@pellux/goodvibes-tui 1.17.0 → 1.19.0

package/src/input/commands/queue-runtime.ts

@@ -0,0 +1,70 @@
+import type { CommandRegistry } from '../command-registry.ts';
+
+// ---------------------------------------------------------------------------
+// /queue — the mid-turn message queue as an editable list.
+//
+// Messages typed while a turn is streaming are QUEUED (they deliver after the
+// turn). Until a message is delivered it stays editable and deletable via the
+// SDK's editQueuedMessage / deleteQueuedMessage verbs; a delivered message has
+// left the queue and is no longer listed — delivery is immutability. This
+// command is the editable interface over the same list the composer renders.
+// ---------------------------------------------------------------------------
+
+export function registerQueueRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'queue',
+    aliases: ['q'],
+    description: 'Mid-turn message queue — list, edit, or delete still-undelivered messages',
+    usage: '[list | edit <n> <text> | delete <n>]',
+    argsHint: '[list|edit <n> <text>|delete <n>]',
+    handler(args, ctx) {
+      const list = ctx.listQueuedMessages?.() ?? [];
+      const sub = (args[0] ?? 'list').toLowerCase();
+
+      if (sub === 'list' || args.length === 0) {
+        if (list.length === 0) {
+          ctx.print('No queued messages. (Messages typed while a turn is streaming queue here until it finishes.)');
+          return;
+        }
+        const lines = [`Queued messages (${list.length}) — editable until delivered:`];
+        list.forEach((m, i) => lines.push(`  ${i + 1}. ${m.text}`));
+        lines.push('Use /queue edit <n> <new text> or /queue delete <n>.');
+        ctx.print(lines.join('\n'));
+        return;
+      }
+
+      // Both edit and delete address a message by its 1-based list position.
+      const n = Number.parseInt(args[1] ?? '', 10);
+      if (!Number.isInteger(n) || n < 1 || n > list.length) {
+        ctx.print(list.length === 0
+          ? 'No queued messages to act on.'
+          : `No queued message #${args[1] ?? ''}. Valid range: 1..${list.length}. Run /queue to list them.`);
+        return;
+      }
+      const target = list[n - 1]!;
+
+      if (sub === 'delete') {
+        const ok = ctx.deleteQueuedMessage?.(target.id) ?? false;
+        ctx.print(ok
+          ? `Deleted queued message #${n}.`
+          : `Could not delete message #${n} — it was already delivered (delivered messages are immutable).`);
+        return;
+      }
+
+      if (sub === 'edit') {
+        const text = args.slice(2).join(' ');
+        if (!text.trim()) {
+          ctx.print('Usage: /queue edit <n> <new text>. Provide the replacement text.');
+          return;
+        }
+        const ok = ctx.editQueuedMessage?.(target.id, text) ?? false;
+        ctx.print(ok
+          ? `Edited queued message #${n}.`
+          : `Could not edit message #${n} — it was already delivered (delivered messages are immutable).`);
+        return;
+      }
+
+      ctx.print('Usage: /queue [list | edit <n> <text> | delete <n>]');
+    },
+  });
+}

package/src/input/commands/workstream-attempts.ts

@@ -25,6 +25,7 @@ import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { CommandContext } from '../command-registry.ts';
 import type { WorkstreamCommandService } from '../../runtime/workstream-services.ts';
 import { requirePanelManager } from './runtime-services.ts';
+import { describeFailureReason, isTurnBudgetReason } from '../../core/turn-budget-outcome.ts';
 import { type AttemptGraphItem, renderDependentHoldLines } from './workstream-attempt-dependents.ts';
 
 /** Resolve a workstream's items for dependent-hold display; null-safe against a stubbed engine. */
@@ -58,7 +59,11 @@ function resolveCandidate(group: HeldMergeGroup, ref: string): AttemptCandidate
 
 function candidateLine(c: AttemptCandidate): string {
   const files = c.diff ? `${c.diff.files.length} file(s)` : 'no diff';
-  const state = c.state === 'held-merge' ? 'held (pick-ready)' : `failed${c.failureReason ? `: ${c.failureReason}` : ''}`;
+  const state = c.state === 'held-merge'
+    ? 'held (pick-ready)'
+    : isTurnBudgetReason(c.failureReason)
+      ? describeFailureReason(c.failureReason) // a spent budget, not an infrastructure failure
+      : `failed${c.failureReason ? `: ${c.failureReason}` : ''}`;
   return `    ${c.attemptIndex + 1}. [${state}] ${c.title} — ${files}, item ${shortId(c.itemId)}`;
 }
 

package/src/input/commands/workstream-runtime.ts

@@ -102,6 +102,33 @@ async function checkFanoutQuotaWarning(ctx: CommandContext, draft: WorkstreamDra
   ].join('\n');
 }
 
