@pellux/goodvibes-tui 1.17.0 → 1.18.0

package/src/runtime/idle-power-services.ts

@@ -0,0 +1,85 @@
+// ---------------------------------------------------------------------------
+// idle-power-services.ts — the idle-time / sleep-ownership / live-turn slice of
+// the runtime composition, extracted from services.ts (file-size hygiene).
+//
+// Mirrors the SDK's own createRuntimeServices wiring: idle-time memory
+// consolidation (learning.consolidation.*), host sleep ownership (power.*), and
+// the per-session live-turn control holder that backs the
+// sessions.toolCalls.cancel / sessions.queuedMessages.* wire verbs. Consolidation
+// receipts ride the SAME attach-time queue every other receipt uses — a run that
+// changed something records a one-line notice into the file-backed
+// feature-announcement store, drained on the next surface attach; a quiet run
+// records nothing.
+// ---------------------------------------------------------------------------
+
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { MemoryRegistry } from '@pellux/goodvibes-sdk/platform/state';
+import { MemoryConsolidationScheduler } from '@pellux/goodvibes-sdk/platform/state';
+import { SessionLiveTurnControlsHolder } from '@pellux/goodvibes-sdk/platform/control-plane';
+import { PowerManager, wireRuntimePower, createUnavailablePowerSeam } from '@pellux/goodvibes-sdk/platform/power';
+import { FeatureAnnouncementStore, featureAnnouncementsPath } from '@pellux/goodvibes-sdk/platform/runtime/feature-announcements';
+import type { RuntimeEventBus } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import { formatConsolidationReceipt } from '../core/consolidation-receipt.ts';
+
+export interface IdlePowerServicesDeps {
+  readonly configManager: ConfigManager;
+  readonly memoryRegistry: MemoryRegistry;
+  readonly runtimeBus: RuntimeEventBus;
+  /** True when no session is busy — the consolidation scheduler's idle gate. */
+  readonly isIdle: () => boolean;
+  /** Sleep-edge checkpoint + a wake catch-up tick (store snapshots). */
+  readonly snapshotTick: () => void;
+  /** Wake catch-up: fire the automation heartbeat. */
+  readonly heartbeat: () => Promise<void>;
+  /**
+   * Host power seam. SDK 1.9.0 makes wireRuntimePower default an absent seam to
+   * the REAL host seam (createHostPowerSeam — which spawns systemd-inhibit and a
+   * dbus-monitor sleep-edge watcher). That spawn is a host-level side effect, so
+   * this fork mirrors the SDK's own createRuntimeServices: when no seam is passed
+   * we default to the NON-spawning unavailable seam, keeping test-constructed
+   * runtimes deterministic. Only the real long-lived compositions (the standalone
+   * daemon and the embedded interactive runtime, which itself IS the daemon) pass
+   * createHostPowerSeam() to opt into live OS keep-awake/idle-inhibit.
+   */
+  readonly powerSeam?: Parameters<typeof wireRuntimePower>[0]['seam'];
+}
+
+export interface IdlePowerServices {
+  readonly memoryConsolidationScheduler: MemoryConsolidationScheduler;
+  readonly powerManager: PowerManager;
+  readonly sessionLiveTurnControls: SessionLiveTurnControlsHolder;
+}
+
+/** Construct (and start) the idle-consolidation scheduler, power manager, and live-turn holder. */
+export function wireIdlePowerAndLiveTurn(deps: IdlePowerServicesDeps): IdlePowerServices {
+  const consolidationReceiptStore = new FeatureAnnouncementStore(featureAnnouncementsPath(deps.configManager));
+  const memoryConsolidationScheduler = new MemoryConsolidationScheduler({
+    memoryRegistry: deps.memoryRegistry,
+    configSource: deps.configManager,
+    isIdle: deps.isIdle,
+    onReceipt: (receipt) => {
+      const text = formatConsolidationReceipt(receipt);
+      if (text) consolidationReceiptStore.record(receipt.runId, text);
+    },
+  });
+  memoryConsolidationScheduler.start();
+  const sessionLiveTurnControls = new SessionLiveTurnControlsHolder();
+  const powerManager = wireRuntimePower({
+    readConfig: (key) => deps.configManager.get(key as Parameters<typeof deps.configManager.get>[0]),
+    writeConfig: (key, value) => deps.configManager.setDynamic(key as Parameters<typeof deps.configManager.setDynamic>[0], value),
+    // Live config subscription: an external edit to power.keepAwake (a settings-
+    // modal toggle, a hand-edited settings file) applies LIVE to the in-process
+    // manager — acquires/releases the inhibitor and lights the chip with no
+    // restart. This is the config-apply path for the EMBEDDED topology + the
+    // local chip; the external daemon is reached separately over the verb.
+    subscribeConfig: (key, cb) => (deps.configManager.subscribe as unknown as (k: string, c: (v: unknown) => void) => () => void)(key, (newValue) => cb(newValue)),
+    runtimeBus: deps.runtimeBus,
+    sleepCheckpoint: deps.snapshotTick,
+    wakeCatchUp: [() => memoryConsolidationScheduler.tick(), deps.snapshotTick, deps.heartbeat],
+    // Non-spawning default (see powerSeam doc above): without an explicit opt-in
+    // the seam is the honest unavailable one, NOT the spawning host seam that
+    // wireRuntimePower would otherwise pick for an undefined seam.
+    seam: deps.powerSeam ?? createUnavailablePowerSeam('runtime services constructed without a host power seam'),
+  });
+  return { memoryConsolidationScheduler, powerManager, sessionLiveTurnControls };
+}

