@pellux/goodvibes-tui 1.17.0 → 1.18.0

package/src/daemon/cli.ts

@@ -1,6 +1,5 @@
-import { homedir, networkInterfaces } from 'node:os';
+import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { readFileSync } from 'node:fs';
 import { ConfigManager, resolveDaemonEnabled } from '@pellux/goodvibes-sdk/platform/config';
 import { formatProviderModel, getModelIdFromProviderModel, getProviderIdFromModel } from '../config/provider-model.ts';
 import { RuntimeEventBus, GlobalNetworkTransportInstaller } from '@/runtime/index.ts';
@@ -8,17 +7,20 @@ import { bindFeatureSettingsBridge, createFeatureFlagManager, deriveFeatureState
 import { createRuntimeStore } from '../runtime/store/index.ts';
 import { createRuntimeServices } from '../runtime/services.ts';
 import { DaemonServer, HttpListener } from '@pellux/goodvibes-sdk/platform/daemon';
+import { createHostPowerSeam } from '@pellux/goodvibes-sdk/platform/power';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import {
   getOrCreateCompanionToken,
   pruneStaleOperatorTokens,
-  buildCompanionConnectionInfo,
-  encodeConnectionPayload,
-  formatConnectionBlock,
+  buildPairingHandoffLink,
+  describeOriginPosture,
   generateQrMatrix,
   renderQrToString,
 } from '@pellux/goodvibes-sdk/platform/pairing';
+import { ensurePublicBaseUrl } from '../core/pairing-origin.ts';
+import { availablePairingOffers } from '../core/pairing-handoff.ts';
+import { formatPairingOffers, formatPostureCapabilities, pairingPostureNotice } from '../core/pairing-offers.ts';
 import { workspaceOperatorTokenCandidates } from '../runtime/operator-token-cleanup.ts';
 import {
   scan,
@@ -51,36 +53,6 @@ type DaemonCliTokens = {
   readonly httpToken: string | undefined;
 };
 
-function getLocalNetworkIp(): string {
-  try {
-    const nets = networkInterfaces();
-    for (const name of Object.keys(nets)) {
-      for (const net of nets[name] ?? []) {
-        if (net.family === 'IPv4' && !net.internal) {
-          return net.address;
-        }
-      }
-    }
-  } catch {
-    return 'localhost';
-  }
-  return 'localhost';
-}
-
-function readBootstrapPassword(credentialPath: string): string | undefined {
-  try {
-    const content = readFileSync(credentialPath, 'utf-8');
-    for (const line of content.split('\n')) {
-      if (line.startsWith('password=')) {
-        return line.slice('password='.length).trim();
-      }
-    }
-  } catch {
-    // credential file may not exist yet
-  }
-  return undefined;
-}
-
 function resolveDaemonCliOwnership(): DaemonCliOwnership {
   return {
     workingDirectory: process.env['GOODVIBES_WORKING_DIR'] ?? process.cwd(),
@@ -204,6 +176,17 @@ async function main(): Promise<void> {
     getConversationTitle: () => 'goodvibes daemon',
     workingDir,
     homeDirectory,
+    // The standalone daemon observes externally-launched coding-agent sessions
+    // on the host read-only (fleet visibility + steer; never counted, never
+    // stopped). Daemon-side only — the interactive process reads this snapshot
+    // rather than double-detecting. Mirrors the SDK daemon cli.
+    observeExternalAgents: true,
+    // Opt into the REAL host power seam (Linux logind: systemd-inhibit children
+    // + the dbus-monitor sleep-edge watcher) so the standalone daemon holds live
+    // keep-awake/idle-inhibit. SDK 1.9.0's runtime-services factory defaults to
+    // the non-spawning unavailable seam; only daemon compositions opt in. Mirrors
+    // the SDK daemon cli's createHostPowerSeam() (sdk commit 3a5ea26d).
+    powerSeam: createHostPowerSeam(),
   });
 
   // Load persisted providers from disk so the provider registry is pre-populated
@@ -312,29 +295,37 @@ async function main(): Promise<void> {
     httpListener: config.get('danger.httpListener'),
   });
 
