@pellux/goodvibes-tui 1.17.0 → 1.18.0

package/src/panels/workstream-graph-render.ts

@@ -0,0 +1,123 @@
+// ---------------------------------------------------------------------------
+// workstream-graph-render.ts — render a workstream's task graph (fleet.graph.get)
+// legibly, so the observability layer shows the dependency graph's shape,
+// states, and pool posture WITHOUT opening any transcript.
+//
+// The SDK serves a WorkstreamGraphSnapshot: nodes (id/title/state, plus
+// blockedReason, orphaned, stalled, agentId), edges (from → to dependency
+// links), and the elastic-pool state (ready/running/atCap/maxSize). This module
+// is a pure string renderer; every line is fit to the given width (no clipping,
+// no horizontal overflow), so the same output drives a panel or a command.
+// ---------------------------------------------------------------------------
+
+import type { OperatorMethodOutput } from '@pellux/goodvibes-sdk';
+import { truncateDisplay, getDisplayWidth } from '../utils/terminal-width.ts';
+
+export type WorkstreamGraphSnapshot = OperatorMethodOutput<'fleet.graph.get'>;
+export type WorkstreamGraphNode = WorkstreamGraphSnapshot['nodes'][number];
+
+/** The pool posture line: "N ready, M running[, at cap (fleet.maxSize=N)]". */
+export function renderPoolSummary(pool: WorkstreamGraphSnapshot['pool']): string {
+  if (!pool) return 'no pool state';
+  const base = `${pool.ready} ready, ${pool.running} running`;
+  return pool.atCap ? `${base}, at cap (fleet.maxSize=${pool.maxSize})` : base;
+}
+
+/** The leading glyph for a node — orphaned/blocked/stalled tells win over the base state. */
+function nodeGlyph(node: WorkstreamGraphNode): string {
+  if (node.orphaned) return '⊘';
+  if (node.blockedReason) return '⊘';
+  if (node.stalled) return '◒';
+  switch (node.state) {
+    case 'running': return '●';
+    case 'ready': return '○';
+    case 'done': return '✓';
+    case 'failed': return '✕';
+    default: return '·';
+  }
+}
+
+/** The state tell for a node: the "waiting on: X" for blocked, running/ready, plus orphaned/stalled markers. */
+function nodeTell(node: WorkstreamGraphNode, needs: readonly string[]): string {
+  const parts: string[] = [];
+  if (node.blockedReason) {
+    parts.push(`blocked — waiting on: ${node.blockedReason}`);
+  } else if (node.state === 'running') {
+    parts.push(node.agentId ? `running (${node.agentId})` : 'running');
+  } else if (node.state === 'ready') {
+    parts.push('ready');
+  } else {
+    parts.push(node.state);
+  }
+  if (needs.length > 0 && !node.blockedReason) parts.push(`needs: ${needs.join(', ')}`);
+  if (node.orphaned) parts.push('orphaned');
+  if (node.stalled) parts.push('stalled');
+  return parts.join(' · ');
+}
+
+/** Fit a line to the width without overflowing (truncates with an ellipsis). */
+function fit(line: string, width: number): string {
+  return getDisplayWidth(line) > width ? truncateDisplay(line, width) : line;
+}
+
+/**
+ * Wrap content to the width on word boundaries — NO clipping: the whole tell
+ * (including a long "waiting on: …" reason) survives onto indented continuation
+ * lines rather than being cut off. `firstIndent` leads the first line;
+ * `contIndent` leads each continuation. A single word longer than the width is
+ * hard-fit defensively so a line never overflows.
+ */
+function wrapContent(content: string, width: number, firstIndent: string, contIndent: string): string[] {
+  const words = content.split(/\s+/).filter(Boolean);
+  const out: string[] = [];
+  let cur = firstIndent;
+  let hasWord = false;
+  for (const word of words) {
+    const candidate = hasWord ? `${cur} ${word}` : `${cur}${word}`;
+    if (getDisplayWidth(candidate) > width && hasWord) {
+      out.push(cur);
+      cur = `${contIndent}${word}`;
+    } else {
+      cur = candidate;
+    }
+    hasWord = true;
+  }
+  if (hasWord) out.push(cur);
+  return out.map((l) => (getDisplayWidth(l) > width ? fit(l, width) : l));
+}
+
+/**
+ * Render the whole snapshot as legible lines, each fit to `width`. The header
+ * carries the pool posture; every node is one line with its glyph, title, and
+ * state tell (ready / running / blocked-with-waiting-on / stalled / orphaned),
+ * with its dependency edges named inline ("needs: …"). An empty graph states so
+ * honestly rather than rendering a blank surface.
+ */
+export function renderWorkstreamGraphLines(snapshot: WorkstreamGraphSnapshot, width: number): string[] {
+  const lines: string[] = [];
+  // Title and pool posture on their own lines so neither clips the other at a
+  // narrow width — the pool summary ("… at cap (fleet.maxSize=N)") is load-bearing.
+  lines.push(fit(snapshot.title, width));
+  lines.push(fit(`  ${renderPoolSummary(snapshot.pool)}`, width));
+
+  if (snapshot.nodes.length === 0) {
+    lines.push(fit('  (no work items in this workstream)', width));
+    return lines;
+  }
+
+  const titleById = new Map<string, string>();
+  for (const node of snapshot.nodes) titleById.set(node.id, node.title);
+  const needsByNode = new Map<string, string[]>();
+  for (const edge of snapshot.edges) {
+    const list = needsByNode.get(edge.to) ?? [];
+    list.push(titleById.get(edge.from) ?? edge.from);
+    needsByNode.set(edge.to, list);
+  }
+
+  for (const node of snapshot.nodes) {
+    const glyph = nodeGlyph(node);
+    const tell = nodeTell(node, needsByNode.get(node.id) ?? []);
+    lines.push(...wrapContent(`${glyph} ${node.title}  ${tell}`, width, '  ', '      '));
+  }
+  return lines;
+}

