@pellux/goodvibes-tui 1.24.1 → 1.25.0

package/src/input/settings-modal.ts

@@ -28,6 +28,9 @@ import {
 } from './settings-modal-secrets.ts';
 import type { FeatureFlagManager } from '@/runtime/index.ts';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
+import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { ConnectionStatus } from './commands/connection-status.ts';
+import { initialConnectionEntries, refreshConnectionEntries } from './settings-modal-connections.ts';
 import { isWorktreeSetupListConfigKey, parseWorktreeSetupListInput } from './worktree-setup-config.ts';
 import { isSandboxExecListConfigKey, parseSandboxExecListInput } from './sandbox-exec-config.ts';
 import { isExecEnvScrubAllowlistConfigKey, parseExecEnvScrubAllowlistInput } from './exec-env-scrub-config.ts';
@@ -86,6 +89,10 @@ export type SettingsModalChangeHandler = (change: SettingsModalChange) => Settin
 
 export interface SettingsModalOpenOptions {
   readonly onSettingApplied?: SettingsModalChangeHandler;
+  /** In-process catalog the Connections category probes; see that module. */
+  readonly gatewayMethods?: GatewayMethodCatalog;
+  /** Called when an async connection refresh has new rows to paint. */
+  readonly requestRender?: () => void;
 }
 
 export {
@@ -154,6 +161,11 @@ export class SettingsModal {
   public mcpEntries: McpEntry[] = [];
   /** Provider subscription entries (populated when subscriptions tab is active). */
   public subscriptionEntries: SubscriptionEntry[] = [];
+  /** Connections-tab state; all of it driven by settings-modal-connections.ts. */
+  public connectionEntries: ConnectionStatus[] = initialConnectionEntries();
+  public gatewayMethods: GatewayMethodCatalog | null = null;
+  public requestRender: (() => void) | null = null;
+  public connectionsRefreshing = false;
 
   /**
    * Whether the user has entered search mode (pressed / or a printable key
@@ -217,6 +229,9 @@ export class SettingsModal {
     this.groups = buildSettingGroups(configManager, featureFlagManager);
     this.mcpEntries = buildMcpEntries(this.mcpRegistry);
     this.subscriptionEntries = buildSubscriptionEntries(subscriptionManager, serviceRegistry);
+    this.gatewayMethods = options?.gatewayMethods ?? null;
+    this.requestRender = options?.requestRender ?? null;
+    this.connectionEntries = initialConnectionEntries();
     this.categoryIndex = 0;
     this.selectedIndex = 0;
     this.focusPane = 'categories';
@@ -256,6 +271,11 @@ export class SettingsModal {
     this.searchResults = [];
     this.searchFocused = false;
     this.contextScroll = 0;
+    // A probe still in flight checks `active` before writing, so a reopen
+    // starts from `checking` rather than from a finished session's answer.
+    this.gatewayMethods = null;
+    this.requestRender = null;
+    this.connectionEntries = initialConnectionEntries();
     this.serviceRegistry = null;
     this.secretsManager = null;
     this.onSettingApplied = null;
@@ -357,6 +377,8 @@ export class SettingsModal {
       } else if (this.currentCategory === 'subscriptions' && this.subscriptionEntries.length > 0) {
         this.selectedIndex = (this.selectedIndex - 1 + this.subscriptionEntries.length) % this.subscriptionEntries.length;
         this.subscriptionLogoutConfirmationTarget = null;
+      } else if (this.currentCategory === 'connections' && this.connectionEntries.length > 0) {
+        this.selectedIndex = (this.selectedIndex - 1 + this.connectionEntries.length) % this.connectionEntries.length;
       }
       return;
     }
@@ -380,6 +402,8 @@ export class SettingsModal {
       } else if (this.currentCategory === 'subscriptions' && this.subscriptionEntries.length > 0) {
         this.selectedIndex = (this.selectedIndex + 1) % this.subscriptionEntries.length;
         this.subscriptionLogoutConfirmationTarget = null;
+      } else if (this.currentCategory === 'connections' && this.connectionEntries.length > 0) {
+        this.selectedIndex = (this.selectedIndex + 1) % this.connectionEntries.length;
       }
       return;
     }
@@ -702,6 +726,8 @@ export class SettingsModal {
       this.mcpEntries = buildMcpEntries(this.mcpRegistry);
     } else if (this.currentCategory === 'subscriptions') {
       this.subscriptionEntries = buildSubscriptionEntries(this.subscriptionManager, this.serviceRegistry);
+    } else if (this.currentCategory === 'connections') {
+      void refreshConnectionEntries(this);
     }
   }
 
