@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/input/commands/operator-panel-runtime.ts

@@ -5,7 +5,7 @@ import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 /**
  * Parse `--target <id>[:<kind>]` out of the args following `<panel-id>
- * [top|bottom]` (DEBT-5 item 4). Splits the args array in place (removing the
+ * [top|bottom]` (item 4). Splits the args array in place (removing the
  * flag + its value) so positional `pane` parsing downstream is unaffected by
  * where the flag appears. Only `open fleet` currently has a deep-link
  * consumer (FleetPanel.receiveDeepLink) — other panel ids just ignore an
@@ -32,7 +32,7 @@ export function registerOperatorPanelCommand(registry: CommandRegistry): void {
       const pm = requirePanelManager(ctx);
       const sub = args[0]?.toLowerCase() ?? '';
       if (!sub || sub === 'toggle') {
-        // W6.1 (the purge): 'panel-list' (the browse-all-panels picker) was
+        // (the purge): 'panel-list' (the browse-all-panels picker) was
         // DELETE-disposition — a picker over a handful of panels is dead
         // weight now (see the Ctrl+P selectionModal repoint in
         // shell/ui-openers.ts for its interactive replacement). Bare
@@ -71,9 +71,9 @@ export function registerOperatorPanelCommand(registry: CommandRegistry): void {
           // no panel lands in the workspace. Report that honestly rather than
           // claiming "Panel opened: <id>".
           const redirectTarget = pm.getModalRedirect(id);
-          // UX-C focus rule 1a: the command path leaves focus in the composer
+          // focus rule 1a: the command path leaves focus in the composer
           // ("mid-command-flow") — showPanel does not grab panel focus here.
-          // DEBT-5: forward the deep-link target so the panel lands on the row.
+          // forward the deep-link target so the panel lands on the row.
           if (ctx.showPanel) ctx.showPanel(id, pane as 'top' | 'bottom' | undefined, target);
           else {
             pm.open(id, pane as 'top' | 'bottom' | undefined, target);
@@ -169,7 +169,7 @@ export function registerOperatorPanelCommand(registry: CommandRegistry): void {
       } else {
         const id = args[0]!;
         try {
-          // UX-C: bare `/panel <id>` is the same command path as `/panel open
+          // bare `/panel <id>` is the same command path as `/panel open
           // <id>` — composer stays focused.
           if (ctx.showPanel) ctx.showPanel(id);
           else {

package/src/input/commands/operator-rpc.ts

@@ -27,6 +27,7 @@ import { join } from 'node:path';
 import { createGoodVibesSdk } from '@pellux/goodvibes-sdk';
 import type { GoodVibesSdk } from '@pellux/goodvibes-sdk';
 import { GoodVibesSdkError } from '@pellux/goodvibes-sdk';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { resolveDaemonEnabled } from '@pellux/goodvibes-sdk/platform/config';
 import { getOrCreateCompanionToken } from '@pellux/goodvibes-sdk/platform/pairing';
 import type { CommandContext } from '../command-registry.ts';
@@ -44,8 +45,7 @@ export interface OperatorRpcAvailable {
 
 export type OperatorRpc = OperatorRpcUnavailable | OperatorRpcAvailable;
 
-function resolveControlPlaneBaseUrl(context: CommandContext): string | null {
-  const configManager = context.platform.configManager;
+function resolveControlPlaneBaseUrl(configManager: ConfigManager): string | null {
   const explicit = String(configManager.get('controlPlane.baseUrl') ?? '').trim();
   if (explicit) return explicit;
   const host = String(configManager.get('controlPlane.host') ?? '').trim();
@@ -55,27 +55,48 @@ function resolveControlPlaneBaseUrl(context: CommandContext): string | null {
 }
 
