@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/input/commands/acp-runtime.ts

@@ -0,0 +1,72 @@
+// ---------------------------------------------------------------------------
+// acp-runtime.ts — the scripted path for hosting third-party coding agents,
+// over the SAME verbs the Fleet panel's spawn affordance drives (acp.agents.list
+// / acp.sessions.create). `/agents list` shows what the daemon discovered
+// (read-only, quiet when none); `/agents host <agentId> [dir]` spawns one as a
+// long-lived daemon session that shows up as an acp-agent fleet row. A working
+// directory defaults to the current one; a known workspace root can be named
+// instead — but no path is ever required beyond what the operator already has.
+//
+// A structured spawn failure ({binary, stage, message}) is printed verbatim,
+// never left as a hung row: the daemon bounds the handshake and returns a
+// 'failed' record with its three honest fields.
+// ---------------------------------------------------------------------------
+
+import type { CommandRegistry } from '../command-registry.ts';
+import { requireShellPaths } from './runtime-services.ts';
+import { describeOperatorRpcError, getOperatorRpc } from './operator-rpc.ts';
+
+export function registerAcpRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'agents',
+    aliases: ['acp'],
+    description: 'Host third-party coding agents (Claude Code, Codex, opencode) as fleet rows over ACP',
+    usage: 'list | host <agentId> [directory]',
+    argsHint: '[list|host]',
+    async handler(args, ctx) {
+      const sub = (args[0] ?? 'list').toLowerCase();
+      const rpc = getOperatorRpc(ctx);
+      if (!rpc.available) { ctx.print(`[agents] ${rpc.reason}`); return; }
+
+      if (sub === 'list') {
+        try {
+          const { agents } = await rpc.sdk.operator.invoke('acp.agents.list', {});
+          if (agents.length === 0) {
+            ctx.print('[agents] No third-party ACP agents discovered. Install Claude Code, Codex, or opencode on PATH to host one.');
+            return;
+          }
+          ctx.print([
+            'Discovered ACP agents (host with /agents host <id> [directory]):',
+            ...agents.map((a) => `  ${a.id} — ${a.title}  (${a.binaryPath})`),
+          ].join('\n'));
+        } catch (error) {
+          ctx.print(`[agents list] ${describeOperatorRpcError(error)}`);
+        }
+        return;
+      }
+
+      if (sub === 'host') {
+        const agentId = args[1];
+        if (!agentId) {
+          ctx.print('Usage: /agents host <agentId> [directory]  (agentId from /agents list; directory defaults to the current one)');
+          return;
+        }
+        const cwd = args[2] ?? requireShellPaths(ctx).workingDirectory;
+        try {
+          const { hosted, started } = await rpc.sdk.operator.invoke('acp.sessions.create', { agentId, cwd });
+          if (hosted.error) {
+            // Structured failure, verbatim — never a hung row.
+            ctx.print(`[agents host] Could not host ${hosted.title || agentId}: ${hosted.error.stage} stage failed for ${hosted.error.binary} — ${hosted.error.message}`);
+            return;
+          }
+          ctx.print(`[agents host] Hosting ${hosted.title || agentId} in ${cwd}${started ? '' : ' (queued)'} — it appears as an acp-agent row in the fleet; steer and stop it like any agent.`);
+        } catch (error) {
+          ctx.print(`[agents host] ${describeOperatorRpcError(error)}`);
+        }
+        return;
+      }
+
+      ctx.print('Usage: /agents list | /agents host <agentId> [directory]');
+    },
+  });
+}