package/src/renderer/composer-fragments.ts

@@ -0,0 +1,69 @@
+// ---------------------------------------------------------------------------
+// composer-fragments.ts — composer-adjacent transcript fragments extracted from
+// ui-factory.ts (file-size hygiene): the mid-turn queued-message editable list
+// and the optional "used N memories" provenance chip. Pure renderers; the
+// UIFactory static methods are thin wrappers over these.
+// ---------------------------------------------------------------------------
+
+import { type Line } from '../types/grid.ts';
+import { renderConversationFragment } from './conversation-surface.ts';
+import { activeUiTones } from './theme.ts';
+import { activeTheme } from './theme.ts';
+
+/**
+ * The mid-turn message queue rendered as an EDITABLE list. Each still-undelivered
+ * message shows a 1-based number so it can be named to `/queue edit <n> …` /
+ * `/queue delete <n>` (the SDK editQueuedMessage / deleteQueuedMessage verbs). A
+ * delivered message has already left the queue, so the list only ever shows what
+ * is still editable — delivery is immutability, made visible.
+ */
+export function renderQueuedMessageList(width: number, items: readonly { readonly id: string; readonly text: string }[]): Line[] {
+  if (items.length === 0) return [];
+  const t = activeUiTones();
+  const bodyBg = activeTheme().collapsedBodyBg;
+  const lines: Line[] = [];
+  const header = `${items.length} queued — /queue edit·delete until delivered`;
+  lines.push(...renderConversationFragment(header, width, { prefix: ' ⧗ ', prefixFg: t.state.reasoning, text: t.fg.dim, bodyBg, dim: true }));
+  items.forEach((item, index) => {
+    lines.push(...renderConversationFragment(item.text, width, { prefix: `   ${index + 1}. `, prefixFg: t.state.reasoning, text: t.fg.dim, bodyBg, dim: true }));
+  });
+  return lines;
+}
+
+/**
+ * One drilled-in memory-provenance row. `record` is the RESOLVED record summary
+ * (undefined = still resolving, null = no longer available) — the drill-in
+ * shows a human summary, never a raw record id, matching the webui's detail
+ * fetch (per-id, so one missing record never blanks the rest).
+ */
+export interface MemoryProvenanceEntry {
+  readonly id: string;
+  readonly record?: { readonly summary: string; readonly cls: string } | null | undefined;
+}
+
+/**
+ * The optional "used N memories" turn chip. Collapsed: one small line naming the
+ * count with the drill-in hint. Expanded (Alt+M): the same line followed by one
+ * line per memory — its resolved SUMMARY (with the record class), a "resolving…"
+ * placeholder while the fetch is in flight, or an honest "no longer available"
+ * for a record that has since been forgotten. Empty when no memories were used.
+ */
+export function renderMemoryProvenanceChip(width: number, count: number, entries: readonly MemoryProvenanceEntry[], expanded: boolean): Line[] {
+  if (count <= 0) return [];
+  const t = activeUiTones();
+  const bodyBg = activeTheme().collapsedBodyBg;
+  const noun = count === 1 ? 'memory' : 'memories';
+  const header = expanded ? `used ${count} ${noun} — Alt+M to hide` : `used ${count} ${noun} — Alt+M to list`;
+  const lines: Line[] = renderConversationFragment(header, width, { prefix: ' ◆ ', prefixFg: t.state.info, text: t.fg.dim, bodyBg, dim: true });
+  if (expanded) {
+    entries.forEach((entry, index) => {
+      const body = entry.record === undefined
+        ? 'resolving…'
+        : entry.record === null
+          ? 'no longer available'
+          : `${entry.record.summary}  ·  ${entry.record.cls}`;
+      lines.push(...renderConversationFragment(body, width, { prefix: `   ${index + 1}. `, prefixFg: t.state.info, text: t.fg.dim, bodyBg, dim: true }));
+    });
+  }
+  return lines;
+}

