@pellux/goodvibes-tui 1.21.1 → 1.22.0

package/src/renderer/conversation-tree.ts

@@ -0,0 +1,179 @@
+/**
+ * conversation-tree.ts — column geometry for the transcript's branch tree.
+ *
+ * The transcript renders an assistant turn as a small tree: the turn header at
+ * depth 0, each tool call it issues as a depth-1 branch, and each call's result
+ * as a depth-2 branch under that call. This module owns the *only* arithmetic
+ * that decides where those branch glyphs and their content land, so every row
+ * type (event lines, tool-call rows, collapsed fragments) agrees on a single
+ * column grid instead of each re-deriving it.
+ *
+ * Geometry, relative to the existing flush layout (LAYOUT.LEFT_MARGIN = 4):
+ *
+ *   depth 0   `  ● assistant …`         marker col 3, content col 5
+ *   depth 1   `✓   ├ config.get …`       connector col 5, content col 7
+ *   depth 2   `✓   │ └ ▸ 627 lines …`    connector col 7, content col 9
+ *
+ * The connector sits where the parent's content began, and content starts two
+ * columns after it — the same marker→content relationship a depth-0 row has.
+ * Status lives in a fixed gutter at column 0, OUTSIDE the indent, so every ✓
+ * and ✗ in the transcript lines up in one column regardless of nesting depth.
+ *
+ * Every level steps by exactly TREE_STEP_COLS, and indent, gutter and content
+ * columns are functions of depth and width ALONE — never of sibling status.
+ * That is what makes a `└`→`├` connector flip cost exactly one cell: the
+ * column it occupies exists either way, so no text moves.
+ *
+ * Narrow terminals: indenting unconditionally would eat the content budget and
+ * silently truncate the informative end of a row — the failure class the
+ * markdown-table column bug came from. treeIndentCols() therefore clamps the
+ * indent to whatever still leaves TREE_MIN_CONTENT_COLS of content, and drops
+ * to 0 (flush, no branch glyph) when even one level does not fit. Losing the
+ * visual nesting on a 30-column terminal is acceptable; losing characters is
+ * not.
+ */
+
+import { LAYOUT } from './layout.ts';
+import type { Line } from '../types/grid.ts';
+import { createStyledCell } from '../types/grid.ts';
+
+/** Columns added per nesting level. Fixed — never content-dependent. */
+const TREE_STEP_COLS = 2;
+
+/**
+ * Width of the reserved status column that every row carries, at every depth.
+ *
+ * The column exists whether or not the row currently has a marker: a completed
+ * row shows ✓, a failed row its failure glyph, an in-flight or plain row a
+ * blank of the same width. Because the space is always reserved, a marker
+ * appearing or resolving changes only that cell's contents and can never shift
+ * the label beside it. Combined with fixed per-depth indentation this gives the
+ * whole tree one rule: columns are fixed, only their contents change.
+ */
+const TREE_STATUS_COLS = 2;
+
+/**
+ * Content columns a branch row is guaranteed to keep. Below this the indent is
+ * reduced (and finally dropped) rather than squeezing the row's text.
+ */
+const TREE_MIN_CONTENT_COLS = 16;
+
+
+/**
+ * Effective indent, in columns, for a branch at `depth` rendered at `width`.
+ *
+ * Returns 0 for depth <= 0 (a flush, non-branch row) and for widths too narrow
+ * to carry even one level while keeping TREE_MIN_CONTENT_COLS of content. The
+ * result is always a whole multiple of TREE_STEP_COLS, so branch glyphs across
+ * different depths stay on the same column grid.
+ */
+export function treeIndentCols(depth: number, width: number): number {
+  if (depth <= 0) return 0;
+  // The status gutter is charged first and never given back — see TREE_GUTTER_COL.
+  const budget = width - LAYOUT.LEFT_MARGIN - LAYOUT.RIGHT_MARGIN - TREE_STATUS_COLS - TREE_MIN_CONTENT_COLS;
+  if (budget < TREE_STEP_COLS) return 0;
+  const affordableLevels = Math.floor(budget / TREE_STEP_COLS);