package/src/input/commands/ci-runtime.ts

@@ -155,8 +155,12 @@ export function registerCiRuntimeCommands(registry: CommandRegistry): void {
             const result = await rpc.sdk.operator.invoke('ci.watches.run', { watchId: runId });
             const lines = [renderReport(result.report)];
             lines.push(`notified: ${result.notified ? 'yes' : 'no'}${result.notificationId ? ` (${result.notificationId})` : ''}`);
-            lines.push(`fix-session triggered: ${result.fixSessionTriggered ? 'yes' : 'no'}${result.fixSessionId ? ` (${result.fixSessionId})` : ''}`);
+            lines.push(`fix-session triggered: ${result.fixSessionTriggered ? 'yes' : 'no'}`);
             ctx.print(lines.join('\n'));
+            // Route the spawned session through the shared one-key jump affordance
+            // instead of printing the id for the user to retype — same attach flow
+            // as the accepted fix-this card.
+            if (result.fixSessionId) ctx.armFixSessionAttach?.(result.fixSessionId);
           } catch (error) {
             ctx.print(`[ci watches run] ${describeOperatorRpcError(error)}`);
           }

package/src/input/commands/codebase-runtime.ts

@@ -3,7 +3,7 @@
 //
 // Explicit-query + transparency surface over the repo source-tree code index
 // (CodeIndexStore, @pellux/goodvibes-sdk/platform/state, landed on SDK main
-// as wo802/W5.3 Stage A) via the TUI's own wiring in
+// with explicit-query build/status/search) via the TUI's own wiring in
 // src/runtime/code-index-services.ts, threaded through
 // CommandContext.session.codeIndexStore exactly like wrfcController/
 // workstreamEngine already are (bootstrap-command-context.ts).
@@ -14,8 +14,8 @@
 // node while it runs), status (counts, skips, degradation state, last
 // build), search <query> (explicit retrieval, results labeled
 // 'lexical'|'semantic' honestly — never implied as more precise than they
-// are). Stage B (now landed) adds passive auto-injection into coding turns and
-// tool-site incremental reindex; `status` surfaces both honestly (the
+// are). Passive auto-injection into coding turns and tool-site incremental
+// reindex followed later; `status` surfaces both honestly (the
 // auto-injection flag+setting gate, and the last reindex activity).
 // ---------------------------------------------------------------------------
 
@@ -35,7 +35,7 @@ function formatBytes(bytes: number): string {
 }
 
 /**
- * Honest one-line auto-injection state (Stage B): both the (default-off)
+ * Honest one-line auto-injection state: both the (default-off)
  * `agent-passive-code-injection` feature flag AND storage.codeIndexEnabled must
  * be on for passive code injection to run — state which is off, and why.
  */
@@ -49,7 +49,7 @@ function renderAutoInjectionState(flagEnabled: boolean, settingEnabled: boolean)
   return `  auto-injection: off (${reasons.join('; ')})`;
 }
 
-/** Honest last-reindex activity line (Stage B tool-site incremental reindex). */
+/** Honest last-reindex activity line (tool-site incremental reindex). */
 function renderReindexActivity(activity: CodeIndexReindexActivity | null, now: number): string {
   if (!activity) return '  last reindex: none this session (writes/edits reindex touched files once the index is built)';
   const agoSec = Math.max(0, Math.round((now - activity.at) / 1000));
@@ -82,7 +82,7 @@ function renderCodeIndexStatus(stats: CodeIndexStats, configManager: Pick<Config
   lines.push(
     `  auto-build on startup: ${autoStart ? 'on' : 'off'} (storage.codeIndexEnabled, default off — /config to change)`,
   );
-  // Stage B surfacing: passive code auto-injection state (flag + setting) and the last tool-site reindex.
+  // Passive code auto-injection state (flag + setting) and the last tool-site reindex.
   lines.push(renderAutoInjectionState(extras.flagEnabled, autoStart));
   lines.push(renderReindexActivity(extras.reindexActivity, extras.now ?? Date.now()));
   lines.push(

package/src/input/commands/cost-runtime.ts

@@ -11,7 +11,7 @@ import {
 } from './cost-attribution-format.ts';
 
