@pellux/goodvibes-tui 1.20.1 → 1.21.1

package/src/renderer/markdown.ts

@@ -4,6 +4,12 @@ import { renderCodeBlock } from './code-block.ts';
 import { getDisplayWidth } from '../utils/terminal-width.ts';
 import { LAYOUT } from './layout.ts';
 import { activeTheme } from './theme.ts';
+import { renderInlineMarkdown, type InlineToken } from './markdown-inline.ts';
+import { isLikelyTableHeaderRow, isLikelyTableSeparatorRow, renderTable } from './markdown-table.ts';
+
+// Re-exported so existing importers of renderInlineMarkdown keep working after
+// the tokenizer moved to markdown-inline.ts (see that module's header).
+export { renderInlineMarkdown, type InlineToken };
 
 // Transcript tokens are read live per render (const T = activeTheme() at the top
 // of each render function below) so a dark→light repaint re-resolves with no
@@ -15,27 +21,6 @@ export interface MarkdownRenderOptions {
   isStreaming?: boolean;
 }
 
-/** Module-level set of inline markdown special characters (hoisted out of hot loop). */
-const INLINE_SPECIAL_CHARS = new Set(['[', '`', '*', '_', '~']);
-
-function splitTableCells(row: string): string[] {
-  const cells = row.trim().split('|').map((c) => c.trim());
-  if (cells.length > 0 && cells[0] === '') cells.shift();
-  if (cells.length > 0 && cells[cells.length - 1] === '') cells.pop();
-  return cells;
-}
-
-function isLikelyTableSeparatorRow(row: string): boolean {
-  if (!row.includes('|')) return false;
-  const cells = splitTableCells(row);
-  if (cells.length === 0) return false;
-  return cells.every((cell) => /:?-{3,}:?/.test(cell));
-}
-
-function isLikelyTableHeaderRow(row: string): boolean {
-  return splitTableCells(row).length >= 2;
-}
-
 /**
  * renderMarkdown - Parse markdown text into styled Line[].
  * Thin wrapper over renderMarkdownTracked for callers that don't need code-block metadata.
@@ -220,320 +205,6 @@ export function renderMarkdownTracked(
   return { lines, codeBlocks };
 }
 
