@pellux/goodvibes-tui 1.21.0 → 1.22.0

package/src/renderer/conversation-tree.ts

@@ -0,0 +1,179 @@
+/**
+ * conversation-tree.ts — column geometry for the transcript's branch tree.
+ *
+ * The transcript renders an assistant turn as a small tree: the turn header at
+ * depth 0, each tool call it issues as a depth-1 branch, and each call's result
+ * as a depth-2 branch under that call. This module owns the *only* arithmetic
+ * that decides where those branch glyphs and their content land, so every row
+ * type (event lines, tool-call rows, collapsed fragments) agrees on a single
+ * column grid instead of each re-deriving it.
+ *
+ * Geometry, relative to the existing flush layout (LAYOUT.LEFT_MARGIN = 4):
+ *
+ *   depth 0   `  ● assistant …`         marker col 3, content col 5
+ *   depth 1   `✓   ├ config.get …`       connector col 5, content col 7
+ *   depth 2   `✓   │ └ ▸ 627 lines …`    connector col 7, content col 9
+ *
+ * The connector sits where the parent's content began, and content starts two
+ * columns after it — the same marker→content relationship a depth-0 row has.
+ * Status lives in a fixed gutter at column 0, OUTSIDE the indent, so every ✓
+ * and ✗ in the transcript lines up in one column regardless of nesting depth.
+ *
+ * Every level steps by exactly TREE_STEP_COLS, and indent, gutter and content
+ * columns are functions of depth and width ALONE — never of sibling status.
+ * That is what makes a `└`→`├` connector flip cost exactly one cell: the
+ * column it occupies exists either way, so no text moves.
+ *
+ * Narrow terminals: indenting unconditionally would eat the content budget and
+ * silently truncate the informative end of a row — the failure class the
+ * markdown-table column bug came from. treeIndentCols() therefore clamps the
+ * indent to whatever still leaves TREE_MIN_CONTENT_COLS of content, and drops
+ * to 0 (flush, no branch glyph) when even one level does not fit. Losing the
+ * visual nesting on a 30-column terminal is acceptable; losing characters is
+ * not.
+ */
+
+import { LAYOUT } from './layout.ts';
+import type { Line } from '../types/grid.ts';
+import { createStyledCell } from '../types/grid.ts';
+
+/** Columns added per nesting level. Fixed — never content-dependent. */
+const TREE_STEP_COLS = 2;
+
+/**
+ * Width of the reserved status column that every row carries, at every depth.
+ *
+ * The column exists whether or not the row currently has a marker: a completed
+ * row shows ✓, a failed row its failure glyph, an in-flight or plain row a
+ * blank of the same width. Because the space is always reserved, a marker
+ * appearing or resolving changes only that cell's contents and can never shift
+ * the label beside it. Combined with fixed per-depth indentation this gives the
+ * whole tree one rule: columns are fixed, only their contents change.
+ */
+const TREE_STATUS_COLS = 2;
+
+/**
+ * Content columns a branch row is guaranteed to keep. Below this the indent is
+ * reduced (and finally dropped) rather than squeezing the row's text.
+ */
+const TREE_MIN_CONTENT_COLS = 16;
+
+
+/**
+ * Effective indent, in columns, for a branch at `depth` rendered at `width`.
+ *
+ * Returns 0 for depth <= 0 (a flush, non-branch row) and for widths too narrow
+ * to carry even one level while keeping TREE_MIN_CONTENT_COLS of content. The
+ * result is always a whole multiple of TREE_STEP_COLS, so branch glyphs across
+ * different depths stay on the same column grid.
+ */
+export function treeIndentCols(depth: number, width: number): number {
+  if (depth <= 0) return 0;
+  // The status gutter is charged first and never given back — see TREE_GUTTER_COL.
+  const budget = width - LAYOUT.LEFT_MARGIN - LAYOUT.RIGHT_MARGIN - TREE_STATUS_COLS - TREE_MIN_CONTENT_COLS;
+  if (budget < TREE_STEP_COLS) return 0;
+  const affordableLevels = Math.floor(budget / TREE_STEP_COLS);