@@ -714,6 +740,7 @@ export class SettingsModal {
     if (
       this.currentCategory === 'mcp'
       || this.currentCategory === 'subscriptions'
+      || this.currentCategory === 'connections'
     ) return [];
     const items = this.groups.get(this.currentCategory) ?? [];
     if (this.currentCategory === 'network') {

package/src/main.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { homedir } from 'node:os';
+import { resolveGoodVibesDaemonHome, resolveGoodVibesHome } from './config/goodvibes-home.ts';
 import { Compositor } from './renderer/compositor.ts';
 import { type Line } from './types/grid.ts';
 import { UIFactory } from './renderer/ui-factory.ts';
@@ -87,9 +87,12 @@ import { VERSION } from './version.ts';
 async function main() {
   const stdout = process.stdout;
   const stdin = process.stdin;
+  // Both roots come from the one resolver the daemon CLI also uses. This line
+  // called homedir() unconditionally, so a harness that redirected the tree got
+  // a client that wrote the real one — secret store included.
   const { cli, configManager, bootstrapWorkingDir, bootstrapHomeDirectory } = await prepareShellCliRuntime(process.argv.slice(2), {
     defaultWorkingDirectory: process.env['GOODVIBES_WORKING_DIR'] ?? process.cwd(),
-    homeDirectory: homedir(),
+    homeDirectory: resolveGoodVibesHome(),
   }, 'goodvibes');
 
   // Between binary start and the first frame, boot used to be silent (config
@@ -106,6 +109,8 @@ async function main() {
     configManager,
     workingDir: bootstrapWorkingDir,
     homeDirectory: bootstrapHomeDirectory,
+    // Named, so GOODVIBES_DAEMON_HOME on its own moves the client's daemon tier.
+    daemonHomeDirectory: resolveGoodVibesDaemonHome(bootstrapHomeDirectory),
   });
   const {
     conversation,

package/src/renderer/settings-modal-connections.ts

@@ -0,0 +1,63 @@
+/**
+ * settings-modal-connections.ts — rendering for the Connections category of the
+ * settings workspace.
+ *
+ * Split out of settings-modal.ts for the 800-line file cap, the same reason
+ * settings-modal-helpers.ts exists. Pure rendering: every value shown here was
+ * decided by the daemon probe in input/commands/connection-status.ts.
+ */
+
+import type { SettingsModal } from '../input/settings-modal.ts';
+import { selectedConnectionEntry } from '../input/settings-modal-connections.ts';
+import { connectionSurfaceLabel, type ConnectionStatus } from '../input/commands/connection-status.ts';
+import { GLYPHS } from './ui-primitives.ts';
+import { clamp, padDisplay, stableWindow } from './fullscreen-workspace.ts';
+
+/**
+ * The Connections rows: one line per surface, saying what it actually is.
+ *
+ * `checking` is rendered as its own state rather than blanked, because a row
+ * that showed nothing while the probe was in flight would read as "nothing
+ * configured" — the one thing this category exists to stop claiming falsely.
+ */
+export function renderConnectionRows(modal: SettingsModal, width: number, height: number): string[] {
+  const rows: string[] = [];
+  const items = modal.connectionEntries;
+  if (items.length === 0) return ['No connection surfaces are known to this build.'];
+  const selectedIndex = clamp(modal.selectedIndex, 0, items.length - 1);
+  const surfaceWidth = clamp(Math.floor(width * 0.16), 10, 20);
+  const stateWidth = 12;
+  const detailWidth = Math.max(16, width - surfaceWidth - stateWidth - 8);
+  rows.push(`  ${padDisplay('Surface', surfaceWidth)}  ${padDisplay('State', stateWidth)}  ${padDisplay('Detail', detailWidth)}`);
+  const window = stableWindow(items.length, selectedIndex, Math.max(1, height - 2));
+  if (window.start > 0) rows.push(`${GLYPHS.navigation.moreAbove} ${window.start} more connection(s) above`);
+  for (let index = window.start; index < window.end; index += 1) {
+    const entry = items[index]!;
+    const selected = index === selectedIndex;
+    const marker = selected ? (modal.focusPane === 'settings' ? GLYPHS.navigation.selected : '\u2022') : ' ';
+    rows.push(`${marker} ${padDisplay(connectionSurfaceLabel(entry.surface), surfaceWidth)}  ${padDisplay(entry.state, stateWidth)}  ${padDisplay(entry.detail, detailWidth)}`);
+  }
+  if (window.end < items.length) rows.push(`${GLYPHS.navigation.moreBelow} ${items.length - window.end} more connection(s) below`);
+  return rows.slice(0, height);
+}
+
+/**
+ * The detail pane for one connection: the state, what it means, and every next
+ * step verbatim. The next steps are the daemon's requirements, so they are
+ * listed in full rather than summarized — a truncated instruction is a wrong
+ * instruction.
+ */
+export function buildConnectionContext(modal: SettingsModal): string[] {
+  const entry = selectedConnectionEntry(modal);
+  if (!entry) return ['Connections', 'No connection surface is selected.'];
+  return [
+    connectionSurfaceLabel(entry.surface),
+    `State: ${entry.state}`,
+    entry.detail,
+    ...(entry.nextActions.length > 0 ? ['', 'Next steps:', ...entry.nextActions] : []),
+    '',
+    entry.surface === 'mail'
+      ? 'Use it from the transcript with /mail (status, list, read, draft, send).'
+      : 'Use it from the transcript with /calendar (status, list, get, create).',
+  ];
+}