 /**
- * Resolve (or honestly refuse to resolve) an operator SDK client wired to
- * this workspace's control-plane daemon. Reasons for refusal are surfaced
- * verbatim to the caller so `/ci`, `/checkin`, and `/principals` can print
- * them directly rather than inventing their own wording.
+ * Context-free core of {@link getOperatorRpc}: resolve (or honestly refuse to
+ * resolve) an operator SDK client wired to this workspace's control-plane
+ * daemon from just the two things the resolution actually needs — the config
+ * manager and the home directory. Shared by the command layer (via
+ * getOperatorRpc) and the Fleet panel's gateway (fleet-gateway.ts) so both
+ * reach the same daemon over the same generic invoke path, never two divergent
+ * clients. Refusal reasons are surfaced verbatim so callers print them directly.
  */
-export function getOperatorRpc(context: CommandContext): OperatorRpc {
-  const configManager = context.platform.configManager;
+export function resolveOperatorRpc(deps: { readonly configManager: ConfigManager; readonly homeDirectory: string | (() => string) }): OperatorRpc {
+  const { configManager } = deps;
   if (!resolveDaemonEnabled(configManager)) {
     return { available: false, reason: 'the daemon is disabled (daemon.enabled=false) — no operator surface to reach. Enable it in /settings, then retry.' };
   }
-  const baseUrl = resolveControlPlaneBaseUrl(context);
+  const baseUrl = resolveControlPlaneBaseUrl(configManager);
   if (!baseUrl) {
     return { available: false, reason: 'no control-plane base URL is configured (controlPlane.baseUrl / controlPlane.host+port) — cannot reach the operator surface.' };
   }
-  const shellPaths = requireShellPaths(context);
-  const daemonHomeDir = join(shellPaths.homeDirectory, '.goodvibes', 'daemon');
+  // Resolve the home directory only AFTER the static refusals — a caller whose
+  // shell paths are not wired (a disabled-daemon path) must still get the honest
+  // unavailable reason above, never a "shell paths not wired" throw.
+  const homeDirectory = typeof deps.homeDirectory === 'function' ? deps.homeDirectory() : deps.homeDirectory;
+  const daemonHomeDir = join(homeDirectory, '.goodvibes', 'daemon');
   const token = getOrCreateCompanionToken('tui', { daemonHomeDir }).token;
   const sdk = createGoodVibesSdk({ baseUrl, authToken: token });
   return { available: true, sdk };
 }
 
+/**
+ * Resolve (or honestly refuse to resolve) an operator SDK client wired to
+ * this workspace's control-plane daemon. Reasons for refusal are surfaced
+ * verbatim to the caller so `/ci`, `/checkin`, and `/principals` can print
+ * them directly rather than inventing their own wording.
+ */
+export function getOperatorRpc(context: CommandContext): OperatorRpc {
+  return resolveOperatorRpc({
+    configManager: context.platform.configManager,
+    // Lazy: only resolved once the daemon-enabled + base-URL refusals pass, so a
+    // disabled-daemon context with no shell paths still returns the honest reason.
+    homeDirectory: () => requireShellPaths(context).homeDirectory,
+  });
+}
+
 /**
  * Render a thrown operator-rpc error honestly: a 404 means this daemon has
  * not wired a handler for the verb (a live local runtime that simply doesn't

package/src/input/commands/permissions-provenance.ts

@@ -63,7 +63,7 @@ const PERMISSION_KEYS: readonly { readonly key: string; readonly label: string;
   { key: 'permissions.mode', label: 'Permission mode', note: 'also the current session mode' },
   { key: 'permissions.backgroundAgents', label: 'Background-agent mode' },
   { key: 'behavior.autoApprove', label: 'Auto-approve everything' },
-  { key: 'featureFlags.permissions-policy-engine', label: 'Runtime policy engine (flag)' },
+  { key: 'permissions.engine', label: 'Permission evaluator', note: 'baseline or policy-engine' },
   { key: 'permissions.tools.read', label: 'Tool rule: read' },
   { key: 'permissions.tools.write', label: 'Tool rule: write' },
   { key: 'permissions.tools.edit', label: 'Tool rule: edit' },