+  return Math.min(depth, affordableLevels) * TREE_STEP_COLS;
+}
+
+/**
+ * Write the status gutter for a row: `glyph` when it has one, an untouched
+ * blank of the same width when it does not. Success and failure differ by
+ * GLYPH, not only by colour, so the distinction survives a monochrome terminal
+ * and colour-blind viewers.
+ */
+export function writeTreeStatusGutter(
+  line: Line,
+  glyph: string | null,
+  fg: string,
+  width: number,
+): void {
+  if (!glyph || TREE_GUTTER_COL >= width) return;
+  line[TREE_GUTTER_COL] = createStyledCell(glyph, { fg, bold: true });
+}
+
+/**
+ * Column the connector (`├`/`└`) occupies for a given effective indent, and
+ * the column an ancestor's `│` gutter occupies at that same indent.
+ */
+export function treeBranchCol(indentCols: number): number {
+  return LAYOUT.LEFT_MARGIN - 1 + indentCols;
+}
+
+/**
+ * The status gutter: a fixed column at the far LEFT of every row, before any
+ * indentation, carrying ✓ / ✕ / blank.
+ *
+ * Deliberately outside the indent so it does not scale with depth. With the
+ * marker placed after the connector instead, status would sit at a different
+ * horizontal position on every row depending on nesting, so scanning for what
+ * completed means tracking a ragged edge — and that degrades precisely as
+ * trees get deeper. Here every marker in the transcript lines up in one
+ * column no matter how deep its row sits, for the cost of one fixed column.
+ *
+ * It is never clamped: narrow terminals clamp the INDENT (see treeIndentCols)
+ * and leave the gutter intact, because losing nesting depth is recoverable by
+ * widening the terminal while losing which rows succeeded is not.
+ */
+const TREE_GUTTER_COL = 0;
+
+/** Column where a branch row's text starts, immediately after its connector. */
+export function treeContentCol(indentCols: number): number {
+  return treeBranchCol(indentCols) + 2;
+}
+
+/**
+ * Columns at which ancestor `│` gutters are drawn for a row at `depth`, given
+ * the set of ancestor depths whose subtrees are still open.
+ *
+ * Clamping can push two levels onto the same column at narrow widths; a gutter
+ * is emitted only when it lands strictly left of this row's own connector, so
+ * a clamped tree degrades by losing gutters rather than by overwriting the
+ * connector.
+ */
+function treeGutterCols(
+  openAncestorDepths: readonly number[],
+  depth: number,
+  width: number,
+): number[] {
+  const ownCol = treeBranchCol(treeIndentCols(depth, width));
+  const cols: number[] = [];
+  for (const ancestorDepth of openAncestorDepths) {
+    const col = treeBranchCol(treeIndentCols(ancestorDepth, width));
+    if (col < ownCol) cols.push(col);
+  }
+  return cols;
+}
+
+/**
+ * Draw a branch row's connector and the `│` gutters of its still-open
+ * ancestors onto an already-rendered line, in place.
+ *
+ * Connectors are recomputed from live structure on every rebuild (see
+ * conversation-turn-structure.ts), never cached, so a row that stops being
+ * last flips `└`→`├` here with nothing stale to invalidate. Only this cell
+ * changes: indent, status gutter and content column are functions of depth and
+ * width alone, so a sibling arriving repaints one connector cell and moves no
+ * text.
+ */
+export function drawBranchConnector(
+  line: Line,
+  depth: number,
+  connector: string | undefined,
+  openAncestorDepths: readonly number[],
+  width: number,
+  fg: string,
+): void {
+  if (depth <= 0 || !connector) return;
+  const indent = treeIndentCols(depth, width);
+  if (indent <= 0) return;
+  for (const gutterCol of treeGutterCols(openAncestorDepths, depth, width)) {
+    if (gutterCol >= 0 && gutterCol < width) {
+      line[gutterCol] = createStyledCell('\u2502', { fg, dim: true });
+    }
+  }
+  const col = treeBranchCol(indent);
+  if (col >= 0 && col < width) {
+    line[col] = createStyledCell(connector, { fg, dim: true });
+  }
+}