package/src/renderer/settings-modal-helpers.ts

@@ -77,6 +77,7 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   wrfc: 'WRFC',
   helper: 'Helper',
   tts: 'TTS',
+  voice: 'Voice (local engines)',
   service: 'Service',
   daemon: 'Daemon',
   controlPlane: 'Control Plane',
@@ -95,6 +96,8 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   surfaces: 'Surfaces',
   cloudflare: 'Cloudflare',
   release: 'Release',
+  power: 'Power',
+  memory: 'Memory',
   danger: 'Danger',
   tools: 'Tools',
   network: 'Network',
@@ -115,6 +118,12 @@ const SETTING_LABELS: Partial<Record<string, string>> = {
   'ui.voiceEnabled': 'Always Speak',
   'behavior.autoCompactThreshold': 'Auto-Compact %',
   'behavior.staleContextWarnings': 'Context Warnings',
+  // Blocked-too-long escalation: a fleet node waiting on a human gets a device
+  // push once the grace elapses (regardless of an attached surface), then bounded
+  // reminders. Real numeric option shapes come from the SDK schema's ranges.
+  'notifications.blockedEscalationGraceMs': 'Blocked-Too-Long Grace (ms)',
+  'notifications.blockedEscalationFollowUpMs': 'Blocked Reminder Interval (ms)',
+  'notifications.blockedEscalationMaxFollowUps': 'Blocked Reminder Limit',
   'behavior.returnContextMode': 'Return Context',
   'behavior.guidanceMode': 'Guidance Mode',
   'storage.secretPolicy': 'Secret Policy',

package/src/renderer/settings-modal.ts

@@ -40,6 +40,7 @@ const CATEGORY_INFO: Record<SettingsCategory, string> = {
   wrfc: 'Work-review-fix-cycle thresholds, retry limits, and automatic commit behavior.',
   helper: 'Helper model defaults used by helper subsystems when they do not use the main chat route.',
   tts: 'Text-to-speech provider, voice, and optional spoken-turn LLM overrides.',
+  voice: 'Free, offline local voice engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro. All empty by default — configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error). Once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension.',
   service: 'Background service posture: enabled state, autostart, restart behavior, service name, platform, and logs.',
   daemon: 'Local session daemon. It hosts the shared session broker and companion chat so a session started here is visible and steerable from other surfaces. On by default, bound to loopback (127.0.0.1) only.',
   controlPlane: 'Daemon control-plane settings for local admin/API access.',
@@ -58,6 +59,8 @@ const CATEGORY_INFO: Record<SettingsCategory, string> = {
   surfaces: 'External app surfaces such as Slack, Discord, ntfy, Home Assistant, Telegram, webhooks, chat bridges, and messaging providers.',
   cloudflare: 'Optional Cloudflare control plane, batch queue, Worker, Tunnel, Access, DNS, KV, Durable Objects, Secrets Store, and R2 settings.',
   release: 'Release-channel preference.',
+  power: 'Host sleep ownership. Keep-awake holds the host awake (the always-visible "sleep disabled" chip is the safety mechanism — no timer, no AC-only option); automatic inhibition keeps the host awake while real work runs, with an honest hard cap on that work hold.',
+  memory: 'Memory provenance surfacing. Whether turns that drew on your standing memories show a small "used N memories" chip with a drill-in listing them. Off by default — when off, nothing is rendered and no context is added.',
   danger: 'High-impact switches for daemon and HTTP listener behavior. These are operational overrides, not normal preferences.',
   tools: 'Tool LLM and helper model routing. Empty provider/model values inherit the active chat route unless a specific helper/tool route is set.',
   network: 'Combined network view for daemon control-plane, HTTP listener, browser web surface, and general outbound network settings.',
@@ -183,8 +186,7 @@ function buildSettingContext(modal: SettingsModal, entry: SettingEntry): string[
   if (entry.locked) lines.push(`Locked: ${entry.lockReason ?? 'This setting is locked by a higher-priority layer.'}`);
   if (entry.conflict) lines.push(`Conflict: resolve with /settings-sync resolve ${entry.setting.key} local|synced.`);
 