 /**
- * /cost budget <usd> — makes the CostTrackerPanel's budget alert real (WO-139).
+ * /cost budget <usd> — makes the CostTrackerPanel's budget alert real.
  * Opens the cost panel (creating it via the registered factory if not already
  * open) and sets its budget threshold directly, so the meter+alert already
  * built into CostTrackerPanel.render() (:266-290) actually fires. 0 disables

package/src/input/commands/devices-runtime.ts

@@ -0,0 +1,109 @@
+import type { CommandContext, CommandRegistry } from '../command-registry.ts';
+import { formatDeviceLine, resolveTokenByIdPrefix } from '../../core/pairing-devices.ts';
+
+/**
+ * Register the /devices command — manage the per-device pairing tokens minted by
+ * the pairing surfaces. Mirrors the pairing.tokens.* gateway verbs the daemon
+ * serves (list/rename/revoke/migrate/revoke-shared) so the terminal has the same
+ * capability as the web app's device manager.
+ *
+ *   /devices                      list paired devices (name · created · last-seen · id)
+ *   /devices rename <id> <name>   rename a device token (id or unambiguous prefix)
+ *   /devices revoke <id>          revoke a device token immediately
+ *   /devices migrate-shared [name] mint a per-device token off the legacy shared token
+ *   /devices revoke-shared        revoke the legacy shared token (it stops authenticating)
+ */
+export function registerDevicesRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'devices',
+    aliases: ['device'],
+    description: 'Manage paired-device tokens (list, rename, revoke, migrate-shared)',
+    usage: '[list|rename <id> <name>|revoke <id>|migrate-shared [name]|revoke-shared]',
+    argsHint: '[list|rename|revoke|migrate-shared|revoke-shared]',
+    handler(args, ctx) {
+      const pairingTokens = ctx.platform.pairingTokens;
+      if (!pairingTokens) {
+        ctx.print('Device management is unavailable in this runtime (no pairing token service wired).');
+        return;
+      }
+      const sub = (args[0] ?? 'list').toLowerCase();
+
+      if (sub === 'list') {
+        renderList(ctx, pairingTokens);
+        return;
+      }
+
+      if (sub === 'rename') {
+        const idOrPrefix = args[1];
+        const name = args.slice(2).join(' ').trim();
+        if (!idOrPrefix || !name) {
+          ctx.print('Usage: /devices rename <id> <new name>');
+          return;
+        }
+        const resolved = resolveTokenByIdPrefix(pairingTokens.list(), idOrPrefix);
+        if (!resolved.ok) {
+          ctx.print(resolved.reason === 'ambiguous' ? `Ambiguous device id "${idOrPrefix}" — use more characters.` : `No device matches "${idOrPrefix}".`);
+          return;
+        }
+        pairingTokens.rename(resolved.token.id, name);
+        ctx.print(`Renamed device to "${name}".`);
+        return;
+      }
+
+      if (sub === 'revoke') {
+        const idOrPrefix = args[1];
+        if (!idOrPrefix) {
+          ctx.print('Usage: /devices revoke <id>');
+          return;
+        }
+        const resolved = resolveTokenByIdPrefix(pairingTokens.list(), idOrPrefix);
+        if (!resolved.ok) {
+          ctx.print(resolved.reason === 'ambiguous' ? `Ambiguous device id "${idOrPrefix}" — use more characters.` : `No device matches "${idOrPrefix}".`);
+          return;
+        }
+        const revoked = pairingTokens.revoke(resolved.token.id);
+        ctx.print(revoked ? `Revoked "${resolved.token.name}" — its token stops working immediately.` : `Device "${resolved.token.name}" was already absent.`);
+        return;
+      }
+
+      if (sub === 'migrate-shared') {
+        const name = args.slice(1).join(' ').trim() || 'migrated device';
+        const minted = pairingTokens.mintForMigration({ name });
+        ctx.print(
+          `Minted a per-device token "${minted.name}" (shown once): ${minted.token}\n` +
+          'Pair this device with it, then run /devices revoke-shared to retire the legacy shared token.',
+        );
+        return;
+      }
+
+      if (sub === 'revoke-shared') {
+        if (pairingTokens.isLegacyRevoked()) {
+          ctx.print('The legacy shared token is already revoked.');
+          return;
+        }
+        pairingTokens.revokeLegacyShared();
+        ctx.print('Revoked the legacy shared token — devices still on it must re-pair with their own token.');
+        return;
+      }
+
+      ctx.print(`Unknown /devices subcommand: ${sub}. Use: list | rename | revoke | migrate-shared | revoke-shared`);
+    },
+  });
+}
+
+function renderList(ctx: CommandContext, pairingTokens: NonNullable<CommandContext['platform']['pairingTokens']>): void {
+  const list = pairingTokens.list();
+  const lines: string[] = ['Paired devices:'];
+  if (list.length === 0) {
+    lines.push('  (none yet — pair one with /pair)');
+  } else {
+    for (const token of list) lines.push(`  ${formatDeviceLine(token)}`);
+  }
+  lines.push(
+    '',
+    pairingTokens.isLegacyRevoked()
+      ? 'Legacy shared token: revoked.'
+      : 'Legacy shared token: active — run /devices migrate-shared then /devices revoke-shared to retire it.',
+  );
+  ctx.print(lines.join('\n'));
+}