-/**
- * Strip markdown formatting from text for width measurement.
- * Removes **, *, `, ~~ markers but keeps the inner text.
- */
-function stripMarkdown(text: string): string {
-  return text
-    .replace(/\*\*(.+?)\*\*/g, '$1')  // bold
-    .replace(/\*(.+?)\*/g, '$1')      // italic
-    .replace(/~~(.+?)~~/g, '$1')      // strikethrough
-    .replace(/`(.+?)`/g, '$1');       // inline code
-}
-
-/**
- * Render a markdown table with box-drawing borders.
- * Parses inline markdown in cells, fits to terminal width,
- * truncates long content, and renders with proper styling.
- */
-function renderTable(rows: string[], width: number, indent: number): Line[] {
-  const T = activeTheme();
-  const lines: Line[] = [];
-
-  // Parse rows into cells, skip separator
-  const parsedRows: string[][] = [];
-  let hasSeparator = false;
-  for (const row of rows) {
-    const trimmed = row.trim();
-    if (isLikelyTableSeparatorRow(trimmed)) {
-      hasSeparator = true;
-      continue;
-    }
-    const cells = splitTableCells(trimmed);
-    if (cells.length > 0) parsedRows.push(cells);
-  }
-
-  if (parsedRows.length === 0) return lines;
-
-  const colCount = Math.max(...parsedRows.map(r => r.length));
-  const availW = width - indent;
-
-  // Measure column widths using stripped text (no markdown markers)
-  const naturalWidths: number[] = new Array(colCount).fill(0);
-  for (const row of parsedRows) {
-    for (let c = 0; c < row.length; c++) {
-      naturalWidths[c] = Math.max(naturalWidths[c], getDisplayWidth(stripMarkdown(row[c])));
-    }
-  }
-
-  // Budget: availW minus borders (colCount+1) minus padding (2 per col)
-  const overhead = (colCount + 1) + (colCount * 2);
-  const contentBudget = Math.max(colCount, availW - overhead);
-  const totalNatural = naturalWidths.reduce((a, b) => a + b, 0);
-
-  // Compute final column widths
-  const colWidths: number[] = new Array(colCount).fill(0);
-  if (totalNatural <= contentBudget) {
-    // Everything fits
-    for (let c = 0; c < colCount; c++) colWidths[c] = naturalWidths[c];
-  } else {
-    // Proportionally shrink, with minimum of 4 chars per column
-    const minW = 4;
-    for (let c = 0; c < colCount; c++) {
-      colWidths[c] = Math.max(minW, Math.floor((naturalWidths[c] / totalNatural) * contentBudget));
-    }
-    // Distribute leftover from rounding
-    let used = colWidths.reduce((a, b) => a + b, 0);
-    for (let c = 0; c < colCount && used < contentBudget; c++) {
-      colWidths[c]++;
-      used++;
-    }
-  }
-
-  const bc = '240'; // border color
-
-  // Helper: build a border line
-  const makeBorder = (left: string, mid: string, right: string, horiz: string): Line => {
-    let s = ' '.repeat(indent) + left;
-    for (let c = 0; c < colCount; c++) {
-      s += horiz.repeat(colWidths[c] + 2) + (c < colCount - 1 ? mid : right);
-    }
-    return UIFactory.stringToLine(s, width, { fg: bc });
-  };
-
-  // Helper: render a cell's content with inline markdown into Cell[]
-  const renderCellContent = (raw: string, maxW: number, isHdr: boolean): Cell[] => {
-    const cells: Cell[] = [];
-    const tokens = renderInlineMarkdown(raw);
-    let w = 0;
-
-    for (const token of tokens) {
-      const text = token.text;
-      for (const ch of text) {
-        const cw = getDisplayWidth(ch);
-        if (w + cw > maxW) {
-          // Truncate with ellipsis. If the last cell pushed is a wide-glyph
-          // placeholder (the empty second column of a 2-wide character),
-          // overwriting it in place would leave the wide glyph's first
-          // column dangling next to the ellipsis with no placeholder cell \u2014
-          // step back one more cell so the ellipsis replaces the actual
-          // glyph, not its placeholder.
-          if (cells.length > 0 && cells[cells.length - 1].char === '' && cells.length > 1) {
-            cells.pop();
-          }
-          if (cells.length > 0) cells[cells.length - 1] = createStyledCell('\u2026', cells[cells.length - 1]);
-          return cells;
-        }
-        let style: Partial<Cell> = {};
-        if (token.type === 'code') {
-          style = { fg: T.inlineCodeFg, bold: true };
-        } else if (token.type === 'link') {
-          style = { fg: T.link, underline: true };
-        } else {
-          style = { ...token.style };
-        }
-        if (isHdr) {
-          style.fg = style.fg || T.heading1;
-          style.bold = true;
-        } else {
-          style.fg = style.fg || '252';
-        }
-        cells.push(createStyledCell(ch, style));
-        if (cw === 2) cells.push(createStyledCell('', style)); // wide char placeholder
-        w += cw;
-      }
-    }
-
-    // Pad remaining space
-    while (w < maxW) {
-      cells.push(createStyledCell(' ', isHdr ? { fg: T.heading1 } : { fg: '252' }));
-      w++;
-    }
-    return cells;
-  };
-
-  // Top border
-  lines.push(makeBorder('\u250c', '\u252c', '\u2510', '\u2500'));
-
-  // Rows
-  for (let r = 0; r < parsedRows.length; r++) {
-    const row = parsedRows[r];
-    const isHeader = hasSeparator && r === 0;
-
-    // Build the row line cell-by-cell
-    const line = new Array(width).fill(null).map(() => createStyledCell(' ')) as Cell[];
-    let x = indent;
-
-    // Left border
