiveTurn } from './idle-power-services.ts';
 import { StepUpService } from '@pellux/goodvibes-sdk/daemon';
-import { attachWsOnlyGatewayVerbHandlers, createArchivableFleetRegistry } from '@pellux/goodvibes-terminal-shell';
+import { PairingTokenManager } from '@pellux/goodvibes-sdk/platform/pairing';
+import { resolvePairingWebOrigin } from '../core/pairing-origin.ts';
+import { attachWsOnlyGatewayVerbHandlers } from '@pellux/goodvibes-terminal-shell';
 import { WatcherRegistry } from '@pellux/goodvibes-sdk/platform/watchers';
 import { ArtifactStore } from '@pellux/goodvibes-sdk/platform/artifacts';
 import {
@@ -25,7 +29,13 @@ import { MediaProviderRegistry, ensureBuiltinMediaProviders } from '@pellux/good
 import { MultimodalService } from '@pellux/goodvibes-sdk/platform/multimodal';
 import { AgentMessageBus, AgentOrchestrator, ArchetypeLoader, WrfcController } from '@pellux/goodvibes-sdk/platform/agents';
 import { AgentManager, ContextAccountingHolder, OverflowHandler, ProcessManager, createWorkflowServices, type WorkflowServices } from '@pellux/goodvibes-sdk/platform/tools';
-import { FileStateCache, FileUndoManager, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, resolveCanonicalMemoryDbPath, type CodeIndexStore, type CodeIndexReindexScheduler } from '@pellux/goodvibes-sdk/platform/state';
+import { FileStateCache, FileUndoManager, MemoryConsolidationScheduler, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, resolveCanonicalMemoryDbPath, type CodeIndexStore, type CodeIndexReindexScheduler } from '@pellux/goodvibes-sdk/platform/state';
+import type { StoreSnapshotScheduler } from '@pellux/goodvibes-sdk/platform/state/store-snapshots';
+import type { UserPermissionRuleStore } from '@pellux/goodvibes-sdk/platform/permissions';
+import { buildExecPromptAnswerHandler } from '@pellux/goodvibes-sdk/platform/runtime/permissions/exec-prompt-wiring';
+import { buildLocalhostFetchApproval } from '@pellux/goodvibes-sdk/platform/runtime/permissions/localhost-fetch-approval';
+import { createNotificationDispatcher, wireRuntimeNotificationBridge, type NotificationDispatcher } from './notification-dispatch.ts';
+import { createDurabilityServices } from './durability-services.ts';
 import { MemorySpineClient, createLocalMemoryAccess } from '@pellux/goodvibes-sdk/platform/runtime/memory-spine';
 import { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
 import { createWorkspaceCheckpointing } from './workspace-checkpointing.ts';
@@ -49,20 +59,19 @@ import { SessionManager, CrossSessionTaskRegistry, SessionChangeTracker } from '
 import { ApiTokenAuditor, UserAuthManager } from '@pellux/goodvibes-sdk/platform/security';
 import { WebhookNotifier } from '@pellux/goodvibes-sdk/platform/integrations';
 import { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
-import { BenchmarkStore, CacheHitTracker, FavoritesStore, inferFallbackContextWindow, type ModelDefinition, ModelLimitsService, ProviderCapabilityRegistry, ProviderOptimizer, ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+import { BenchmarkStore, CacheHitTracker, FavoritesStore, ModelLimitsService, ProviderCapabilityRegistry, ProviderOptimizer, ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
 import { KeybindingsManager } from '../input/keybindings.ts';
 import { AdaptivePlanner, DeterministicReplayEngine, ExecutionPlanManager, SessionLineageTracker, SessionMemoryStore } from '@pellux/goodvibes-sdk/platform/core';
-import { isFeatureFlagEnabled } from './surface-feature-flags.ts';
+import { deriveFeatureStates, bindFeatureSettingsBridge } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import { createChannelComposition } from './channel-composition.ts';
+import { applyProviderOptimizerConfigMode, bindProviderOptimizerFeatureFlag } from './provider-optimizer-wiring.ts';
 import { type ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
-import { calcSessionCost, isModelPriced } from '../export/cost-utils.ts';
+import { createFleetServices } from './fleet-services.ts';
 import { createWorkstreamServices, type OrchestrationEngine, type WorkstreamCommandService } from './workstream-services.ts';
 import { wireFleetNeedsInputPush } from './fleet-needs-input-push.ts';
 import { codeIndexDbPath, createCodeIndexServices, isCodeInjectionSettingEnabled } from './code-index-services.ts';
 import { WorkPlanStore } from '../work-plans/work-plan-store.ts';
-import {
-  registerDaemonHandlers,
-  type DaemonHandlerSurfaces,
-} from '../daemon/handlers/index.ts';
+import { registerDaemonHandlers, type DaemonHandlerSurfaces } from '../daemon/handlers/index.ts';
 import type { HandlerContext, HandlerLogger } from '../daemon/handlers/context.ts';
 import { createDaemonCredentialStore } from '../daemon/handlers/credentials.ts';
 import { registerRouting } from '../daemon/handlers/routing/index.ts';
@@ -73,58 +82,10 @@ import { registerCalendar } from '../daemon/handlers/calendar/index.ts';
 import { registerEmailMethods } from '../daemon/handlers/email/index.ts';
 import { registerRemoteSurface } from '../daemon/handlers/remote/index.ts';
 import { WorkspaceTrustManager } from './trust/workspace-trust.ts';
+import { ensureConfiguredModelIsRoutable } from './provider-fallback.ts';
 