package/src/renderer/settings-modal-helpers.ts

@@ -107,6 +107,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   agents: 'Sub-agent context-window awareness and per-turn passive knowledge/code injection: token budget, relevance floor, code-chunk limit, and the compaction threshold. Gated by the agent context/injection features.',
   security: 'API token scope and rotation auditing: rotation cadence, warning lead time, and whether overdue/over-scoped tokens are blocked or only reported. Gated by the Token Scope and Rotation Audit feature.',
   integrations: 'Integration delivery reliability (Slack/Discord/webhook): retry counts, backoff bounds, dead-letter queue size, and SLO enforcement. Gated by the Integration Delivery SLO feature.',
+  connections: 'Whether mail and calendar are actually usable right now. Each row is answered by asking the daemon that owns the connection, not by reading config here, so a row says ready only when a real request succeeded.',
   policy: 'Policy-as-code bundle loading: where the startup policy bundle is loaded from and its file path. Gated by the Policy-as-Code feature.',
   notifications: 'Notification router burst-suppression tuning: burst window, threshold, and cooldown. Gated by the Adaptive Notification Suppression feature.',
   relay: 'Outbound zero-knowledge relay reachability, for reaching this daemon from outside the LAN without opening an inbound port. Off by default — relay.enabled is the switch. The relay operator sees only ciphertext and connection metadata — self-host your own relay for full control.',
@@ -161,6 +162,7 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   agents: 'Agents & Context',
   security: 'Token Security',
   integrations: 'Integration Delivery',
+  connections: 'Connections',
   policy: 'Policy-as-Code',
   notifications: 'Notifications',
 };