+  return Math.min(depth, affordableLevels) * TREE_STEP_COLS;
+}
+
+/**
+ * Write the status gutter for a row: `glyph` when it has one, an untouched
+ * blank of the same width when it does not. Success and failure differ by
+ * GLYPH, not only by colour, so the distinction survives a monochrome terminal
+ * and colour-blind viewers.
+ */
+export function writeTreeStatusGutter(
+  line: Line,
+  glyph: string | null,
+  fg: string,
+  width: number,
+): void {
+  if (!glyph || TREE_GUTTER_COL >= width) return;
+  line[TREE_GUTTER_COL] = createStyledCell(glyph, { fg, bold: true });
+}
+
+/**
+ * Column the connector (`├`/`└`) occupies for a given effective indent, and
+ * the column an ancestor's `│` gutter occupies at that same indent.
+ */
+export function treeBranchCol(indentCols: number): number {
+  return LAYOUT.LEFT_MARGIN - 1 + indentCols;
+}
+
+/**
+ * The status gutter: a fixed column at the far LEFT of every row, before any
+ * indentation, carrying ✓ / ✕ / blank.
+ *
+ * Deliberately outside the indent so it does not scale with depth. With the
+ * marker placed after the connector instead, status would sit at a different
+ * horizontal position on every row depending on nesting, so scanning for what
+ * completed means tracking a ragged edge — and that degrades precisely as
+ * trees get deeper. Here every marker in the transcript lines up in one
+ * column no matter how deep its row sits, for the cost of one fixed column.
+ *
+ * It is never clamped: narrow terminals clamp the INDENT (see treeIndentCols)
+ * and leave the gutter intact, because losing nesting depth is recoverable by
+ * widening the terminal while losing which rows succeeded is not.
+ */
+const TREE_GUTTER_COL = 0;
+
+/** Column where a branch row's text starts, immediately after its connector. */
+export function treeContentCol(indentCols: number): number {
+  return treeBranchCol(indentCols) + 2;
+}
+
+/**
+ * Columns at which ancestor `│` gutters are drawn for a row at `depth`, given
+ * the set of ancestor depths whose subtrees are still open.
+ *
+ * Clamping can push two levels onto the same column at narrow widths; a gutter
+ * is emitted only when it lands strictly left of this row's own connector, so
+ * a clamped tree degrades by losing gutters rather than by overwriting the
+ * connector.
+ */
+function treeGutterCols(
+  openAncestorDepths: readonly number[],
+  depth: number,
+  width: number,
+): number[] {
+  const ownCol = treeBranchCol(treeIndentCols(depth, width));
+  const cols: number[] = [];
+  for (const ancestorDepth of openAncestorDepths) {
+    const col = treeBranchCol(treeIndentCols(ancestorDepth, width));
+    if (col < ownCol) cols.push(col);
+  }
+  return cols;
+}
+
+/**
+ * Draw a branch row's connector and the `│` gutters of its still-open
+ * ancestors onto an already-rendered line, in place.
+ *
+ * Connectors are recomputed from live structure on every rebuild (see
+ * conversation-turn-structure.ts), never cached, so a row that stops being
+ * last flips `└`→`├` here with nothing stale to invalidate. Only this cell
+ * changes: indent, status gutter and content column are functions of depth and
+ * width alone, so a sibling arriving repaints one connector cell and moves no
+ * text.
+ */
+export function drawBranchConnector(
+  line: Line,
+  depth: number,
+  connector: string | undefined,
+  openAncestorDepths: readonly number[],
+  width: number,
+  fg: string,
+): void {
+  if (depth <= 0 || !connector) return;
+  const indent = treeIndentCols(depth, width);
+  if (indent <= 0) return;
+  for (const gutterCol of treeGutterCols(openAncestorDepths, depth, width)) {
+    if (gutterCol >= 0 && gutterCol < width) {
+      line[gutterCol] = createStyledCell('\u2502', { fg, dim: true });
+    }
+  }
+  const col = treeBranchCol(indent);
+  if (col >= 0 && col < width) {
+    line[col] = createStyledCell(connector, { fg, dim: true });
+  }
+}