 const REGULAR_KNOWLEDGE_DB_FILE = 'knowledge-wiki.sqlite';
 const HOME_GRAPH_KNOWLEDGE_DB_FILE = 'knowledge-home-graph.sqlite';
-
-function buildFallbackModelDefinition(provider: string, modelId: string): ModelDefinition {
-  const providerLower = provider.toLowerCase();
-  const isReasoningProvider = providerLower.includes('openai')
-    || providerLower.includes('anthropic')
-    || providerLower.includes('gemini')
-    || providerLower.includes('google');
-
-  return {
-    id: modelId,
-    provider,
-    registryKey: `${provider}:${modelId}`,
-    displayName: modelId,
-    description: 'Configured model available before the model catalog cache has loaded.',
-    capabilities: {
-      toolCalling: true,
-      codeEditing: true,
-      reasoning: isReasoningProvider,
-      multimodal: isReasoningProvider,
-    },
-    // Pre-catalog fallback uses the SDK's family-aware inference (SDK 0.35.0+),
-    // matching the post-catalog window so the meter/compaction denominator agrees.
-    contextWindow: inferFallbackContextWindow(provider, modelId),
-    contextWindowProvenance: 'fallback',
-    selectable: true,
-    tier: 'standard',
-    ...(isReasoningProvider ? { reasoningEffort: ['instant', 'low', 'medium', 'high'] } : {}),
-  };
-}
-
-function ensureConfiguredModelIsRoutable(providerRegistry: ProviderRegistry, configManager: ConfigManager): void {
-  const configuredModel = String(configManager.get('provider.model') ?? '').trim();
-  if (!configuredModel.includes(':')) return;
-  if (providerRegistry.listModels().some((model) => model.registryKey === configuredModel)) return;
-
-  const [providerId, ...modelParts] = configuredModel.split(':');
-  const modelId = modelParts.join(':').trim();
-  if (!providerId || !modelId) return;
-
-  const provider = providerRegistry.tryGet(providerId);
-  if (!provider) return;
-
-  providerRegistry.registerRuntimeProvider({
-    provider,
-    replace: true,
-    models: [buildFallbackModelDefinition(providerId, modelId)],
-  });
-}
-
 export interface RuntimeServicesOptions {
   readonly runtimeBus: RuntimeEventBus;
   readonly runtimeStore: RuntimeStore;
@@ -134,8 +95,13 @@ export interface RuntimeServicesOptions {
   readonly getConversationTitle?: () => string | undefined;
   readonly workingDir: string;
   readonly homeDirectory: string;
-  /** Prior GoodVibes runtime state existed at startup — sampled before any write; seeds the trust gate's grandfathering. */
-  readonly workspaceHadPriorState?: boolean;
+  /** Opt-in (daemon-side only): fold host-observed external coding-agent sessions
+   * into the fleet as 'observed-external' rows. Interactive leaves it off and reads
+   * the daemon snapshot. Mirrors the SDK's own createRuntimeServices option. */
+  readonly observeExternalAgents?: boolean | undefined;
+  /** Host power seam opt-in. Fork mirrors the SDK: non-spawning unavailable-seam
+   * default (idle-power-services.ts); daemon + embedded runtime pass createHostPowerSeam(). */
+  readonly powerSeam?: Parameters<typeof wireIdlePowerAndLiveTurn>[0]['powerSeam'];
 }
 