-  // A settings sub-row owned by a feature unit names its feature so "what
-  // does this do" is answerable without scrolling back to the header row.
+  // A settings sub-row owned by a feature unit names its feature so "what does this do" is answerable without scrolling back to the header row.
   if (entry.ownerFlagId) {
     const owner = FEATURE_SETTINGS_BY_ID.get(entry.ownerFlagId);
     if (owner) lines.push(`Part of feature: ${owner.name} (the header row above).`);

package/src/renderer/shell-surface.ts

@@ -67,6 +67,8 @@ export interface ShellFooterBuildOptions {
   readonly sessionSpineStatus?: 'online' | 'offline';
   /** The web surface's reachable URL, when that surface is enabled; a persistent footer segment. */
   readonly webSurfaceUrl?: string;
+  /** True while power.keepAwake holds — renders the always-visible "sleep disabled" chip. */
+  readonly powerKeepAwake?: boolean;
 }
 
 export interface ShellFooterBuildResult {
@@ -147,6 +149,7 @@ export function buildShellFooter(
     options.sessionSpineStatus,
     options.permissionMode,
     options.webSurfaceUrl,
+    options.powerKeepAwake,
   );
   // Compact posture drops the process indicator and context hint entirely so
   // the footer fits within ~5 rows on short terminals.

package/src/renderer/tool-call.ts

@@ -147,7 +147,7 @@ function extractKeyArg(toolCall: ToolCall): string {
  * Layout: [margin] [icon] [space] [tool name padded] [key arg] [summary] [duration]
  *
  * @param toolCall - The tool call being executed
- * @param status - 'executing' | 'done' | 'error'
+ * @param status - 'executing' | 'done' | 'error' | 'pending' | 'cancelled'
  * @param resultSummary - Optional brief summary (e.g., "3 files", "exit 0")
  * @param width - Terminal width
  * @param durationMs - Optional duration in milliseconds
@@ -157,7 +157,7 @@ function extractKeyArg(toolCall: ToolCall): string {
  */
 export function renderToolCallBlock(
   toolCall: ToolCall,
-  status: 'executing' | 'done' | 'error' | 'pending',
+  status: 'executing' | 'done' | 'error' | 'pending' | 'cancelled',
   resultSummary: string | undefined,
   width: number,
   durationMs?: number,
@@ -174,12 +174,16 @@ export function renderToolCallBlock(
   // Status icon. 'pending' means the tool is still awaiting a decision
   // (e.g. an approval prompt) and has NOT run yet — it uses the hollow idle
   // glyph so a not-yet-run tool never shows the completed green ✓ (2c).
+  // 'cancelled' means the user stopped THIS call mid-flight — the blocked glyph
+  // in the warn tone, distinct from both success and a real error.
   const icon = status === 'done' ? TOOL_STATUS.SUCCESS_ICON
     : status === 'error' ? TOOL_STATUS.FAIL_ICON
+    : status === 'cancelled' ? GLYPHS.status.blocked
     : status === 'pending' ? GLYPHS.status.idle
     : TOOL_STATUS.SPINNER_FRAMES[(frameIndex ?? 0) % TOOL_STATUS.SPINNER_FRAMES.length];
   const iconColor = status === 'done' ? t.chrome.good
     : status === 'error' ? t.chrome.bad
+    : status === 'cancelled' ? t.chrome.warn
     : '244';
   const rightText = (() => {
     if (durationMs !== undefined && status === 'done') {
@@ -204,7 +208,7 @@ export function renderToolCallBlock(
   let col: number = leftStart;
 
   if (col < leftEndExclusive) {
-    line[col] = createStyledCell(icon, { fg: iconColor, bold: status === 'done' || status === 'error' });
+    line[col] = createStyledCell(icon, { fg: iconColor, bold: status === 'done' || status === 'error' || status === 'cancelled' });
   }
   col += 2; // icon + space
 