-    if (x < width) line[x] = createStyledCell('\u2502', { fg: bc });
-    x++;
-
-    for (let c = 0; c < colCount; c++) {
-      // Space before content
-      if (x < width) line[x] = createStyledCell(' ');
-      x++;
-
-      // Cell content
-      const raw = c < row.length ? row[c] : '';
-      const cellContent = renderCellContent(raw, colWidths[c], isHeader);
-      for (const cell of cellContent) {
-        if (x < width) line[x] = cell;
-        x++;
-      }
-
-      // Space after content
-      if (x < width) line[x] = createStyledCell(' ');
-      x++;
-
-      // Column separator
-      if (x < width) line[x] = createStyledCell('\u2502', { fg: bc });
-      x++;
-    }
-
-    lines.push(line);
-
-    // Header separator
-    if (isHeader) {
-      lines.push(makeBorder('\u251c', '\u253c', '\u2524', '\u2500'));
-    }
-  }
-
-  // Bottom border
-  lines.push(makeBorder('\u2514', '\u2534', '\u2518', '\u2500'));
-
-  return lines;
-}
-
-/**
- * Inline markdown token types.
- */
-type InlineToken =
-  | { type: 'text'; text: string; style: Partial<Cell> }
-  | { type: 'code'; text: string }
-  | { type: 'link'; text: string; url: string };
-
-/**
- * renderInlineMarkdown - Parse inline markdown (bold, italic, inline code, links)
- * and return a flat array of tokens with style info.
- */
-export function renderInlineMarkdown(text: string): InlineToken[] {
-  const tokens: InlineToken[] = [];
-  let i = 0;
-
-  while (i < text.length) {
-    // Link: [text](url)
-    if (text[i] === '[') {
-      const closeB = text.indexOf(']', i);
-      if (closeB !== -1 && text[closeB + 1] === '(') {
-        const closeP = text.indexOf(')', closeB + 2);
-        if (closeP !== -1) {
-          const linkText = text.slice(i + 1, closeB);
-          const url = text.slice(closeB + 2, closeP);
-          tokens.push({ type: 'link', text: linkText, url });
-          i = closeP + 1;
-          continue;
-        }
-      }
-    }
-
-    // Inline code: `code`
-    if (text[i] === '`') {
-      const end = text.indexOf('`', i + 1);
-      if (end !== -1) {
-        tokens.push({ type: 'code', text: text.slice(i + 1, end) });
-        i = end + 1;
-        continue;
-      }
-    }
-
-    // Bold+italic: ***text***
-    if (text.slice(i, i + 3) === '***') {
-      const end = text.indexOf('***', i + 3);
-      if (end !== -1) {
-        tokens.push({ type: 'text', text: text.slice(i + 3, end), style: { bold: true, italic: true } });
-        i = end + 3;
-        continue;
-      }
-      // No closing *** found — emit the leading * as plain text so the ** bold
-      // check can handle the remaining ** on the next iteration.
-      tokens.push({ type: 'text', text: '*', style: {} });
-      i += 1;
-      continue;
-    }
-
-    // Bold: **text**
-    if (text.slice(i, i + 2) === '**') {
-      const end = text.indexOf('**', i + 2);
-      if (end !== -1) {
-        tokens.push({ type: 'text', text: text.slice(i + 2, end), style: { bold: true } });
-        i = end + 2;
-        continue;
-      }
-    }
-
-    // Italic: *text* or _text_
-    // Guard: text[i - 1] !== '*' prevents the second * of ** from starting italic.
-    // Guard: text[i + 1] !== text[i] prevents the first * of ** (or _ of __) from
-    // starting italic when bold/underscore-bold detection failed (e.g. unclosed **).
-    if (
-      (text[i] === '*' || text[i] === '_') &&
-      text[i - 1] !== text[i] &&
-      text[i + 1] !== text[i]
-    ) {
-      const closer = text[i];
-      const end = text.indexOf(closer, i + 1);
-      if (end !== -1 && end > i + 1) {
-        tokens.push({ type: 'text', text: text.slice(i + 1, end), style: { italic: true } });
-        i = end + 1;
-        continue;
-      }
-    }
-
-    // Strikethrough: ~~text~~
-    if (text.slice(i, i + 2) === '~~') {
-      const end = text.indexOf('~~', i + 2);
-      if (end !== -1) {
-        tokens.push({ type: 'text', text: text.slice(i + 2, end), style: { strikethrough: true, fg: '244' } });
-        i = end + 2;
-        continue;
-      }
-    }
-
-    // Plain text — accumulate until next special char, detect bare URLs and file paths
-    let end = i + 1;
-    while (end < text.length && !INLINE_SPECIAL_CHARS.has(text[end])) {
-      const code = text.charCodeAt(end);
-      end += (code >= 0xD800 && code <= 0xDBFF) ? 2 : 1;
-    }
-    const plainText = text.slice(i, end);
-
-    // Detect http/https URLs in plain text
-    const urlMatch = plainText.match(/^(https?:\/\/[^\s,)>"]+)/);
-    if (urlMatch) {
-      const url = urlMatch[1];
-      tokens.push({ type: 'link', text: url, url });
-      i += url.length;
-      continue;
-    }
-
-    // Detect absolute file paths in plain text (require at least one directory separator)
-    const fileMatch = plainText.match(/^(\/[^\s,)>"]+\/[^\s,)>"]+(?:\.[a-zA-Z0-9]+)?)/);
-    if (fileMatch) {
-      const filePath = fileMatch[1];
-      const fileUrl = `file://${filePath}`;
-      tokens.push({ type: 'link', text: filePath, url: fileUrl });
-      i += filePath.length;
-      continue;
-    }
-
-    tokens.push({ type: 'text', text: plainText, style: {} });
-    i = end;
-  }
-
-  return tokens;
-}
-
 /**
  * compositeInlineLine - Convert a prefix + InlineTokens into Line[], applying word wrap.
  * Builds cells directly from token styles.