 export interface RuntimeServices {
@@ -155,6 +121,14 @@ export interface RuntimeServices {
   readonly channelDeliveryRouter: ChannelDeliveryRouter;
   readonly watcherRegistry: WatcherRegistry;
   readonly approvalBroker: ApprovalBroker;
+  /** Loopback-fetch approval that rides the approval broker; shared by the tool registry and orchestrator so every surface asks the same way. */
+  readonly localhostFetchApproval: ReturnType<typeof buildLocalhostFetchApproval>;
+  /** Terminal prompt-answer handler that rides the approval broker; shared by the tool registry and orchestrator so an interactive command's prompt gets an ask/card on every surface. */
+  readonly execPromptAnswerHandler: ReturnType<typeof buildExecPromptAnswerHandler>;
+  /** Routes curated runtime-domain events into the panel_only notification feed (the panel's live producer). */
+  readonly notificationDispatcher: NotificationDispatcher;
+  /** Durable user-origin permission rules (remembered approvals); permissions.rules.* surface. Mirrors the SDK composition. */
+  readonly userPermissionRuleStore: UserPermissionRuleStore;
   readonly sessionBroker: SharedSessionBroker;
   readonly deliveryManager: AutomationDeliveryManager;
   readonly automationManager: AutomationManager;
@@ -173,6 +147,7 @@ export interface RuntimeServices {
   readonly serviceRegistry: ServiceRegistry;
   readonly secretsManager: SecretsManager;
   readonly stepUpService: StepUpService;
+  readonly pairingTokens: PairingTokenManager; // backs pairing.tokens.* verbs + the settings device surface (mirrors the SDK composition)
   readonly subscriptionManager: SubscriptionManager;
   readonly localUserAuthManager: UserAuthManager;
   readonly profileManager: ProfileManager;
@@ -198,7 +173,7 @@ export interface RuntimeServices {
   readonly worktreeRegistry: WorktreeRegistry;
   readonly sandboxSessionRegistry: SandboxSessionRegistry;
   readonly webhookNotifier: WebhookNotifier;
-  /** Terminal focus tracker (W2.3) — fed by input/handler-feed.ts, read by the alert notifiers in core/. */
+  /** Terminal focus tracker — fed by input/handler-feed.ts, read by the alert notifiers in core/. */
   readonly focusTracker: FocusTracker;
   readonly replayEngine: DeterministicReplayEngine;
   readonly providerOptimizer: ProviderOptimizer;
@@ -234,6 +209,11 @@ export interface RuntimeServices {
   /** The repo source-tree code index — see runtime/code-index-services.ts. */
   readonly codeIndexStore: CodeIndexStore;
   readonly codeIndexReindexScheduler: CodeIndexReindexScheduler; // tool-site reindex
+  /** Daily snapshots of every SQLite store this runtime writes, with bounded retention; unref'd timers (mirrors the SDK composition — hosts that tear down a runtime stop() it themselves). */
+  readonly storeSnapshotScheduler: StoreSnapshotScheduler;
+  readonly memoryConsolidationScheduler: MemoryConsolidationScheduler;
+  readonly powerManager: PowerManager;
+  readonly sessionLiveTurnControls: SessionLiveTurnControlsHolder;
   /** Unified live process registry (agents, WRFC chains, workflows, watchers, background processes) backing the Fleet panel; archive-aware — finished subtrees can be moved to the session archive view. */
   readonly processRegistry: ArchivableProcessRegistry;
   readonly modeManager: ModeManager;
@@ -253,26 +233,31 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     workingDirectory,
     homeDirectory,
   });
-  const workspaceTrustManager = new WorkspaceTrustManager({ shellPaths, hadPriorState: options.workspaceHadPriorState ?? false });
+  const workspaceTrustManager = new WorkspaceTrustManager({ shellPaths });
   const configManager = options.configManager;
   const featureFlags = options.featureFlags ?? createFeatureFlagManager();
+  if (options.featureFlags === undefined) {
+    // Owned manager: gate states derive from domain settings keys + live
+    // bridge (mirrors the SDK composition root; a passed manager is the caller's to wire).
+    featureFlags.loadFromConfig({ flags: deriveFeatureStates(configManager) });
+    bindFeatureSettingsBridge(configManager, featureFlags);
+  }
   const runtimeDispatch = createDomainDispatch(options.runtimeStore);
   const gatewayMethods = new GatewayMethodCatalog();
   const panelManager = new PanelManager();
-  // W6.1 (the purge): MIGRATE-TO-MODAL surface + redirect registration moved to
+  // (the purge): MIGRATE-TO-MODAL surface + redirect registration moved to
   // registerBuiltinPanels (builtin-panels.ts), where the panels' resolved deps
   // are available for the surfaces to close over.
   const keybindingsManager = new KeybindingsManager({
     configPath: shellPaths.resolveUserPath('tui', 'keybindings.json'),
   });
-  const routeBindings = new RouteBindingManager({
-    store: new AutomationRouteStore({ configManager }),
+  // Channel/surface wiring: see channel-composition.ts (incl. the recorded surface-gating divergence note).
+  const { routeBindings, surfaceRegistry, channelPlugins } = createChannelComposition({
+    configManager,
     runtimeStore: options.runtimeStore,
     runtimeBus: options.runtimeBus,
+    featureFlags,
   });
-  const surfaceRegistry = new SurfaceRegistry(configManager, options.runtimeStore);
-  const channelPlugins = new ChannelPluginRegistry();
-  surfaceRegistry.attachPluginRegistry(channelPlugins);
   const secretsManager = new SecretsManager({
     projectRoot: workingDirectory,
     globalHome: homeDirectory,
@@ -280,6 +265,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   });
   // Step-up (WebAuthn) ceremony service, shared between the ceremony gateway verbs and the relay gate's verifier.
   const stepUpService = new StepUpService({ secrets: secretsManager });
+  const pairingTokens = new PairingTokenManager(shellPaths.resolveUserPath('control-plane', 'pairing-tokens.json'));
   const subscriptionManager = new SubscriptionManager(shellPaths.resolveUserPath('tui', 'subscriptions.json'));
   const serviceRegistry = new ServiceRegistry(shellPaths.resolveProjectPath('tui', 'services.json'), {
     secretsManager,
@@ -307,6 +293,10 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   });
   ensureConfiguredModelIsRoutable(providerRegistry, configManager);
   providerRegistry.initCustomProviders();
+  // Kick off the background, TTL-respecting live model discovery sweep so
+  // provider model lists refresh from their own listing APIs — matching the
+  // SDK and agent compositions (this call was the one omitted here).
+  providerRegistry.initProviderModelDiscovery();
   const toolLLM = new ToolLLM({
     configManager,
     providerRegistry,
@@ -341,6 +331,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     messageBus: agentMessageBus,