package/src/input/commands/git-runtime.ts

@@ -1,6 +1,6 @@
 import type { CommandRegistry } from '../command-registry.ts';
 import { GitService } from '@pellux/goodvibes-sdk/platform/git';
-import { requireShellPaths } from './runtime-services.ts';
+import { requireShellPaths, requirePanelManager } from './runtime-services.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 export function registerGitRuntimeCommands(registry: CommandRegistry): void {
@@ -64,10 +64,34 @@ export function registerGitRuntimeCommands(registry: CommandRegistry): void {
           break;
         }
         case 'diff': {
+          // Route the full, uncapped working-tree diff (GitService.diffStructured
+          // — parsed per-file/per-hunk with no size limit) into the real diff
+          // panel. The old path sliced the raw text at 4,000 chars and printed a
+          // stub; a large diff now renders complete.
           try {
-            const diffText = await git.diff();
-            if (!diffText.trim()) ctx.print('No unstaged changes.');
-            else ctx.print(diffText.length > 4000 ? `${diffText.slice(0, 4000)}\n\n...(diff truncated)` : diffText);
+            const structured = await git.diffStructured();
+            if (structured.files.length === 0) {
+              ctx.print('No unstaged changes.');
+              break;
+            }
+            const { DiffPanel } = await import('../../panels/diff-panel.ts');
+            const pm = requirePanelManager(ctx);
+            let panel = pm.getAllOpen().find((p) => p.id === 'diff');
+            if (!panel) {
+              try {
+                panel = pm.open('diff');
+              } catch {
+                ctx.print('Could not open diff panel.');
+                break;
+              }
+            }
+            pm.activateById('diff');
+            if (!pm.isVisible()) pm.show();
+            ctx.focusPanels?.();
+            (panel as InstanceType<typeof DiffPanel>).loadStructuredDiff(structured);
+            const fileWord = structured.files.length === 1 ? 'file' : 'files';
+            ctx.print(`Diff panel updated: ${structured.files.length} ${fileWord}, +${structured.additions} -${structured.deletions} (complete, uncapped).`);
+            ctx.renderRequest();
           } catch (e) {
             ctx.print(`Git diff failed: ${summarizeError(e)}`);
           }