package/src/renderer/settings-modal.ts

@@ -11,6 +11,7 @@ import { SETTINGS_CATEGORIES, SETTINGS_CATEGORY_GROUPS } from '../input/settings
 import { FEATURE_SETTINGS_BY_ID, isFeatureValueEnabled } from '../runtime/feature-settings.ts';
 import { getDisplayWidth, wrapText } from '../utils/terminal-width.ts';
 import { CATEGORY_INFO, CATEGORY_LABELS, describeUiRouting, formatValue, getSettingLabel, inferSubscriptionRouteReason, valueColor } from './settings-modal-helpers.ts';
+import { buildConnectionContext, renderConnectionRows } from './settings-modal-connections.ts';
 import { isSecretConfigKey } from '../config/secret-config.ts';
 import { GLYPHS } from './ui-primitives.ts';
 import { formatHints, joinHints } from './hint-grammar.ts';
@@ -360,6 +361,8 @@ function buildContextLines(modal: SettingsModal, width: number): string[] {
     lines.push(...buildMcpContext(modal, modal.getSelectedMcp()));
   } else if (category === 'subscriptions') {
     lines.push(...buildSubscriptionContext(modal, modal.getSelectedSubscription()));
+  } else if (category === 'connections') {
+    lines.push(...buildConnectionContext(modal));
   } else {
     const selected = modal.getSelected();
     // A feature-unit header shows the feature's documentation (full
@@ -386,6 +389,7 @@ function buildContextLines(modal: SettingsModal, width: number): string[] {
 function categoryItemCount(modal: SettingsModal, category: SettingsCategory): number {
   if (category === 'mcp') return modal.mcpEntries.length;
   if (category === 'subscriptions') return modal.subscriptionEntries.length;
+  if (category === 'connections') return modal.connectionEntries.length;
   return modal.groups.get(category)?.length ?? 0;
 }
 
@@ -601,6 +605,7 @@ function renderControlRows(modal: SettingsModal, width: number, height: number):
   if (modal.searchFocused) return renderSearchRows(modal, width, height);
   if (modal.currentCategory === 'mcp') return renderMcpRows(modal, width, height);
   if (modal.currentCategory === 'subscriptions') return renderSubscriptionRows(modal, width, height);
+  if (modal.currentCategory === 'connections') return renderConnectionRows(modal, width, height);
   return renderSettingRows(modal, width, height);
 }
 

package/src/runtime/bootstrap-core.ts

@@ -248,7 +248,7 @@ export async function initializeBootstrapCore(
     runtimeBus,
     runtimeStore: store,
     getConversationTitle: () => getConversationTitle(),
-    workingDir, homeDirectory,
+    workingDir, homeDirectory, ...(options.daemonHomeDirectory === undefined ? {} : { daemonHomeDirectory: options.daemonHomeDirectory }),
     // Embedded topology: the in-process runtime IS the daemon and holds its own OS
     // inhibitor, so opt into the real host seam (fork default is non-spawning). See services.ts.
     powerSeam: createHostPowerSeam(),

package/src/runtime/context.ts

@@ -31,6 +31,15 @@ export interface BootstrapOptions {
   workingDir: string;
   /** App-owned home directory for this runtime instance. */
   homeDirectory: string;
+  /**
+   * The daemon's identity directory for this runtime instance.
+   *
+   * Named rather than derived so the client's daemon-TIER secret reads and
+   * writes follow a GOODVIBES_DAEMON_HOME set on its own. Absent, the secret
+   * store falls back to `<homeDirectory>/.goodvibes/daemon`, which is the same
+   * answer whenever that variable is unset.
+   */
+  daemonHomeDirectory?: string;
   /** Explicit app-owned config manager for this runtime instance. */
   configManager: import('@pellux/goodvibes-sdk/platform/config').ConfigManager;
   /**