package/src/renderer/settings-modal-helpers.ts

@@ -4,7 +4,7 @@
  * architecture cap. No layout logic lives here.
  */
 
-import type { SettingEntry, McpEntry, SubscriptionEntry } from '../input/settings-modal-types.ts';
+import type { SettingEntry, McpEntry, SubscriptionEntry, SettingsCategory } from '../input/settings-modal-types.ts';
 import { SETTINGS_CATEGORIES } from '../input/settings-modal-types.ts';
 import { isSecretConfigKey, isSecretReferenceValue } from '../config/secret-config.ts';
 import { UI_TONES } from './ui-primitives.ts';
@@ -61,6 +61,58 @@ export function inferSubscriptionRouteReason(entry: SubscriptionEntry): string |
   return undefined;
 }
 
+export const CATEGORY_INFO: Record<SettingsCategory, string> = {
+  display: 'Presentation settings for the terminal transcript: streaming, line numbers, thinking visibility, reasoning summaries, token speed, and tool previews.',
+  ui: 'Controls where operational messages render and whether voice surfaces are enabled. These settings change visibility, not provider behavior.',
+  provider: 'Default model routing for normal chat turns, embeddings, reasoning effort, and persistent system prompt file.',
+  pricing: 'Manual model prices (USD per 1M tokens, keyed provider:model). Your price wins over provider-served and catalog prices in every cost display, immediately.',
+  update: 'Self-update posture: whether the daemon checks hourly and updates at an idle moment, the release source it checks, and the check cadence. Clients update at launch; every swap keeps the previous binary for one-command rollback.',
+  subscriptions: 'Provider subscription login state and routing posture. Active sessions can be reviewed or signed out here; API keys remain managed through secrets.',
+  behavior: 'Day-to-day shell behavior: approval posture, compaction, history, guidance, notifications, stale-context warnings, return context, and Human-in-the-Loop mode.',
+  storage: 'Local storage posture, including secret storage policy and maximum artifact size for knowledge/home graph/document ingestion.',
+  atRest: 'Data-at-rest policy for the on-disk transcript journal and execution ledger: whether secret/credential patterns are redacted at write time, and the age/size caps that trigger pruning.',
+  permissions: 'Permission mode and tool-class policy. These settings decide whether the shell prompts before read/write/exec/network/agent actions.',
+  orchestration: 'Agent orchestration limits and recursion controls.',
+  planner: 'How /workstream decomposes a goal into work items: agent-driven decomposition (with heuristic fallback) or the forced heuristic path, plus the planning agent\'s turn, token, and wall-clock bounds.',
+  wrfc: 'Work-review-fix-cycle thresholds, retry limits, and automatic commit behavior.',
+  helper: 'Helper model defaults used by helper subsystems when they do not use the main chat route.',
+  tts: 'Text-to-speech provider, voice, and optional spoken-turn LLM overrides.',
+  voice: 'Two independent voice capabilities. Local engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro — all empty by default, configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error); once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension. Wake-word detection (voice.wake.*, rendered as its own unit below): listening continuously for a spoken wake phrase and handing the utterance that follows to speech-to-text — off by default, because holding a microphone open is meant to be an explicit act. Its published recall figures are measured on synthesised speech only, so no human recording of the phrase is behind them.',
+  service: 'Background service posture: enabled state, autostart, restart behavior, service name, platform, and logs.',
+  daemon: 'Local session daemon. It hosts the shared session broker and companion chat so a session started here is visible and steerable from other surfaces. On by default, bound to loopback (127.0.0.1) only.',
+  controlPlane: 'Daemon control-plane settings for local admin/API access.',
+  httpListener: 'HTTP listener settings for webhook and integration ingress.',
+  web: 'Browser surface settings for the local or network web UI.',
+  batch: 'Batch execution settings, including local vs Cloudflare queue behavior.',
+  automation: 'Scheduled and automated run settings, concurrency, timeout, catch-up, cooldown, and retention behavior.',
+  checkin: 'Proactive check-in: on a cadence, a briefing is judged and you are contacted only when something warrants it. Off by default; every run — scheduled or manual — leaves a receipt (see /checkin) recording whether it stayed quiet, delivered a message, or was skipped.',
+  watchers: 'File/process watcher heartbeat, polling, and recovery-window behavior, plus the trigger family (watchers.triggers.*, rendered as its own unit): stream watchers that regex-filter and batch a long-lived command\'s output, model-free condition checks running a probe/extract/rule pipeline with no LLM in the loop, and one-shot on-exit triggers that fire exactly one payload when a launched command terminates. The trigger family is off by default — a trigger supervises real processes with nobody watching — and its rows tune the backoff ladder, the strike breaker, retention bounds, batching, and process caps.',
+  runtime: 'Runtime guardrails such as companion chat limiter and event bus listener caps.',
+  telemetry: 'Telemetry payload policy.',
+  cache: 'Provider and model cache behavior, TTL, and hit-rate monitoring.',
+  diagnostics: 'Post-edit diagnostics: whether the shell runs language diagnostics on a file after the model edits or writes it, surfacing new problems inline.',
+  mcp: 'MCP server trust and scope review. Trust changes can expose local files, tools, databases, browsers, or remote automation depending on the server.',
+  sandbox: 'Isolation strategy for REPL, MCP, Windows, and QEMU-backed execution. Use these settings to separate risky tools from the host shell.',