package/src/input/commands/permissions-runtime.ts

@@ -1,21 +1,112 @@
-import type { CommandRegistry } from '../command-registry.ts';
+import type { CommandContext, CommandRegistry } from '../command-registry.ts';
+import type { SelectionItem, SelectionAction } from '../selection-modal.ts';
 import { buildPermissionProvenance, renderPermissionProvenance } from './permissions-provenance.ts';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+
+/** One remembered-rule row: what it does, and how/when it was remembered. */
+function describeRuleRow(record: {
+  rule: { id: string; description?: string | undefined; effect: 'allow' | 'deny' };
+  tier: string;
+  tool: string;
+  createdAt: number;
+}): { label: string; detail: string } {
+  const what = record.rule.description ?? record.rule.id;
+  return {
+    label: `${record.tool}: ${what}`,
+    detail: `${record.rule.effect} · remembered ${record.tier} · ${new Date(record.createdAt).toLocaleString()}`,
+  };
+}
+
+function showRememberedRules(ctx: CommandContext): void {
+  const store = ctx.clients?.userPermissionRuleStore;
+  if (!store) {
+    ctx.print('Remembered permission rules are not available on this surface.');
+    return;
+  }
+  const records = store.list();
+  if (records.length === 0) {
+    ctx.print('No remembered permission rules. Approving an ask with a remember tier stores one here.');
+    return;
+  }
+  if (ctx.openSelection) {
+    const revoke = new Map<string, SelectionAction>([['d', 'delete']]);
+    const items: SelectionItem[] = records.map((record) => {
+      const { label, detail } = describeRuleRow(record);
+      return { id: record.rule.id, label, detail, actions: '[d] revoke' };
+    });
+    ctx.openSelection('Remembered permission rules', items, { allowSearch: true, customActions: revoke }, (result) => {
+      if (!result || result.action !== 'delete') return;
+      void (async () => {
+        try {
+          const removed = await store.delete(result.item.id);
+          ctx.print(removed ? `Revoked remembered rule: ${result.item.label}` : `Rule already gone: ${result.item.label}`);
+        } catch (error) {
+          ctx.print(`Could not revoke the rule: ${summarizeError(error)}`);
+        }
+      })();
+    });
+    return;
+  }
+  // No selection surface: list them honestly with the revoke command to run.
+  ctx.print([
+    'Remembered permission rules:',
+    ...records.map((record) => {
+      const { label, detail } = describeRuleRow(record);
+      return `  ${record.rule.id}  ${label}  (${detail})`;
+    }),
+    '',
+    'Revoke one with: /permissions revoke <rule-id>',
+  ].join('\n'));
+}
+
+async function revokeRememberedRule(ctx: CommandContext, ruleId: string): Promise<void> {
+  const store = ctx.clients?.userPermissionRuleStore;
+  if (!store) {
+    ctx.print('Remembered permission rules are not available on this surface.');
+    return;
+  }
+  if (!ruleId) {
+    ctx.print('Usage: /permissions revoke <rule-id>  (see /permissions rules for ids)');
+    return;
+  }
+  try {
+    const removed = await store.delete(ruleId);
+    ctx.print(removed ? `Revoked remembered rule: ${ruleId}` : `No remembered rule with id: ${ruleId}`);
+  } catch (error) {
+    ctx.print(`Could not revoke the rule: ${summarizeError(error)}`);
+  }
+}
 
 /**
- * `/permissions` — the permission provenance panel. Prints every
- * permission-relevant setting in effect and where each value came from
- * (default / config file / runtime override / session mode), plus the current
- * session mode. Read-only: it changes no config. See permissions-provenance.ts
- * for how origin is resolved from the platform's own ConfigManager.
+ * `/permissions` — the permission settings surface. With no arguments it prints
+ * every permission-relevant setting in effect and where each value came from
+ * (provenance; read-only). `rules` lists the durable remembered approvals with a
+ * press-Enter revoke; `revoke <id>` removes one by id. Revokes hit the same
+ * in-process rule store the evaluator reads, so they take effect live.
  */
 export function registerPermissionsRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'permissions',
     aliases: ['perms'],
-    description: 'Show permission settings in effect and where each value came from (provenance)',
-    handler(_args, ctx) {
+    description: 'Show permission settings and provenance, and list or revoke remembered approval rules',
+    usage: '[rules | revoke <rule-id>]',
+    argsHint: '[rules|revoke]',
+    async handler(args, ctx) {
+      const sub = (args[0] ?? '').toLowerCase();
+      if (sub === 'rules' || sub === 'rule') {
+        showRememberedRules(ctx);
+        return;
+      }
+      if (sub === 'revoke' || sub === 'forget') {
+        await revokeRememberedRule(ctx, args[1] ?? '');
+        return;
+      }
       const provenance = buildPermissionProvenance(ctx.platform.configManager);
       ctx.print(renderPermissionProvenance(provenance));
+      const ruleCount = ctx.clients?.userPermissionRuleStore?.list().length ?? 0;
+      ctx.print(ruleCount > 0
+        ? `\n${ruleCount} remembered approval rule${ruleCount === 1 ? '' : 's'} in effect. Use /permissions rules to review or revoke them.`
+        : '\nNo remembered approval rules. Use /permissions rules once you have some.');
     },
   });
 }