package/src/runtime/credential-composition.ts

@@ -0,0 +1,54 @@
+/**
+ * credential-composition.ts
+ *
+ * The credential and identity seam: the secret store, the step-up ceremony
+ * service that verifies against it, and the per-device pairing tokens.
+ *
+ * These are grouped because they share one fact, and it is the fact this round
+ * had to fix: WHERE the daemon's own credentials live. `daemonHome` is threaded
+ * rather than defaulted, because without it a daemon told to run out of a temp
+ * tree moved its identity directory and nothing else — the credential store
+ * stayed in the real home, so an "isolated" test daemon held live credentials
+ * and long-polled a real account. A default here would silently restore that.
+ *
+ * Extracted from services.ts because that file sits at the 800-line
+ * architecture cap. Moving a coherent seam out is what the cap is for; trimming
+ * unrelated comments to buy headroom is the thing it exists to prevent.
+ */
+
+import { SecretsManager } from '../config/secrets.ts';
+import { StepUpService } from '@pellux/goodvibes-sdk/daemon';
+import { PairingTokenManager } from '@pellux/goodvibes-sdk/platform/pairing';
+
+interface CredentialCompositionInput {
+  readonly workingDirectory: string;
+  readonly homeDirectory: string;
+  /**
+   * The daemon's state root when the host was told one. Absent means "not
+   * overridden" and must stay absent rather than being defaulted — see above.
+   */
+  readonly daemonHomeDirectory?: string | undefined;
+  readonly configManager: ConstructorParameters<typeof SecretsManager>[0]['configManager'];
+  readonly pairingTokenPath: string;
+}
+
+export function composeCredentialServices(input: CredentialCompositionInput): {
+  readonly secretsManager: SecretsManager;
+  readonly stepUpService: StepUpService;
+  readonly pairingTokens: PairingTokenManager;
+} {
+  const secretsManager = new SecretsManager({
+    projectRoot: input.workingDirectory,
+    globalHome: input.homeDirectory,
+    // Threaded, not defaulted: else an isolated daemon reads the real store.
+    ...(input.daemonHomeDirectory === undefined ? {} : { daemonHome: input.daemonHomeDirectory }),
+    configManager: input.configManager,
+  });
+  return {
+    secretsManager,
+    // Shared between the ceremony gateway verbs and the relay gate's verifier,
+    // so both check a step-up against the same store.
+    stepUpService: new StepUpService({ secrets: secretsManager }),
+    pairingTokens: new PairingTokenManager(input.pairingTokenPath),
+  };
+}

package/src/runtime/daemon-handler-composition.ts

@@ -27,8 +27,6 @@ import { registerRouting } from '../daemon/handlers/routing/index.ts';
 import { registerInboxMethods } from '../daemon/handlers/inbox/index.ts';
 import { registerTriagedInbox } from '../daemon/handlers/triage/index.ts';
 import { registerDraftMethods } from '../daemon/handlers/drafts/index.ts';
-import { registerCalendar } from '../daemon/handlers/calendar/index.ts';
-import { registerEmailMethods } from '../daemon/handlers/email/index.ts';
 import { registerRemoteSurface } from '../daemon/handlers/remote/index.ts';
 import { inboxPollerGate } from './cluster-composition.ts';
 
@@ -73,8 +71,6 @@ export function createDaemonHandlerComposition(
           options.clusterCoordinator.register(inboxPollerGate(providerId, control)),
       })).unregister,
     registerDrafts: (ctx) => registerDraftMethods(ctx),
-    registerCalendar,
-    registerEmail: (ctx) => registerEmailMethods(ctx),
     registerRemote: (ctx) => registerRemoteSurface(ctx, { manager: options.distributedRuntime }),
   });
 }

package/src/runtime/mail-composition.ts

@@ -0,0 +1,65 @@
+/**
+ * mail-composition.ts
+ *
+ * The deps that let the platform register this daemon's `email.*` verbs.
+ *
+ * `calendar.*` and `email.*` are served by the platform now, not by handlers in
+ * this repository — those were deleted when the platform gained an
+ * implementation the daemon could call. What is left for a product to supply is
+ * the wiring, and it is not optional: without `homeDirectory` the calendar
+ * composition returns null, without these deps the mail one does, and either way
+ * the verbs stay cataloged-but-unhandled while every surface reports the daemon
+ * unreachable on a daemon that is working perfectly.
+ *
+ * Extracted from services.ts rather than living there, because that file sits at
+ * the 800-line architecture cap and a composition step is exactly the kind of
+ * thing the cap exists to push into a module of its own.
+ */
+
+import {
+  withSurfaceEmailConfig,
+  describeSurfaceEmailConfigProblem,
+  describeSenderClaimNeutrally,
+  type EmailServiceDeps,
+  type SurfaceEmailConfigProblem,
+} from '@pellux/goodvibes-sdk/platform/email';
+import { nodeEmailTransport } from '@pellux/goodvibes-sdk/platform/email/node';
+
+/** The narrow slices this composition needs; the real managers satisfy them. */
+interface MailCompositionInput {
+  readonly configManager: { get(key: never): unknown };
+  readonly secretsManager: { get(key: string): Promise<string | null> };
+}
+
+/**
+ * Build the mail deps and the not-configured describer that go to
+ * `registerGatewayVerbGroups`.
+ *
+ * The settings come from the daemon's own `surfaces.email.*` keys through
+ * `withSurfaceEmailConfig`, so the keys an operator has already set — and that
+ * the settings modal now shows — keep working unchanged, and a not-configured
+ * answer names the keys THIS operator actually has rather than the ones the
+ * service validates internally.
+ */
+export function composeMailDeps(input: MailCompositionInput): {
+  readonly emailServiceDeps: EmailServiceDeps;
+  readonly describeEmailConfigProblem: () => Promise<SurfaceEmailConfigProblem | null>;
+} {
+  const getConfig = (key: string): unknown => input.configManager.get(key as never);
+  const emailServiceDeps = withSurfaceEmailConfig({
+    getConfig,
+    secretsManager: input.secretsManager,
+    transport: nodeEmailTransport,
+    // The daemon has no wording of its own for a sender line, so it takes the
+    // platform's rather than growing a second implementation of a rule that is
+    // security-relevant: a From: header is a claim, sender authentication
+    // raises display confidence only, and commandAuthority is the literal
+    // 'none'.
+    describeSenderClaim: describeSenderClaimNeutrally,
+  } as never);
+  return {
+    emailServiceDeps,
+    describeEmailConfigProblem: () =>
+      describeSurfaceEmailConfigProblem(getConfig, input.secretsManager),
+  };
+}