+/**
+ * Launch an already-approved draft through its gates (best-of-N attempt
+ * validation, then the fan-out quota warning unless `--force`), and print the
+ * outcome. Shared by `launch` and by `approve` (which launches in the same act
+ * — the one confirmed step that replaces the old approve-then-retype ceremony).
+ */
+async function launchApprovedDraft(ctx: CommandContext, service: WorkstreamCommandService, id: string, draft: WorkstreamDraft, force: boolean): Promise<void> {
+  const attemptsCheck = validateAttempts(draft.spec);
+  if (attemptsCheck.violations.length > 0) {
+    ctx.print(`Cannot launch ${id} — best-of-N plan constraints are violated:\n${attemptsCheck.violations.map((v) => `  - ${v}`).join('\n')}\nFix the plan (or drop the attempts) and re-approve.`);
+    return;
+  }
+  if (!force) {
+    const quotaWarning = await checkFanoutQuotaWarning(ctx, draft);
+    if (quotaWarning) {
+      ctx.print(quotaWarning);
+      return;
+    }
+  }
+  const result = service.launchDraft(id);
+  if (!result) {
+    ctx.print(`Could not launch ${id}.`);
+    return;
+  }
+  ctx.print(`Launched workstream ${result.workstreamId} — track it with /workstream status ${result.workstreamId} or the Fleet panel.`);
+}
+
 /**
  * phase.role for a 'custom' phase is the free-text description passed to
  * `/workstream insert-phase` — it is purely COSMETIC. Neither
@@ -377,7 +404,7 @@ export function registerWorkstreamRuntimeCommands(registry: CommandRegistry): vo
   registry.register({
     name: 'workstream',
     description: 'Author and oversee multi-phase agent workstreams (orchestration engine)',
-    usage: 'create [--isolation shared|worktree] <task...> | list | status [id] | insert-phase <id> <description...> | edit-item <id> <item#> <brief...> | remove-item <id> <item#> | move-item <id> <item#> <pos> | approve <id> | edit <id> [--isolation shared|worktree] <task...> | launch <id> [--force] | cancel <id> | attempts list|diff|judge|pick',
+    usage: 'create [--isolation shared|worktree] <task...> | list | status [id] | insert-phase <id> <description...> | edit-item <id> <item#> <brief...> | remove-item <id> <item#> | move-item <id> <item#> <pos> | approve <id> [--no-launch] [--force] | edit <id> [--isolation shared|worktree] <task...> | launch <id> [--force] | cancel <id> | attempts list|diff|judge|pick',
     argsHint: 'create [--isolation worktree] <task> | list | status [id] | edit-item | remove-item | move-item | approve | edit | launch | cancel | attempts',
     handler: async (args, ctx: CommandContext) => {
       const service = ctx.session.workstreamEngine;
@@ -470,9 +497,14 @@ export function registerWorkstreamRuntimeCommands(registry: CommandRegistry): vo
       }
 
       if (sub === 'approve') {
-        const id = args[1];
+        // Approve IS the one confirmed act: it approves AND launches (typing the
+        // verb with an explicit id is the confirmation). --no-launch keeps the
+        // old split for scripts; --force skips the fan-out quota warning.
+        const noLaunch = args.includes('--no-launch');
+        const force = args.includes('--force');
+        const id = args.find((arg, index) => index > 0 && arg !== '--no-launch' && arg !== '--force');
         if (!id) {
-          ctx.print('Usage: /workstream approve <id>');
+          ctx.print('Usage: /workstream approve <id> [--no-launch] [--force]');
           return;
         }
         const draft = service.approveDraft(id);
@@ -480,7 +512,11 @@ export function registerWorkstreamRuntimeCommands(registry: CommandRegistry): vo
           ctx.print(draftNotFoundMessage(service, id));
           return;
         }
-        ctx.print(`Approved ${id}. Launch with: /workstream launch ${id}`);
+        if (noLaunch) {
+          ctx.print(`Approved ${id} (held, not launched). Launch it with /workstream launch ${id}.`);
+          return;
+        }
+        await launchApprovedDraft(ctx, service, id, draft, force);
         return;
       }
 