package/src/input/commands/planning-runtime.ts

@@ -13,7 +13,7 @@ import { togglePlanMode, permissionModeLabel, type PermissionModeValue } from '.
  * A lone one of these is refused rather than seeded as a goal, so a stray verb
  * can never overwrite the project goal with itself.
  *
- * DEBT-3: `dismiss` and `answer` are now REAL subcommands (handled above this
+ * `dismiss` and `answer` are now REAL subcommands (handled above this
  * guard), so they were removed from the refuse-list. `pause`/`stop`/`cancel`
  * remain here — they still have no backing verb and must not seed a goal.
  */
@@ -178,7 +178,7 @@ export function registerPlanningRuntimeCommands(registry: CommandRegistry): void
         return;
       }
 
-      // DEBT-3: /plan dismiss — archive the current plan. Dismisses the active
+      // /plan dismiss — archive the current plan. Dismisses the active
       // execution plan (ExecutionPlanManager.dismiss, honest per-state) AND
       // deactivates the project-planning interview state shown in the modal so a
       // later /plan <goal> starts fresh. Mid-execution is refused outright.
@@ -223,7 +223,7 @@ export function registerPlanningRuntimeCommands(registry: CommandRegistry): void
         return;
       }
 
-      // DEBT-3: /plan answer <n|question-id> <text> — record a real answer to an
+      // /plan answer <n|question-id> <text> — record a real answer to an
       // open planning question (moves open → answered, consumed on next refine).
       if (args[0] === 'answer') {
         if (!projectPlanningService || !projectId) {

package/src/input/commands/platform-sandbox-runtime.ts

@@ -98,7 +98,7 @@ export function registerPlatformSandboxRuntimeCommands(registry: CommandRegistry
       const shellPaths = requireShellPaths(ctx);
       const sub = args[0] ?? 'open';
       if (sub === 'open' || sub === 'panel') {
-        ctx.openModal?.('sandbox-modal'); // W6.1: sandbox panel -> config modal
+        ctx.openModal?.('sandbox-modal'); // sandbox panel -> config modal
         return;
       }
       if (sub === 'review') {

package/src/input/commands/power-runtime.ts

@@ -0,0 +1,56 @@
+import type { CommandRegistry } from '../command-registry.ts';
+import { powerStatusLines } from '../../core/power-status.ts';
+
+// ---------------------------------------------------------------------------
+// /power — host sleep ownership (the ops/status idiom surface for power.*).
+//
+// Shows the honest account of sleep ownership — the "sleep disabled" chip
+// meaning, each "held because X" work-inhibition reason, and the lid-split note
+// rendered VERBATIM when the OS could block idle-sleep but not lid-close
+// suspend — and toggles the daemon-held keep-awake switch. Owner ruling: the
+// always-visible chip IS the safety mechanism, so there is no timer and no
+// AC-only option — keep-awake is exactly one on/off toggle.
+// ---------------------------------------------------------------------------
+
+export function registerPowerRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'power',
+    description: 'Host sleep ownership — show status and toggle keep-awake',
+    usage: '[status | on | off | toggle]',
+    argsHint: '[status|on|off|toggle]',
+    async handler(args, ctx) {
+      const sub = (args[0] ?? 'status').toLowerCase();
+
+      if (sub === 'status' || args.length === 0) {
+        const state = ctx.getPowerState?.();
+        if (!state) {
+          ctx.print('Power status is unavailable in this session.');
+          return;
+        }
+        const lines = ['Host sleep ownership:', ...powerStatusLines(state).map((l) => `  ${l}`)];
+        lines.push(state.keepAwake
+          ? 'Keep-awake is ON. Turn it off with /power off.'
+          : 'Keep-awake is OFF. Turn it on with /power on.');
+        ctx.print(lines.join('\n'));
+        return;
+      }
+
+      if (sub === 'on' || sub === 'off' || sub === 'toggle') {
+        if (!ctx.setKeepAwake || !ctx.getPowerState) {
+          ctx.print('Keep-awake cannot be changed in this session.');
+          return;
+        }
+        const current = ctx.getPowerState().keepAwake;
+        const next = sub === 'on' ? true : sub === 'off' ? false : !current;
+        const state = await ctx.setKeepAwake(next);
+        const lines = [state.keepAwake ? 'Keep-awake ON — this host will not idle-sleep.' : 'Keep-awake OFF.'];
+        // Surface the honest lid-split note verbatim if the SDK served one.
+        if (state.note) lines.push(`  ${state.note}`);
+        ctx.print(lines.join('\n'));
+        return;
+      }
+
+      ctx.print('Usage: /power [status | on | off | toggle]');
+    },
+  });
+}