package/src/runtime/services.ts

@@ -11,6 +11,8 @@ import { StepUpService } from '@pellux/goodvibes-sdk/daemon';
 import { PairingTokenManager } from '@pellux/goodvibes-sdk/platform/pairing';
 import { resolvePairingWebOrigin } from '../core/pairing-origin.ts';
 import { attachWsOnlyGatewayVerbHandlers } from '@pellux/goodvibes-terminal-shell';
+import { composeMailDeps } from './mail-composition.ts';
+import { composeCredentialServices } from './credential-composition.ts';
 import { createDisposalScope, registerSurfaceRuntimePollers } from './disposal-wiring.ts';
 import { WatcherRegistry } from '@pellux/goodvibes-sdk/platform/watchers';
 import { ArtifactStore } from '@pellux/goodvibes-sdk/platform/artifacts';
@@ -85,6 +87,11 @@ export interface RuntimeServicesOptions {
   readonly getConversationTitle?: () => string | undefined;
   readonly workingDir: string;
   readonly homeDirectory: string;
+  /** Daemon state root (`--daemon-home`); absent ⇒ `<homeDirectory>/.goodvibes/daemon`.
+   * Threaded into SecretsManager so the override MOVES the credential store —
+   * without it an "isolated" daemon read the real home's secrets. One name for
+   * one thing; resolveGoodVibesHomeOwnership is the single reader. */
+  readonly daemonHomeDirectory?: string | undefined;
   /** Opt-in (daemon-side only): fold host-observed external coding-agent sessions
    * into the fleet as 'observed-external' rows. Interactive leaves it off and reads
    * the daemon snapshot. Mirrors the SDK's own createRuntimeServices option. */
@@ -292,14 +299,12 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     runtimeBus: options.runtimeBus,
     featureFlags,
   });
-  const secretsManager = new SecretsManager({
-    projectRoot: workingDirectory,
-    globalHome: homeDirectory,
-    configManager,
+  // The credential/identity seam (credential-composition.ts).
+  const { secretsManager, stepUpService, pairingTokens } = composeCredentialServices({
+    workingDirectory, homeDirectory, configManager,
+    daemonHomeDirectory: options.daemonHomeDirectory,
+    pairingTokenPath: shellPaths.resolveUserPath('control-plane', 'pairing-tokens.json'),
   });
-  // Step-up (WebAuthn) ceremony service, shared between the ceremony gateway verbs and the relay gate's verifier.
-  const stepUpService = new StepUpService({ secrets: secretsManager });
-  const pairingTokens = new PairingTokenManager(shellPaths.resolveUserPath('control-plane', 'pairing-tokens.json'));
   const subscriptionManager = new SubscriptionManager(shellPaths.resolveUserPath('tui', 'subscriptions.json'));
   const serviceRegistry = new ServiceRegistry(shellPaths.resolveProjectPath('tui', 'services.json'), {
     secretsManager,
@@ -603,25 +608,17 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   const { voiceSetup } = wireVoiceSetup({ configManager, shellPaths, voiceProviders, admitExpensiveWork });
 