package/src/runtime/index.ts

@@ -279,8 +279,10 @@ export const loadLastConversation = operations.loadLastConversation;
 export const loadRecoveryConversation = operations.loadRecoveryConversation;
 export const writeRecoveryFile = operations.writeRecoveryFile;
 export const deleteRecoveryFile = operations.deleteRecoveryFile;
+export const autoRestoreRecovery = operations.autoRestoreRecovery;
 export const checkRecoveryFile = operations.checkRecoveryFile;
 export const getRecoveryFilePath = operations.getRecoveryFilePath;
+export const getRecoveryDir = operations.getRecoveryDir;
 export const getLastSessionPointerPath = operations.getLastSessionPointerPath;
 export const writeLastSessionPointer = operations.writeLastSessionPointer;
 export const readLastSessionPointer = operations.readLastSessionPointer;

package/src/runtime/interaction-seams.ts

@@ -0,0 +1,109 @@
+// ---------------------------------------------------------------------------
+// interaction-seams.ts — the command-context interaction seams and the memory-
+// provenance UI controller, extracted from main.ts (file-size hygiene).
+//
+// The seams expose the in-process orchestrator's per-tool cancel and mid-turn
+// queue edit/delete, the power toggle/status, and the provenance-chip drill-in
+// to the command layer. The memory-provenance controller owns the "used N
+// memories" chip's state (the latest turn's metadata.memory.recordIds and the
+// expand flag), its per-turn capture, and its render.
+// ---------------------------------------------------------------------------
+
+import type { CommandContext } from '../input/command-registry.ts';
+import type { PowerManager } from '@pellux/goodvibes-sdk/platform/power';
+import type { Line } from '../types/grid.ts';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import { createCancelToolCall, type ToolCancelOrchestrator } from '../core/turn-cancellation.ts';
+import { powerSurfaceFromState } from '../core/power-status.ts';
+import { memoryRecordIdsFromTurn, readMemoryShowProvenance } from '../core/memory-provenance.ts';
+import { UIFactory } from '../renderer/ui-factory.ts';
+
+/** The orchestrator surface the interaction seams need. */
+export interface InteractionOrchestrator extends ToolCancelOrchestrator {
+  listQueuedMessages(): ReadonlyArray<{ id: string; queuedAt: number; text: string }>;
+  editQueuedMessage(id: string, text: string): boolean;
+  deleteQueuedMessage(id: string): boolean;
+}
+
+export interface InteractionSeamDeps {
+  readonly orchestrator: InteractionOrchestrator;
+  readonly powerManager: PowerManager;
+  /** Topology-aware power projection (the chip source): the DAEMON's state in adopted-external mode. Falls back to the local manager when absent. */
+  readonly readPowerSurface?: (() => ReturnType<typeof powerSurfaceFromState>) | undefined;
+  readonly render: () => void;
+  readonly notify: (message: string) => void;
+  readonly getActiveToolCallId: () => string | undefined;
+  readonly toggleMemoryProvenance: () => void;
+}
+
+/** Wire the per-tool cancel, queue edit/delete, power, and memory-provenance seams onto the command context. */
+export function wireInteractionSeams(cc: CommandContext, deps: InteractionSeamDeps): void {
+  cc.cancelToolCall = createCancelToolCall(deps.orchestrator, deps.getActiveToolCallId, () => {
+    deps.notify('[Tool] Cancelled the running tool call — the turn continues.');
+    deps.render();
+  });