-  // Print companion connection info + QR code to stdout.
-  // Use the config-driven control plane port, not a hardcoded default.
-  const daemonPort = config.get('controlPlane.port');
-  const configuredDaemonHost = String(process.env.GOODVIBES_DAEMON_HOST ?? getLocalNetworkIp());
-  const daemonHost = configuredDaemonHost === '0.0.0.0' || configuredDaemonHost === '::'
-    ? getLocalNetworkIp()
-    : configuredDaemonHost;
-  const daemonUrl = `http://${daemonHost}:${daemonPort}`;
-  const bootstrapPassword = readBootstrapPassword(userAuth.getBootstrapCredentialPath());
-  const connectionInfo = buildCompanionConnectionInfo({
-    daemonUrl,
-    token: companionTokenRecord.token,
-    password: bootstrapPassword,
-    // Without this the SDK defaults the printed banner header to v0.0.0 —
-    // the visible version must be this binary's real version.
-    version: VERSION,
-    surface: 'tui',
+  // Print a device-pairing QR to stdout. The QR encodes the canonical
+  // `#pair=<token>` deep link the web app consumes — a camera scan opens it
+  // already signed in. No raw JSON connection blob is printed. This is also the
+  // one place web.publicBaseUrl is frozen from the stable-name resolution (never
+  // clobbering a user-set value), so the printed origin survives a DHCP change.
+  // The daemon's shared companion token rides as the pairing token; a device can
+  // later migrate to its own per-device token from /settings → security → devices.
+  const webOrigin = ensurePublicBaseUrl(config);
+  const offers = availablePairingOffers({
+    relayEnabled: config.get('relay.enabled') === true,
+    stepUpAvailable: true,
   });
-  const payload = encodeConnectionPayload(connectionInfo);
-  const qrMatrix = generateQrMatrix(payload);
-  const qrString = renderQrToString(qrMatrix);
+  const deepLink = buildPairingHandoffLink({ webOrigin: webOrigin.origin, token: companionTokenRecord.token, offers });
+  const qrString = renderQrToString(generateQrMatrix(deepLink));
+  // The banner renders the SAME SDK posture the pairing verb carries: the labeled
+  // capability list, and the one honest LAN line only when the posture holds it.
+  const posture = describeOriginPosture(webOrigin.origin);
+  const capabilities = formatPostureCapabilities(posture);
+  const notice = pairingPostureNotice(posture);
+  const bannerLines = [
+    `GoodVibes daemon ${VERSION} — scan to pair a device (opens the web app signed in):`,
+    '',
+    `  ${webOrigin.origin}`,
+    '',
+    ...(offers.length > 0 ? ['Offers (each declinable in the web app):', ...formatPairingOffers(offers), ''] : []),
+    ...(capabilities.length > 0 ? ['This device will get:', ...capabilities, ''] : []),
+    ...(notice ? [notice, ''] : []),
+    qrString,
+  ];
   // eslint-disable-next-line no-console
-  console.log(formatConnectionBlock(connectionInfo, qrString));
+  console.log(bannerLines.join('\n'));
 }
 