package/src/renderer/model-workspace.ts

@@ -280,14 +280,49 @@ function renderModelRows(picker: ModelPickerModal, lines: Line[], rows: number,
   if (end < models.length && lines[rows - 1]) writeText(lines[rows - 1]!, startX + 1, width - 2, `${GLYPHS.navigation.moreBelow} ${models.length - end} more model(s) below`, { fg: PALETTE.dim, bg: PALETTE.bodyBg, dim: true });
 }
 
+/**
+ * The effort step of the model picker.
+ *
+ * The list is exactly the levels the chosen model resolved to — not a fixed
+ * four — and it is introduced by a headline naming what this model does with
+ * the setting (named levels, a thinking-token budget, an on/off toggle, or
+ * nothing at all). A best-guess spec prints its caveat under the list rather
+ * than presenting unverified levels as if the provider had confirmed them.
+ */
 function renderEffortRows(picker: ModelPickerModal, lines: Line[], rows: number, startX: number, width: number): void {
-  for (let row = 0; row < Math.min(rows, picker.effortLevels.length); row += 1) {
-    const effort = picker.effortLevels[row]!;
-    const selected = row === picker.selectedIndex;
+  const presentation = picker.effortPresentation;
+  let row = 0;
+
+  if (presentation && rows > 0) {
+    fillRange(lines[row]!, startX, startX + width - 1, PALETTE.bodyBg);
+    writeText(lines[row]!, startX + 1, width - 2, presentation.headline, { fg: PALETTE.subtitle, bg: PALETTE.bodyBg });
+    row += 1;
+  }
+
+  // A model with nothing to configure gets a statement, not an empty list.
+  if (presentation && !presentation.configurable) {
+    if (row < rows) {
+      fillRange(lines[row]!, startX, startX + width - 1, PALETTE.bodyBg);
+      writeText(lines[row]!, startX + 1, width - 2, 'Esc returns to the model list.', { fg: PALETTE.dim, bg: PALETTE.bodyBg, dim: true });
+    }
+    return;
+  }
+
+  const firstLevelRow = row;
+  for (let i = 0; i < picker.effortLevels.length && row < rows; i += 1, row += 1) {
+    const effort = picker.effortLevels[i]!;
+    const selected = i === picker.selectedIndex;
     const bg = selected ? PALETTE.selectedBg : PALETTE.bodyBg;
     fillRange(lines[row]!, startX, startX + width - 1, bg);
     const marker = selected ? GLYPHS.navigation.selected : ' ';
-    writeText(lines[row]!, startX + 1, width - 2, `${marker} ${effort}`, { fg: selected ? PALETTE.text : PALETTE.muted, bg, bold: selected });
+    const detail = presentation?.choices[i]?.description ?? '';
+    const text = detail ? `${marker} ${effort.padEnd(8)}${detail}` : `${marker} ${effort}`;
+    writeText(lines[row]!, startX + 1, width - 2, text, { fg: selected ? PALETTE.text : PALETTE.muted, bg, bold: selected });
+  }
+
+  if (presentation?.caveat && row < rows && row > firstLevelRow) {
+    fillRange(lines[row]!, startX, startX + width - 1, PALETTE.bodyBg);
+    writeText(lines[row]!, startX + 1, width - 2, presentation.caveat, { fg: PALETTE.dim, bg: PALETTE.bodyBg, dim: true });
   }
 }
 
@@ -489,7 +524,15 @@ function getRenderCacheKey(picker: ModelPickerModal, width: number, viewportHeig
     const filteredProviders = picker.getFilteredProviders();
     base.push(objectId(picker.providers), objectId(filteredProviders), filteredProviders.length);
   } else if (picker.mode === 'effort') {
-    base.push(objectId(picker.effortLevels), picker.effortLevels.join('\u001f'), picker.pendingModel?.registryKey ?? picker.pendingModel?.id ?? '');
+    base.push(
+      objectId(picker.effortLevels),
+      picker.effortLevels.join('\u001f'),
+      picker.pendingModel?.registryKey ?? picker.pendingModel?.id ?? '',
+      // The headline and caveat are rendered content too: two models with the
+      // same level list but different spec kinds must not share a cache entry.
+      picker.effortPresentation?.headline ?? '',
+      picker.effortPresentation?.caveat ?? '',
+    );
   } else if (picker.mode === 'contextCap') {
     base.push(picker.contextCapQuery, picker.contextCapPendingModel?.registryKey ?? picker.contextCapPendingModel?.id ?? '');
   } else if (picker.mode === 'embeddingProvider') {

package/src/renderer/settings-modal-helpers.ts

@@ -4,7 +4,7 @@
  * architecture cap. No layout logic lives here.
  */
 
-import type { SettingEntry, McpEntry, SubscriptionEntry } from '../input/settings-modal-types.ts';
+import type { SettingEntry, McpEntry, SubscriptionEntry, SettingsCategory } from '../input/settings-modal-types.ts';
 import { SETTINGS_CATEGORIES } from '../input/settings-modal-types.ts';
 import { isSecretConfigKey, isSecretReferenceValue } from '../config/secret-config.ts';
 import { UI_TONES } from './ui-primitives.ts';
@@ -61,6 +61,57 @@ export function inferSubscriptionRouteReason(entry: SubscriptionEntry): string |
   return undefined;
 }
 