+  cc.listQueuedMessages = () => deps.orchestrator.listQueuedMessages();
+  cc.editQueuedMessage = (id, text) => { const ok = deps.orchestrator.editQueuedMessage(id, text); if (ok) deps.render(); return ok; };
+  cc.deleteQueuedMessage = (id) => { const ok = deps.orchestrator.deleteQueuedMessage(id); if (ok) deps.render(); return ok; };
+  cc.toggleMemoryProvenance = deps.toggleMemoryProvenance;
+  cc.getPowerState = () => (deps.readPowerSurface ? deps.readPowerSurface() : powerSurfaceFromState(deps.powerManager.getState()));
+  cc.setKeepAwake = async (enabled) => { const next = powerSurfaceFromState(await deps.powerManager.setKeepAwake(enabled)); deps.render(); return next; };
+}
+
+/** The memory-provenance chip UI: per-turn capture, drill-in state, and render. */
+export interface MemoryProvenanceUi {
+  /** Toggle the drill-in expand state (Alt+M). */
+  toggle(): void;
+  /** Capture the memory record ids from a completed turn's payload (metadata.memory.recordIds). */
+  onTurnCompleted(evt: unknown): void;
+  /** The chip lines for the current turn — empty when the setting is off or the turn used no memories. */
+  renderChip(width: number, configManager: Pick<ConfigManager, 'get'>): Line[];
+}
+
+/** A resolved provenance record summary (null = the record is no longer available). */
+type ResolvedRecord = { readonly summary: string; readonly cls: string } | null;
+
+/**
+ * Create the memory-provenance chip controller (default OFF; reads nothing when
+ * off). When the drill-in is expanded it RESOLVES each memory record id to its
+ * summary through the memory spine (the same host-or-daemon access the recall
+ * commands use, so an adopted daemon resolves over the wire) — per-id and
+ * lazily, so one forgotten record never blanks the rest and a collapsed chip
+ * costs nothing. Mirrors the webui's provenance detail fetch.
+ */
+export function createMemoryProvenanceUi(deps: {
+  readonly render: () => void;
+  readonly memorySpine: { get(id: string): Promise<{ summary: string; cls: string } | null> };
+}): MemoryProvenanceUi {
+  let latestRecordIds: readonly string[] = [];
+  let expanded = false;
+  // id -> resolved record (null = not found). Absent = not yet fetched.
+  const resolved = new Map<string, ResolvedRecord>();
+  const inFlight = new Set<string>();
+
+  const resolveExpanded = (): void => {
+    for (const id of latestRecordIds) {
+      if (resolved.has(id) || inFlight.has(id)) continue;
+      inFlight.add(id);
+      void deps.memorySpine.get(id)
+        .then((record) => { resolved.set(id, record ? { summary: record.summary, cls: record.cls } : null); })
+        .catch(() => { resolved.set(id, null); })
+        .finally(() => { inFlight.delete(id); deps.render(); });
+    }
+  };
+
+  return {
+    toggle() {
+      expanded = !expanded;
+      if (expanded) resolveExpanded();
+      deps.render();
+    },
+    onTurnCompleted(evt) { latestRecordIds = memoryRecordIdsFromTurn(evt); expanded = false; },
+    renderChip(width, configManager) {
+      if (!readMemoryShowProvenance(configManager) || latestRecordIds.length === 0) return [];
+      if (expanded) resolveExpanded(); // lazy: fetch any still-unresolved ids (idempotent)
+      const entries = latestRecordIds.map((id) => ({ id, record: resolved.has(id) ? resolved.get(id) : undefined }));
+      return UIFactory.createMemoryProvenanceChip(width, latestRecordIds.length, entries, expanded);
+    },
+  };
+}