 void main().catch(async (error) => {

package/src/input/command-registry.ts

@@ -84,6 +84,25 @@ export interface CommandUiActions {
   /** Arm the one-key jump to a spawned CI fix-session (the surface attaches on the jump key; the user never retypes an id). */
   armFixSessionAttach?: (fixSessionId: string) => void;
   cancelGeneration?: () => void;
+  /**
+   * Cancel JUST the currently-running tool call (the live transcript row),
+   * leaving the turn to continue — the local-session equivalent of the
+   * sessions.toolCalls.cancel wire verb over the in-process orchestrator.
+   * Returns true when a running call was found and cancelled.
+   */
+  cancelToolCall?: () => boolean;
+  /** The still-undelivered mid-turn messages, in delivery order (the /queue editable list). */
+  listQueuedMessages?: () => ReadonlyArray<{ id: string; queuedAt: number; text: string }>;
+  /** Replace a still-queued message's text; false once delivered (immutable). */
+  editQueuedMessage?: (id: string, text: string) => boolean;
+  /** Remove a still-queued message before delivery; false once delivered. */
+  deleteQueuedMessage?: (id: string) => boolean;
+  /** Toggle the drill-in of the "used N memories" provenance chip (memory.showProvenance). */
+  toggleMemoryProvenance?: () => void;
+  /** The current host sleep-ownership projection (power.status.get, flattened) — chip, held-because, lid-split. */
+  getPowerState?: () => import('../core/power-status.ts').PowerSurfaceState;
+  /** Set the daemon-held keep-awake toggle (power.keepAwake.set), acquiring/releasing the inhibitor live; returns the new state. */
+  setKeepAwake?: (enabled: boolean) => Promise<import('../core/power-status.ts').PowerSurfaceState>;
   /** True while an LLM turn is actively streaming. Used to give Escape
    *  cancel-turn precedence over a focused panel's own escape handling. */
   isGenerating?: () => boolean;
@@ -273,6 +292,8 @@ export interface CommandWorkspaceServices
 export interface CommandPlatformConfigServices {
   readonly config: DeepReadonly<GoodVibesConfig>;
   readonly configManager: ConfigManager;
+  /** Per-device pairing tokens — backs the /devices command family. */
+  readonly pairingTokens?: import('@pellux/goodvibes-sdk/platform/pairing').PairingTokenManager;
   /** Capability gate runtime — feature states derive from domain settings keys; surfaces read live/pending state here. */
   readonly featureFlagManager?: FeatureFlagManager;
   readonly voiceProviderRegistry?: VoiceProviderRegistry;

package/src/input/commands/acp-runtime.ts

@@ -0,0 +1,72 @@
+// ---------------------------------------------------------------------------
+// acp-runtime.ts — the scripted path for hosting third-party coding agents,
+// over the SAME verbs the Fleet panel's spawn affordance drives (acp.agents.list
+// / acp.sessions.create). `/agents list` shows what the daemon discovered
+// (read-only, quiet when none); `/agents host <agentId> [dir]` spawns one as a
+// long-lived daemon session that shows up as an acp-agent fleet row. A working
+// directory defaults to the current one; a known workspace root can be named
+// instead — but no path is ever required beyond what the operator already has.
+//
+// A structured spawn failure ({binary, stage, message}) is printed verbatim,
+// never left as a hung row: the daemon bounds the handshake and returns a
+// 'failed' record with its three honest fields.
+// ---------------------------------------------------------------------------
+
+import type { CommandRegistry } from '../command-registry.ts';
+import { requireShellPaths } from './runtime-services.ts';
+import { describeOperatorRpcError, getOperatorRpc } from './operator-rpc.ts';
+
+export function registerAcpRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'agents',
+    aliases: ['acp'],
+    description: 'Host third-party coding agents (Claude Code, Codex, opencode) as fleet rows over ACP',
+    usage: 'list | host <agentId> [directory]',
+    argsHint: '[list|host]',
+    async handler(args, ctx) {
+      const sub = (args[0] ?? 'list').toLowerCase();
+      const rpc = getOperatorRpc(ctx);
+      if (!rpc.available) { ctx.print(`[agents] ${rpc.reason}`); return; }
+
+      if (sub === 'list') {
+        try {
+          const { agents } = await rpc.sdk.operator.invoke('acp.agents.list', {});
+          if (agents.length === 0) {
+            ctx.print('[agents] No third-party ACP agents discovered. Install Claude Code, Codex, or opencode on PATH to host one.');
+            return;
+          }
+          ctx.print([
+            'Discovered ACP agents (host with /agents host <id> [directory]):',
+            ...agents.map((a) => `  ${a.id} — ${a.title}  (${a.binaryPath})`),
+          ].join('\n'));
+        } catch (error) {
+          ctx.print(`[agents list] ${describeOperatorRpcError(error)}`);
+        }
+        return;
+      }
+
+      if (sub === 'host') {
+        const agentId = args[1];
+        if (!agentId) {
+          ctx.print('Usage: /agents host <agentId> [directory]  (agentId from /agents list; directory defaults to the current one)');
+          return;
+        }
+        const cwd = args[2] ?? requireShellPaths(ctx).workingDirectory;
+        try {
+          const { hosted, started } = await rpc.sdk.operator.invoke('acp.sessions.create', { agentId, cwd });
+          if (hosted.error) {
+            // Structured failure, verbatim — never a hung row.
+            ctx.print(`[agents host] Could not host ${hosted.title || agentId}: ${hosted.error.stage} stage failed for ${hosted.error.binary} — ${hosted.error.message}`);
+            return;
+          }
+          ctx.print(`[agents host] Hosting ${hosted.title || agentId} in ${cwd}${started ? '' : ' (queued)'} — it appears as an acp-agent row in the fleet; steer and stop it like any agent.`);
+        } catch (error) {
+          ctx.print(`[agents host] ${describeOperatorRpcError(error)}`);
+        }
+        return;
+      }
+
+      ctx.print('Usage: /agents list | /agents host <agentId> [directory]');
+    },
+  });
+}