package/src/renderer/settings-modal-helpers.ts

@@ -77,7 +77,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   wrfc: 'Work-review-fix-cycle thresholds, retry limits, and automatic commit behavior.',
   helper: 'Helper model defaults used by helper subsystems when they do not use the main chat route.',
   tts: 'Text-to-speech provider, voice, and optional spoken-turn LLM overrides.',
-  voice: 'Free, offline local voice engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro. All empty by default — configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error). Once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension.',
+  voice: 'Two independent voice capabilities. Local engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro — all empty by default, configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error); once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension. Wake-word detection (voice.wake.*, rendered as its own unit below): listening continuously for a spoken wake phrase and handing the utterance that follows to speech-to-text — off by default, because holding a microphone open is meant to be an explicit act. Its published recall figures are measured on synthesised speech only, so no human recording of the phrase is behind them.',
   service: 'Background service posture: enabled state, autostart, restart behavior, service name, platform, and logs.',
   daemon: 'Local session daemon. It hosts the shared session broker and companion chat so a session started here is visible and steerable from other surfaces. On by default, bound to loopback (127.0.0.1) only.',
   controlPlane: 'Daemon control-plane settings for local admin/API access.',
@@ -86,7 +86,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   batch: 'Batch execution settings, including local vs Cloudflare queue behavior.',
   automation: 'Scheduled and automated run settings, concurrency, timeout, catch-up, cooldown, and retention behavior.',
   checkin: 'Proactive check-in: on a cadence, a briefing is judged and you are contacted only when something warrants it. Off by default; every run — scheduled or manual — leaves a receipt (see /checkin) recording whether it stayed quiet, delivered a message, or was skipped.',
-  watchers: 'File/process watcher heartbeat, polling, and recovery-window behavior.',
+  watchers: 'File/process watcher heartbeat, polling, and recovery-window behavior, plus the trigger family (watchers.triggers.*, rendered as its own unit): stream watchers that regex-filter and batch a long-lived command\'s output, model-free condition checks running a probe/extract/rule pipeline with no LLM in the loop, and one-shot on-exit triggers that fire exactly one payload when a launched command terminates. The trigger family is off by default — a trigger supervises real processes with nobody watching — and its rows tune the backoff ladder, the strike breaker, retention bounds, batching, and process caps.',
   runtime: 'Runtime guardrails such as companion chat limiter and event bus listener caps.',
   telemetry: 'Telemetry payload policy.',
   cache: 'Provider and model cache behavior, TTL, and hit-rate monitoring.',
@@ -94,6 +94,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   mcp: 'MCP server trust and scope review. Trust changes can expose local files, tools, databases, browsers, or remote automation depending on the server.',
   sandbox: 'Isolation strategy for REPL, MCP, Windows, and QEMU-backed execution. Use these settings to separate risky tools from the host shell.',
   surfaces: 'External app surfaces such as Slack, Discord, ntfy, Home Assistant, Telegram, webhooks, chat bridges, and messaging providers.',
+  device: 'Posture for using a PAIRED phone as a tool — its cameras, its screen, its location, its clipboard, and a small set of device effects. Two rows change behaviour today. device.capabilities.mode is the live switch: off stops every capability request reaching any paired device, ask-every-time asks on every single request and never consults a durable grant, and honor-grants (stock) asks the first time and every time after unless you chose "always allow" for that one capability on that one phone. device.nodes.maxPaired is enforced at the moment a device pairs: at the cap a NEW device is refused with a message naming the setting, the cap and how many are already paired, while a phone that is already in the list simply supersedes its own record and keeps working. Lowering the cap below the number already paired unpairs no one — existing devices keep working and only the next new pairing is refused; a device moving off the legacy shared token to its own is exempt so it cannot be stranded; and a nonsensical cap (zero, negative, not a number) is read as no cap at all, because a broken setting must never lock you out of your own daemon. The cap is re-read at every pairing, so a change applies without a restart. The remaining rows state the posture the capability service is built to honour — which capabilities may be granted durably, how long a phone has to answer, how exact a location it reports, whether the clipboard can be read, how long captures and grants live, and how often housekeeping sweeps. They are recorded and read back exactly as you set them, but no surface in THIS build maps them into a running capability session — the capability service currently runs on its own matching defaults. Your values are kept and take effect in the release that wires the session up.',
   conversationGate: 'What a message arriving from one of those channels does. By default it gets a conversational answer, and work is proposed and waits for your agreement rather than starting on its own; you can instead confirm every run, or restore the old behavior where a message starts work immediately. Also how long a pending proposal stays answerable and how many can wait at once. This governs messages from channels only — what you type here always runs, and schedules and triggers were authorized when created.',
   cloudflare: 'Optional Cloudflare control plane, batch queue, Worker, Tunnel, Access, DNS, KV, Durable Objects, Secrets Store, and R2 settings.',
   release: 'Release-channel preference.',
@@ -145,6 +146,7 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   mcp: 'MCP',
   sandbox: 'Sandbox',
   surfaces: 'Surfaces',
+  device: 'Paired Devices',
   conversationGate: 'Channel Message Handling',
   cloudflare: 'Cloudflare',
   release: 'Release',
@@ -200,7 +202,7 @@ const SETTING_LABELS: Partial<Record<string, string>> = {
   'controlPlane.hostMode': 'CP Host Mode',
   'controlPlane.host': 'CP Host',
   'controlPlane.port': 'CP Port',
-  'controlPlane.baseUrl': 'CP Base URL',
+  'controlPlane.publicBaseUrl': 'CP Public Base URL',
   'controlPlane.streamMode': 'CP Stream Mode',
   'controlPlane.allowRemote': 'CP Allow Remote',
   'controlPlane.trustProxy': 'CP Trust Proxy',