package/src/runtime/power-keepawake-remote.ts

@@ -0,0 +1,75 @@
+// ---------------------------------------------------------------------------
+// power-keepawake-remote.ts — forward the keep-awake toggle to an adopted
+// EXTERNAL daemon over the power.keepAwake.set operator verb.
+//
+// In the external/adopted-daemon topology the in-process PowerManager is NOT
+// the daemon's, so a keep-awake toggle applied only locally dies when the TUI
+// closes. The owner ruling is that keep-awake is daemon-held: it must survive
+// the TUI closing. The config file does NOT carry it across (power.keepAwake is
+// not a cross-surface shared key), so the toggle is forwarded to the daemon
+// over the verb instead — best-effort, gated on reachability. Mirrors the
+// agent's own power-keep-awake-remote seam.
+//
+// A single config subscriber carries ALL THREE toggle paths (/power, Alt+A, the
+// settings modal): each lands on the power.keepAwake config key — the local
+// PowerManager persists it on set, and the settings modal writes it directly —
+// so subscribing to that one key catches every origin. In the EMBEDDED topology
+// this is a no-op: the in-process manager already IS the daemon.
+// ---------------------------------------------------------------------------
+
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { PowerState } from '@pellux/goodvibes-sdk/platform/power';
+import { resolveOperatorRpc } from '../input/commands/operator-rpc.ts';
+
+export interface KeepAwakeRemoteDeps {
+  readonly configManager: ConfigManager;
+  readonly homeDirectory: string | (() => string);
+  /** True only in the external/adopted-daemon topology (the local manager is not the daemon's). */
+  readonly isExternalDaemon: () => boolean;
+  /** Injectable rpc resolution (tests); defaults to the shared resolveOperatorRpc. */
+  readonly resolveRpc?: typeof resolveOperatorRpc;
+}
+
+/**
+ * Best-effort forward of the keep-awake toggle to the adopted external daemon so
+ * the DAEMON holds the inhibitor (surviving the TUI closing). A no-op in the
+ * embedded topology and quiet when the daemon is unreachable — a transient
+ * daemon hiccup never breaks the local toggle.
+ */
+export async function forwardKeepAwakeToDaemon(enabled: boolean, deps: KeepAwakeRemoteDeps): Promise<void> {
+  if (!deps.isExternalDaemon()) return;
+  const rpc = (deps.resolveRpc ?? resolveOperatorRpc)({ configManager: deps.configManager, homeDirectory: deps.homeDirectory });
+  if (!rpc.available) return;
+  try {
+    await rpc.sdk.operator.invoke('power.keepAwake.set', { enabled });
+  } catch {
+    // Best-effort by design; the local toggle already applied.
+  }
+}
+
+/**
+ * Install a config subscriber that forwards every power.keepAwake change to the
+ * adopted external daemon. Returns an unsubscribe handle. Because all three
+ * toggle origins land on the same config key, this one seam carries them all.
+ */
+export function installKeepAwakeRemoteForward(deps: KeepAwakeRemoteDeps): () => void {
+  return deps.configManager.subscribe('power.keepAwake', (newValue) => {
+    void forwardKeepAwakeToDaemon(newValue === true, deps);
+  });
+}
+
+/**
+ * Fetch the adopted DAEMON's power.status.get (null when unreachable or not in
+ * the external topology). The chip's external-mode poll source — the adopted
+ * wire is plain HTTP with no event bridge, so the chip syncs by polling.
+ */
+export async function fetchDaemonPowerState(deps: KeepAwakeRemoteDeps): Promise<PowerState | null> {
+  if (!deps.isExternalDaemon()) return null;
+  const rpc = (deps.resolveRpc ?? resolveOperatorRpc)({ configManager: deps.configManager, homeDirectory: deps.homeDirectory });
+  if (!rpc.available) return null;
+  try {
+    return await rpc.sdk.operator.invoke('power.status.get', {}) as unknown as PowerState;
+  } catch {
+    return null;
+  }
+}