package/src/input/commands/devices-runtime.ts

@@ -0,0 +1,109 @@
+import type { CommandContext, CommandRegistry } from '../command-registry.ts';
+import { formatDeviceLine, resolveTokenByIdPrefix } from '../../core/pairing-devices.ts';
+
+/**
+ * Register the /devices command — manage the per-device pairing tokens minted by
+ * the pairing surfaces. Mirrors the pairing.tokens.* gateway verbs the daemon
+ * serves (list/rename/revoke/migrate/revoke-shared) so the terminal has the same
+ * capability as the web app's device manager.
+ *
+ *   /devices                      list paired devices (name · created · last-seen · id)
+ *   /devices rename <id> <name>   rename a device token (id or unambiguous prefix)
+ *   /devices revoke <id>          revoke a device token immediately
+ *   /devices migrate-shared [name] mint a per-device token off the legacy shared token
+ *   /devices revoke-shared        revoke the legacy shared token (it stops authenticating)
+ */
+export function registerDevicesRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'devices',
+    aliases: ['device'],
+    description: 'Manage paired-device tokens (list, rename, revoke, migrate-shared)',
+    usage: '[list|rename <id> <name>|revoke <id>|migrate-shared [name]|revoke-shared]',
+    argsHint: '[list|rename|revoke|migrate-shared|revoke-shared]',
+    handler(args, ctx) {
+      const pairingTokens = ctx.platform.pairingTokens;
+      if (!pairingTokens) {
+        ctx.print('Device management is unavailable in this runtime (no pairing token service wired).');
+        return;
+      }
+      const sub = (args[0] ?? 'list').toLowerCase();
+
+      if (sub === 'list') {
+        renderList(ctx, pairingTokens);
+        return;
+      }
+
+      if (sub === 'rename') {
+        const idOrPrefix = args[1];
+        const name = args.slice(2).join(' ').trim();
+        if (!idOrPrefix || !name) {
+          ctx.print('Usage: /devices rename <id> <new name>');
+          return;
+        }
+        const resolved = resolveTokenByIdPrefix(pairingTokens.list(), idOrPrefix);
+        if (!resolved.ok) {
+          ctx.print(resolved.reason === 'ambiguous' ? `Ambiguous device id "${idOrPrefix}" — use more characters.` : `No device matches "${idOrPrefix}".`);
+          return;
+        }
+        pairingTokens.rename(resolved.token.id, name);
+        ctx.print(`Renamed device to "${name}".`);
+        return;
+      }
+
+      if (sub === 'revoke') {
+        const idOrPrefix = args[1];
+        if (!idOrPrefix) {
+          ctx.print('Usage: /devices revoke <id>');
+          return;
+        }
+        const resolved = resolveTokenByIdPrefix(pairingTokens.list(), idOrPrefix);
+        if (!resolved.ok) {
+          ctx.print(resolved.reason === 'ambiguous' ? `Ambiguous device id "${idOrPrefix}" — use more characters.` : `No device matches "${idOrPrefix}".`);
+          return;
+        }
+        const revoked = pairingTokens.revoke(resolved.token.id);
+        ctx.print(revoked ? `Revoked "${resolved.token.name}" — its token stops working immediately.` : `Device "${resolved.token.name}" was already absent.`);
+        return;
+      }
+
+      if (sub === 'migrate-shared') {
+        const name = args.slice(1).join(' ').trim() || 'migrated device';
+        const minted = pairingTokens.mintForMigration({ name });
+        ctx.print(
+          `Minted a per-device token "${minted.name}" (shown once): ${minted.token}\n` +
+          'Pair this device with it, then run /devices revoke-shared to retire the legacy shared token.',
+        );
+        return;
+      }
+
+      if (sub === 'revoke-shared') {
+        if (pairingTokens.isLegacyRevoked()) {
+          ctx.print('The legacy shared token is already revoked.');
+          return;
+        }
+        pairingTokens.revokeLegacyShared();
+        ctx.print('Revoked the legacy shared token — devices still on it must re-pair with their own token.');
+        return;
+      }
+
+      ctx.print(`Unknown /devices subcommand: ${sub}. Use: list | rename | revoke | migrate-shared | revoke-shared`);
+    },
+  });
+}
+
+function renderList(ctx: CommandContext, pairingTokens: NonNullable<CommandContext['platform']['pairingTokens']>): void {
+  const list = pairingTokens.list();
+  const lines: string[] = ['Paired devices:'];
+  if (list.length === 0) {
+    lines.push('  (none yet — pair one with /pair)');
+  } else {
+    for (const token of list) lines.push(`  ${formatDeviceLine(token)}`);
+  }
+  lines.push(
+    '',
+    pairingTokens.isLegacyRevoked()
+      ? 'Legacy shared token: revoked.'
+      : 'Legacy shared token: active — run /devices migrate-shared then /devices revoke-shared to retire it.',
+  );
+  ctx.print(lines.join('\n'));
+}