@@ -554,27 +590,10 @@ export function registerWorkstreamRuntimeCommands(registry: CommandRegistry): vo
           return;
         }
         if (!draft.approved) {
-          ctx.print(`Proposal ${id} is not approved yet. Run /workstream approve ${id} first.`);
-          return;
-        }
-        const attemptsCheck = validateAttempts(draft.spec);
-        if (attemptsCheck.violations.length > 0) {
-          ctx.print(`Cannot launch ${id} — best-of-N plan constraints are violated:\n${attemptsCheck.violations.map((v) => `  - ${v}`).join('\n')}\nFix the plan (or drop the attempts) and re-approve.`);
-          return;
-        }
-        if (!force) {
-          const quotaWarning = await checkFanoutQuotaWarning(ctx, draft);
-          if (quotaWarning) {
-            ctx.print(quotaWarning);
-            return;
-          }
-        }
-        const result = service.launchDraft(id);
-        if (!result) {
-          ctx.print(`Could not launch ${id}.`);
+          ctx.print(`Proposal ${id} is not approved yet. Run /workstream approve ${id} first (or approve launches it directly).`);
           return;
         }
-        ctx.print(`Launched workstream ${result.workstreamId} — track it with /workstream status ${result.workstreamId} or the Fleet panel.`);
+        await launchApprovedDraft(ctx, service, id, draft, force);
         return;
       }
 
@@ -616,9 +635,9 @@ export function registerWorkstreamRuntimeCommands(registry: CommandRegistry): vo
         + '  /workstream edit-item <id> <item#> <new brief...>\n'
         + '  /workstream remove-item <id> <item#>\n'
         + '  /workstream move-item <id> <item#> <new-position#>\n'
-        + '  /workstream approve <id>\n'
+        + '  /workstream approve <id> [--no-launch] [--force]   (approves AND launches in one act)\n'
         + '  /workstream edit <id> [--isolation shared|worktree] <new task...>\n'
-        + '  /workstream launch <id> [--force]\n'
+        + '  /workstream launch <id> [--force]   (for a --no-launch-held or re-launched draft)\n'
         + '  /workstream cancel <id>',
       );
     },

package/src/input/commands/worktree-runtime.ts

@@ -145,19 +145,46 @@ export function registerWorktreeRuntimeCommands(registry: CommandRegistry): void
           : `${header}: ${targetKind} ${targetId}\n  No attached worktrees tracked.`);
         return;
       }
-      if (sub === 'pause' || sub === 'resume' || sub === 'keep' || sub === 'discard') {
+      if (sub === 'discard') {
+        // Discard is a real destructive act, not a metadata flip: route it
+        // through the worktrees.discard operator verb (preservation commit,
+        // git worktree removal, honest receipt) — the SAME behavior as the
+        // Fleet panel's D key. Typing the verb with an explicit path is the
+        // confirmation.
+        const path = args[1];
+        if (!path) {
+          ctx.print('Usage: /worktree discard <path>');
+          return;
+        }
+        const rpc = getOperatorRpc(ctx);
+        if (!rpc.available) {
+          ctx.print(`[worktree discard] ${rpc.reason}`);
+          return;
+        }
+        try {
+          const receipt = await rpc.sdk.operator.invoke('worktrees.discard', { path });
+          if (receipt.ok) {
+            ctx.print([
+              `[worktree discard] Discarded ${receipt.path}`,
+              `  branch kept: ${receipt.branch || '(unknown)'}`,
+              `  preservation commit: ${receipt.preservedCommit || '(none — nothing to preserve)'}`,
+              `  ${receipt.detail}`,
+            ].join('\n'));
+          } else {
+            ctx.print(`[worktree discard] refused for ${receipt.path}: ${receipt.detail}`);
+          }
+        } catch (error) {
+          ctx.print(`[worktree discard] round-trip request failed: ${describeOperatorRpcError(error)}`);
+        }
+        return;
+      }
+      if (sub === 'pause' || sub === 'resume' || sub === 'keep') {
         const path = args[1];
         if (!path) {
           ctx.print(`Usage: /worktree ${sub} <path>`);
           return;
         }
-        const nextState = sub === 'resume'
-          ? 'active'
-          : sub === 'pause'
-            ? 'paused'
-            : sub === 'keep'
-              ? 'kept'
-              : 'discard';
+        const nextState = sub === 'resume' ? 'active' : sub === 'pause' ? 'paused' : 'kept';
         runtime.setState(path, nextState);
         ctx.print(`Updated ${path} to state ${nextState}.`);
         return;