+export const CATEGORY_INFO: Record<SettingsCategory, string> = {
+  display: 'Presentation settings for the terminal transcript: streaming, line numbers, thinking visibility, reasoning summaries, token speed, and tool previews.',
+  ui: 'Controls where operational messages render and whether voice surfaces are enabled. These settings change visibility, not provider behavior.',
+  provider: 'Default model routing for normal chat turns, embeddings, reasoning effort, and persistent system prompt file.',
+  pricing: 'Manual model prices (USD per 1M tokens, keyed provider:model). Your price wins over provider-served and catalog prices in every cost display, immediately.',
+  update: 'Self-update posture: whether the daemon checks hourly and updates at an idle moment, the release source it checks, and the check cadence. Clients update at launch; every swap keeps the previous binary for one-command rollback.',
+  subscriptions: 'Provider subscription login state and routing posture. Active sessions can be reviewed or signed out here; API keys remain managed through secrets.',
+  behavior: 'Day-to-day shell behavior: approval posture, compaction, history, guidance, notifications, stale-context warnings, return context, and Human-in-the-Loop mode.',
+  storage: 'Local storage posture, including secret storage policy and maximum artifact size for knowledge/home graph/document ingestion.',
+  atRest: 'Data-at-rest policy for the on-disk transcript journal and execution ledger: whether secret/credential patterns are redacted at write time, and the age/size caps that trigger pruning.',
+  permissions: 'Permission mode and tool-class policy. These settings decide whether the shell prompts before read/write/exec/network/agent actions.',
+  orchestration: 'Agent orchestration limits and recursion controls.',
+  planner: 'How /workstream decomposes a goal into work items: agent-driven decomposition (with heuristic fallback) or the forced heuristic path, plus the planning agent\'s turn, token, and wall-clock bounds.',
+  wrfc: 'Work-review-fix-cycle thresholds, retry limits, and automatic commit behavior.',
+  helper: 'Helper model defaults used by helper subsystems when they do not use the main chat route.',
+  tts: 'Text-to-speech provider, voice, and optional spoken-turn LLM overrides.',
+  voice: 'Free, offline local voice engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro. All empty by default — configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error). Once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension.',
+  service: 'Background service posture: enabled state, autostart, restart behavior, service name, platform, and logs.',
+  daemon: 'Local session daemon. It hosts the shared session broker and companion chat so a session started here is visible and steerable from other surfaces. On by default, bound to loopback (127.0.0.1) only.',
+  controlPlane: 'Daemon control-plane settings for local admin/API access.',
+  httpListener: 'HTTP listener settings for webhook and integration ingress.',
+  web: 'Browser surface settings for the local or network web UI.',
+  batch: 'Batch execution settings, including local vs Cloudflare queue behavior.',
+  automation: 'Scheduled and automated run settings, concurrency, timeout, catch-up, cooldown, and retention behavior.',
+  checkin: 'Proactive check-in: on a cadence, a briefing is judged and you are contacted only when something warrants it. Off by default; every run — scheduled or manual — leaves a receipt (see /checkin) recording whether it stayed quiet, delivered a message, or was skipped.',
+  watchers: 'File/process watcher heartbeat, polling, and recovery-window behavior.',
+  runtime: 'Runtime guardrails such as companion chat limiter and event bus listener caps.',
+  telemetry: 'Telemetry payload policy.',
+  cache: 'Provider and model cache behavior, TTL, and hit-rate monitoring.',
+  diagnostics: 'Post-edit diagnostics: whether the shell runs language diagnostics on a file after the model edits or writes it, surfacing new problems inline.',
+  mcp: 'MCP server trust and scope review. Trust changes can expose local files, tools, databases, browsers, or remote automation depending on the server.',
+  sandbox: 'Isolation strategy for REPL, MCP, Windows, and QEMU-backed execution. Use these settings to separate risky tools from the host shell.',
+  surfaces: 'External app surfaces such as Slack, Discord, ntfy, Home Assistant, Telegram, webhooks, chat bridges, and messaging providers.',
+  conversationGate: 'What a message arriving from one of those channels does. By default it gets a conversational answer, and work is proposed and waits for your agreement rather than starting on its own; you can instead confirm every run, or restore the old behavior where a message starts work immediately. Also how long a pending proposal stays answerable and how many can wait at once. This governs messages from channels only — what you type here always runs, and schedules and triggers were authorized when created.',
+  cloudflare: 'Optional Cloudflare control plane, batch queue, Worker, Tunnel, Access, DNS, KV, Durable Objects, Secrets Store, and R2 settings.',
+  release: 'Release-channel preference.',
+  power: 'Host sleep ownership. Keep-awake holds the host awake (the always-visible "sleep disabled" chip is the safety mechanism — no timer, no AC-only option); automatic inhibition keeps the host awake while real work runs, with an honest hard cap on that work hold.',
+  memory: 'Memory provenance surfacing. Whether turns that drew on your standing memories show a small "used N memories" chip with a drill-in listing them. Off by default — when off, nothing is rendered and no context is added.',
+  danger: 'High-impact switches for daemon and HTTP listener behavior. These are operational overrides, not normal preferences.',
+  tools: 'Tool LLM and helper model routing. Empty provider/model values inherit the active chat route unless a specific helper/tool route is set.',
+  network: 'Combined network view for daemon control-plane, HTTP listener, browser web surface, and general outbound network settings.',
+  fetch: 'Fetch response sanitization and host trust tiers for the fetch tool: sanitize mode plus default trusted/blocked host lists. Gated by the Fetch Response Sanitization feature.',
+  agents: 'Sub-agent context-window awareness and per-turn passive knowledge/code injection: token budget, relevance floor, code-chunk limit, and the compaction threshold. Gated by the agent context/injection features.',
+  security: 'API token scope and rotation auditing: rotation cadence, warning lead time, and whether overdue/over-scoped tokens are blocked or only reported. Gated by the Token Scope and Rotation Audit feature.',
+  integrations: 'Integration delivery reliability (Slack/Discord/webhook): retry counts, backoff bounds, dead-letter queue size, and SLO enforcement. Gated by the Integration Delivery SLO feature.',
+  policy: 'Policy-as-code bundle loading: where the startup policy bundle is loaded from and its file path. Gated by the Policy-as-Code feature.',
+  notifications: 'Notification router burst-suppression tuning: burst window, threshold, and cooldown. Gated by the Adaptive Notification Suppression feature.',
+  relay: 'Outbound zero-knowledge relay reachability, for reaching this daemon from outside the LAN without opening an inbound port. Off by default — relay.enabled is the switch. The relay operator sees only ciphertext and connection metadata — self-host your own relay for full control.',
+  learning: 'Idle-time memory consolidation: merging duplicate standing memory records and decaying/archiving stale ones. Off by default — nothing runs until enabled.',
+};
+
 export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], string> = {
   display: 'Display',
   ui: 'UI',
@@ -94,6 +145,7 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   mcp: 'MCP',
   sandbox: 'Sandbox',
   surfaces: 'Surfaces',
+  conversationGate: 'Channel Message Handling',
   cloudflare: 'Cloudflare',
   release: 'Release',
   power: 'Power',