package/src/input/commands/git-runtime.ts

@@ -1,6 +1,6 @@
 import type { CommandRegistry } from '../command-registry.ts';
 import { GitService } from '@pellux/goodvibes-sdk/platform/git';
-import { requireShellPaths } from './runtime-services.ts';
+import { requireShellPaths, requirePanelManager } from './runtime-services.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 export function registerGitRuntimeCommands(registry: CommandRegistry): void {
@@ -64,10 +64,34 @@ export function registerGitRuntimeCommands(registry: CommandRegistry): void {
           break;
         }
         case 'diff': {
+          // Route the full, uncapped working-tree diff (GitService.diffStructured
+          // — parsed per-file/per-hunk with no size limit) into the real diff
+          // panel. The old path sliced the raw text at 4,000 chars and printed a
+          // stub; a large diff now renders complete.
           try {
-            const diffText = await git.diff();
-            if (!diffText.trim()) ctx.print('No unstaged changes.');
-            else ctx.print(diffText.length > 4000 ? `${diffText.slice(0, 4000)}\n\n...(diff truncated)` : diffText);
+            const structured = await git.diffStructured();
+            if (structured.files.length === 0) {
+              ctx.print('No unstaged changes.');
+              break;
+            }
+            const { DiffPanel } = await import('../../panels/diff-panel.ts');
+            const pm = requirePanelManager(ctx);
+            let panel = pm.getAllOpen().find((p) => p.id === 'diff');
+            if (!panel) {
+              try {
+                panel = pm.open('diff');
+              } catch {
+                ctx.print('Could not open diff panel.');
+                break;
+              }
+            }
+            pm.activateById('diff');
+            if (!pm.isVisible()) pm.show();
+            ctx.focusPanels?.();
+            (panel as InstanceType<typeof DiffPanel>).loadStructuredDiff(structured);
+            const fileWord = structured.files.length === 1 ? 'file' : 'files';
+            ctx.print(`Diff panel updated: ${structured.files.length} ${fileWord}, +${structured.additions} -${structured.deletions} (complete, uncapped).`);
+            ctx.renderRequest();
           } catch (e) {
             ctx.print(`Git diff failed: ${summarizeError(e)}`);
           }