package/src/input/commands/graph-runtime.ts

@@ -0,0 +1,45 @@
+import type { CommandRegistry } from '../command-registry.ts';
+import { getOperatorRpc, describeOperatorRpcError } from './operator-rpc.ts';
+import { renderWorkstreamGraphLines } from '../../panels/workstream-graph-render.ts';
+
+// ---------------------------------------------------------------------------
+// /graph — a workstream's task graph (fleet.graph.get) rendered legibly.
+//
+// The observability-layer surface: nodes, edges, per-node states (ready /
+// running / blocked-with-"waiting on: X" / stalled / orphaned) and the elastic
+// pool posture ("N ready, M running, at cap (fleet.maxSize=N)") — the shape of
+// the dependency graph WITHOUT opening any transcript. The fix-phase chain's
+// task graph is one such workstream.
+// ---------------------------------------------------------------------------
+
+function renderWidth(): number {
+  const cols = typeof process !== 'undefined' && process.stdout && process.stdout.columns ? process.stdout.columns : 80;
+  return Math.max(40, cols - 2);
+}
+
+export function registerGraphRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'graph',
+    description: "Show a workstream's task graph — nodes, edges, states, and pool posture",
+    usage: '<workstreamId>',
+    argsHint: '<workstreamId>',
+    async handler(args, ctx) {
+      const workstreamId = (args[0] ?? '').trim();
+      if (!workstreamId) {
+        ctx.print('Usage: /graph <workstreamId>  — renders that workstream\'s task graph (nodes, edges, states, pool).');
+        return;
+      }
+      const rpc = getOperatorRpc(ctx);
+      if (!rpc.available) {
+        ctx.print(`[graph] ${rpc.reason}`);
+        return;
+      }
+      try {
+        const snapshot = await rpc.sdk.operator.invoke('fleet.graph.get', { workstreamId });
+        ctx.print(renderWorkstreamGraphLines(snapshot, renderWidth()).join('\n'));
+      } catch (error) {
+        ctx.print(`[graph] ${describeOperatorRpcError(error)}`);
+      }
+    },
+  });
+}

package/src/input/commands/health-runtime.ts

@@ -48,7 +48,7 @@ export function registerHealthRuntimeCommands(registry: CommandRegistry): void {
       const readModels = requireReadModels(ctx);
 
       if (sub === 'open' || sub === 'panel' || sub === 'provider') {
-        ctx.openModal?.('providers-modal'); // W6.1: provider-health panel -> config modal
+        ctx.openModal?.('providers-modal'); // provider-health panel -> config modal
         return;
       }
 
@@ -477,7 +477,7 @@ export function registerHealthRuntimeCommands(registry: CommandRegistry): void {
 
       ctx.print([
         'Health Review',
-        // DEBT-5 item 3: /health stays a cross-domain transcript report (it
+        // item 3: /health stays a cross-domain transcript report (it
         // genuinely spans settings/accounts/auth/sandbox/etc — no single
         // modal owns this data), but the providers domain DOES have one, so
         // point at it honestly. "/provider" (no domain) is a DIFFERENT

package/src/input/commands/intelligence-runtime.ts

@@ -55,7 +55,7 @@ export function registerIntelligenceRuntimeCommands(registry: CommandRegistry):
     async handler(args, ctx) {
       const sub = (args[0] ?? 'review').toLowerCase();
       if (sub === 'panel' || sub === 'open') {
-        // W6.1 (the purge): 'intelligence'/IntelligencePanel was
+        // (the purge): 'intelligence'/IntelligencePanel was
         // DELETE-disposition (no surviving human surface — its read model
         // stays and still backs every subcommand below). There is no alias
         // to resolve through, so this prints an honest notice and opens

package/src/input/commands/local-auth-runtime.ts

@@ -10,7 +10,7 @@ export function handleLocalAuthCommand(args: string[], ctx: CommandContext): voi
   const sub = (args[0] ?? 'review').toLowerCase();
   const auth = requireLocalUserAuthManager(ctx);
   if (sub === 'panel' || sub === 'open') {
-    // W6.1: browse view moved to local-auth-modal. The LocalAuthPanel itself is
+    // browse view moved to local-auth-modal. The LocalAuthPanel itself is
     // kept (masked password-entry host) but is no longer the /local-auth panel
     // destination — masked entry is reached via add-user/rotate-password below.
     ctx.openModal?.('local-auth-modal');

package/src/input/commands/local-provider-runtime.ts

@@ -4,29 +4,35 @@ import { writeFile, unlink } from 'node:fs/promises';
 import type { CommandRegistry } from '../command-registry.ts';
 import { fetchModelContextWindows } from '@pellux/goodvibes-sdk/platform/discovery';
 import type { CustomProviderConfig } from '@pellux/goodvibes-sdk/platform/providers';
-import { requireProviderApi, requireShellPaths } from './runtime-services.ts';
+import { requireProviderApi, requireSecretsManager, requireShellPaths } from './runtime-services.ts';
+import { ensureProviderKeyThenSelect } from '../provider-key-intake.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 function isValidProviderName(name: string): boolean {
   return /^[a-zA-Z0-9_-]+$/.test(name);
 }
 