@@ -215,9 +219,11 @@ export function renderToolCallBlock(
   const keyArg = stripDangerousAnsi(extractKeyArg(toolCall));
   const suffixText = status === 'error' && errorMsg
     ? `- ${stripDangerousAnsi(errorMsg).slice(0, 40)}`
-    : status === 'done' && resultSummary
-      ? `(${stripDangerousAnsi(resultSummary)})`
-      : '';
+    : status === 'cancelled'
+      ? '- cancelled'
+      : status === 'done' && resultSummary
+        ? `(${stripDangerousAnsi(resultSummary)})`
+        : '';
   const leftBudget = Math.max(0, leftEndExclusive - col);
   const leftSegments = buildLeftSegments(rawName, keyArg, suffixText, leftBudget);
   for (const segment of leftSegments) {

package/src/renderer/ui-factory.ts

@@ -10,6 +10,8 @@ import { formatElapsed } from '../utils/format-elapsed.ts';
 import { abbreviateCount } from '../utils/format-number.ts';
 import { computeContextUsage } from '../core/context-usage.ts';
 import { permissionModeLabel, permissionModeTone } from '../core/permission-mode.ts';
+import { SLEEP_DISABLED_CHIP } from '../core/power-status.ts';
+import { renderQueuedMessageList, renderMemoryProvenanceChip, type MemoryProvenanceEntry } from './composer-fragments.ts';
 import { calcSessionCost, isModelPriced } from '../export/cost-utils.ts';
 import { buildFooterTip, isAgentActive } from './footer-tips.ts';
 import type { StreamMetrics } from '../core/stream-event-wiring.ts';
@@ -173,6 +175,16 @@ export class UIFactory {
     });
   }
 
+  /** The mid-turn queue as an editable list — see composer-fragments.ts. */
+  public static createQueuedMessageList(width: number, items: readonly { readonly id: string; readonly text: string }[]): Line[] {
+    return renderQueuedMessageList(width, items);
+  }
+
+  /** The optional "used N memories" provenance chip — see composer-fragments.ts. */
+  public static createMemoryProvenanceChip(width: number, count: number, entries: readonly MemoryProvenanceEntry[], expanded: boolean): Line[] {
+    return renderMemoryProvenanceChip(width, count, entries, expanded);
+  }
+
   public static createFooter(
     width: number,
     prompt: string,
@@ -205,6 +217,10 @@ export class UIFactory {
     // The web surface's reachable URL, when that surface is enabled — a
     // persistent low-priority context segment; undefined suppresses it.
     webSurfaceUrl?: string,
+    // True while power.keepAwake holds — renders the always-visible
+    // "sleep disabled" chip in the posture block (the danger-mode idiom: a
+    // persistent, colored surface indicator, the safety mechanism itself).
+    powerKeepAwake?: boolean,
   ): Line[] {
     const lines: Line[] = [];
     const promptLines = prompt.split('\n');
@@ -368,6 +384,10 @@ export class UIFactory {
             : t.chrome.warn;
       composerTokens.push({ text: ` risk:${composerPendingRisk} `, fg: riskColor, bold: true });
     }
+    // "sleep disabled" chip — always visible while keep-awake holds, in the
+    // danger-mode idiom (a persistent warn-tone indicator; the chip is the
+    // safety mechanism, so there is no timer and no AC-only variant).
+    if (powerKeepAwake) composerTokens.push({ text: ` ${SLEEP_DISABLED_CHIP} `, fg: t.chrome.warn, bold: true });
     if (composerStatus && composerStatus !== 'idle') composerTokens.push({ text: ` state:${composerStatus} `, fg: '244', dim: true });
     if (composerFlags && composerFlags.length > 0) composerTokens.push({ text: ` flags:${composerFlags.join(',')} `, fg: '244', dim: true });
     if (!compact && composerTokens.length > 0) {
@@ -391,6 +411,18 @@ export class UIFactory {
         if (px >= width) break;
       }
       lines.push(postureLine);
+    } else if (compact && powerKeepAwake) {
+      // The keep-awake chip is a safety indicator — it survives compact height
+      // even though the rest of the posture row (mode/ctx/risk/state/flags) is
+      // dropped at height < 30. Its own compact-surviving slot.
+      const chipLine = createBaseLine();
+      let cx = 2;
+      for (const ch of ` ${SLEEP_DISABLED_CHIP} `) {
+        if (cx >= width) break;
+        chipLine[cx] = { char: ch, fg: t.chrome.warn, bg: '', bold: true, dim: false, underline: false, italic: false, strikethrough: false };
+        cx += getDisplayWidth(ch);
+      }
+      lines.push(chipLine);
     }
     const isRecentlyCopied = Date.now() - lastCopyTime < 2000;
     // Token usage line + running ~$ cost estimate (derived from the usage