     executor: agentOrchestrator,
     configManager,
+    // The live registry lets a bare model id in a spawn() override resolve
+    // through the shared resolver instead of being rejected as unqualified.
+    providerRegistry,
   });
   const contextAccountingHolder = new ContextAccountingHolder();
   agentOrchestrator.setConversationSink({ // Conversation-snapshot bridge (mirrors the SDK's own createRuntimeServices)
@@ -418,6 +411,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     runtimeStore: options.runtimeStore,
     runtimeBus: options.runtimeBus,
     deliveryManager,
+    // Same live registry: a bare model id on an automation job resolves through
+    // the shared resolver instead of a format-only rejection.
+    providerRegistry,
     spawnTask: (input) => {
       const record = agentManager.spawn({
         mode: 'spawn',
@@ -489,7 +485,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     projectRoot: workingDirectory,
   });
   const voiceProviders = new VoiceProviderRegistry();
-  ensureBuiltinVoiceProviders(voiceProviders);
+  ensureBuiltinVoiceProviders(voiceProviders, { readConfig: (key) => configManager.get(key as Parameters<typeof configManager.get>[0]) });
   const voiceService = new VoiceService(voiceProviders);
   const webSearchProviders = new WebSearchProviderRegistry({
     env: process.env,
@@ -499,18 +495,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     serviceRegistry,
     featureFlags,
   });
-  knowledgeSemanticService.setGapRepairer(createWebKnowledgeGapRepairer({
-    searchService: webSearchService,
-    ingestService: knowledgeService,
-  }));
-  agentKnowledgeSemanticService.setGapRepairer(createWebKnowledgeGapRepairer({
-    searchService: webSearchService,
-    ingestService: agentKnowledgeService,
-  }));
-  homeGraphSemanticService.setGapRepairer(createWebKnowledgeGapRepairer({
-    searchService: webSearchService,
-    ingestService: homeGraphService,
-  }));
+  for (const [semantic, ingest] of [[knowledgeSemanticService, knowledgeService], [agentKnowledgeSemanticService, agentKnowledgeService], [homeGraphSemanticService, homeGraphService]] as const) {
+    semantic.setGapRepairer(createWebKnowledgeGapRepairer({ searchService: webSearchService, ingestService: ingest }));
+  }
   const mediaProviders = new MediaProviderRegistry();
   ensureBuiltinMediaProviders(mediaProviders, artifactStore, providerRegistry);
   const multimodalService = new MultimodalService(artifactStore, mediaProviders, voiceService, knowledgeService);
@@ -578,11 +565,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const webhookNotifier = new WebhookNotifier();
   const focusTracker = new FocusTracker();
   const replayEngine = new DeterministicReplayEngine(workingDirectory);
-  const providerOptimizer = new ProviderOptimizer(
-    providerRegistry,
-    providerCapabilityRegistry,
-    isFeatureFlagEnabled(configManager, 'provider-optimizer'),
-  );
+  const providerOptimizer = new ProviderOptimizer(providerRegistry, providerCapabilityRegistry, false); // dark until its gate flips it (see provider-optimizer-wiring.ts)
+  bindProviderOptimizerFeatureFlag(featureFlags, providerOptimizer);
+  applyProviderOptimizerConfigMode(configManager, providerOptimizer);
   const sessionMemoryStore = new SessionMemoryStore();
   const sessionLineageTracker = new SessionLineageTracker();
   const sessionChangeTracker = new SessionChangeTracker();
@@ -611,37 +596,28 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // with MemoryStore above. Auto-build is config-gated (default off) — see
   // code-index-services.ts's header doc.
   const { codeIndexStore, codeIndexReindexScheduler } = createCodeIndexServices({ workingDirectory, configManager, memoryEmbeddingRegistry });
+  // Store snapshots + durable remembered-approval rules + the live credential
+  // chain, mirroring the SDK composition — see durability-services.ts.
+  const { storeSnapshotScheduler, userPermissionRuleStore } = createDurabilityServices({
+    configManager, secretsManager, providerRegistry, memoryDbPath, codeIndexDbPath: codeIndexDbPath(workingDirectory), workingDirectory, surfaceRoot: 'tui', homeDirectory, shellPaths, // + retention-sweep roots & live config watch (mirrors the SDK)
+  });
   const codeInjectionOrchestratorDeps = { codeIndex: codeIndexStore, isCodeInjectionSettingEnabled: () => isCodeInjectionSettingEnabled(configManager), codeIndexReindexScheduler }; // Code-injection seam (agent here; main via orchestrator-core-services.ts)
-  // Shared, archive-aware fleet registry — see gateway-verbs.ts's factory doc.
-  const processRegistry = createArchivableFleetRegistry({
-    agentManager,
-    wrfcController,
+  const { processRegistry } = createFleetServices({ // Shared archive-aware fleet registry (+ daemon observed rows) — see fleet-services.ts
+    agentManager, wrfcController,
     orchestrationEngine, // Folds workstream/phase/work-item nodes into the fleet
     codeIndexService: codeIndexStore, // Folds a single 'code-index' node into the fleet
-    processManager,
-    watcherRegistry,
-    workflow,
-    approvalBroker,
-    sessionBroker,
+    processManager, watcherRegistry, workflow, approvalBroker, sessionBroker,
     messageBus: agentMessageBus, // Backs steer()/`steerable` (the Fleet steer composer builds on top)
     automationManager, // Folds /schedule AutomationJobs into the fleet as 'schedule' nodes
     runtimeBus: options.runtimeBus,
-    // Honest pricing: never fabricate a cost for an unrecognized model.
-    priceUsage: (model, usage) => {
-      const modelId = model ?? 'unknown';
-      if (!isModelPriced(modelId)) return null;
-      return calcSessionCost(usage.inputTokens, usage.outputTokens, usage.cacheReadTokens, usage.cacheWriteTokens, modelId);
-    },
+    observeExternalAgents: options.observeExternalAgents, providerRegistry, // observeExternalAgents is daemon-side only
   });
-  const modeManager = new ModeManager();
-  const fileUndoManager = new FileUndoManager();
+  const modeManager = new ModeManager(); const fileUndoManager = new FileUndoManager();
   const workspaceCheckpointManager = createWorkspaceCheckpointing({ workspaceRoot: workingDirectory, runtimeBus: options.runtimeBus, configManager });
+  const { memoryConsolidationScheduler, powerManager, sessionLiveTurnControls } = wireIdlePowerAndLiveTurn({ configManager, memoryRegistry, runtimeBus: options.runtimeBus, isIdle: () => sessionBroker.countBusySessions() === 0, snapshotTick: () => storeSnapshotScheduler.tick(), heartbeat: async () => { await automationManager.triggerHeartbeat({ source: 'wake-catchup' }); }, powerSeam: options.powerSeam });
 