+  surfaces: 'External app surfaces such as Slack, Discord, ntfy, Home Assistant, Telegram, webhooks, chat bridges, and messaging providers.',
+  device: 'Posture for using a PAIRED phone as a tool — its cameras, its screen, its location, its clipboard, and a small set of device effects. Two rows change behaviour today. device.capabilities.mode is the live switch: off stops every capability request reaching any paired device, ask-every-time asks on every single request and never consults a durable grant, and honor-grants (stock) asks the first time and every time after unless you chose "always allow" for that one capability on that one phone. device.nodes.maxPaired is enforced at the moment a device pairs: at the cap a NEW device is refused with a message naming the setting, the cap and how many are already paired, while a phone that is already in the list simply supersedes its own record and keeps working. Lowering the cap below the number already paired unpairs no one — existing devices keep working and only the next new pairing is refused; a device moving off the legacy shared token to its own is exempt so it cannot be stranded; and a nonsensical cap (zero, negative, not a number) is read as no cap at all, because a broken setting must never lock you out of your own daemon. The cap is re-read at every pairing, so a change applies without a restart. The remaining rows state the posture the capability service is built to honour — which capabilities may be granted durably, how long a phone has to answer, how exact a location it reports, whether the clipboard can be read, how long captures and grants live, and how often housekeeping sweeps. They are recorded and read back exactly as you set them, but no surface in THIS build maps them into a running capability session — the capability service currently runs on its own matching defaults. Your values are kept and take effect in the release that wires the session up.',
+  conversationGate: 'What a message arriving from one of those channels does. By default it gets a conversational answer, and work is proposed and waits for your agreement rather than starting on its own; you can instead confirm every run, or restore the old behavior where a message starts work immediately. Also how long a pending proposal stays answerable and how many can wait at once. This governs messages from channels only — what you type here always runs, and schedules and triggers were authorized when created.',
+  cloudflare: 'Optional Cloudflare control plane, batch queue, Worker, Tunnel, Access, DNS, KV, Durable Objects, Secrets Store, and R2 settings.',
+  release: 'Release-channel preference.',
+  power: 'Host sleep ownership. Keep-awake holds the host awake (the always-visible "sleep disabled" chip is the safety mechanism — no timer, no AC-only option); automatic inhibition keeps the host awake while real work runs, with an honest hard cap on that work hold.',
+  memory: 'Memory provenance surfacing. Whether turns that drew on your standing memories show a small "used N memories" chip with a drill-in listing them. Off by default — when off, nothing is rendered and no context is added.',
+  danger: 'High-impact switches for daemon and HTTP listener behavior. These are operational overrides, not normal preferences.',
+  tools: 'Tool LLM and helper model routing. Empty provider/model values inherit the active chat route unless a specific helper/tool route is set.',
+  network: 'Combined network view for daemon control-plane, HTTP listener, browser web surface, and general outbound network settings.',
+  fetch: 'Fetch response sanitization and host trust tiers for the fetch tool: sanitize mode plus default trusted/blocked host lists. Gated by the Fetch Response Sanitization feature.',
+  agents: 'Sub-agent context-window awareness and per-turn passive knowledge/code injection: token budget, relevance floor, code-chunk limit, and the compaction threshold. Gated by the agent context/injection features.',
+  security: 'API token scope and rotation auditing: rotation cadence, warning lead time, and whether overdue/over-scoped tokens are blocked or only reported. Gated by the Token Scope and Rotation Audit feature.',
+  integrations: 'Integration delivery reliability (Slack/Discord/webhook): retry counts, backoff bounds, dead-letter queue size, and SLO enforcement. Gated by the Integration Delivery SLO feature.',
+  policy: 'Policy-as-code bundle loading: where the startup policy bundle is loaded from and its file path. Gated by the Policy-as-Code feature.',
+  notifications: 'Notification router burst-suppression tuning: burst window, threshold, and cooldown. Gated by the Adaptive Notification Suppression feature.',
+  relay: 'Outbound zero-knowledge relay reachability, for reaching this daemon from outside the LAN without opening an inbound port. Off by default — relay.enabled is the switch. The relay operator sees only ciphertext and connection metadata — self-host your own relay for full control.',
+  learning: 'Idle-time memory consolidation: merging duplicate standing memory records and decaying/archiving stale ones. Off by default — nothing runs until enabled.',
+};
+
 export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], string> = {
   display: 'Display',
   ui: 'UI',
@@ -94,6 +146,8 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   mcp: 'MCP',
   sandbox: 'Sandbox',
   surfaces: 'Surfaces',
+  device: 'Paired Devices',
+  conversationGate: 'Channel Message Handling',
   cloudflare: 'Cloudflare',
   release: 'Release',
   power: 'Power',
@@ -148,7 +202,7 @@ const SETTING_LABELS: Partial<Record<string, string>> = {
   'controlPlane.hostMode': 'CP Host Mode',
   'controlPlane.host': 'CP Host',
   'controlPlane.port': 'CP Port',
-  'controlPlane.baseUrl': 'CP Base URL',
+  'controlPlane.publicBaseUrl': 'CP Public Base URL',
   'controlPlane.streamMode': 'CP Stream Mode',
   'controlPlane.allowRemote': 'CP Allow Remote',
   'controlPlane.trustProxy': 'CP Trust Proxy',