package/src/runtime/process-lifecycle.ts

@@ -219,8 +219,10 @@ export function installProcessLifecycle(deps: ProcessLifecycleDeps): ProcessLife
     }
     // Only remove the recovery fallback once the durable shutdown save actually completed,
     // so an interrupted or timed-out shutdown leaves the snapshot for the next launch.
+    // Scoped to THIS session's id: without it, one session's clean exit wipes
+    // every session's crash snapshot (the concurrent-session isolation bug).
     if (shutdownOk) {
-      deleteRecoveryFile({ homeDirectory: ctx.services.homeDirectory });
+      deleteRecoveryFile({ homeDirectory: ctx.services.homeDirectory }, ctx.runtime.sessionId);
     }
     process.exit(0);
   };

package/src/runtime/services.ts

@@ -4,9 +4,13 @@ import { ConfigManager, ServiceRegistry, SubscriptionManager, ToolLLM } from '@p
 import { SecretsManager } from '../config/secrets.ts';
 import { AutomationDeliveryManager, AutomationManager } from '@pellux/goodvibes-sdk/platform/automation';
 import { ChannelDeliveryRouter, ChannelPolicyManager, type ChannelPluginRegistry, type RouteBindingManager, type SurfaceRegistry } from '@pellux/goodvibes-sdk/platform/channels';
-import { ApprovalBroker, GatewayMethodCatalog, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
+import { ApprovalBroker, GatewayMethodCatalog, SessionLiveTurnControlsHolder, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { PowerManager } from '@pellux/goodvibes-sdk/platform/power';
+import { wireIdlePowerAndLiveTurn } from './idle-power-services.ts';
 import { StepUpService } from '@pellux/goodvibes-sdk/daemon';
-import { attachWsOnlyGatewayVerbHandlers, createArchivableFleetRegistry } from '@pellux/goodvibes-terminal-shell';
+import { PairingTokenManager } from '@pellux/goodvibes-sdk/platform/pairing';
+import { resolvePairingWebOrigin } from '../core/pairing-origin.ts';
+import { attachWsOnlyGatewayVerbHandlers } from '@pellux/goodvibes-terminal-shell';
 import { WatcherRegistry } from '@pellux/goodvibes-sdk/platform/watchers';
 import { ArtifactStore } from '@pellux/goodvibes-sdk/platform/artifacts';
 import {
@@ -25,7 +29,7 @@ import { MediaProviderRegistry, ensureBuiltinMediaProviders } from '@pellux/good
 import { MultimodalService } from '@pellux/goodvibes-sdk/platform/multimodal';
 import { AgentMessageBus, AgentOrchestrator, ArchetypeLoader, WrfcController } from '@pellux/goodvibes-sdk/platform/agents';
 import { AgentManager, ContextAccountingHolder, OverflowHandler, ProcessManager, createWorkflowServices, type WorkflowServices } from '@pellux/goodvibes-sdk/platform/tools';
-import { FileStateCache, FileUndoManager, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, resolveCanonicalMemoryDbPath, type CodeIndexStore, type CodeIndexReindexScheduler } from '@pellux/goodvibes-sdk/platform/state';
+import { FileStateCache, FileUndoManager, MemoryConsolidationScheduler, MemoryEmbeddingProviderRegistry, MemoryRegistry, MemoryStore, ModeManager, ProjectIndex, resolveCanonicalMemoryDbPath, type CodeIndexStore, type CodeIndexReindexScheduler } from '@pellux/goodvibes-sdk/platform/state';
 import type { StoreSnapshotScheduler } from '@pellux/goodvibes-sdk/platform/state/store-snapshots';
 import type { UserPermissionRuleStore } from '@pellux/goodvibes-sdk/platform/permissions';
 import { buildExecPromptAnswerHandler } from '@pellux/goodvibes-sdk/platform/runtime/permissions/exec-prompt-wiring';
@@ -55,13 +59,14 @@ import { SessionManager, CrossSessionTaskRegistry, SessionChangeTracker } from '
 import { ApiTokenAuditor, UserAuthManager } from '@pellux/goodvibes-sdk/platform/security';
 import { WebhookNotifier } from '@pellux/goodvibes-sdk/platform/integrations';
 import { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
-import { BenchmarkStore, CacheHitTracker, computeUsageCostUsd, FavoritesStore, ModelLimitsService, ProviderCapabilityRegistry, ProviderOptimizer, ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
+import { BenchmarkStore, CacheHitTracker, FavoritesStore, ModelLimitsService, ProviderCapabilityRegistry, ProviderOptimizer, ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
 import { KeybindingsManager } from '../input/keybindings.ts';
 import { AdaptivePlanner, DeterministicReplayEngine, ExecutionPlanManager, SessionLineageTracker, SessionMemoryStore } from '@pellux/goodvibes-sdk/platform/core';
 import { deriveFeatureStates, bindFeatureSettingsBridge } from '@pellux/goodvibes-sdk/platform/runtime/state';
 import { createChannelComposition } from './channel-composition.ts';
 import { applyProviderOptimizerConfigMode, bindProviderOptimizerFeatureFlag } from './provider-optimizer-wiring.ts';
 import { type ArchivableProcessRegistry } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
+import { createFleetServices } from './fleet-services.ts';
 import { createWorkstreamServices, type OrchestrationEngine, type WorkstreamCommandService } from './workstream-services.ts';
 import { wireFleetNeedsInputPush } from './fleet-needs-input-push.ts';
 import { codeIndexDbPath, createCodeIndexServices, isCodeInjectionSettingEnabled } from './code-index-services.ts';
@@ -90,6 +95,13 @@ export interface RuntimeServicesOptions {
   readonly getConversationTitle?: () => string | undefined;
   readonly workingDir: string;
   readonly homeDirectory: string;
+  /** Opt-in (daemon-side only): fold host-observed external coding-agent sessions
+   * into the fleet as 'observed-external' rows. Interactive leaves it off and reads
+   * the daemon snapshot. Mirrors the SDK's own createRuntimeServices option. */
+  readonly observeExternalAgents?: boolean | undefined;
+  /** Host power seam opt-in. Fork mirrors the SDK: non-spawning unavailable-seam
+   * default (idle-power-services.ts); daemon + embedded runtime pass createHostPowerSeam(). */
+  readonly powerSeam?: Parameters<typeof wireIdlePowerAndLiveTurn>[0]['powerSeam'];
 }
 