+/** Conventional secrets-store key a custom provider reads its API key from. */
+function customProviderKeyName(providerName: string): string {
+  return `${providerName.replace(/[^A-Za-z0-9]/g, '_').toUpperCase()}_API_KEY`;
+}
+
 export function registerLocalProviderRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'provider',
     aliases: ['p'],
     description: 'Switch provider or manage custom providers (add/remove)',
-    usage: '[add <name> <baseURL> [apiKey] | remove <name> | <provider-name>]',
+    usage: '[add <name> <baseURL> | remove <name> | <provider-name>]',
     argsHint: '[add|remove|name]',
     async handler(args, ctx) {
       const shellPaths = requireShellPaths(ctx);
       if (args[0] === 'add') {
         const addArgs = args.slice(1);
         if (addArgs.length < 2) {
-          ctx.print('Usage: /provider add <name> <baseURL> [apiKey]\nExample: /provider add my-server http://192.168.0.85:8001/v1');
+          ctx.print('Usage: /provider add <name> <baseURL>\nExample: /provider add my-server http://192.168.0.85:8001/v1\nAfter the provider is created you can enter its API key with the keystrokes masked (or skip it for keyless endpoints).');
           return;
         }
-        const [name, baseURL, apiKey] = addArgs;
+        const [name, baseURL] = addArgs;
         if (!isValidProviderName(name)) {
           ctx.print('Error: Provider name must contain only letters, numbers, hyphens, and underscores.');
           return;
@@ -51,7 +57,6 @@ export function registerLocalProviderRuntimeCommands(registry: CommandRegistry):
           const controller = new AbortController();
           const timeoutId = setTimeout(() => controller.abort(), 5000);
           const headers: Record<string, string> = { 'Content-Type': 'application/json' };
-          if (apiKey) headers['Authorization'] = `Bearer ${apiKey}`;
           const res = await fetch(`${baseURL}/models`, { signal: controller.signal, headers });
           clearTimeout(timeoutId);
           if (res.ok) {
@@ -91,12 +96,16 @@ export function registerLocalProviderRuntimeCommands(registry: CommandRegistry):
               contextWindow: contextWindows[id] ?? 8192,
               capabilities: { toolCalling: true, codeEditing: true, reasoning: false, multimodal: false },
             }));
+        // The key is never embedded in the provider JSON. The config references
+        // it by name (apiKeyEnv) and the actual value lands in the secrets
+        // manager below, resolved live at request time.
+        const keyName = customProviderKeyName(name);
         const config: CustomProviderConfig = {
           name,
           displayName: name,
           type: 'openai-compat',
           baseURL,
-          ...(apiKey ? { apiKey } : {}),
+          apiKeyEnv: keyName,
           models,
         };
         try {
@@ -107,6 +116,32 @@ export function registerLocalProviderRuntimeCommands(registry: CommandRegistry):
           return;
         }
         ctx.print(`Provider '${name}' added with ${models.length} model(s):\n${discoveredModelIds.length > 0 ? discoveredModelIds.map((id) => `  • ${id} (${(contextWindows[id] ?? 8192).toLocaleString()} ctx)`).join('\n') : `  • ${defaultModel} (starter entry)`}\nThe file watcher will auto-register it shortly.`);
+        // Capture the key with the keystrokes masked, straight into the secrets
+        // manager — never a cleartext argument, never written into the JSON.
+        if (ctx.beginConcealedInput) {
+          const secretsManager = requireSecretsManager(ctx);
+          ctx.print(`Enter the API key for provider '${name}' (input is masked; press Enter to store, Esc to skip if the endpoint needs no key).`);
+          ctx.beginConcealedInput({
+            label: name,
+            onSubmit: (value) => {
+              if (value.length === 0) {
+                ctx.print(`No key stored for '${name}' (endpoint used without a key).`);
+                return;
+              }
+              void (async () => {
+                try {
+                  await secretsManager.set(keyName, value, { scope: 'user', medium: 'secure' });
+                  ctx.print(`Stored the API key for '${name}' (value hidden). It resolves live for this provider — no restart needed.`);
+                } catch (error) {
+                  ctx.print(`Could not store the key for '${name}': ${summarizeError(error)}`);
+                }
+              })();
+            },
+            onCancel: () => {
+              ctx.print(`No key stored for '${name}' (endpoint used without a key).`);
+            },
+          });
+        }
         return;
       }
 