-  // Shared terminal-shell wrapper over the SDK's registerGatewayVerbGroups (see gateway-verbs.ts): 501s the ws-only
-  // family without it. principals.*/channels.profiles.*/ci.* register unconditionally; checkin.* only with
-  // channelDeliveryRouter/providerRegistry/automationManager/sessionLister ALL present; fleet needs-input push gated by
-  // runtimeBus/sessionPresence (fleet-needs-input-push.ts). conversationRewindPort serves conversation-scope rewind live.
-  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
+  // Terminal-shell wrapper over the SDK registerGatewayVerbGroups (gateway-verbs.ts); checkin.*/fleet-needs-input/pairing.* register only when their deps are present.
+  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input), watcherRegistry, userPermissionRuleStore, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, sessionIntake: sessionBroker, workingDirectory, memoryRegistry, pairingTokens, sessionLiveTurnControls, powerManager, relayAvailable: () => configManager.get('relay.enabled') === true, pairingWebOrigin: () => resolvePairingWebOrigin(configManager).origin, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
   const integrationHelpers = new IntegrationHelperService({
     workingDirectory,
     homeDirectory,
@@ -662,8 +638,16 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     subscriptionManager,
     secretsManager,
   });
+  // A loopback fetch that isn't allow-listed asks once through the approval
+  // broker; "allow for this project" persists and later fetches never ask. Built
+  // once and shared with the tool registry (bootstrap-core) so both ask alike.
+  const localhostFetchApproval = buildLocalhostFetchApproval({ requestApproval: (input) => approvalBroker.requestApproval(input), configManager });
+  // Exec stuck on a terminal prompt rides the approval broker; the typed answer feeds the continuing run. Built once and shared (like localhostFetchApproval) so the tool registry AND every setDependencies site — incl. the post-clobber rewire in bootstrap-core — install the SAME handler; otherwise a wholesale replace drops it and interactive prompts hang.
+  const execPromptAnswerHandler = buildExecPromptAnswerHandler({ requestApproval: (input) => approvalBroker.requestApproval(input) });
   agentOrchestrator.setDependencies({
     surfaceRoot: 'tui',
+    execPromptAnswerHandler,
+    localhostFetchApproval,
     fileCache,
     projectIndex,
     workingDirectory,
@@ -691,6 +675,12 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     contextAccountingHolder,
   });
 