package/src/renderer/settings-modal.ts

@@ -10,7 +10,7 @@ import type { SettingsModal, SettingEntry, McpEntry, SubscriptionEntry, Settings
 import { SETTINGS_CATEGORIES, SETTINGS_CATEGORY_GROUPS } from '../input/settings-modal.ts';
 import { FEATURE_SETTINGS_BY_ID, isFeatureValueEnabled } from '../runtime/feature-settings.ts';
 import { getDisplayWidth, wrapText } from '../utils/terminal-width.ts';
-import { CATEGORY_LABELS, describeUiRouting, formatValue, getSettingLabel, inferSubscriptionRouteReason, valueColor } from './settings-modal-helpers.ts';
+import { CATEGORY_INFO, CATEGORY_LABELS, describeUiRouting, formatValue, getSettingLabel, inferSubscriptionRouteReason, valueColor } from './settings-modal-helpers.ts';
 import { isSecretConfigKey } from '../config/secret-config.ts';
 import { GLYPHS } from './ui-primitives.ts';
 import { formatHints, joinHints } from './hint-grammar.ts';
@@ -24,55 +24,6 @@ import {
   type WorkspaceRow,
 } from './fullscreen-workspace.ts';
 
-const CATEGORY_INFO: Record<SettingsCategory, string> = {
-  display: 'Presentation settings for the terminal transcript: streaming, line numbers, thinking visibility, reasoning summaries, token speed, and tool previews.',
-  ui: 'Controls where operational messages render and whether voice surfaces are enabled. These settings change visibility, not provider behavior.',
-  provider: 'Default model routing for normal chat turns, embeddings, reasoning effort, and persistent system prompt file.',
-  pricing: 'Manual model prices (USD per 1M tokens, keyed provider:model). Your price wins over provider-served and catalog prices in every cost display, immediately.',
-  update: 'Self-update posture: whether the daemon checks hourly and updates at an idle moment, the release source it checks, and the check cadence. Clients update at launch; every swap keeps the previous binary for one-command rollback.',
-  subscriptions: 'Provider subscription login state and routing posture. Active sessions can be reviewed or signed out here; API keys remain managed through secrets.',
-  behavior: 'Day-to-day shell behavior: approval posture, compaction, history, guidance, notifications, stale-context warnings, return context, and Human-in-the-Loop mode.',
-  storage: 'Local storage posture, including secret storage policy and maximum artifact size for knowledge/home graph/document ingestion.',
-  atRest: 'Data-at-rest policy for the on-disk transcript journal and execution ledger: whether secret/credential patterns are redacted at write time, and the age/size caps that trigger pruning.',
-  permissions: 'Permission mode and tool-class policy. These settings decide whether the shell prompts before read/write/exec/network/agent actions.',
-  orchestration: 'Agent orchestration limits and recursion controls.',
-  planner: 'How /workstream decomposes a goal into work items: agent-driven decomposition (with heuristic fallback) or the forced heuristic path, plus the planning agent\'s turn, token, and wall-clock bounds.',
-  wrfc: 'Work-review-fix-cycle thresholds, retry limits, and automatic commit behavior.',
-  helper: 'Helper model defaults used by helper subsystems when they do not use the main chat route.',
-  tts: 'Text-to-speech provider, voice, and optional spoken-turn LLM overrides.',
-  voice: 'Free, offline local voice engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro. All empty by default — configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error). Once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension.',
-  service: 'Background service posture: enabled state, autostart, restart behavior, service name, platform, and logs.',
-  daemon: 'Local session daemon. It hosts the shared session broker and companion chat so a session started here is visible and steerable from other surfaces. On by default, bound to loopback (127.0.0.1) only.',
-  controlPlane: 'Daemon control-plane settings for local admin/API access.',
-  httpListener: 'HTTP listener settings for webhook and integration ingress.',
-  web: 'Browser surface settings for the local or network web UI.',