package/src/input/commands.ts

@@ -17,6 +17,9 @@ import { registerOperatorRuntimeCommands } from './commands/operator-runtime.ts'
 import { registerPluginRuntimeCommands } from './commands/plugin-runtime.ts';
 import { registerDiffRuntimeCommands } from './commands/diff-runtime.ts';
 import { registerGitRuntimeCommands } from './commands/git-runtime.ts';
+import { registerQueueRuntimeCommands } from './commands/queue-runtime.ts';
+import { registerPowerRuntimeCommands } from './commands/power-runtime.ts';
+import { registerGraphRuntimeCommands } from './commands/graph-runtime.ts';
 import { registerTestRuntimeCommands } from './commands/test-runtime.ts';
 import { registerNotifyRuntimeCommands } from './commands/notify-runtime.ts';
 import { registerReplayRuntimeCommands } from './commands/replay-runtime.ts';
@@ -55,11 +58,13 @@ import { registerLocalProviderRuntimeCommands } from './commands/local-provider-
 import { registerHealthRuntimeCommands } from './commands/health-runtime.ts';
 import { registerSettingsSyncRuntimeCommands } from './commands/settings-sync-runtime.ts';
 import { registerWorktreeRuntimeCommands } from './commands/worktree-runtime.ts';
+import { registerAcpRuntimeCommands } from './commands/acp-runtime.ts';
 import { registerProviderAccountsRuntimeCommands } from './commands/provider-accounts-runtime.ts';
 import { registerLocalAuthRuntimeCommands } from './commands/local-auth-runtime.ts';
 import { registerIntelligenceRuntimeCommands } from './commands/intelligence-runtime.ts';
 import { registerConversationRuntimeCommands } from './commands/conversation-runtime.ts';
 import { registerQrcodeRuntimeCommands } from './commands/qrcode-runtime.ts';
+import { registerDevicesRuntimeCommands } from './commands/devices-runtime.ts';
 import { registerRelayRuntimeCommands } from './commands/relay-runtime.ts';
 import { registerOnboardingRuntimeCommands } from './commands/onboarding-runtime.ts';
 import { registerTtsRuntimeCommands } from './commands/tts-runtime.ts';
@@ -101,6 +106,9 @@ export const BUILTIN_COMMAND_GROUPS: readonly BuiltinCommandGroup[] = [
   { category: 'Plugins', register: registerPluginRuntimeCommands },
   { category: 'Diff & Review', register: registerDiffRuntimeCommands },
   { category: 'Git', register: registerGitRuntimeCommands },
+  { category: 'Shell & Session', register: registerQueueRuntimeCommands },
+  { category: 'Shell & Session', register: registerPowerRuntimeCommands },
+  { category: 'Automation', register: registerGraphRuntimeCommands },
   { category: 'Testing', register: registerTestRuntimeCommands },
   { category: 'Notifications', register: registerNotifyRuntimeCommands },
   { category: 'Sessions & Replay', register: registerReplayRuntimeCommands },
@@ -133,11 +141,13 @@ export const BUILTIN_COMMAND_GROUPS: readonly BuiltinCommandGroup[] = [
   { category: 'Health', register: registerHealthRuntimeCommands },
   { category: 'Settings Sync', register: registerSettingsSyncRuntimeCommands },
   { category: 'Worktrees', register: registerWorktreeRuntimeCommands },
+  { category: 'Fleet', register: registerAcpRuntimeCommands },
   { category: 'Provider Accounts', register: registerProviderAccountsRuntimeCommands },
   { category: 'Local Auth', register: registerLocalAuthRuntimeCommands },
   { category: 'Intelligence', register: registerIntelligenceRuntimeCommands },
   { category: 'Conversation', register: registerConversationRuntimeCommands },
   { category: 'QR Codes', register: registerQrcodeRuntimeCommands },
+  { category: 'Security', register: registerDevicesRuntimeCommands },
   { category: 'Relay', register: registerRelayRuntimeCommands },
   { category: 'Onboarding', register: registerOnboardingRuntimeCommands },
   { category: 'Voice & TTS', register: registerTtsRuntimeCommands },

package/src/input/config-modal-types.ts

@@ -106,6 +106,17 @@ export interface ConfigModalActionContext {
   readonly setStatus: (message: string) => void;
   /** Close the modal (focus returns to whatever opened it). */
   readonly close: () => void;
+  /**
+   * Switch the active tab and select a row within it, by id — the in-surface
+   * "jump" affordance (e.g. the Memory modal's Proposals tab jumping to an
+   * affected record in the Review Queue tab, rather than opening a second
+   * modal). Host-owned, populated by ConfigModal itself (like `close`/
+   * `setStatus`) — a surface's `onAction` calls it, never constructs it. A
+   * no-op if either id is not present in the surface's current structure; the
+   * surface should check reachability itself and print an honest status line
+   * when it isn't, rather than relying on a silent no-op.
+   */
+  readonly jumpToRow?: (tabId: string, rowId: string) => void;
 }
 