package/src/renderer/settings-modal.ts

@@ -236,6 +236,14 @@ function buildFlagContext(entry: SettingEntry | null): string[] {
     `Feature: ${feature.id} (${feature.domain} domain)`,
     `Setting: ${feature.enablement.key} = ${formatValue(entry)}`,
     `State: ${displayState}`,
+    // A capability the registry declares not operable reads as disabled no
+    // matter what its settings key says. Without this line the row shows a
+    // value of true beside a state of disabled and explains nothing — the
+    // written reason exists in the registry, so render it where the user meets
+    // the contradiction rather than leaving it to be discovered.
+    ...(feature.operable === false && feature.inoperableDetail
+      ? [`Not available in this build: ${feature.inoperableDetail}`]
+      : []),
     `Default: ${feature.defaultEnabled ? 'enabled' : 'disabled'}`,
     `Applies: ${feature.restartRequired ? 'on next launch (startup-gated)' : 'immediately'}`,
     ...(pendingRestart

package/src/renderer/tool-call.ts

@@ -6,10 +6,20 @@ import { stripDangerousAnsi } from './ansi-sanitize.ts';
 import { formatElapsed } from '../utils/format-elapsed.ts';
 import { GLYPHS } from './ui-primitives.ts';
 import { activeUiTones } from './theme.ts';
+import { treeBranchCol, treeContentCol, writeTreeStatusGutter } from './conversation-tree.ts';
 
 const TOOL_NAME_MIN_WIDTH = 8;
 const TOOL_NAME_MAX_WIDTH = 20;
 
+/** Tree placement for a tool-call row rendered as a branch of its turn. */
+export interface ToolCallTreeOptions {
+  /** Effective indent in columns, already clamped by treeIndentCols(). */
+  readonly indentCols?: number;
+  readonly branchFg?: string;
+  /** Suppress the tool label because the turn header already carries it. */
+  readonly omitToolName?: boolean;
+}
+
 function writeStyledText(
   line: Line,
   startCol: number,
@@ -44,9 +54,18 @@ function buildLeftSegments(
   keyArg: string,
   suffixText: string,
   leftBudget: number,
+  omitToolName = false,
 ): Array<{ text: string; fg: string; bold?: boolean; dim?: boolean }> {
   if (leftBudget <= 0) return [];
 
+  // When every call in the turn shares one label, the label rides on the turn
+  // header and each row leads with the argument that actually distinguishes it
+  // (`config.get`, `services.restart`). Falls back to showing the name when
+  // there is no key argument, so a row can never render empty.
+  if (omitToolName && keyArg) {
+    return buildLeftSegments(keyArg, '', suffixText, leftBudget, false);
+  }
+
   const t = activeUiTones();
   const segments: Array<{ text: string; fg: string; bold?: boolean; dim?: boolean }> = [];
   const suffixBudget = suffixText ? Math.min(Math.max(12, Math.floor(leftBudget * 0.3)), 20) : 0;
@@ -164,13 +183,19 @@ export function renderToolCallBlock(
   errorMsg?: string,
   frameIndex?: number,
   startedAtMs?: number,
+  tree?: ToolCallTreeOptions,
 ): Line[] {
   const line = createEmptyLine(width);
   const t = activeUiTones();
-  const margin = LAYOUT.LEFT_MARGIN;
+  const indent = Math.max(0, tree?.indentCols ?? 0);
+  // In tree mode the status icon moves to the branch's content column, so the
+  // ✓ lines up with the content of every other row at the same depth and the
+  // branch glyph sits where the parent's content began.
+  const margin = indent > 0 ? treeContentCol(indent) : LAYOUT.LEFT_MARGIN;
   const rightMargin = LAYOUT.RIGHT_MARGIN;
   const contentEnd = width - rightMargin;
 