+  // Give the panel_only notification target a live producer: curated
+  // runtime-domain events route through the notification router into the shared
+  // panel feed (panel_only and burst-collapsed decisions land there).
+  const notificationDispatcher = createNotificationDispatcher(configManager);
+  wireRuntimeNotificationBridge(options.runtimeBus, notificationDispatcher);
+
   return {
     workingDirectory,
     homeDirectory,
@@ -709,6 +699,10 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     channelDeliveryRouter,
     watcherRegistry,
     approvalBroker,
+    localhostFetchApproval,
+    execPromptAnswerHandler,
+    notificationDispatcher,
+    userPermissionRuleStore,
     sessionBroker,
     deliveryManager,
     automationManager,
@@ -726,6 +720,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     serviceRegistry,
     secretsManager,
     stepUpService,
+    pairingTokens,
     subscriptionManager,
     localUserAuthManager,
     profileManager,
@@ -784,6 +779,10 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     workstreamCommands,
     codeIndexStore,
     codeIndexReindexScheduler,
+    storeSnapshotScheduler,
+    memoryConsolidationScheduler,
+    powerManager,
+    sessionLiveTurnControls,
     processRegistry,
     modeManager,
     fileUndoManager,
@@ -791,8 +790,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     integrationHelpers,
     async rerootStores(newWorkingDir: string): Promise<void> {
       // The memory store is the home-scoped canonical cross-surface store and
-      // deliberately does NOT reroot per-project (that would re-silo memory, the E6
-      // regression). Only working-tree-bound stores (code index, project index) reroot.
+      // deliberately does NOT reroot per-project (that would re-silo memory back
+      // into per-project stores). Only working-tree-bound stores (code index,
+      // project index) reroot.
       await codeIndexStore.reroot(newWorkingDir, codeIndexDbPath(newWorkingDir));
       await projectIndex.reroot(newWorkingDir);
     },