 /** A declarative action bound to a key. */

package/src/input/config-modal.ts

@@ -339,7 +339,7 @@ export class ConfigModal {
    * action (consumed). Handles the two-press confirm for destructive actions.
    * This is an interaction boundary (syncs structure first).
    */
-  fireAction(key: string, ctx: Omit<ConfigModalActionContext, 'row' | 'tabId' | 'setStatus' | 'close' | 'requestRender'>): boolean {
+  fireAction(key: string, ctx: Omit<ConfigModalActionContext, 'row' | 'tabId' | 'setStatus' | 'close' | 'requestRender' | 'jumpToRow'>): boolean {
     this.syncStructure();
     const action = this.resolveAction(key);
     if (!action) return false;
@@ -359,11 +359,36 @@ export class ConfigModal {
       requestRender: this.requestRender,
       setStatus: (m: string) => { this.statusMessage = m; },
       close: () => this.close(),
+      jumpToRow: (tabId: string, rowId: string) => this.jumpToRow(tabId, rowId),
     };
     this.surface?.onAction?.(action.id, fullCtx);
     return true;
   }
 
+  /**
+   * In-surface "jump": switch the active tab (by id) and select a specific
+   * row (by id) within it — the mechanism a surface's own action handler
+   * uses to move the user from one tab to a specific row in another (e.g.
+   * the Memory modal's Proposals tab jumping to an affected record in the
+   * Review Queue tab). An interaction boundary (re-syncs structure first,
+   * same as `_switchTab`). A no-op if either id is absent from the
+   * freshly-synced structure.
+   */
+  jumpToRow(tabId: string, rowId: string): void {
+    this._clearConfirm();
+    this.filterActive = false;
+    this.filterQuery = '';
+    this.syncStructure();
+    const tab = this.frozenView?.tabs.find((t) => t.id === tabId);
+    if (!tab) return;
+    if (!tab.rows.some((r) => r.id === rowId && r.selectable !== false)) return;
+    this.activeTabId = tabId;
+    this.selectedRowId = rowId;
+    this.scrollOffset = 0;
+    this.statusMessage = '';
+    this._clampScroll();
+  }
+
   /** Clear a pending confirm when the user navigates or presses an unrelated key. */
   clearConfirmOnMiss(): void {
     this._clearConfirm();
@@ -442,7 +467,7 @@ export class ConfigModal {
     });
 
     const visible = this.visibleRows;
-    const windowed = allRows.slice(this.scrollOffset, this.scrollOffset + visible);
+    const windowed = this._windowRowsByLineBudget(allRows, this.scrollOffset, visible, labelWrapWidth);
 
     // item 1: while filtering, the surface's own action/tab hints are
     // unreliable (their printable-letter keys are captured by the filter
@@ -505,6 +530,44 @@ export class ConfigModal {
     return clamped.join('\n');
   }
 
+  /**
+   * Modal sizing rule (owner, zero tolerance: a modal/list must never clip
+   * its full descriptive text — size to content or scroll, never clip).
+   * `scrollOffset`/`visible` are ROW-count based, which is exactly right when
+   * every row wraps to one line — but ModalFactory renders each row's WRAPPED
+   * lines and then bounds the whole section to a fixed content-row budget
+   * computed from `visible` (see renderConfigModal's targetContentRows). A
+   * row whose label wraps to MULTIPLE lines can therefore push the total past
+   * that budget, and the LAST row handed to the renderer gets cut off
+   * mid-line instead of being deferred to the next scroll page — the
+   * clipping hazard this closes.
+   *
+   * Windows `rows` starting at `scrollOffset`, greedily including whole rows
+   * while their CUMULATIVE wrapped-line count (at `wrapWidth`) stays within
+   * the `visible` line budget. Always includes at least the first candidate
+   * row so the view is never empty — a single row that alone exceeds the
+   * budget is shown in full rather than replaced with nothing; only a
+   * SUBSEQUENT row that would overflow is deferred to scrolling instead of
+   * being rendered partially.
+   */
+  private _windowRowsByLineBudget(
+    rows: readonly ConfigModalRenderRow[],
+    scrollOffset: number,
+    visible: number,
+    wrapWidth: number,
+  ): ConfigModalRenderRow[] {
+    const candidates = rows.slice(scrollOffset);
+    const out: ConfigModalRenderRow[] = [];
+    let usedLines = 0;
+    for (const row of candidates) {
+      const lineCount = Math.max(1, wrapText(row.label, wrapWidth).length);
+      if (out.length > 0 && usedLines + lineCount > visible) break;
+      out.push(row);
+      usedLines += lineCount;
+    }
+    return out;
+  }
+
   /** Footer text for the active filter: the query + a truthful match count. */
   private _filterStatusHint(matched: number, total: number): string {
     const q = this.filterQuery;