 export interface RuntimeServices {
@@ -135,6 +147,7 @@ export interface RuntimeServices {
   readonly serviceRegistry: ServiceRegistry;
   readonly secretsManager: SecretsManager;
   readonly stepUpService: StepUpService;
+  readonly pairingTokens: PairingTokenManager; // backs pairing.tokens.* verbs + the settings device surface (mirrors the SDK composition)
   readonly subscriptionManager: SubscriptionManager;
   readonly localUserAuthManager: UserAuthManager;
   readonly profileManager: ProfileManager;
@@ -198,6 +211,9 @@ export interface RuntimeServices {
   readonly codeIndexReindexScheduler: CodeIndexReindexScheduler; // tool-site reindex
   /** Daily snapshots of every SQLite store this runtime writes, with bounded retention; unref'd timers (mirrors the SDK composition — hosts that tear down a runtime stop() it themselves). */
   readonly storeSnapshotScheduler: StoreSnapshotScheduler;
+  readonly memoryConsolidationScheduler: MemoryConsolidationScheduler;
+  readonly powerManager: PowerManager;
+  readonly sessionLiveTurnControls: SessionLiveTurnControlsHolder;
   /** Unified live process registry (agents, WRFC chains, workflows, watchers, background processes) backing the Fleet panel; archive-aware — finished subtrees can be moved to the session archive view. */
   readonly processRegistry: ArchivableProcessRegistry;
   readonly modeManager: ModeManager;
@@ -249,6 +265,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   });
   // Step-up (WebAuthn) ceremony service, shared between the ceremony gateway verbs and the relay gate's verifier.
   const stepUpService = new StepUpService({ secrets: secretsManager });
+  const pairingTokens = new PairingTokenManager(shellPaths.resolveUserPath('control-plane', 'pairing-tokens.json'));
   const subscriptionManager = new SubscriptionManager(shellPaths.resolveUserPath('tui', 'subscriptions.json'));
   const serviceRegistry = new ServiceRegistry(shellPaths.resolveProjectPath('tui', 'services.json'), {
     secretsManager,
@@ -468,7 +485,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     projectRoot: workingDirectory,
   });
   const voiceProviders = new VoiceProviderRegistry();
-  ensureBuiltinVoiceProviders(voiceProviders);
+  ensureBuiltinVoiceProviders(voiceProviders, { readConfig: (key) => configManager.get(key as Parameters<typeof configManager.get>[0]) });
   const voiceService = new VoiceService(voiceProviders);
   const webSearchProviders = new WebSearchProviderRegistry({
     env: process.env,
@@ -478,18 +495,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     serviceRegistry,
     featureFlags,
   });
-  knowledgeSemanticService.setGapRepairer(createWebKnowledgeGapRepairer({
-    searchService: webSearchService,
-    ingestService: knowledgeService,
-  }));
-  agentKnowledgeSemanticService.setGapRepairer(createWebKnowledgeGapRepairer({
-    searchService: webSearchService,
-    ingestService: agentKnowledgeService,
-  }));
-  homeGraphSemanticService.setGapRepairer(createWebKnowledgeGapRepairer({
-    searchService: webSearchService,
-    ingestService: homeGraphService,
-  }));
+  for (const [semantic, ingest] of [[knowledgeSemanticService, knowledgeService], [agentKnowledgeSemanticService, agentKnowledgeService], [homeGraphSemanticService, homeGraphService]] as const) {
+    semantic.setGapRepairer(createWebKnowledgeGapRepairer({ searchService: webSearchService, ingestService: ingest }));