package/src/input/commands/provider-accounts-runtime.ts

@@ -3,11 +3,13 @@ import type {
   ProviderAccountRecord,
   ProviderAccountSnapshot,
 } from '@/runtime/index.ts';
+import type { SelectionItem } from '../selection-modal.ts';
 import {
-  openCommandPanel,
   requireOperatorClient,
 } from './runtime-services.ts';
 
+type RecommendedAction = ProviderAccountRecord['recommendedActions'][number];
+
 async function loadProviderAccountSnapshot(context: CommandContext): Promise<ProviderAccountSnapshot> {
   return await requireOperatorClient(context).providers.accountSnapshot();
 }
@@ -20,6 +22,71 @@ function findProviderAccountRecord(
   return snapshot.providers.find((entry) => entry.providerId === providerId);
 }
 
+/**
+ * Present a record's recommended actions as executable rows. A recommended
+ * action that carries a structured command becomes a press-Enter row that RUNS
+ * that command through the command registry — never a line the user has to
+ * retype. Actions with no command are genuinely out-of-product steps, so they
+ * stay as plain (non-executing) rows. When there is no interactive selection
+ * surface, each action is printed honestly instead.
+ */
+export function presentRecommendedActions(
+  ctx: CommandContext,
+  providerId: string,
+  actions: readonly RecommendedAction[],
+): void {
+  if (actions.length === 0) {
+    ctx.print('No active repair actions suggested.');
+    return;
+  }
+  if (ctx.openSelection) {
+    const items: SelectionItem[] = actions.map((action, index) => {
+      if (action.command) {
+        const argsPart = action.command.args.length > 0 ? ` ${action.command.args.join(' ')}` : '';
+        return {
+          id: String(index),
+          label: action.description,
+          detail: `runs /${action.command.name}${argsPart}`,
+          primaryAction: 'select',
+        };
+      }
+      return {
+        id: String(index),
+        label: action.description,
+        detail: 'manual step (nothing to run)',
+        primaryAction: 'select',
+      };
+    });
+    ctx.openSelection(
+      `Repair ${providerId}`,
+      items,
+      { allowSearch: false, primaryVerbLabel: 'Run' },
+      (result) => {
+        if (!result) return;
+        const action = actions[Number(result.item.id)];
+        if (!action) return;
+        if (action.command) {
+          const args = [...action.command.args];
+          void (ctx.executeCommand?.(action.command.name, args)
+            ?? Promise.resolve(ctx.print(`Cannot run /${action.command.name} — command execution is unavailable here.`)));
+          return;
+        }
+        ctx.print(action.description);
+      },
+    );
+    return;
+  }
+  // No selection surface (headless/command-only): list actions honestly.
+  ctx.print([
+    'Recommended actions:',
+    ...actions.map((action) => (
+      action.command
+        ? `  • ${action.description} — /${action.command.name}${action.command.args.length > 0 ? ` ${action.command.args.join(' ')}` : ''}`
+        : `  • ${action.description} (manual step)`
+    )),
+  ].join('\n'));
+}
+
 export function registerProviderAccountsRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'accounts',
@@ -29,7 +96,7 @@ export function registerProviderAccountsRuntimeCommands(registry: CommandRegistr
     async handler(args, ctx) {
       const sub = (args[0] ?? 'review').toLowerCase();
       if (sub === 'panel' || sub === 'open') {
-        ctx.openModal?.('providers-modal'); // W6.1: accounts alias -> provider-health modal
+        ctx.openModal?.('providers-modal'); // accounts alias -> provider-health modal
         return;
       }
       const snapshot = await loadProviderAccountSnapshot(ctx);
@@ -63,10 +130,8 @@ export function registerProviderAccountsRuntimeCommands(registry: CommandRegistr
           `  preferred route: ${record.preferredRoute}`,
           ...(record.fallbackRisk ? [`  fallback: ${record.fallbackRisk}`] : []),
           ...(record.issues.map((issue) => `  issue: ${issue}`)),
-          ...(record.recommendedActions.length > 0
-            ? ['  next:', ...record.recommendedActions.map((action) => `    ${action}`)]
-            : ['  No active repair actions suggested.']),
         ].join('\n'));
+        presentRecommendedActions(ctx, record.providerId, record.recommendedActions);
         return;
       }
       if (sub === 'show') {
@@ -95,8 +160,8 @@ export function registerProviderAccountsRuntimeCommands(registry: CommandRegistr
           ...record.usageWindows.map((entry) => `  window: ${entry.label} — ${entry.detail}`),
           ...record.issues.map((issue) => `  issue: ${issue}`),
           ...record.notes.map((note) => `  note: ${note}`),
-          ...record.recommendedActions.map((action) => `  next: ${action}`),
         ].join('\n'));
+        presentRecommendedActions(ctx, record.providerId, record.recommendedActions);
         return;
       }
       ctx.print([