package/src/input/handler-shortcuts.ts

@@ -119,6 +119,29 @@ export function handleGlobalShortcutToken(
       state.handleCtrlC();
       return true;
 
+    case 'cancel-tool-call':
+      // Cancel JUST the currently-running tool call (the live transcript row).
+      // No-op (still consumed) when nothing is running — the composer keeps the
+      // keystroke rather than letting it fall through as text.
+      state.commandContext?.cancelToolCall?.();
+      return true;
+
+    case 'toggle-memory-provenance':
+      // Expand/collapse the provenance chip's drill-in. No-op when the chip is
+      // not showing; still consumed so the composer never sees a stray Alt+M.
+      state.commandContext?.toggleMemoryProvenance?.();
+      return true;
+
+    case 'toggle-keep-awake': {
+      // Flip the daemon-held keep-awake toggle; the always-visible "sleep
+      // disabled" chip is the confirmation. Fire-and-forget (the seam renders on
+      // completion); errors are swallowed so a keystroke never throws.
+      const power = state.commandContext;
+      const current = power?.getPowerState?.().keepAwake ?? false;
+      void power?.setKeepAwake?.(!current);
+      return true;
+    }
+
     case 'screen-clear':
       state.commandContext?.clearScreen?.();
       return true;

package/src/input/keybindings.ts

@@ -68,7 +68,10 @@ export type KeyAction =
   | 'kill-to-start'
   | 'kill-word-forward'
   | 'yank'
-  | 'yank-pop';
+  | 'yank-pop'
+  | 'cancel-tool-call'
+  | 'toggle-keep-awake'
+  | 'toggle-memory-provenance';
 
 /** Human-readable description for each action (used in /keybindings display). */
 export const ACTION_DESCRIPTIONS: Record<KeyAction, string> = {
@@ -111,6 +114,9 @@ export const ACTION_DESCRIPTIONS: Record<KeyAction, string> = {
   'kill-word-forward':     'Kill word forward into kill ring (Alt+D)',
   'yank':                  'Yank (paste) from kill ring (Ctrl+Shift+Y)',
   'yank-pop':              'Rotate kill ring and yank next entry (Alt+Y)',
+  'cancel-tool-call':      'Cancel the running tool call (the turn continues)',
+  'toggle-keep-awake':     'Toggle keep-awake (the "sleep disabled" chip)',
+  'toggle-memory-provenance': 'List/hide the memories a turn used (provenance chip drill-in)',
 };
 
 /** Default key bindings for all actions. */
@@ -189,6 +195,18 @@ export const DEFAULT_KEYBINDINGS: Record<KeyAction, KeyCombo[]> = {
   'yank':                  [{ key: 'y', ctrl: true, shift: true }],
   // Alt+Y: yank-pop (rotate ring after yank)
   'yank-pop':              [{ key: 'y', alt: true }],
+  // Alt+C: cancel the currently-running tool call (the turn continues). Alt+C
+  // is unused by any other default and representable by the tokenizer's
+  // { key, alt } combo form. Ctrl+C stays whole-input clear/cancel; this is the
+  // narrower per-tool stop.
+  'cancel-tool-call':      [{ key: 'c', alt: true }],
+  // Alt+A: toggle keep-awake (the one-key affordance for the "sleep disabled"
+  // chip). Alt+A is unused by any other default. The always-visible chip is the
+  // confirmation of the toggle's state.
+  'toggle-keep-awake':     [{ key: 'a', alt: true }],
+  // Alt+M: expand/collapse the "used N memories" provenance chip's drill-in.
+  // Alt+M is unused by any other default. A no-op when the chip is not showing.
+  'toggle-memory-provenance': [{ key: 'm', alt: true }],
 };
 