package/src/renderer/settings-modal.ts

@@ -10,7 +10,7 @@ import type { SettingsModal, SettingEntry, McpEntry, SubscriptionEntry, Settings
 import { SETTINGS_CATEGORIES, SETTINGS_CATEGORY_GROUPS } from '../input/settings-modal.ts';
 import { FEATURE_SETTINGS_BY_ID, isFeatureValueEnabled } from '../runtime/feature-settings.ts';
 import { getDisplayWidth, wrapText } from '../utils/terminal-width.ts';
-import { CATEGORY_LABELS, describeUiRouting, formatValue, getSettingLabel, inferSubscriptionRouteReason, valueColor } from './settings-modal-helpers.ts';
+import { CATEGORY_INFO, CATEGORY_LABELS, describeUiRouting, formatValue, getSettingLabel, inferSubscriptionRouteReason, valueColor } from './settings-modal-helpers.ts';
 import { isSecretConfigKey } from '../config/secret-config.ts';
 import { GLYPHS } from './ui-primitives.ts';
 import { formatHints, joinHints } from './hint-grammar.ts';
@@ -24,55 +24,6 @@ import {
   type WorkspaceRow,
 } from './fullscreen-workspace.ts';
 
-const CATEGORY_INFO: Record<SettingsCategory, string> = {
-  display: 'Presentation settings for the terminal transcript: streaming, line numbers, thinking visibility, reasoning summaries, token speed, and tool previews.',
-  ui: 'Controls where operational messages render and whether voice surfaces are enabled. These settings change visibility, not provider behavior.',
-  provider: 'Default model routing for normal chat turns, embeddings, reasoning effort, and persistent system prompt file.',
-  pricing: 'Manual model prices (USD per 1M tokens, keyed provider:model). Your price wins over provider-served and catalog prices in every cost display, immediately.',
-  update: 'Self-update posture: whether the daemon checks hourly and updates at an idle moment, the release source it checks, and the check cadence. Clients update at launch; every swap keeps the previous binary for one-command rollback.',
-  subscriptions: 'Provider subscription login state and routing posture. Active sessions can be reviewed or signed out here; API keys remain managed through secrets.',
-  behavior: 'Day-to-day shell behavior: approval posture, compaction, history, guidance, notifications, stale-context warnings, return context, and Human-in-the-Loop mode.',
-  storage: 'Local storage posture, including secret storage policy and maximum artifact size for knowledge/home graph/document ingestion.',
-  atRest: 'Data-at-rest policy for the on-disk transcript journal and execution ledger: whether secret/credential patterns are redacted at write time, and the age/size caps that trigger pruning.',
-  permissions: 'Permission mode and tool-class policy. These settings decide whether the shell prompts before read/write/exec/network/agent actions.',
-  orchestration: 'Agent orchestration limits and recursion controls.',
-  planner: 'How /workstream decomposes a goal into work items: agent-driven decomposition (with heuristic fallback) or the forced heuristic path, plus the planning agent\'s turn, token, and wall-clock bounds.',
-  wrfc: 'Work-review-fix-cycle thresholds, retry limits, and automatic commit behavior.',
-  helper: 'Helper model defaults used by helper subsystems when they do not use the main chat route.',
-  tts: 'Text-to-speech provider, voice, and optional spoken-turn LLM overrides.',
-  voice: 'Free, offline local voice engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro. All empty by default — configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error). Once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension.',
-  service: 'Background service posture: enabled state, autostart, restart behavior, service name, platform, and logs.',
-  daemon: 'Local session daemon. It hosts the shared session broker and companion chat so a session started here is visible and steerable from other surfaces. On by default, bound to loopback (127.0.0.1) only.',
-  controlPlane: 'Daemon control-plane settings for local admin/API access.',
-  httpListener: 'HTTP listener settings for webhook and integration ingress.',
-  web: 'Browser surface settings for the local or network web UI.',
-  batch: 'Batch execution settings, including local vs Cloudflare queue behavior.',
-  automation: 'Scheduled and automated run settings, concurrency, timeout, catch-up, cooldown, and retention behavior.',
-  checkin: 'Proactive check-in: on a cadence, a briefing is judged and you are contacted only when something warrants it. Off by default; every run — scheduled or manual — leaves a receipt (see /checkin) recording whether it stayed quiet, delivered a message, or was skipped.',
-  watchers: 'File/process watcher heartbeat, polling, and recovery-window behavior.',
-  runtime: 'Runtime guardrails such as companion chat limiter and event bus listener caps.',
-  telemetry: 'Telemetry payload policy.',
-  cache: 'Provider and model cache behavior, TTL, and hit-rate monitoring.',
-  diagnostics: 'Post-edit diagnostics: whether the shell runs language diagnostics on a file after the model edits or writes it, surfacing new problems inline.',
-  mcp: 'MCP server trust and scope review. Trust changes can expose local files, tools, databases, browsers, or remote automation depending on the server.',
-  sandbox: 'Isolation strategy for REPL, MCP, Windows, and QEMU-backed execution. Use these settings to separate risky tools from the host shell.',
-  surfaces: 'External app surfaces such as Slack, Discord, ntfy, Home Assistant, Telegram, webhooks, chat bridges, and messaging providers.',
-  cloudflare: 'Optional Cloudflare control plane, batch queue, Worker, Tunnel, Access, DNS, KV, Durable Objects, Secrets Store, and R2 settings.',
-  release: 'Release-channel preference.',
-  power: 'Host sleep ownership. Keep-awake holds the host awake (the always-visible "sleep disabled" chip is the safety mechanism — no timer, no AC-only option); automatic inhibition keeps the host awake while real work runs, with an honest hard cap on that work hold.',
-  memory: 'Memory provenance surfacing. Whether turns that drew on your standing memories show a small "used N memories" chip with a drill-in listing them. Off by default — when off, nothing is rendered and no context is added.',
-  danger: 'High-impact switches for daemon and HTTP listener behavior. These are operational overrides, not normal preferences.',
-  tools: 'Tool LLM and helper model routing. Empty provider/model values inherit the active chat route unless a specific helper/tool route is set.',
-  network: 'Combined network view for daemon control-plane, HTTP listener, browser web surface, and general outbound network settings.',
-  fetch: 'Fetch response sanitization and host trust tiers for the fetch tool: sanitize mode plus default trusted/blocked host lists. Gated by the Fetch Response Sanitization feature.',
-  agents: 'Sub-agent context-window awareness and per-turn passive knowledge/code injection: token budget, relevance floor, code-chunk limit, and the compaction threshold. Gated by the agent context/injection features.',
-  security: 'API token scope and rotation auditing: rotation cadence, warning lead time, and whether overdue/over-scoped tokens are blocked or only reported. Gated by the Token Scope and Rotation Audit feature.',
-  integrations: 'Integration delivery reliability (Slack/Discord/webhook): retry counts, backoff bounds, dead-letter queue size, and SLO enforcement. Gated by the Integration Delivery SLO feature.',
-  policy: 'Policy-as-code bundle loading: where the startup policy bundle is loaded from and its file path. Gated by the Policy-as-Code feature.',
-  notifications: 'Notification router burst-suppression tuning: burst window, threshold, and cooldown. Gated by the Adaptive Notification Suppression feature.',
-  relay: 'Outbound zero-knowledge relay reachability, for reaching this daemon from outside the LAN without opening an inbound port. Off by default — relay.enabled is the switch. The relay operator sees only ciphertext and connection metadata — self-host your own relay for full control.',
-  learning: 'Idle-time memory consolidation: merging duplicate standing memory records and decaying/archiving stale ones. Off by default — nothing runs until enabled.',
-};
 