@@ -157,10 +192,14 @@ export function registerLocalProviderRuntimeCommands(registry: CommandRegistry):
       }
       try {
         const selected = await providerApi.selectModel(match.registryKey);
-        ctx.session.runtime.model = selected.registryKey;
-        ctx.session.runtime.provider = selected.providerId;
-        ctx.platform.configManager.set('provider.model', selected.registryKey);
-        ctx.print(`Switched to provider: ${selected.providerId} (model: ${selected.modelId})`);
+        // Unconfigured provider selected → capture its key inline, then finish
+        // the switch so it lands ready to chat.
+        ensureProviderKeyThenSelect(ctx, selected.providerId, () => {
+          ctx.session.runtime.model = selected.registryKey;
+          ctx.session.runtime.provider = selected.providerId;
+          ctx.platform.configManager.set('provider.model', selected.registryKey);
+          ctx.print(`Switched to provider: ${selected.providerId} (model: ${selected.modelId})`);
+        });
       } catch (e) {
         ctx.print(`Error: ${summarizeError(e)}`);
       }

package/src/input/commands/local-runtime.ts

@@ -4,6 +4,7 @@ import { readFile } from 'node:fs/promises';
 import type { CommandRegistry, CommandContext } from '../command-registry.ts';
 import type { SelectionItem } from '../selection-modal.ts';
 import type { ContentPart } from '@pellux/goodvibes-sdk/platform/providers';
+import { formatModelDiscoveryReport } from '@pellux/goodvibes-sdk/platform/providers';
 import { resolveAndValidatePath } from '@pellux/goodvibes-sdk/platform/utils';
 import { BUILTIN_SECRET_PROVIDER_SOURCES, describeSecretRef, isSecretRefInput, resolveSecretRef } from '@pellux/goodvibes-sdk/platform/config';
 import { openCommandPanel, requireBookmarkManager, requireProviderApi, requireSecretsManager } from './runtime-services.ts';
@@ -70,7 +71,7 @@ export function registerLocalRuntimeCommands(registry: CommandRegistry): void {
     handler(args, ctx) {
       const sub = (args[0] ?? '').toLowerCase();
       if (sub === 'panel' || sub === 'review') {
-        // W6.1 (the purge): 'tools'/ToolInspectorPanel was DELETE-disposition
+        // (the purge): 'tools'/ToolInspectorPanel was DELETE-disposition
         // (no surviving human surface — tool results render inline in the
         // transcript, plus a per-node tool list in Fleet). There is no alias
         // to resolve through, so this prints an honest notice and opens
@@ -200,10 +201,42 @@ export function registerLocalRuntimeCommands(registry: CommandRegistry): void {
         const flags = new Set(rest.filter((value) => value.startsWith('--')));
         const valueParts = rest.filter((value) => !value.startsWith('--'));
         const [key, ...rawValueParts] = valueParts;
-        if (!key || valueParts.length === 0) {
+        if (!key) {
           ctx.print(`[secrets] Usage: /secrets ${sub} <KEY> <${sub === 'link' ? 'secret-ref' : 'value'}> [--user|--project] [--secure|--plaintext]`);
           return;
         }
+        const scope = flags.has('--user') ? 'user' : 'project';
+        const medium = flags.has('--plaintext') ? 'plaintext' : 'secure';
+        // /secrets set KEY (no value) drops into the concealed prompt so the
+        // value is typed with the keystrokes masked and never enters history.
+        if (sub === 'set' && rawValueParts.length === 0) {
+          if (!ctx.beginConcealedInput) {
+            ctx.print('[secrets] Usage: /secrets set <KEY> <value> [--user|--project] [--secure|--plaintext]');
+            return;
+          }
+          ctx.print(`[secrets] Enter value for ${key} (input is masked; press Enter to store, Esc to cancel).`);
+          ctx.beginConcealedInput({
+            label: key,
+            onSubmit: (value) => {