   // Terminal-shell wrapper over the SDK registerGatewayVerbGroups (gateway-verbs.ts); checkin.*/fleet-needs-input/pairing.* register only when their deps are present. memoryGovernor lights up ops.memory.get; voiceSetup lights up voice.local.status/install.
-  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input), watcherRegistry, userPermissionRuleStore, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, sessionIntake: sessionBroker, workingDirectory, memoryRegistry, pairingTokens, sessionLiveTurnControls, powerManager, memoryGovernor, voiceSetup, relayAvailable: () => configManager.get('relay.enabled') === true, pairingWebOrigin: () => resolvePairingWebOrigin(configManager).origin, disposal: disposalScope.registry, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
+  // calendar.*/email.* are platform-served; these two let it register (mail-composition.ts).
+  const { emailServiceDeps, describeEmailConfigProblem } = composeMailDeps({ configManager, secretsManager });
+  attachWsOnlyGatewayVerbHandlers(gatewayMethods, { homeDirectory, emailServiceDeps, describeEmailConfigProblem, processRegistry, workspaceCheckpointManager, conversationRewindPort: createSessionConversationRewindPort(), sessionBroker, secretsManager, stepUpService, approvalBroker, requestApproval: (input) => approvalBroker.requestApproval(input), watcherRegistry, userPermissionRuleStore, shellPaths, configManager, runtimeStore: options.runtimeStore, channelDeliveryRouter, providerRegistry, automationManager, sessionLister: sessionBroker, sessionIntake: sessionBroker, workingDirectory, memoryRegistry, pairingTokens, sessionLiveTurnControls, powerManager, memoryGovernor, voiceSetup, relayAvailable: () => configManager.get('relay.enabled') === true, pairingWebOrigin: () => resolvePairingWebOrigin(configManager).origin, disposal: disposalScope.registry, ...wireFleetNeedsInputPush({ registry: processRegistry, runtimeBus: options.runtimeBus, sessionBroker }) });
+  // surface-scoped: continuity's recovery-file check must read the SAME paths
+  // the app writes with, not the unscoped legacy pair.
   const integrationHelpers = new IntegrationHelperService({
-    surface, // surface-scoped: continuity's recovery-file check must read the SAME paths the app writes with, not the unscoped legacy pair.
-    runtimeStore: options.runtimeStore,
-    runtimeBus: options.runtimeBus,
-    configManager,
+    surface, configManager, automationManager, approvalBroker, sessionBroker, distributedRuntime,
+    remoteRunnerRegistry, remoteSupervisor, panelManager, localUserAuthManager, providerRegistry,
+    serviceRegistry, subscriptionManager, secretsManager,
+    runtimeStore: options.runtimeStore, runtimeBus: options.runtimeBus,
     getConversationTitle: options.getConversationTitle,
-    automationManager,
-    approvalBroker,
-    sessionBroker,
-    distributedRuntime,
-    remoteRunnerRegistry,
-    remoteSupervisor,
-    panelManager,
-    localUserAuthManager,
-    providerRegistry,
-    serviceRegistry,
-    subscriptionManager,
-    secretsManager,
   });
   // A loopback fetch that isn't allow-listed asks once through the approval
   // broker; "allow for this project" persists and later fetches never ask. Built

package/src/shell/ui-openers.ts

@@ -394,6 +394,13 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
   commandContext.openSettingsModal = (target?: string) => {
     input.modalOpened('settings');
     input.settingsModal.open(configManager, featureFlags, subscriptionManager, serviceRegistry, mcpRegistry, secretsManager, {
+      // The Connections category asks the daemon handlers directly, through the
+      // same in-process catalog `/mail` and `/calendar` use, so the workspace
+      // reports the daemon's state rather than a local guess about it.
+      ...(commandContext.workspace?.gatewayMethods
+        ? { gatewayMethods: commandContext.workspace.gatewayMethods }
+        : {}),
+      requestRender: render,
       onSettingApplied: (change) => {
         // forced dark/light applies immediately (rebuild palettes + full
         // repaint); auto only re-probes at startup, so it takes effect next launch.