 const ENUM_VALUE_DESCRIPTIONS: Record<string, Record<string, string>> = {
   'display.themeMode': {
@@ -285,6 +236,14 @@ function buildFlagContext(entry: SettingEntry | null): string[] {
     `Feature: ${feature.id} (${feature.domain} domain)`,
     `Setting: ${feature.enablement.key} = ${formatValue(entry)}`,
     `State: ${displayState}`,
+    // A capability the registry declares not operable reads as disabled no
+    // matter what its settings key says. Without this line the row shows a
+    // value of true beside a state of disabled and explains nothing — the
+    // written reason exists in the registry, so render it where the user meets
+    // the contradiction rather than leaving it to be discovered.
+    ...(feature.operable === false && feature.inoperableDetail
+      ? [`Not available in this build: ${feature.inoperableDetail}`]
+      : []),
     `Default: ${feature.defaultEnabled ? 'enabled' : 'disabled'}`,
     `Applies: ${feature.restartRequired ? 'on next launch (startup-gated)' : 'immediately'}`,
     ...(pendingRestart

package/src/renderer/tool-call.ts

@@ -6,10 +6,20 @@ import { stripDangerousAnsi } from './ansi-sanitize.ts';
 import { formatElapsed } from '../utils/format-elapsed.ts';
 import { GLYPHS } from './ui-primitives.ts';
 import { activeUiTones } from './theme.ts';
+import { treeBranchCol, treeContentCol, writeTreeStatusGutter } from './conversation-tree.ts';
 
 const TOOL_NAME_MIN_WIDTH = 8;
 const TOOL_NAME_MAX_WIDTH = 20;
 
+/** Tree placement for a tool-call row rendered as a branch of its turn. */
+export interface ToolCallTreeOptions {
+  /** Effective indent in columns, already clamped by treeIndentCols(). */
+  readonly indentCols?: number;
+  readonly branchFg?: string;
+  /** Suppress the tool label because the turn header already carries it. */
+  readonly omitToolName?: boolean;
+}
+
 function writeStyledText(
   line: Line,
   startCol: number,
@@ -44,9 +54,18 @@ function buildLeftSegments(
   keyArg: string,
   suffixText: string,
   leftBudget: number,
+  omitToolName = false,
 ): Array<{ text: string; fg: string; bold?: boolean; dim?: boolean }> {
   if (leftBudget <= 0) return [];
 