 /** Resolved overrides type: each key can be a single combo or array. */

package/src/input/settings-modal-data.ts

@@ -25,6 +25,7 @@ import {
 } from './worktree-setup-config.ts';
 import { BUDGET_ALERT_USD_CONFIG_KEY, BUDGET_ALERT_USD_DEFAULT, readBudgetAlertUsd } from '../export/cost-utils.ts';
 import { MEMORY_PROJECTION_DIR_CONFIG_KEY, buildMemoryProjectionDirSyntheticEntry } from './commands/recall-files-config.ts';
+import { MEMORY_SHOW_PROVENANCE_CONFIG_KEY, buildMemoryProvenanceSyntheticEntry } from '../core/memory-provenance.ts';
 import {
   injectSandboxExecSyntheticEntries,
   isSandboxExecListConfigKey,
@@ -120,11 +121,11 @@ export function buildSettingGroups(
     if ((rawCat === 'controlPlane' || rawCat === 'httpListener' || rawCat === 'web') && groups.has('network')) {
       groups.get('network')!.push(entry);
     }
+    // fleet.maxSize (was orchestration.maxActiveAgents) surfaces under orchestration.
+    if (rawCat === 'fleet' && groups.has('orchestration')) groups.get('orchestration')!.push(entry);
   }
 
-  // inject the synthetic display.themeMode enum (auto|dark|light). TUI-local
-  // key stored under the existing `display` section (see theme-mode-config.ts for why
-  // not `appearance`), same rationale as the other synthetic settings below.
+  // Synthetic display.themeMode enum (auto|dark|light) — TUI-local, see theme-mode-config.ts.
   const displayEntries = groups.get('display');
   if (displayEntries && !displayEntries.some((e) => e.setting.key === (THEME_MODE_CONFIG_KEY as ConfigKey))) {
     displayEntries.push(buildThemeModeSyntheticEntry(configManager));
@@ -151,26 +152,19 @@ export function buildSettingGroups(
     }
   }
 
-  // Inject the synthetic tts.speed entry into the tts category.
-  // tts.speed is not yet a ConfigKey in the SDK schema (pending SDK addition).
-  // The entry is surfaced here with an honest description caveat so users can
-  // see and understand the setting before the SDK schema catches up.
+  // Synthetic tts.speed (not yet an SDK ConfigKey) — surfaced with an honest caveat.
   if (ttsEntries && !ttsEntries.some((e) => e.setting.key === ('tts.speed' as ConfigKey))) {
     ttsEntries.push(buildTtsSpeedSyntheticEntry(configManager));
   }
 
-  // Inject the synthetic behavior.notifyAfterSeconds entry into the behavior
-  // category. This key is TUI-local (not in the SDK ConfigKey union) and
-  // controls the long-task push notification threshold.
+  // Synthetic behavior.notifyAfterSeconds (TUI-local): long-task push threshold.
   const behaviorEntries = groups.get('behavior');
   if (behaviorEntries && !behaviorEntries.some((e) => e.setting.key === ('behavior.notifyAfterSeconds' as ConfigKey))) {
     behaviorEntries.push(buildNotifyAfterSecondsSyntheticEntry(configManager));
   }
 
-  // Inject the synthetic behavior.budgetAlertUsd entry into the behavior
-  // category. This key is TUI-local (not in the SDK ConfigKey union), which
-  // previously left it with no schema-driven inspection surface at all: it
-  // never appeared in /config, and /settings-sync show rejects any key not
+  // Synthetic behavior.budgetAlertUsd (TUI-local): no schema surface previously,
+  // never in /config; /settings-sync show rejects any key not
   // in CONFIG_KEYS. The Cost panel's 'b' key and /cost budget <usd> remain
   // the primary way to change it; this entry makes the current effective
   // value (and whether it's still the "no budget configured" default)
@@ -212,6 +206,12 @@ export function buildSettingGroups(
     storageEntries.push(buildMemoryProjectionDirSyntheticEntry(configManager));
   }
 