package/src/input/commands/graph-runtime.ts

@@ -0,0 +1,45 @@
+import type { CommandRegistry } from '../command-registry.ts';
+import { getOperatorRpc, describeOperatorRpcError } from './operator-rpc.ts';
+import { renderWorkstreamGraphLines } from '../../panels/workstream-graph-render.ts';
+
+// ---------------------------------------------------------------------------
+// /graph — a workstream's task graph (fleet.graph.get) rendered legibly.
+//
+// The observability-layer surface: nodes, edges, per-node states (ready /
+// running / blocked-with-"waiting on: X" / stalled / orphaned) and the elastic
+// pool posture ("N ready, M running, at cap (fleet.maxSize=N)") — the shape of
+// the dependency graph WITHOUT opening any transcript. The fix-phase chain's
+// task graph is one such workstream.
+// ---------------------------------------------------------------------------
+
+function renderWidth(): number {
+  const cols = typeof process !== 'undefined' && process.stdout && process.stdout.columns ? process.stdout.columns : 80;
+  return Math.max(40, cols - 2);
+}
+
+export function registerGraphRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'graph',
+    description: "Show a workstream's task graph — nodes, edges, states, and pool posture",
+    usage: '<workstreamId>',
+    argsHint: '<workstreamId>',
+    async handler(args, ctx) {
+      const workstreamId = (args[0] ?? '').trim();
+      if (!workstreamId) {
+        ctx.print('Usage: /graph <workstreamId>  — renders that workstream\'s task graph (nodes, edges, states, pool).');
+        return;
+      }
+      const rpc = getOperatorRpc(ctx);
+      if (!rpc.available) {
+        ctx.print(`[graph] ${rpc.reason}`);
+        return;
+      }
+      try {
+        const snapshot = await rpc.sdk.operator.invoke('fleet.graph.get', { workstreamId });
+        ctx.print(renderWorkstreamGraphLines(snapshot, renderWidth()).join('\n'));
+      } catch (error) {
+        ctx.print(`[graph] ${describeOperatorRpcError(error)}`);
+      }
+    },
+  });
+}

package/src/input/commands/operator-rpc.ts

@@ -27,6 +27,7 @@ import { join } from 'node:path';
 import { createGoodVibesSdk } from '@pellux/goodvibes-sdk';
 import type { GoodVibesSdk } from '@pellux/goodvibes-sdk';
 import { GoodVibesSdkError } from '@pellux/goodvibes-sdk';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { resolveDaemonEnabled } from '@pellux/goodvibes-sdk/platform/config';
 import { getOrCreateCompanionToken } from '@pellux/goodvibes-sdk/platform/pairing';
 import type { CommandContext } from '../command-registry.ts';
@@ -44,8 +45,7 @@ export interface OperatorRpcAvailable {
 
 export type OperatorRpc = OperatorRpcUnavailable | OperatorRpcAvailable;
 
-function resolveControlPlaneBaseUrl(context: CommandContext): string | null {
-  const configManager = context.platform.configManager;
+function resolveControlPlaneBaseUrl(configManager: ConfigManager): string | null {
   const explicit = String(configManager.get('controlPlane.baseUrl') ?? '').trim();
   if (explicit) return explicit;
   const host = String(configManager.get('controlPlane.host') ?? '').trim();
@@ -55,27 +55,48 @@ function resolveControlPlaneBaseUrl(context: CommandContext): string | null {
 }
 