+  // When every call in the turn shares one label, the label rides on the turn
+  // header and each row leads with the argument that actually distinguishes it
+  // (`config.get`, `services.restart`). Falls back to showing the name when
+  // there is no key argument, so a row can never render empty.
+  if (omitToolName && keyArg) {
+    return buildLeftSegments(keyArg, '', suffixText, leftBudget, false);
+  }
+
   const t = activeUiTones();
   const segments: Array<{ text: string; fg: string; bold?: boolean; dim?: boolean }> = [];
   const suffixBudget = suffixText ? Math.min(Math.max(12, Math.floor(leftBudget * 0.3)), 20) : 0;
@@ -164,13 +183,19 @@ export function renderToolCallBlock(
   errorMsg?: string,
   frameIndex?: number,
   startedAtMs?: number,
+  tree?: ToolCallTreeOptions,
 ): Line[] {
   const line = createEmptyLine(width);
   const t = activeUiTones();
-  const margin = LAYOUT.LEFT_MARGIN;
+  const indent = Math.max(0, tree?.indentCols ?? 0);
+  // In tree mode the status icon moves to the branch's content column, so the
+  // ✓ lines up with the content of every other row at the same depth and the
+  // branch glyph sits where the parent's content began.
+  const margin = indent > 0 ? treeContentCol(indent) : LAYOUT.LEFT_MARGIN;
   const rightMargin = LAYOUT.RIGHT_MARGIN;
   const contentEnd = width - rightMargin;
 
+
   // Status icon. 'pending' means the tool is still awaiting a decision
   // (e.g. an approval prompt) and has NOT run yet — it uses the hollow idle
   // glyph so a not-yet-run tool never shows the completed green ✓ (2c).
@@ -207,10 +232,18 @@ export function renderToolCallBlock(
     : contentEnd;
   let col: number = leftStart;
 
-  if (col < leftEndExclusive) {
-    line[col] = createStyledCell(icon, { fg: iconColor, bold: status === 'done' || status === 'error' || status === 'cancelled' });
+  // In tree mode the status glyph goes in the fixed left gutter (column 0),
+  // before the indent, so every marker in the transcript aligns in one column
+  // no matter how deep its row sits. The row's own content then starts at the
+  // branch's content column with no inline icon slot.
+  if (indent > 0) {
+    writeTreeStatusGutter(line, icon, iconColor, width);
+  } else {
+    if (col < leftEndExclusive) {
+      line[col] = createStyledCell(icon, { fg: iconColor, bold: status === 'done' || status === 'error' || status === 'cancelled' });
+    }
+    col += 2; // icon + space
   }
-  col += 2; // icon + space
 
   // Tool name — extract short name for long MCP tool names, but keep a readable dynamic width.
   const rawName = toolCall.name.includes('__')
@@ -225,7 +258,7 @@ export function renderToolCallBlock(
         ? `(${stripDangerousAnsi(resultSummary)})`
         : '';
   const leftBudget = Math.max(0, leftEndExclusive - col);
-  const leftSegments = buildLeftSegments(rawName, keyArg, suffixText, leftBudget);
+  const leftSegments = buildLeftSegments(rawName, keyArg, suffixText, leftBudget, tree?.omitToolName ?? false);
   for (const segment of leftSegments) {
     col = writeStyledText(line, col, leftEndExclusive, segment.text, {
       fg: segment.fg,

package/src/runtime/cloudflare-control-plane.ts

@@ -282,7 +282,10 @@ function hostForUrl(host: string): string {
 }
 
 export function resolveCloudflareDaemonBaseUrl(configManager: Pick<ConfigManager, 'get'>): string {
-  const configuredBaseUrl = String(configManager.get('controlPlane.baseUrl' as never) ?? '').trim();
+  // An explicitly DECLARED external address (tunnel / proxy) wins; otherwise the
+  // URL is built from the bind below. The old `controlPlane.baseUrl` this read
+  // was a stored mirror of the bind with no writers, so it drifted from it.
+  const configuredBaseUrl = String(configManager.get('controlPlane.publicBaseUrl' as never) ?? '').trim();
   if (configuredBaseUrl) return configuredBaseUrl.replace(/\/+$/, '');
   const host = hostForUrl(connectHostForBindHost(String(configManager.get('controlPlane.host' as never) ?? '127.0.0.1')));
   const portValue = Number(configManager.get('controlPlane.port' as never) ?? 3421);