package/src/runtime/bootstrap-command-context.ts

@@ -56,6 +56,7 @@ import {
 
 export type CreateBootstrapCommandContextOptions = {
   configManager: ConfigManager;
+  pairingTokens?: import('@pellux/goodvibes-sdk/platform/pairing').PairingTokenManager;
   featureFlagManager?: import('@/runtime/index.ts').FeatureFlagManager;
   providerRegistry: ProviderRegistry;
   conversation: ConversationManager;
@@ -144,6 +145,7 @@ export function createBootstrapCommandContext(
   const {
     providerRegistry,
     configManager,
+    pairingTokens,
     featureFlagManager,
     conversation,
     runtime,
@@ -288,7 +290,7 @@ export function createBootstrapCommandContext(
     projectPlanningProjectId,
     workPlanStore,
   }, shellServices);
-  const platform = createBootstrapCommandPlatformSection({ configManager, featureFlagManager, voiceProviderRegistry, voiceService, webSearchService, mediaProviders, artifactStore }, shellServices);
+  const platform = createBootstrapCommandPlatformSection({ configManager, pairingTokens, featureFlagManager, voiceProviderRegistry, voiceService, webSearchService, mediaProviders, artifactStore }, shellServices);
   const extensions = createBootstrapCommandExtensionsSection({
     toolRegistry,
     mcpRegistry,

package/src/runtime/bootstrap-command-parts.ts

@@ -74,6 +74,7 @@ export interface BootstrapCommandActionOptions {
 
 export interface BootstrapCommandSectionOptions {
   readonly configManager: ConfigManager;
+  readonly pairingTokens?: import('@pellux/goodvibes-sdk/platform/pairing').PairingTokenManager;
   readonly featureFlagManager?: FeatureFlagManager;
   readonly providerRegistry: ProviderRegistry;
   readonly conversation: ConversationManager;
@@ -396,13 +397,14 @@ export function createBootstrapCommandWorkspaceSection(
 export function createBootstrapCommandPlatformSection(
   options: Pick<
     BootstrapCommandSectionOptions,
-    'configManager' | 'featureFlagManager' | 'voiceProviderRegistry' | 'voiceService' | 'webSearchService' | 'mediaProviders' | 'artifactStore'
+    'configManager' | 'pairingTokens' | 'featureFlagManager' | 'voiceProviderRegistry' | 'voiceService' | 'webSearchService' | 'mediaProviders' | 'artifactStore'
   >,
   shellServices: BootstrapCommandShellServices,
 ): BootstrapCommandPlatformSection {
   return {
     config: getConfigSnapshot(options.configManager),
     configManager: options.configManager,
+    ...(options.pairingTokens ? { pairingTokens: options.pairingTokens } : {}),
     featureFlagManager: options.featureFlagManager,
     voiceProviderRegistry: options.voiceProviderRegistry,
     voiceService: options.voiceService,

package/src/runtime/bootstrap-core.ts

@@ -25,6 +25,7 @@ import {
 import { readExecEnvScrubAllowlist } from '../input/exec-env-scrub-config.ts';
 import { createSandboxExecAsk, sandboxExecAskDepsFromRuntime } from '../permissions/sandbox-exec-gate.ts';
 import { createRuntimeServices, type RuntimeServices } from './services.ts';
+import { createHostPowerSeam } from '@pellux/goodvibes-sdk/platform/power';
 import { runBootMemoryFold } from './memory-fold.ts';
 import { wireCostPricing } from '../export/cost-utils.ts';
 import { createUiRuntimeServices, type UiRuntimeServices } from './ui-services.ts';
@@ -37,9 +38,7 @@ import { SessionInboundInputPoller, createBootstrapInboundInputPoller } from './
 import { trustGatedAsk, type WorkspaceTrustLevel } from './trust/workspace-trust.ts';
 import { syncNotifierQueueIntegrations } from './bootstrap-notifier-sync.ts';
 