 /**
- * Resolve (or honestly refuse to resolve) an operator SDK client wired to
- * this workspace's control-plane daemon. Reasons for refusal are surfaced
- * verbatim to the caller so `/ci`, `/checkin`, and `/principals` can print
- * them directly rather than inventing their own wording.
+ * Context-free core of {@link getOperatorRpc}: resolve (or honestly refuse to
+ * resolve) an operator SDK client wired to this workspace's control-plane
+ * daemon from just the two things the resolution actually needs — the config
+ * manager and the home directory. Shared by the command layer (via
+ * getOperatorRpc) and the Fleet panel's gateway (fleet-gateway.ts) so both
+ * reach the same daemon over the same generic invoke path, never two divergent
+ * clients. Refusal reasons are surfaced verbatim so callers print them directly.
  */
-export function getOperatorRpc(context: CommandContext): OperatorRpc {
-  const configManager = context.platform.configManager;
+export function resolveOperatorRpc(deps: { readonly configManager: ConfigManager; readonly homeDirectory: string | (() => string) }): OperatorRpc {
+  const { configManager } = deps;
   if (!resolveDaemonEnabled(configManager)) {
     return { available: false, reason: 'the daemon is disabled (daemon.enabled=false) — no operator surface to reach. Enable it in /settings, then retry.' };
   }
-  const baseUrl = resolveControlPlaneBaseUrl(context);
+  const baseUrl = resolveControlPlaneBaseUrl(configManager);
   if (!baseUrl) {
     return { available: false, reason: 'no control-plane base URL is configured (controlPlane.baseUrl / controlPlane.host+port) — cannot reach the operator surface.' };
   }
-  const shellPaths = requireShellPaths(context);
-  const daemonHomeDir = join(shellPaths.homeDirectory, '.goodvibes', 'daemon');
+  // Resolve the home directory only AFTER the static refusals — a caller whose
+  // shell paths are not wired (a disabled-daemon path) must still get the honest
+  // unavailable reason above, never a "shell paths not wired" throw.
+  const homeDirectory = typeof deps.homeDirectory === 'function' ? deps.homeDirectory() : deps.homeDirectory;
+  const daemonHomeDir = join(homeDirectory, '.goodvibes', 'daemon');
   const token = getOrCreateCompanionToken('tui', { daemonHomeDir }).token;
   const sdk = createGoodVibesSdk({ baseUrl, authToken: token });
   return { available: true, sdk };
 }
 
+/**
+ * Resolve (or honestly refuse to resolve) an operator SDK client wired to
+ * this workspace's control-plane daemon. Reasons for refusal are surfaced
+ * verbatim to the caller so `/ci`, `/checkin`, and `/principals` can print
+ * them directly rather than inventing their own wording.
+ */
+export function getOperatorRpc(context: CommandContext): OperatorRpc {
+  return resolveOperatorRpc({
+    configManager: context.platform.configManager,
+    // Lazy: only resolved once the daemon-enabled + base-URL refusals pass, so a
+    // disabled-daemon context with no shell paths still returns the honest reason.
+    homeDirectory: () => requireShellPaths(context).homeDirectory,
+  });
+}
+
 /**
  * Render a thrown operator-rpc error honestly: a 404 means this daemon has
  * not wired a handler for the verb (a live local runtime that simply doesn't

package/src/input/commands/power-runtime.ts

@@ -0,0 +1,56 @@
+import type { CommandRegistry } from '../command-registry.ts';
+import { powerStatusLines } from '../../core/power-status.ts';
+
+// ---------------------------------------------------------------------------
+// /power — host sleep ownership (the ops/status idiom surface for power.*).
+//
+// Shows the honest account of sleep ownership — the "sleep disabled" chip
+// meaning, each "held because X" work-inhibition reason, and the lid-split note
+// rendered VERBATIM when the OS could block idle-sleep but not lid-close
+// suspend — and toggles the daemon-held keep-awake switch. Owner ruling: the
+// always-visible chip IS the safety mechanism, so there is no timer and no
+// AC-only option — keep-awake is exactly one on/off toggle.
+// ---------------------------------------------------------------------------
+
+export function registerPowerRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'power',
+    description: 'Host sleep ownership — show status and toggle keep-awake',
+    usage: '[status | on | off | toggle]',
+    argsHint: '[status|on|off|toggle]',
+    async handler(args, ctx) {
+      const sub = (args[0] ?? 'status').toLowerCase();
+
+      if (sub === 'status' || args.length === 0) {
+        const state = ctx.getPowerState?.();
+        if (!state) {
+          ctx.print('Power status is unavailable in this session.');
+          return;
+        }
+        const lines = ['Host sleep ownership:', ...powerStatusLines(state).map((l) => `  ${l}`)];
+        lines.push(state.keepAwake
+          ? 'Keep-awake is ON. Turn it off with /power off.'
+          : 'Keep-awake is OFF. Turn it on with /power on.');
+        ctx.print(lines.join('\n'));
+        return;
+      }
+
+      if (sub === 'on' || sub === 'off' || sub === 'toggle') {
+        if (!ctx.setKeepAwake || !ctx.getPowerState) {
+          ctx.print('Keep-awake cannot be changed in this session.');
+          return;
+        }
+        const current = ctx.getPowerState().keepAwake;
+        const next = sub === 'on' ? true : sub === 'off' ? false : !current;
+        const state = await ctx.setKeepAwake(next);
+        const lines = [state.keepAwake ? 'Keep-awake ON — this host will not idle-sleep.' : 'Keep-awake OFF.'];
+        // Surface the honest lid-split note verbatim if the SDK served one.
+        if (state.note) lines.push(`  ${state.note}`);
+        ctx.print(lines.join('\n'));
+        return;
+      }
+
+      ctx.print('Usage: /power [status | on | off | toggle]');
+    },
+  });
+}