package/src/input/commands/provider.ts

@@ -15,14 +15,13 @@
  */
 
 import type { SlashCommand, CommandContext } from '../command-registry.ts';
-import type { ConfigKey } from '../../config/index.ts';
 import type { RouteExplanation } from '@pellux/goodvibes-sdk/platform/providers';
 import type { FallbackTestResult, FallbackTransition } from '@pellux/goodvibes-sdk/platform/providers';
 import type { ProviderApiModelRecord } from '@pellux/goodvibes-sdk/platform/providers';
 import { requireProviderApi } from './runtime-services.ts';
+import { featureEnablementWrite } from '../../runtime/feature-settings.ts';
 
 const PROVIDER_OPTIMIZER_FLAG = 'provider-optimizer';
-const PROVIDER_OPTIMIZER_CONFIG_KEY = `featureFlags.${PROVIDER_OPTIMIZER_FLAG}` as ConfigKey;
 
 // ---------------------------------------------------------------------------
 // Formatting helpers
@@ -95,9 +94,12 @@ function handleOptimizerToggle(
   const wasEnabled = optimizer.enabled;
   optimizer.setEnabled(enable);
 
-  // Persist to config so the setting survives restart.
-  const flagValue = enable ? 'enabled' : 'disabled';
-  context.platform.configManager.setDynamic(PROVIDER_OPTIMIZER_CONFIG_KEY, flagValue);
+  // Persist to config so the setting survives restart: the optimizer is
+  // governed by the provider.optimizerMode settings key (off = disabled;
+  // manual/auto/pinned = active), and the settings bridge forwards the same
+  // write to the runtime gate.
+  const write = featureEnablementWrite(PROVIDER_OPTIMIZER_FLAG, enable);
+  if (write) context.platform.configManager.setDynamic(write.key, write.value);
 
   if (enable && !wasEnabled) {
     context.print('[provider] Optimizer enabled.');

package/src/input/commands/qrcode-runtime.ts

@@ -1,36 +1,31 @@
-import { join } from 'node:path';
 import type { CommandRegistry } from '../command-registry.ts';
-import { openModalCommand, requireShellPaths } from './runtime-services.ts';
-import { regenerateCompanionToken } from '@pellux/goodvibes-sdk/platform/pairing';
+import { openModalCommand } from './runtime-services.ts';
 