+
   // Status icon. 'pending' means the tool is still awaiting a decision
   // (e.g. an approval prompt) and has NOT run yet — it uses the hollow idle
   // glyph so a not-yet-run tool never shows the completed green ✓ (2c).
@@ -207,10 +232,18 @@ export function renderToolCallBlock(
     : contentEnd;
   let col: number = leftStart;
 
-  if (col < leftEndExclusive) {
-    line[col] = createStyledCell(icon, { fg: iconColor, bold: status === 'done' || status === 'error' || status === 'cancelled' });
+  // In tree mode the status glyph goes in the fixed left gutter (column 0),
+  // before the indent, so every marker in the transcript aligns in one column
+  // no matter how deep its row sits. The row's own content then starts at the
+  // branch's content column with no inline icon slot.
+  if (indent > 0) {
+    writeTreeStatusGutter(line, icon, iconColor, width);
+  } else {
+    if (col < leftEndExclusive) {
+      line[col] = createStyledCell(icon, { fg: iconColor, bold: status === 'done' || status === 'error' || status === 'cancelled' });
+    }
+    col += 2; // icon + space
   }
-  col += 2; // icon + space
 
   // Tool name — extract short name for long MCP tool names, but keep a readable dynamic width.
   const rawName = toolCall.name.includes('__')
@@ -225,7 +258,7 @@ export function renderToolCallBlock(
         ? `(${stripDangerousAnsi(resultSummary)})`
         : '';
   const leftBudget = Math.max(0, leftEndExclusive - col);
-  const leftSegments = buildLeftSegments(rawName, keyArg, suffixText, leftBudget);
+  const leftSegments = buildLeftSegments(rawName, keyArg, suffixText, leftBudget, tree?.omitToolName ?? false);
   for (const segment of leftSegments) {
     col = writeStyledText(line, col, leftEndExclusive, segment.text, {
       fg: segment.fg,

package/src/runtime/cloudflare-control-plane.ts

@@ -282,7 +282,10 @@ function hostForUrl(host: string): string {
 }
 
 export function resolveCloudflareDaemonBaseUrl(configManager: Pick<ConfigManager, 'get'>): string {
-  const configuredBaseUrl = String(configManager.get('controlPlane.baseUrl' as never) ?? '').trim();
+  // An explicitly DECLARED external address (tunnel / proxy) wins; otherwise the
+  // URL is built from the bind below. The old `controlPlane.baseUrl` this read
+  // was a stored mirror of the bind with no writers, so it drifted from it.
+  const configuredBaseUrl = String(configManager.get('controlPlane.publicBaseUrl' as never) ?? '').trim();
   if (configuredBaseUrl) return configuredBaseUrl.replace(/\/+$/, '');
   const host = hostForUrl(connectHostForBindHost(String(configManager.get('controlPlane.host' as never) ?? '127.0.0.1')));
   const portValue = Number(configManager.get('controlPlane.port' as never) ?? 3421);

package/src/runtime/feature-settings.ts

@@ -73,6 +73,13 @@ export function featuresForEnablementKey(key: string): readonly FeatureSetting[]
  */
 export function isFeatureValueEnabled(feature: FeatureSetting, value: unknown): boolean {
   const { key, kind, enabledValues } = feature.enablement;
+  // A capability declared not operable in this build never reads as on, whatever
+  // its settings key says. deriveFeatureState already enforces this for the
+  // boolean and enum kinds; stating it once here covers the constant kind too,
+  // so no surface can show "on" for something that is doing nothing. The user's
+  // value is untouched — it is kept for the release that wires the capability up
+  // — and `feature.inoperableDetail` is the written reason a surface renders.
+  if (feature.operable === false) return false;
   if (kind === 'constant') {
     const schema = getConfigSchemaSetting(key);
     if (schema?.type === 'boolean') return value === true;