package/src/runtime/feature-settings.ts

@@ -73,6 +73,13 @@ export function featuresForEnablementKey(key: string): readonly FeatureSetting[]
  */
 export function isFeatureValueEnabled(feature: FeatureSetting, value: unknown): boolean {
   const { key, kind, enabledValues } = feature.enablement;
+  // A capability declared not operable in this build never reads as on, whatever
+  // its settings key says. deriveFeatureState already enforces this for the
+  // boolean and enum kinds; stating it once here covers the constant kind too,
+  // so no surface can show "on" for something that is doing nothing. The user's
+  // value is untouched — it is kept for the release that wires the capability up
+  // — and `feature.inoperableDetail` is the written reason a surface renders.
+  if (feature.operable === false) return false;
   if (kind === 'constant') {
     const schema = getConfigSchemaSetting(key);
     if (schema?.type === 'boolean') return value === true;

package/src/runtime/index.ts

@@ -230,6 +230,18 @@ export const isPluginTerminal = operations.isPluginTerminal;
 export const resolveCapabilityManifest = operations.resolveCapabilityManifest;
 export const validateManifestV2 = operations.validateManifestV2;
 export const validatePluginSignature = operations.validatePluginSignature;
+// Instance-type companions for the operations class aliases (see note above the
+// security block): the `export const` form re-exports the value only.
+export type AcpTaskAdapter = InstanceType<typeof operations.AcpTaskAdapter>;
+export type OpsIllegalActionError = InstanceType<typeof operations.OpsIllegalActionError>;
+export type OpsTargetNotFoundError = InstanceType<typeof operations.OpsTargetNotFoundError>;
+export type ToolContractVerifier = InstanceType<typeof operations.ToolContractVerifier>;
+export type McpLifecycleManager = InstanceType<typeof operations.McpLifecycleManager>;
+export type McpPermissionManager = InstanceType<typeof operations.McpPermissionManager>;
+export type McpSchemaFreshnessTracker = InstanceType<typeof operations.McpSchemaFreshnessTracker>;
+export type PluginLifecycleManager = InstanceType<typeof operations.PluginLifecycleManager>;
+export type PluginQuarantineEngine = InstanceType<typeof operations.PluginQuarantineEngine>;
+export type PluginTrustStore = InstanceType<typeof operations.PluginTrustStore>;
 export const LOW_QUALITY_THRESHOLD = operations.LOW_QUALITY_THRESHOLD;
 export const computeQualityScore = operations.computeQualityScore;
 export const createCompactionManager = operations.createCompactionManager;
@@ -487,6 +499,15 @@ export const verifyBundle = security.verifyBundle;
 export const MAX_INPUT_LENGTH = security.MAX_INPUT_LENGTH;
 export const MAX_TOKEN_COUNT = security.MAX_TOKEN_COUNT;
 
+// Instance-type companions for the class aliases above. `export const X = ns.X`
+// re-exports only the value, so `X` is unusable in type position (TS2749/TS2694).
+// These declaration-merge the instance type back onto the same name.
+export type DivergenceDashboard = InstanceType<typeof security.DivergenceDashboard>;
+export type DivergenceGateError = InstanceType<typeof security.DivergenceGateError>;
+export type LayeredPolicyEvaluator = InstanceType<typeof security.LayeredPolicyEvaluator>;
+export type PermissionSimulator = InstanceType<typeof security.PermissionSimulator>;
+export type PolicySignatureError = InstanceType<typeof security.PolicySignatureError>;
+
 export type AuthInspectionSnapshot = Security.AuthInspectionSnapshot;
 export type ProviderAuthInspection = Security.ProviderAuthInspection;
 export type DivergenceDashboardSnapshot = Security.DivergenceDashboardSnapshot;
@@ -513,7 +534,7 @@ export type BundleProvenance = Security.BundleProvenance;
 export type DecisionReason = Security.DecisionReason;
 export type DivergenceReport = Security.DivergenceReport;
 export type EnforceGateResult = Security.EnforceGateResult;
-export type SignedPolicyBundle = Security.SignedPolicyBundle;
+export type SignedPolicyBundle<T = unknown> = Security.SignedPolicyBundle<T>;
 
 export interface InspectableDomain {
   readonly name: string;

package/src/runtime/legacy-daemon-migration.ts

@@ -49,6 +49,7 @@ import { fileURLToPath } from 'node:url';
 import { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { PlatformServiceManager, type ManagedServiceStatus } from '@pellux/goodvibes-sdk/platform/daemon';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { runDaemonConfigMigration } from '../config/run-daemon-config-migration.ts';
 
 /** Structurally derived from `PlatformServiceManager`'s own constructor — the
  * SDK's public `platform/daemon` entry point only re-exports the class and
@@ -113,6 +114,7 @@ export interface BuildManagedDaemonServiceManagerParams {
  */
 export function buildManagedDaemonServiceManager(params: BuildManagedDaemonServiceManagerParams): PlatformServiceManager {
   const workingDirectory = params.workingDirectory ?? params.homeDir;
+  if (!params.configManager) runDaemonConfigMigration(params.homeDir);
   const configManager = params.configManager ?? new ConfigManager({
     workingDir: workingDirectory,
     homeDir: params.homeDir,