+  }
   const mediaProviders = new MediaProviderRegistry();
   ensureBuiltinMediaProviders(mediaProviders, artifactStore, providerRegistry);
   const multimodalService = new MultimodalService(artifactStore, mediaProviders, voiceService, knowledgeService);
@@ -591,36 +599,25 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // Store snapshots + durable remembered-approval rules + the live credential
   // chain, mirroring the SDK composition — see durability-services.ts.
   const { storeSnapshotScheduler, userPermissionRuleStore } = createDurabilityServices({
-    configManager, secretsManager, providerRegistry, memoryDbPath, codeIndexDbPath: codeIndexDbPath(workingDirectory),
+    configManager, secretsManager, providerRegistry, memoryDbPath, codeIndexDbPath: codeIndexDbPath(workingDirectory), workingDirectory, surfaceRoot: 'tui', homeDirectory, shellPaths, // + retention-sweep roots & live config watch (mirrors the SDK)
   });
   const codeInjectionOrchestratorDeps = { codeIndex: codeIndexStore, isCodeInjectionSettingEnabled: () => isCodeInjectionSettingEnabled(configManager), codeIndexReindexScheduler }; // Code-injection seam (agent here; main via orchestrator-core-services.ts)
-  // Shared, archive-aware fleet registry — see gateway-verbs.ts's factory doc.
-  const processRegistry = createArchivableFleetRegistry({
-    agentManager,
-    wrfcController,
+  const { processRegistry } = createFleetServices({ // Shared archive-aware fleet registry (+ daemon observed rows) — see fleet-services.ts
+    agentManager, wrfcController,
     orchestrationEngine, // Folds workstream/phase/work-item nodes into the fleet
     codeIndexService: codeIndexStore, // Folds a single 'code-index' node into the fleet
-    processManager,
-    watcherRegistry,
-    workflow,
-    approvalBroker,
-    sessionBroker,
+    processManager, watcherRegistry, workflow, approvalBroker, sessionBroker,
     messageBus: agentMessageBus, // Backs steer()/`steerable` (the Fleet steer composer builds on top)
     automationManager, // Folds /schedule AutomationJobs into the fleet as 'schedule' nodes
     runtimeBus: options.runtimeBus,
-    // Honest-unpriced through the ONE pricing resolver (manual -> registration -> provider-served
-    // -> catalog -> unknown); unknown/subscription yields null, never $0. Mirrors the SDK composition.
-    priceUsage: (model, usage) => (model ? computeUsageCostUsd(providerRegistry.resolveModelPricing(model), usage) : null),
+    observeExternalAgents: options.observeExternalAgents, providerRegistry, // observeExternalAgents is daemon-side only
   });
-  const modeManager = new ModeManager();
-  const fileUndoManager = new FileUndoManager();
+  const modeManager = new ModeManager(); const fileUndoManager = new FileUndoManager();
   const workspaceCheckpointManager = createWorkspaceCheckpointing({ workspaceRoot: workingDirectory, runtimeBus: options.runtimeBus, configManager });
+  const { memoryConsolidationScheduler, powerManager, sessionLiveTurnControls } = wireIdlePowerAndLiveTurn({ configManager, memoryRegistry, runtimeBus: options.runtimeBus, isIdle: () => sessionBroker.countBusySessions() === 0, snapshotTick: () => storeSnapshotScheduler.tick(), heartbeat: async () => { await automationManager.triggerHeartbeat({ source: 'wake-catchup' }); }, powerSeam: options.powerSeam });
 