package/src/runtime/index.ts

@@ -230,6 +230,18 @@ export const isPluginTerminal = operations.isPluginTerminal;
 export const resolveCapabilityManifest = operations.resolveCapabilityManifest;
 export const validateManifestV2 = operations.validateManifestV2;
 export const validatePluginSignature = operations.validatePluginSignature;
+// Instance-type companions for the operations class aliases (see note above the
+// security block): the `export const` form re-exports the value only.
+export type AcpTaskAdapter = InstanceType<typeof operations.AcpTaskAdapter>;
+export type OpsIllegalActionError = InstanceType<typeof operations.OpsIllegalActionError>;
+export type OpsTargetNotFoundError = InstanceType<typeof operations.OpsTargetNotFoundError>;
+export type ToolContractVerifier = InstanceType<typeof operations.ToolContractVerifier>;
+export type McpLifecycleManager = InstanceType<typeof operations.McpLifecycleManager>;
+export type McpPermissionManager = InstanceType<typeof operations.McpPermissionManager>;
+export type McpSchemaFreshnessTracker = InstanceType<typeof operations.McpSchemaFreshnessTracker>;
+export type PluginLifecycleManager = InstanceType<typeof operations.PluginLifecycleManager>;
+export type PluginQuarantineEngine = InstanceType<typeof operations.PluginQuarantineEngine>;
+export type PluginTrustStore = InstanceType<typeof operations.PluginTrustStore>;
 export const LOW_QUALITY_THRESHOLD = operations.LOW_QUALITY_THRESHOLD;
 export const computeQualityScore = operations.computeQualityScore;
 export const createCompactionManager = operations.createCompactionManager;
@@ -487,6 +499,15 @@ export const verifyBundle = security.verifyBundle;
 export const MAX_INPUT_LENGTH = security.MAX_INPUT_LENGTH;
 export const MAX_TOKEN_COUNT = security.MAX_TOKEN_COUNT;
 
+// Instance-type companions for the class aliases above. `export const X = ns.X`
+// re-exports only the value, so `X` is unusable in type position (TS2749/TS2694).
+// These declaration-merge the instance type back onto the same name.
+export type DivergenceDashboard = InstanceType<typeof security.DivergenceDashboard>;
+export type DivergenceGateError = InstanceType<typeof security.DivergenceGateError>;
+export type LayeredPolicyEvaluator = InstanceType<typeof security.LayeredPolicyEvaluator>;
+export type PermissionSimulator = InstanceType<typeof security.PermissionSimulator>;
+export type PolicySignatureError = InstanceType<typeof security.PolicySignatureError>;
+
 export type AuthInspectionSnapshot = Security.AuthInspectionSnapshot;
 export type ProviderAuthInspection = Security.ProviderAuthInspection;
 export type DivergenceDashboardSnapshot = Security.DivergenceDashboardSnapshot;
@@ -513,7 +534,7 @@ export type BundleProvenance = Security.BundleProvenance;
 export type DecisionReason = Security.DecisionReason;
 export type DivergenceReport = Security.DivergenceReport;
 export type EnforceGateResult = Security.EnforceGateResult;
-export type SignedPolicyBundle = Security.SignedPolicyBundle;
+export type SignedPolicyBundle<T = unknown> = Security.SignedPolicyBundle<T>;
 
 export interface InspectableDomain {
   readonly name: string;

package/src/runtime/legacy-daemon-migration.ts

@@ -49,6 +49,7 @@ import { fileURLToPath } from 'node:url';
 import { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { PlatformServiceManager, type ManagedServiceStatus } from '@pellux/goodvibes-sdk/platform/daemon';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { runDaemonConfigMigration } from '../config/run-daemon-config-migration.ts';
 
 /** Structurally derived from `PlatformServiceManager`'s own constructor — the
  * SDK's public `platform/daemon` entry point only re-exports the class and
@@ -113,6 +114,7 @@ export interface BuildManagedDaemonServiceManagerParams {
  */
 export function buildManagedDaemonServiceManager(params: BuildManagedDaemonServiceManagerParams): PlatformServiceManager {
   const workingDirectory = params.workingDirectory ?? params.homeDir;
+  if (!params.configManager) runDaemonConfigMigration(params.homeDir);
   const configManager = params.configManager ?? new ConfigManager({
     workingDir: workingDirectory,
     homeDir: params.homeDir,

package/src/verification/verification-ledger.ts

@@ -79,6 +79,116 @@ export const FEATURE_KNOB_LOCAL_SETTINGS = [
   'runtime.toolBudget.maxCostUsd',
 ] as const;
 