package/src/input/commands/qrcode-runtime.ts

@@ -1,36 +1,31 @@
-import { join } from 'node:path';
 import type { CommandRegistry } from '../command-registry.ts';
-import { openModalCommand, requireShellPaths } from './runtime-services.ts';
-import { regenerateCompanionToken } from '@pellux/goodvibes-sdk/platform/pairing';
+import { openModalCommand } from './runtime-services.ts';
 
 /**
  * Register the /qrcode command.
  *
- * `/qrcode` (no args) opens the companion-app pairing modal (QR code + URL/
- * token/username). `/qrcode regenerate` rotates the companion pairing token:
- * it re-keys the shared operator-token store, so the previously-issued token is
- * rejected on the next auth and a fresh QR must be scanned to reconnect.
+ * `/qrcode` (no args, aliases /qr /pair) opens the device-pairing modal: a QR of
+ * the `#pair=<token>` deep link plus the offer set. Each open mints its own
+ * named per-device token, so `/qrcode regenerate` no longer rotates a shared
+ * token — it simply re-opens the modal, which mints a fresh token and QR. The
+ * previously-shown token stays valid until you revoke it in
+ * /settings → security → devices.
  */
 export function registerQrcodeRuntimeCommands(registry: CommandRegistry): void {
   registry.register({
     name: 'qrcode',
     aliases: ['qr', 'pair'],
-    description: 'Open the companion-app pairing modal (QR code), or regenerate the pairing token',
+    description: 'Open the device-pairing modal (QR deep link + offers); each open mints a fresh device token',
     usage: '[regenerate]',
     argsHint: '[regenerate]',
     handler(args, ctx) {
       if (args[0]?.toLowerCase() === 'regenerate') {
-        const shellPaths = requireShellPaths(ctx);
-        const daemonHomeDir = join(shellPaths.homeDirectory, '.goodvibes', 'daemon');
-        try {
-          const rotated = regenerateCompanionToken({ daemonHomeDir });
-          ctx.print(
-            'Pairing token rotated. The previous token is now rejected — ' +
-            `re-scan the QR (new peer ${rotated.peerId.slice(0, 8)}…) to reconnect the companion app.`,
-          );
-        } catch (error) {
-          ctx.print(`Could not regenerate the pairing token: ${String(error)}`);
-        }
+        // Each pairing-modal open mints its own token, so "regenerate" is just a
+        // fresh open: the re-pull mints a new named token + QR in place. The
+        // prior token is not rotated out from under a live device — revoke it
+        // explicitly in /settings → security → devices when you no longer need it.
+        ctx.print('Opening a fresh pairing QR — it mints a new device token. Revoke old ones in /settings → security → devices.');
+        openModalCommand(ctx, 'pairing-modal');
         return;
       }
       openModalCommand(ctx, 'pairing-modal');