-  // Shared terminal-shell wrapper over the SDK's registerGatewayVerbGroups (see gateway-verbs.ts): 501s the ws-only
-  // family without it. principals.*/channels.profiles.*/ci.* register unconditionally; checkin.* only with
-  // channelDeliveryRouter/providerRegistry/automationManager/sessionLister ALL present; fleet needs-input push gated by
-  // runtimeBus/sessionPresence (fleet-needs-input-push.ts). conversationRewindPort serves conversation-scope rewind live.
-  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input), watcherRegistry, userPermissionRuleStore, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, sessionIntake: sessionBroker, workingDirectory, memoryRegistry, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
+  // Terminal-shell wrapper over the SDK registerGatewayVerbGroups (gateway-verbs.ts); checkin.*/fleet-needs-input/pairing.* register only when their deps are present.
+  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input), watcherRegistry, userPermissionRuleStore, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, sessionIntake: sessionBroker, workingDirectory, memoryRegistry, pairingTokens, sessionLiveTurnControls, powerManager, relayAvailable: () => configManager.get('relay.enabled') === true, pairingWebOrigin: () => resolvePairingWebOrigin(configManager).origin, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
   const integrationHelpers = new IntegrationHelperService({
     workingDirectory,
     homeDirectory,
@@ -723,6 +720,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     serviceRegistry,
     secretsManager,
     stepUpService,
+    pairingTokens,
     subscriptionManager,
     localUserAuthManager,
     profileManager,
@@ -782,6 +780,9 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     codeIndexStore,
     codeIndexReindexScheduler,
     storeSnapshotScheduler,
+    memoryConsolidationScheduler,
+    powerManager,
+    sessionLiveTurnControls,
     processRegistry,
     modeManager,
     fileUndoManager,

package/src/runtime/ui-services.ts

@@ -59,6 +59,8 @@ export interface UiPlatformServices {
   readonly surfaceRegistry: RuntimeServices['surfaceRegistry'];
   readonly subscriptionManager: RuntimeServices['subscriptionManager'];
   readonly secretsManager: SecretsManager;
+  /** Per-device pairing tokens — backs the pairing modal QR and the settings device surface. */
+  readonly pairingTokens: RuntimeServices['pairingTokens'];
   readonly tokenAuditor: RuntimeServices['tokenAuditor'];
   readonly replayEngine: RuntimeServices['replayEngine'];
   readonly webhookNotifier: RuntimeServices['webhookNotifier'];
@@ -188,6 +190,7 @@ export function createUiRuntimeServices(
       surfaceRegistry: runtimeServices.surfaceRegistry,
       subscriptionManager: runtimeServices.subscriptionManager,
       secretsManager: runtimeServices.secretsManager,
+      pairingTokens: runtimeServices.pairingTokens,
       tokenAuditor: runtimeServices.tokenAuditor,
       replayEngine: runtimeServices.replayEngine,
       webhookNotifier: runtimeServices.webhookNotifier,