+  // Synthetic memory.showProvenance (TUI-local, default OFF — see memory-provenance.ts).
+  const memoryEntries = groups.get('memory');
+  if (memoryEntries && !memoryEntries.some((e) => e.setting.key === (MEMORY_SHOW_PROVENANCE_CONFIG_KEY as ConfigKey))) {
+    memoryEntries.push(buildMemoryProvenanceSyntheticEntry(configManager) as unknown as SettingEntry);
+  }
+
   // Inject the worktree.setup.commands / worktree.setup.carryOverGlobs
   // synthetic entries into the orchestration category (worktree isolation is
   // an orchestration-engine concern — see WorkstreamIsolation 'worktree').
@@ -607,44 +607,34 @@ export function refreshEntryValues(
 ): void {
   for (const entries of groups.values()) {
     for (const entry of entries) {
-      // The worktree.setup.* keys read through a defensive helper. The SDK now
-      // registers the 'worktree' section in DEFAULT_CONFIG, so a plain
-      // configManager.get returns the empty default rather than throwing; the
-      // helper's guard (belt-and-suspenders for an older SDK) keeps this
-      // refresh from crashing for EVERY setting change if the section is ever
-      // absent (see worktree-setup-config.ts).
+      // worktree.setup.* read through a defensive array-normalizing helper (see worktree-setup-config.ts).
       if (isWorktreeSetupListConfigKey(entry.setting.key)) {
         entry.currentValue = readWorktreeSetupList(configManager, entry.setting.key);
         entry.isDefault = (entry.currentValue as string[]).length === 0;
         continue;
       }
-      // sandbox.egressAllowlist / sandbox.workspaceWritable: 'sandbox' IS a real
-      // DEFAULT_CONFIG section (has been since before this repack, backing the
-      // VM/REPL isolation settings), so a plain get() would not throw — but an
-      // unset leaf still reads back as `undefined`, not `[]`, so this still needs
-      // the same array-normalizing read as the worktree keys above (see
-      // sandbox-exec-config.ts).
+      // sandbox.* list leaves normalize an unset undefined to [] (see sandbox-exec-config.ts).
       if (isSandboxExecListConfigKey(entry.setting.key)) {
         entry.currentValue = readSandboxExecList(configManager, entry.setting.key);
         entry.isDefault = (entry.currentValue as string[]).length === 0;
         continue;
       }
-      // permissions.execEnvScrubAllowlist: same normalizing-read trap as above —
-      // 'permissions' is a real section but this leaf is TUI-local (see
-      // exec-env-scrub-config.ts).
+      // permissions.execEnvScrubAllowlist: same array-normalizing read (see exec-env-scrub-config.ts).
       if (isExecEnvScrubAllowlistConfigKey(entry.setting.key)) {
         entry.currentValue = readExecEnvScrubAllowlist(configManager);
         entry.isDefault = (entry.currentValue as string[]).length === 0;
         continue;
       }
-      // 'learning' is now a real DEFAULT_CONFIG section (schema-domain-learning.ts),
-      // so learning.consolidation.* keys read through the plain path below like any
-      // other schema-driven setting — no special case needed anymore.
-      // Same trap still applies here: 'memory' has no DEFAULT_CONFIG entry.
+      // 'memory' has no DEFAULT_CONFIG entry — its synthetic leaves read defensively below.
       if (entry.setting.key === MEMORY_PROJECTION_DIR_CONFIG_KEY) {
         const refreshed = buildMemoryProjectionDirSyntheticEntry(configManager);
-        entry.currentValue = refreshed.currentValue;
-        entry.isDefault = refreshed.isDefault;
+        entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
+        continue;
+      }
+      // memory.showProvenance: same 'memory'-has-no-DEFAULT_CONFIG trap — read defensively.
+      if (entry.setting.key === (MEMORY_SHOW_PROVENANCE_CONFIG_KEY as ConfigKey)) {
+        const refreshed = buildMemoryProvenanceSyntheticEntry(configManager);
+        entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
         continue;
       }
       const raw = configManager.get(entry.setting.key as ConfigKey);
@@ -677,8 +667,12 @@ export function updateEntryForKey(
     if (entry) {
       if (key === MEMORY_PROJECTION_DIR_CONFIG_KEY) {
         const refreshed = buildMemoryProjectionDirSyntheticEntry(configManager);
-        entry.currentValue = refreshed.currentValue;
-        entry.isDefault = refreshed.isDefault;
+        entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
+        continue;
+      }
+      if (key === (MEMORY_SHOW_PROVENANCE_CONFIG_KEY as ConfigKey)) {
+        const refreshed = buildMemoryProvenanceSyntheticEntry(configManager);
+        entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
         continue;
       }
       if (isSandboxExecListConfigKey(key)) {