-// ---------------------------------------------------------------------------
-// Pre-router buffer
-// ---------------------------------------------------------------------------
+// --- Pre-router buffer ---
 
 const PRE_ROUTER_BUFFER_MAX = 100;
 
@@ -133,9 +132,7 @@ export interface BootstrapCoreState {
 
 export type CompanionMessagePayload = Extract<SessionEvent, { type: 'COMPANION_MESSAGE_RECEIVED' }>;
 
-// ---------------------------------------------------------------------------
-// Operator narration of inbound channel events
-// ---------------------------------------------------------------------------
+// --- Operator narration of inbound channel events ---
 
 /** Narrate an inbound channel event (GitHub, Slack, ntfy, etc.) that triggered an
  * agent turn, via the SystemMessageRouter — null for internal/companion sources. */
@@ -252,6 +249,9 @@ export async function initializeBootstrapCore(
     runtimeStore: store,
     getConversationTitle: () => getConversationTitle(),
     workingDir, homeDirectory,
+    // Embedded topology: the in-process runtime IS the daemon and holds its own OS
+    // inhibitor, so opt into the real host seam (fork default is non-spawning). See services.ts.
+    powerSeam: createHostPowerSeam(),
   });
   await services.workspaceTrustManager.load(); // settle any already-persisted trust decision before any tool runs
   const providerRegistry = services.providerRegistry;

package/src/runtime/bootstrap-shell.ts

@@ -206,6 +206,12 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     runtimeStore,
     openPanel: (panelId: string) => { services.panelManager.open(panelId); },
     knowledgeApi,
+    // Fleet acts (pick / conflict / discard) surface receipts through the command
+    // context's print and reuse its one-key jump affordance — both late-bound
+    // (the command context is assigned to commandContextRef after bootstrap, and
+    // main.ts patches armFixSessionAttach onto it).
+    fleetActsNotify: (message: string) => { commandContextRef?.print?.(message); requestRender(); },
+    armFixSessionAttach: (sessionId: string) => { commandContextRef?.armFixSessionAttach?.(sessionId); },
   });
   services.panelManager.prewarmRegistered();
 
@@ -239,6 +245,7 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
 
   const commandContext: CommandContext = createBootstrapCommandContext({
     configManager,
+    pairingTokens: services.pairingTokens,
     providerRegistry: services.providerRegistry,
     conversation,
     runtime,

package/src/runtime/durability-services.ts

@@ -14,19 +14,36 @@
  *  - One credential chain (env -> secrets -> subscription): boot applies
  *    secrets-backed keys; every secrets write/delete re-registers builtins
  *    LIVE (no restart) — badges/picker/chat read the same instances.
+ *  - Start-time retention janitor: one best-effort append-only sweep over
+ *    EVERY root the composition knows (working dir, surface root, home,
+ *    logDir, telemetryDir) — omitting logDir/telemetryDir/home would silently
+ *    skip the activity-log, telemetry-ledger, and recovery-snapshot stores.
+ *  - Live config-file watch: external edits to the settings file apply through
+ *    the same subscribe() pipeline an in-process set() uses — no restart. The
+ *    underlying watchers are unref'd, so this never pins the event loop.
  */
 import { join } from 'node:path';
+import { operations } from '@pellux/goodvibes-sdk/platform/runtime';
 import { resolveMemoryVectorDbPath } from '@pellux/goodvibes-sdk/platform/state';
 import { StoreSnapshotScheduler } from '@pellux/goodvibes-sdk/platform/state/store-snapshots';
 import { UserPermissionRuleStore } from '@pellux/goodvibes-sdk/platform/permissions';
 import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 export interface DurabilityServicesInput {
-  readonly configManager: { getControlPlaneConfigDir(): string };
+  readonly configManager: {
+    getControlPlaneConfigDir(): string;
+    get(key: never): unknown;
+    watchConfigFiles(options?: { intervalMs?: number }): () => void;
+  };
   readonly secretsManager: { onDidChange(listener: (key: string) => void): () => void };
   readonly providerRegistry: { refreshProviderCredentials(): Promise<void> };
   readonly memoryDbPath: string;
   readonly codeIndexDbPath: string;
+  /** Retention-sweep roots (mirrors the SDK's own createRuntimeServices roots). */
+  readonly workingDirectory: string;
+  readonly surfaceRoot: string;
+  readonly homeDirectory: string;
+  readonly shellPaths: { resolveUserPath(...segments: string[]): string };
 }
 