-  batch: 'Batch execution settings, including local vs Cloudflare queue behavior.',
-  automation: 'Scheduled and automated run settings, concurrency, timeout, catch-up, cooldown, and retention behavior.',
-  checkin: 'Proactive check-in: on a cadence, a briefing is judged and you are contacted only when something warrants it. Off by default; every run — scheduled or manual — leaves a receipt (see /checkin) recording whether it stayed quiet, delivered a message, or was skipped.',
-  watchers: 'File/process watcher heartbeat, polling, and recovery-window behavior.',
-  runtime: 'Runtime guardrails such as companion chat limiter and event bus listener caps.',
-  telemetry: 'Telemetry payload policy.',
-  cache: 'Provider and model cache behavior, TTL, and hit-rate monitoring.',
-  diagnostics: 'Post-edit diagnostics: whether the shell runs language diagnostics on a file after the model edits or writes it, surfacing new problems inline.',
-  mcp: 'MCP server trust and scope review. Trust changes can expose local files, tools, databases, browsers, or remote automation depending on the server.',
-  sandbox: 'Isolation strategy for REPL, MCP, Windows, and QEMU-backed execution. Use these settings to separate risky tools from the host shell.',
-  surfaces: 'External app surfaces such as Slack, Discord, ntfy, Home Assistant, Telegram, webhooks, chat bridges, and messaging providers.',
-  cloudflare: 'Optional Cloudflare control plane, batch queue, Worker, Tunnel, Access, DNS, KV, Durable Objects, Secrets Store, and R2 settings.',
-  release: 'Release-channel preference.',
-  power: 'Host sleep ownership. Keep-awake holds the host awake (the always-visible "sleep disabled" chip is the safety mechanism — no timer, no AC-only option); automatic inhibition keeps the host awake while real work runs, with an honest hard cap on that work hold.',
-  memory: 'Memory provenance surfacing. Whether turns that drew on your standing memories show a small "used N memories" chip with a drill-in listing them. Off by default — when off, nothing is rendered and no context is added.',
-  danger: 'High-impact switches for daemon and HTTP listener behavior. These are operational overrides, not normal preferences.',
-  tools: 'Tool LLM and helper model routing. Empty provider/model values inherit the active chat route unless a specific helper/tool route is set.',
-  network: 'Combined network view for daemon control-plane, HTTP listener, browser web surface, and general outbound network settings.',
-  fetch: 'Fetch response sanitization and host trust tiers for the fetch tool: sanitize mode plus default trusted/blocked host lists. Gated by the Fetch Response Sanitization feature.',
-  agents: 'Sub-agent context-window awareness and per-turn passive knowledge/code injection: token budget, relevance floor, code-chunk limit, and the compaction threshold. Gated by the agent context/injection features.',
-  security: 'API token scope and rotation auditing: rotation cadence, warning lead time, and whether overdue/over-scoped tokens are blocked or only reported. Gated by the Token Scope and Rotation Audit feature.',
-  integrations: 'Integration delivery reliability (Slack/Discord/webhook): retry counts, backoff bounds, dead-letter queue size, and SLO enforcement. Gated by the Integration Delivery SLO feature.',
-  policy: 'Policy-as-code bundle loading: where the startup policy bundle is loaded from and its file path. Gated by the Policy-as-Code feature.',
-  notifications: 'Notification router burst-suppression tuning: burst window, threshold, and cooldown. Gated by the Adaptive Notification Suppression feature.',
-  relay: 'Outbound zero-knowledge relay reachability, for reaching this daemon from outside the LAN without opening an inbound port. Off by default — relay.enabled is the switch. The relay operator sees only ciphertext and connection metadata — self-host your own relay for full control.',
-  learning: 'Idle-time memory consolidation: merging duplicate standing memory records and decaying/archiving stale ones. Off by default — nothing runs until enabled.',
-};
 