+/**
+ * Config keys added by the paired-device and trigger-family domains in SDK
+ * 1.14.0. Like FEATURE_KNOB_LOCAL_SETTINGS above, these arrived as new
+ * CONFIG_SCHEMA entries that raised the settings inventory `total` with no
+ * matching behavior coverage, dropping `localBehaviorPercent` below its floor.
+ *
+ * THIS CONSTANT IS NOT A DIAL. Each key below is counted because a test that
+ * exercises it was actually written:
+ * `src/test/verification/device-and-trigger-settings-persistence.test.ts` runs,
+ * for every key in this list, the same four-part persistence contract the
+ * feature-knob keys are counted for — schema default exposure, `set()` through
+ * the key's own validator to disk, reload into a fresh ConfigManager with
+ * read-back equality, and reset-to-default that also survives reload. That test
+ * additionally asserts this list is exactly the non-enablement key set of both
+ * domains and overlaps neither of the other counted sets, so nothing here is
+ * double-counted and nothing drifts in uncounted.
+ *
+ * PER-KEY EVIDENCE — what is verified, and how live the key is TODAY.
+ * "persistence" below means the four-part contract above; the second column
+ * records whether anything in this tree (TUI or the pinned SDK) reads the key,
+ * audited by tracing each key to its consumers.
+ *
+ *   watchers.triggers.backoffLadderMs        persistence · live (trigger supervisor retry ladder)
+ *   watchers.triggers.breakerStrikes         persistence · live (strike breaker)
+ *   watchers.triggers.defaultCheckIntervalMs persistence · live (condition-check scheduler)
+ *   watchers.triggers.probeTimeoutMs         persistence · live (probe execution)
+ *   watchers.triggers.maxConcurrentChecks    persistence · live (check concurrency cap)
+ *   watchers.triggers.observationRingSize    persistence · live (observation ring)
+ *   watchers.triggers.runHistoryLimit        persistence · live (run history retention)
+ *   watchers.triggers.runHistoryTtlHours     persistence · live (run history sweep)
+ *   watchers.triggers.eventLogLimit          persistence · live (event log retention)
+ *   watchers.triggers.eventLogTtlHours       persistence · live (event log sweep)
+ *   watchers.triggers.sweepIntervalMs        persistence · live (housekeeping cadence)
+ *   watchers.triggers.supervisionTickMs      persistence · live (supervision loop tick)
+ *   watchers.triggers.streamQueueLimit       persistence · live (stream watcher queue)
+ *   watchers.triggers.streamBatchLines       persistence · live (stream batching)
+ *   watchers.triggers.streamBatchIntervalMs  persistence · live (stream batching)
+ *   watchers.triggers.onExitMaxDurationMs    persistence · live (on-exit trigger duration cap)
+ *   watchers.triggers.onExitStdin            persistence · live (on-exit stdin posture)
+ *   watchers.triggers.outputTailBytes        persistence · live (captured output tail)
+ *   device.capabilities.allowAlwaysOffer     persistence · settings surface only in this build
+ *   device.capabilities.requestTimeoutSeconds persistence · settings surface only in this build
+ *   device.location.precision                persistence · settings surface only in this build
+ *   device.clipboard.readMode                persistence · settings surface only in this build
+ *   device.capture.retentionHours            persistence · settings surface only in this build
+ *   device.capture.maxArtifacts              persistence · settings surface only in this build
+ *   device.capture.sweepIntervalMinutes      persistence · settings surface only in this build
+ *   device.grants.expiryDays                 persistence · settings surface only in this build
+ *   device.grants.maxPerNode                 persistence · settings surface only in this build
+ *   device.grants.auditRetentionDays         persistence · settings surface only in this build
+ *   device.nodes.maxPaired                   persistence · live (enforced at the pairing path)
+ *
+ * On `device.nodes.maxPaired`: the SDK enforces it where a device pairs —