package/src/runtime/session-continuity-hints.ts

@@ -0,0 +1,38 @@
+/**
+ * session-continuity-hints — the recovery snapshot's continuity summary.
+ *
+ * Extracted from main.ts (which sits at the architecture line cap) so the
+ * startup wiring there stays within budget. Builds the small counts/paths
+ * bundle written into the recovery file so a resumed session can describe what
+ * was in flight (pending approvals, active/blocked tasks, remotes, worktrees,
+ * open panels) without re-reading live state.
+ */
+import type { UiReadModels } from './ui-read-models.ts';
+import type { PanelManager } from '../panels/panel-manager.ts';
+
+/**
+ * The continuity summary written into the recovery file. A loose serializable
+ * bag (Record) because it is JSON-persisted and read back by the recovery
+ * continuity-hints consumer, which types it structurally.
+ */
+export function createSessionContinuityHintsBuilder(deps: {
+  readonly readModels: UiReadModels;
+  readonly panelManager: Pick<PanelManager, 'getAllOpen'>;
+}): () => Record<string, unknown> {
+  return () => {
+    const sessionSnapshot = deps.readModels.session.getSnapshot();
+    const tasksSnapshot = deps.readModels.tasks.getSnapshot();
+    const remoteSnapshot = deps.readModels.remote.getSnapshot();
+    const worktreeSnapshot = deps.readModels.worktrees.getSnapshot();
+    return {
+      pendingApprovals: sessionSnapshot.pendingApproval ? 1 : 0,
+      activeTasks: tasksSnapshot.tasks.filter((task) => task.status === 'running' || task.status === 'queued').length,
+      blockedTasks: tasksSnapshot.tasks.filter((task) => task.status === 'blocked').length,
+      remoteContracts: remoteSnapshot.contracts.length,
+      remoteRunners: remoteSnapshot.contracts.slice(0, 4).map((contract) => contract.runnerId),
+      worktreeCount: worktreeSnapshot.records.length,
+      worktreePaths: worktreeSnapshot.records.slice(0, 3).map((record) => record.path),
+      openPanels: deps.panelManager.getAllOpen().map((panel) => panel.id),
+    };
+  };
+}

package/src/runtime/surface-feature-flags.ts

@@ -1,5 +1,16 @@
-import type { ConfigKey, ConfigManager, PersistedFlagState } from '../config/index.ts';
+/**
+ * surface-feature-flags — which platform capabilities a surface/server setup
+ * needs, and how to switch them on through their real domain settings keys.
+ *
+ * Capabilities are configured through first-class domain settings (see
+ * feature-settings.ts); enabling a surface writes keys like
+ * `controlPlane.gateway` or `surfaces.slack.enabled`, never a separate
+ * enablement namespace.
+ */
+
+import type { ConfigManager } from '../config/index.ts';
 import { surfaceFeatureGateId } from '@/runtime/index.ts';
+import { featureEnablementWrite, getFeatureSetting, isFeatureConfigEnabled } from './feature-settings.ts';
 
 export const CONTROL_PLANE_FEATURE_FLAG = 'control-plane-gateway';
 export const ROUTE_BINDING_FEATURE_FLAG = 'route-binding';
@@ -12,10 +23,15 @@ const CORE_CHANNEL_FEATURE_FLAGS = [
   DELIVERY_ENGINE_FEATURE_FLAG,
 ] as const;
 
-export type FeatureFlagConfigKey = 'featureFlags' | `featureFlags.${string}`;
-
 export function getSurfaceFeatureFlag(surfaceId: string): string | null {
-  return surfaceFeatureGateId(surfaceId);
+  // Onboarding surface ids may be camelCase ('googleChat'); the SDK's gate
+  // map is keyed by the kebab-case ChannelSurface id ('google-chat'). Try the
+  // literal id first, then the kebab-case form, so choosing Google Chat in
+  // onboarding really flips google-chat-surface.
+  const literal = surfaceFeatureGateId(surfaceId);
+  if (literal) return literal;
+  const kebab = surfaceId.replace(/[A-Z]/g, (ch) => `-${ch.toLowerCase()}`);
+  return kebab === surfaceId ? null : surfaceFeatureGateId(kebab);
 }
 
 export function getServerSurfaceFeatureFlags(options: {
@@ -46,20 +62,35 @@ export function getServerSurfaceFeatureFlags(options: {
   return [...flags].sort((left, right) => left.localeCompare(right));
 }
 