 /**
  * Register the /qrcode command.
  *
- * `/qrcode` (no args) opens the companion-app pairing modal (QR code + URL/
- * token/username). `/qrcode regenerate` rotates the companion pairing token:
- * it re-keys the shared operator-token store, so the previously-issued token is
- * rejected on the next auth and a fresh QR must be scanned to reconnect.
+ * `/qrcode` (no args, aliases /qr /pair) opens the device-pairing modal: a QR of
+ * the `#pair=<token>` deep link plus the offer set. Each open mints its own
+ * named per-device token, so `/qrcode regenerate` no longer rotates a shared
+ * token — it simply re-opens the modal, which mints a fresh token and QR. The
+ * previously-shown token stays valid until you revoke it in
+ * /settings → security → devices.
  */
 export function registerQrcodeRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'qrcode',
     aliases: ['qr', 'pair'],
-    description: 'Open the companion-app pairing modal (QR code), or regenerate the pairing token',
+    description: 'Open the device-pairing modal (QR deep link + offers); each open mints a fresh device token',
     usage: '[regenerate]',
     argsHint: '[regenerate]',
     handler(args, ctx) {
       if (args[0]?.toLowerCase() === 'regenerate') {
-        const shellPaths = requireShellPaths(ctx);
-        const daemonHomeDir = join(shellPaths.homeDirectory, '.goodvibes', 'daemon');
-        try {
-          const rotated = regenerateCompanionToken({ daemonHomeDir });
-          ctx.print(
-            'Pairing token rotated. The previous token is now rejected — ' +
-            `re-scan the QR (new peer ${rotated.peerId.slice(0, 8)}…) to reconnect the companion app.`,
-          );
-        } catch (error) {
-          ctx.print(`Could not regenerate the pairing token: ${String(error)}`);
-        }
+        // Each pairing-modal open mints its own token, so "regenerate" is just a
+        // fresh open: the re-pull mints a new named token + QR in place. The
+        // prior token is not rotated out from under a live device — revoke it
+        // explicitly in /settings → security → devices when you no longer need it.
+        ctx.print('Opening a fresh pairing QR — it mints a new device token. Revoke old ones in /settings → security → devices.');
+        openModalCommand(ctx, 'pairing-modal');
         return;
       }
       openModalCommand(ctx, 'pairing-modal');

package/src/input/commands/queue-runtime.ts

@@ -0,0 +1,70 @@
+import type { CommandRegistry } from '../command-registry.ts';
+
+// ---------------------------------------------------------------------------
+// /queue — the mid-turn message queue as an editable list.
+//
+// Messages typed while a turn is streaming are QUEUED (they deliver after the
+// turn). Until a message is delivered it stays editable and deletable via the
+// SDK's editQueuedMessage / deleteQueuedMessage verbs; a delivered message has
+// left the queue and is no longer listed — delivery is immutability. This
+// command is the editable interface over the same list the composer renders.
+// ---------------------------------------------------------------------------
+
+export function registerQueueRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'queue',
+    aliases: ['q'],
+    description: 'Mid-turn message queue — list, edit, or delete still-undelivered messages',
+    usage: '[list | edit <n> <text> | delete <n>]',
+    argsHint: '[list|edit <n> <text>|delete <n>]',
+    handler(args, ctx) {
+      const list = ctx.listQueuedMessages?.() ?? [];
+      const sub = (args[0] ?? 'list').toLowerCase();
+
+      if (sub === 'list' || args.length === 0) {
+        if (list.length === 0) {
+          ctx.print('No queued messages. (Messages typed while a turn is streaming queue here until it finishes.)');
+          return;
+        }
+        const lines = [`Queued messages (${list.length}) — editable until delivered:`];
+        list.forEach((m, i) => lines.push(`  ${i + 1}. ${m.text}`));
+        lines.push('Use /queue edit <n> <new text> or /queue delete <n>.');
+        ctx.print(lines.join('\n'));
+        return;
+      }
+
+      // Both edit and delete address a message by its 1-based list position.
+      const n = Number.parseInt(args[1] ?? '', 10);
+      if (!Number.isInteger(n) || n < 1 || n > list.length) {
+        ctx.print(list.length === 0
+          ? 'No queued messages to act on.'
+          : `No queued message #${args[1] ?? ''}. Valid range: 1..${list.length}. Run /queue to list them.`);
+        return;
+      }
+      const target = list[n - 1]!;
+
+      if (sub === 'delete') {
+        const ok = ctx.deleteQueuedMessage?.(target.id) ?? false;
+        ctx.print(ok
+          ? `Deleted queued message #${n}.`
+          : `Could not delete message #${n} — it was already delivered (delivered messages are immutable).`);
+        return;
+      }
+
+      if (sub === 'edit') {
+        const text = args.slice(2).join(' ');
+        if (!text.trim()) {
+          ctx.print('Usage: /queue edit <n> <new text>. Provide the replacement text.');
+          return;
+        }
+        const ok = ctx.editQueuedMessage?.(target.id, text) ?? false;
+        ctx.print(ok
+          ? `Edited queued message #${n}.`
+          : `Could not edit message #${n} — it was already delivered (delivered messages are immutable).`);
+        return;
+      }
+
+      ctx.print('Usage: /queue [list | edit <n> <text> | delete <n>]');
+    },
+  });
+}