+ * PairingTokenManager.mint refuses a NEW node at the cap with
+ * PairingLimitReachedError (code DEVICE_NODES_MAX_PAIRED, carrying the setting
+ * name, the cap and the live count), mapped to HTTP 409 by the pairing and
+ * pairing-handoff routes. An already-paired node supersedes its own record
+ * instead of being refused, migration mints off the legacy shared token are
+ * deliberately exempt, lowering the cap unpairs nobody, and a non-positive or
+ * non-finite value reads as no cap so a broken setting cannot lock the owner
+ * out. The cap is read per mint, so a change applies without a restart. What is
+ * counted HERE is still only the persistence contract this repo's test
+ * exercises — the enforcement itself is SDK-side and SDK-tested, and is recorded
+ * in this column so the "how live is it" audit stays accurate, not to claim
+ * coverage this repo did not write.
+ *
+ * On the other ten `device.*` rows: DeviceCapabilityService carries its own
+ * policy struct whose defaults match those keys one for one, and names them in
+ * its field comments and refusal messages, but no code path in either tree maps
+ * configuration into that struct. Persistence is therefore the whole of what is
+ * verified for them, and the settings-workspace description for the `device`
+ * category says exactly that to the user rather than implying live knobs.
+ *
+ * DELIBERATELY NOT COUNTED: the 24 non-enablement `voice.wake.*` keys from the
+ * same release. `wake-word-detection` is declared `notOperable` — no surface
+ * captures audio — so its rows stay in `total` and out of the numerator. That is
+ * the honest reading, and it is why this list raises coverage by 29 and not 53.
+ */
+export const DEVICE_AND_TRIGGER_LOCAL_SETTINGS = [
+  'watchers.triggers.backoffLadderMs',
+  'watchers.triggers.breakerStrikes',
+  'watchers.triggers.defaultCheckIntervalMs',
+  'watchers.triggers.probeTimeoutMs',
+  'watchers.triggers.maxConcurrentChecks',
+  'watchers.triggers.observationRingSize',
+  'watchers.triggers.runHistoryLimit',
+  'watchers.triggers.runHistoryTtlHours',
+  'watchers.triggers.eventLogLimit',
+  'watchers.triggers.eventLogTtlHours',
+  'watchers.triggers.sweepIntervalMs',
+  'watchers.triggers.supervisionTickMs',
+  'watchers.triggers.streamQueueLimit',
+  'watchers.triggers.streamBatchLines',
+  'watchers.triggers.streamBatchIntervalMs',
+  'watchers.triggers.onExitMaxDurationMs',
+  'watchers.triggers.onExitStdin',
+  'watchers.triggers.outputTailBytes',
+  'device.capabilities.allowAlwaysOffer',
+  'device.capabilities.requestTimeoutSeconds',
+  'device.location.precision',
+  'device.clipboard.readMode',
+  'device.capture.retentionHours',
+  'device.capture.maxArtifacts',
+  'device.capture.sweepIntervalMinutes',
+  'device.grants.expiryDays',
+  'device.grants.maxPerNode',
+  'device.grants.auditRetentionDays',
+  'device.nodes.maxPaired',
+] as const;
+
 /**
  * Every feature's enablement settings key whose on/off writes round-trip
  * through a REAL on-disk ConfigManager in
@@ -95,8 +205,11 @@ const ENABLEMENT_KEYS_BEHAVIOR_VERIFIED = new Set(
     .filter((key) => !(FEATURE_KNOB_LOCAL_SETTINGS as readonly string[]).includes(key)),
 ).size;
 
-/** Settings with real local behavior verification: the authored baseline plus the persistence-tested feature-knob and enablement keys. */
-const SETTINGS_BEHAVIOR_VERIFIED = SETTINGS_BEHAVIOR_BASELINE + FEATURE_KNOB_LOCAL_SETTINGS.length + ENABLEMENT_KEYS_BEHAVIOR_VERIFIED;
+/** Settings with real local behavior verification: the authored baseline plus the persistence-tested feature-knob, device/trigger, and enablement keys. */
+const SETTINGS_BEHAVIOR_VERIFIED = SETTINGS_BEHAVIOR_BASELINE
+  + FEATURE_KNOB_LOCAL_SETTINGS.length
+  + DEVICE_AND_TRIGGER_LOCAL_SETTINGS.length
+  + ENABLEMENT_KEYS_BEHAVIOR_VERIFIED;
 
 const EXTERNAL_SLASH_COMMANDS = new Set([
   'auth',

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.21.1';
+let _version = '1.22.0';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file