 const ENUM_VALUE_DESCRIPTIONS: Record<string, Record<string, string>> = {
   'display.themeMode': {

package/src/runtime/bootstrap-command-parts.ts

@@ -1,4 +1,10 @@
 import { getConfigSnapshot } from '../config/index.ts';
+import {
+  describeServingEffort,
+  publishActiveEffortOptions,
+  resolveRequestedEffortForServingModel,
+  toEffortModel,
+} from '../providers/reasoning-effort-surface.ts';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { AdaptivePlanner } from '@pellux/goodvibes-sdk/platform/core';
 import type { ConversationManager } from '../core/conversation';
@@ -227,7 +233,7 @@ export function createBootstrapCommandActions(
     clearScreen: () => unwiredShellAction('clearScreen'),
     activatePlan,
     requestPermission: (request) => requestPermission(request),
-    completeModelSelection: ({ model, effort, contextCap, target }) => {
+    completeModelSelection: ({ model, effort, contextCap, target, effortChosenByUser }) => {
       if (!model) return;
       const def = model;
       const key = def.registryKey ?? `${def.provider}:${def.id}`;
@@ -257,13 +263,39 @@ export function createBootstrapCommandActions(
           providerRegistry.setCurrentModel(key);
           runtime.model = key;
           runtime.provider = def.provider;
-          runtime.reasoningEffort = effort as 'instant' | 'low' | 'medium' | 'high';
+          // Two levels, kept apart on purpose. Config `provider.reasoningEffort`
+          // holds what the USER asked for; `runtime.reasoningEffort` holds what
+          // the model now serving will actually receive, which is the requested
+          // level snapped DOWN to this model's own levels.
+          //
+          // Only the picker's effort STEP is a user choice, and only it writes
+          // the preference. Every other route into this callback (model-only
+          // commit, context-cap commit) carries a level merely carried over
+          // from the previous model; storing that is what used to ratchet the
+          // preference down for good — one hop through a model that caps at
+          // 'medium' and 'xhigh' was gone from config, so hopping back could
+          // not restore it.
+          //
+          // A stored 'xhigh' that becomes 'high' on the wire would make a
+          // single-value display a lie, so the display carries BOTH values with
+          // their provenance instead (describeServingEffort) rather than the
+          // preference being corrupted to match.
+          const effortModel = toEffortModel(def);
+          // Publish this model's real levels first, so both the preference
+          // write below and a later `config set provider.reasoningEffort` are
+          // validated against them.
+          publishActiveEffortOptions(effortModel);
+          if (effortChosenByUser && effort) configManager.set('provider.reasoningEffort', effort);
+          const serving = resolveRequestedEffortForServingModel(configManager, effortModel);
+          runtime.reasoningEffort = serving.effective ?? '';
           configManager.set('provider.model', key);
-          configManager.set('provider.reasoningEffort', effort as 'instant' | 'low' | 'medium' | 'high');
           const ctxNote = contextCap != null && contextCap > 0
             ? `, context cap: ${contextCap.toLocaleString()}`
             : '';
-          conversation.log(`Switched to model: ${def.displayName} (${def.provider}), effort: ${effort}${ctxNote}`, { fg: '135' });
+          conversation.log(`Switched to model: ${def.displayName} (${def.provider}), effort: ${describeServingEffort(serving, effortModel)}${ctxNote}`, { fg: '135' });
+          // The SDK's own sentence, printed verbatim so the explanation cannot
+          // drift from the resolution that produced it.
+          if (serving.note) conversation.log(serving.note, { fg: '214' });
         }
       } catch (e) {
         conversation.log(`Error switching model: ${summarizeError(e)}`, { fg: '#ef4444' });

package/src/runtime/bootstrap-core.ts

@@ -350,7 +350,7 @@ export async function initializeBootstrapCore(
 
   const toolRegistry = new ToolRegistry();
   const { fileCache, projectIndex } = registerAllTools(toolRegistry, {
-    surfaceRoot: services.surface.surfaceRoot,
+    resolveSessionId: () => runtimeSessionIdRef.value, surfaceRoot: services.surface.surfaceRoot, // task refs follow the LIVE runtime session (recovery reassigns it in place); without this they fall into the shared legacy namespace
     localhostFetchApproval: services.localhostFetchApproval, // loopback-fetch ask, built once in the services composition
     execPromptAnswerHandler: services.execPromptAnswerHandler, // terminal prompt-answer path, built once in the services composition
     fileUndoManager: services.fileUndoManager,