+              if (value.length === 0) {
+                ctx.print(`[secrets] ${key} not set (empty value).`);
+                return;
+              }
+              void (async () => {
+                try {
+                  await mgr.set(key, value, { scope, medium });
+                  ctx.print(`[secrets] Stored: ${key} (${scope}, ${medium})`);
+                } catch (error) {
+                  ctx.print(`[secrets] Could not store ${key}: ${summarizeError(error)}`);
+                }
+              })();
+            },
+            onCancel: () => {
+              ctx.print(`[secrets] ${key} cancelled.`);
+            },
+          });
+          return;
+        }
         const value = rawValueParts.join(' ');
         if (sub === 'link' && !isGoodVibesSecretRefInput(value)) {
           ctx.print('[secrets] Invalid secret reference. Use /secrets providers for examples.');
@@ -213,8 +246,6 @@ export function registerLocalRuntimeCommands(registry: CommandRegistry): void {
           ctx.print('[secrets] Invalid secret reference. Use /secrets providers for examples.');
           return;
         }
-        const scope = flags.has('--user') ? 'user' : 'project';
-        const medium = flags.has('--plaintext') ? 'plaintext' : 'secure';
         await mgr.set(key, value, { scope, medium });
         ctx.print(sub === 'link'
           ? `[secrets] Linked: ${key} -> ${describeSecretRef(value)} (${scope}, ${medium})`
@@ -337,7 +368,24 @@ export function registerLocalRuntimeCommands(registry: CommandRegistry): void {
       } catch (e) {
         ctx.print(`Token limits refresh failed: ${summarizeError(e)}`);
       }
-      if (!catalogOk || !benchmarksOk || !limitsOk) ctx.print('Some refreshes failed — see messages above.');
+      ctx.print('Refreshing live provider model lists...');
+      let discoveryOk = false;
+      try {
+        // Explicit user refresh → force past each provider's TTL cache and
+        // report the delta ("3 new, 1 retired") or the honest fallback reason.
+        const reports = await providerApi.refreshLiveModelDiscovery(undefined, { force: true });
+        discoveryOk = true;
+        if (reports.length === 0) {
+          ctx.print('No providers perform live model discovery.');
+        } else {
+          for (const report of reports) {
+            ctx.print(`  ${formatModelDiscoveryReport(report.providerId, report)}`);
+          }
+        }
+      } catch (e) {
+        ctx.print(`Live model discovery failed: ${summarizeError(e)}`);
+      }
+      if (!catalogOk || !benchmarksOk || !limitsOk || !discoveryOk) ctx.print('Some refreshes failed — see messages above.');
     },
   });
 

package/src/input/commands/memory.ts

@@ -24,7 +24,7 @@ import { handleRecallFilesApply, handleRecallFilesReview, handleRecallFilesSync
 // ── Top-level command ─────────────────────────────────────────────────────────
 
 /**
- * DEBT-5 item 3 divergence note (historical): the work order that shipped
+ * item 3 divergence note (historical): the work order that shipped
  * this command named its front door "/memory", but at the time `/memory` was
  * already a distinct, unrelated command (session-pinned sticky notes,
  * src/input/commands/session-content.ts) with no modal surface — so that
@@ -84,7 +84,7 @@ export const recallCommand: SlashCommand = {
   handler: async (args: string[], context: CommandContext): Promise<void> => {
     const [sub, ...rest] = args;
 
-    // DEBT-5 item 3: bare `/recall` opens the memory-modal surface — the old
+    // item 3: bare `/recall` opens the memory-modal surface — the old
     // bare/unknown-subcommand usage block moved to an explicit `report`
     // subcommand (scriptability preserved: /recall report).
     if (sub === undefined) {