 export interface DurabilityServices {
@@ -48,6 +65,24 @@ export function createDurabilityServices(input: DurabilityServicesInput): Durabi
   });
   storeSnapshotScheduler.start();
 
+  // Start-time retention janitor: pass EVERY root the composition knows so the
+  // activity-log, telemetry-ledger, and recovery-snapshot stores are all swept.
+  // Best-effort — a retention failure never takes startup down (the sweep
+  // swallows its own errors).
+  operations.runStartupAppendOnlySweep(
+    {
+      workingDirectory: input.workingDirectory,
+      surfaceRoot: input.surfaceRoot,
+      homeDirectory: input.homeDirectory,
+      logDir: input.shellPaths.resolveUserPath('logs'),
+      telemetryDir: input.shellPaths.resolveUserPath('telemetry'),
+    },
+    (k: string) => configManager.get(k as never),
+  );
+  // External config edits apply LIVE through the same subscribe() pipeline an
+  // in-process set() uses; the underlying watchers are unref'd.
+  configManager.watchConfigFiles();
+
   const userPermissionRuleStore = new UserPermissionRuleStore(join(configManager.getControlPlaneConfigDir(), 'permission-rules.json'));
   void userPermissionRuleStore.init().catch((error) => logger.warn('user permission rule store init failed; asks will prompt', { error: summarizeError(error) }));
 

package/src/runtime/fleet-services.ts

@@ -0,0 +1,41 @@
+/**
+ * fleet-services.ts — the shared, archive-aware fleet registry construction,
+ * lifted out of services.ts so the composition root stays under the file-size
+ * cap. Mirrors the sibling create*Services helpers (durability, code-index,
+ * workstream): a single dependency-injected call that services.ts makes once.
+ *
+ * Also owns the daemon-side observed foreign-agent source: when
+ * observeExternalAgents is on (the standalone daemon), externally-launched
+ * coding-agent sessions observed read-only on the host fold in as
+ * 'observed-external' rows (visibility + steer; never counted against
+ * fleet.maxSize, never stopped). The interactive process leaves it off and
+ * reads the daemon's snapshot, so it never double-scans. Absence ⇒ a quiet
+ * empty set. Mirrors the SDK's own createRuntimeServices wiring.
+ */
+import { computeUsageCostUsd, type ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+import { type ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
+import { ObservedAgentSource } from '@pellux/goodvibes-sdk/platform/runtime/fleet/observed';
+import { createArchivableFleetRegistry, type ProcessRegistryDeps } from '@pellux/goodvibes-terminal-shell';
+
+export interface FleetServicesDeps
+  extends Omit<ProcessRegistryDeps, 'observedAgents' | 'priceUsage'> {
+  /** Turns on the daemon-side observed foreign-agent source (daemon only). */
+  readonly observeExternalAgents?: boolean | undefined;
+  /** Backs the honest pricing resolver folded into priceUsage below. */
+  readonly providerRegistry: Pick<ProviderRegistry, 'resolveModelPricing'>;
+}
+
+export function createFleetServices(
+  deps: FleetServicesDeps,
+): { processRegistry: ArchivableProcessRegistry } {
+  const { observeExternalAgents, providerRegistry, ...registryDeps } = deps;
+  const observedAgents = observeExternalAgents ? new ObservedAgentSource() : undefined;
+  const processRegistry = createArchivableFleetRegistry({
+    ...registryDeps,
+    observedAgents, // Daemon-side observed foreign-agent rows (undefined in the interactive process)
+    // Honest-unpriced through the ONE pricing resolver (manual -> registration -> provider-served
+    // -> catalog -> unknown); unknown/subscription yields null, never $0. Mirrors the SDK composition.
+    priceUsage: (model, usage) => (model ? computeUsageCostUsd(providerRegistry.resolveModelPricing(model), usage) : null),
+  });
+  return { processRegistry };
+}