-export function isFeatureFlagEnabled(config: Pick<ConfigManager, 'getCategory'>, flagId: string): boolean {
-  const flags = (config.getCategory('featureFlags') as Record<string, PersistedFlagState | undefined>) ?? {};
-  return flags[flagId] === 'enabled';
+/** Whether the live config has the capability on, derived from its domain settings key. */
+export function isFeatureFlagEnabled(config: Pick<ConfigManager, 'get'>, flagId: string): boolean {
+  return isFeatureConfigEnabled(config, flagId);
+}
+
+/**
+ * Translate internal feature-gate ids (e.g. 'control-plane-gateway') to the
+ * canonical domain settings keys the user actually sets (e.g.
+ * 'controlPlane.gateway') — matching the SDK's own gate errors, which name the
+ * settings key. A gate with no mapped setting falls back to its id. Deduped and
+ * sorted for stable output.
+ */
+export function surfaceFeatureGateSettingsKeys(flagIds: readonly string[]): string[] {
+  const keys = new Set<string>();
+  for (const flagId of flagIds) keys.add(getFeatureSetting(flagId)?.enablement.key ?? flagId);
+  return [...keys].sort((left, right) => left.localeCompare(right));
 }
 
-export function getMissingSurfaceFeatureFlags(config: Pick<ConfigManager, 'getCategory'>, surfaceId: string): readonly string[] {
+export function getMissingSurfaceFeatureFlags(config: Pick<ConfigManager, 'get'>, surfaceId: string): readonly string[] {
   const required = surfaceId === 'web'
     ? getServerSurfaceFeatureFlags({ web: true })
     : getServerSurfaceFeatureFlags({ externalSurfaces: [surfaceId] });
   return required.filter((flagId) => !isFeatureFlagEnabled(config, flagId));
 }
 
+/** Switch each capability on by writing its real enablement settings key. */
 export function enableFeatureFlags(config: Pick<ConfigManager, 'setDynamic'>, flagIds: readonly string[]): void {
   for (const flagId of flagIds) {
-    config.setDynamic(`featureFlags.${flagId}` as ConfigKey, 'enabled');
+    const write = featureEnablementWrite(flagId, true);
+    if (write) config.setDynamic(write.key, write.value);
   }
 }

package/src/runtime/terminal-output-guard.ts

@@ -45,7 +45,7 @@ export type TuiTerminalOutputGuardOptions = {
    * writes captured this session, so an honest quiet counter (e.g. /debug) can
    * refresh. The per-write detail is already recorded to the activity log via
    * logger.warn — this callback intentionally does NOT push transcript lines.
-   * (UX-B item 1a.)
+   * (item 1a.)
    */
   readonly onCapture?: (total: number) => void;
 };
@@ -224,7 +224,7 @@ export function installTuiTerminalOutputGuard(options: TuiTerminalOutputGuardOpt
     onIntercept: () => {
       // Each intercept is already logged (logger.warn in record()). Here we only
       // maintain a cumulative counter and, rate-limited, refresh a quiet counter
-      // surface — no repeated transcript lines. (UX-B item 1a.)
+      // surface — no repeated transcript lines. (item 1a.)
       totalInterceptedWrites++;
       const now = Date.now();
       if (now - lastNoticeAt < 5_000) return;

package/src/runtime/trust/workspace-registration.ts

@@ -137,13 +137,21 @@ export class WorkspaceRegistrationManager {
    * Register the current working directory at its resolved project root. The
    * store refuses broad roots (WorkspaceRegistrationError) — we surface that
    * honestly rather than record a phantom registration.
+   *
+   * `origin` stamps which surface wrote the record (honest provenance). This
+   * NEVER passes `checkpointEligible`: absent means false, so a TUI self-record
+   * can never widen the checkpoint-owning consumer's boundary — only that
+   * consumer stamps its own roots eligible on boot.
    */
-  async register(label?: string): Promise<
+  async register(label?: string, origin?: string): Promise<
     | { readonly registered: true; readonly result: RegisterWorkspaceResult }
     | { readonly registered: false; readonly refusedReason: string }
   > {
+    const opts = label || origin
+      ? { ...(label ? { label } : {}), ...(origin ? { origin } : {}) }
+      : undefined;
     try {
-      const result = await this.store.add(this.workingDirectory, label ? { label } : undefined);
+      const result = await this.store.add(this.workingDirectory, opts);
       return { registered: true, result };
     } catch (error) {
       if (error instanceof WorkspaceRegistrationError) {