package/src/verification/verification-ledger.ts

@@ -48,6 +48,63 @@ const SETTINGS_BEHAVIOR_BASELINE = 184;
  * `src/test/verification/feature-knob-settings-persistence.test.ts`. They are
  * therefore genuinely behavior-verified locally and counted as such here.
  */
+/**
+ * The daemon's own mailbox and calendar keys (`surfaces.email.*`,
+ * `surfaces.calendar.*`), promoted into CONFIG_SCHEMA so the settings modal —
+ * which renders from that schema — can actually show them. Before, the
+ * daemon's handlers named these keys in their own error messages
+ * ("Set surfaces.calendar.caldavUrl and surfaces.calendar.caldavUser") while
+ * the UI that told an operator to set them could not display one of them.
+ *
+ * Declaring 25 keys raised the settings inventory `total` with no matching
+ * behavior coverage, which dropped `localBehaviorPercent` below its floor —
+ * the same arrival shape as the two lists above.
+ *
+ * THIS CONSTANT IS NOT A DIAL. Every key below is counted because
+ * `src/test/verification/daemon-mailbox-settings-persistence.test.ts` runs the
+ * same four-part persistence contract the other counted sets are counted for:
+ * schema default exposure, `set()` through the key's own validator to disk,
+ * reload into a fresh ConfigManager with read-back equality, and
+ * reset-to-default that also survives reload. That test also asserts this list
+ * is exactly the `surfaces.email.*` + `surfaces.calendar.*` schema key set and
+ * overlaps neither other counted set, so nothing is double-counted and nothing
+ * drifts in uncounted.
+ *
+ * PER-KEY EVIDENCE. All 25 are read by a LIVE consumer, which is why they were
+ * declared at all: the SDK's mail and calendar gateway compositions
+ * (platform/email/surface-config.ts and platform/calendar/caldav-gateway-config.ts)
+ * resolve every one of them when the daemon serves `email.*` and `calendar.*`.
+ * The three password keys additionally resolve through the daemon secret tier
+ * rather than from config, and carry no secret value in config themselves.
+ */
+export const DAEMON_MAILBOX_LOCAL_SETTINGS = [
+  'surfaces.email.host',
+  'surfaces.email.user',
+  'surfaces.email.username',
+  'surfaces.email.from',
+  'surfaces.email.password',
+  'surfaces.email.imapHost',
+  'surfaces.email.imapPort',
+  'surfaces.email.imapUser',
+  'surfaces.email.imapPassword',
+  'surfaces.email.imap.host',
+  'surfaces.email.imap.port',
+  'surfaces.email.imap.user',
+  'surfaces.email.imap.password',
+  'surfaces.email.imap.secure',
+  'surfaces.email.imap.mailbox',
+  'surfaces.email.imap.draftsMailbox',
+  'surfaces.email.smtp.host',
+  'surfaces.email.smtp.port',
+  'surfaces.email.smtp.password',
+  'surfaces.email.smtp.secure',
+  'surfaces.calendar.caldavUrl',
+  'surfaces.calendar.caldavUser',
+  'surfaces.calendar.caldavPassword',
+  'surfaces.calendar.defaultCalendarId',
+  'surfaces.calendar.calendars',
+] as const;
+
 export const FEATURE_KNOB_LOCAL_SETTINGS = [
   'provider.optimizerMode',
   'provider.optimizerPinnedModel',
@@ -247,6 +304,7 @@ const SETTINGS_BEHAVIOR_VERIFIED = SETTINGS_BEHAVIOR_BASELINE
   + FEATURE_KNOB_LOCAL_SETTINGS.length
   + DEVICE_AND_TRIGGER_LOCAL_SETTINGS.length
   + CLUSTER_GROUP_LOCAL_SETTINGS.length
+  + DAEMON_MAILBOX_LOCAL_SETTINGS.length
   + ENABLEMENT_KEYS_BEHAVIOR_VERIFIED;
 
 const EXTERNAL_SLASH_COMMANDS = new Set([

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.24.1';
+let _version = '1.25.0';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file