@pellux/goodvibes-tui 1.24.2 → 1.26.0

package/src/input/provider-key-intake.ts

@@ -12,6 +12,7 @@
  */
 
 import type { LLMProvider } from '@pellux/goodvibes-sdk/platform/providers';
+import type { SecretScope } from '../config/secrets.ts';
 import type { ConcealedInputRequest } from './concealed-input.ts';
 import type { CommandContext } from './command-registry.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
@@ -58,7 +59,7 @@ export interface ProviderKeyIntakeDeps {
   readonly provider: LLMProvider | undefined;
   /** Canonical secret store — the same path /secrets set writes through. */
   readonly secretsManager?: {
-    set(key: string, value: string, options?: { scope?: 'project' | 'user'; medium?: 'secure' | 'plaintext' }): Promise<void>;
+    set(key: string, value: string, options?: { scope?: SecretScope; medium?: 'secure' | 'plaintext' }): Promise<void>;
   } | undefined;
   /** Re-resolves credentials and re-registers providers live (no restart). */
   readonly refreshProviderCredentials?: (() => Promise<void>) | undefined;
@@ -112,7 +113,14 @@ export function runProviderKeyIntake(
       }
       void (async () => {
         try {
-          await secretsManager.set(secretKey, value, { scope: 'user', medium: 'secure' });
+          // Daemon scope, not user scope. The DAEMON is the process that runs
+          // the model — it answers Telegram, ntfy, mail and every scheduled
+          // run with this TUI closed. A model key filed in this surface's own
+          // tier is readable only while the TUI is open, so the daemon has no
+          // provider to call and cannot answer at all. Daemon tier is the one
+          // home every surface and the daemon read, so a key entered here works
+          // everywhere, which is the point of configuring it once.
+          await secretsManager.set(secretKey, value, { scope: 'daemon', medium: 'secure' });
           await deps.refreshProviderCredentials?.();
           deps.print(`Stored the API key for ${label} and registered it live (value hidden). No restart needed.`);
         } catch (error) {

package/src/input/settings-modal-commit.ts

@@ -0,0 +1,146 @@
+/**
+ * settings-modal-commit.ts — commitEdit(), extracted out of the SettingsModal
+ * class body so the class file can stay under the repo's architecture
+ * line-count gate without trimming arbitrary lines to clear the number.
+ *
+ * Same dependency-injection shape as settings-modal-activation.ts /
+ * settings-modal-adjustment.ts / settings-modal-reset.ts: explicit getters
+ * and setter callbacks instead of a bound `this`, so the logic is
+ * unit-testable without a live SettingsModal instance and the class method
+ * stays a thin delegator.
+ */
+
+import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
+import { isSecretConfigKey } from '../config/secret-config.ts';
+import { setSecretBackedSettingValue, type SettingsSecretsManager } from './settings-modal-secrets.ts';
+import { buildMcpEntries } from './settings-modal-data.ts';
+import { isWorktreeSetupListConfigKey, parseWorktreeSetupListInput } from './worktree-setup-config.ts';
+import { isSandboxExecListConfigKey, parseSandboxExecListInput } from './sandbox-exec-config.ts';
+import { isExecEnvScrubAllowlistConfigKey, parseExecEnvScrubAllowlistInput } from './exec-env-scrub-config.ts';
+import type { McpEntry, SettingEntry } from './settings-modal-types.ts';
+
+export interface CommitEditContext {
+  readonly editingMode: boolean;
+  readonly currentCategory: string;
+  readonly editBuffer: string;
+  readonly configManager: ConfigManager | null;
+  readonly secretsManager: SettingsSecretsManager | null;
+  readonly mcpRegistry: McpRegistry | null;
+  readonly mcpAllowAllConfirmationTarget: string | null;
+  getSelectedMcp(): McpEntry | null;
+  getSelected(): SettingEntry | null;
+  setValue(key: ConfigKey, value: unknown): void;
+  setEditingMode(value: boolean): void;
+  setEditBuffer(value: string): void;
+  setMcpEntries(entries: McpEntry[]): void;
+  setMcpAllowAllConfirmationTarget(value: string | null): void;
+}
+
+/**
+ * Commit the current editBuffer to the config. Returns true on success,
+ * false if validation failed (the caller always clears editingMode/editBuffer
+ * regardless — a failed commit never leaves stale edit state behind).
+ */
+export function commitEditValue(ctx: CommitEditContext): boolean {
+  if (!ctx.editingMode) return false;
+
+  if (ctx.currentCategory === 'mcp') {
+    const entry = ctx.getSelectedMcp();
+    if (!entry || !ctx.mcpRegistry) return false;
+    if (ctx.mcpAllowAllConfirmationTarget) {
+      const expected = `ALLOW ALL ${ctx.mcpAllowAllConfirmationTarget}`;
+      if (ctx.editBuffer.trim() !== expected) {
+        return false;
+      }
+      ctx.mcpRegistry.setServerTrustMode(entry.name, 'allow-all');
+      ctx.setMcpEntries(buildMcpEntries(ctx.mcpRegistry));
+      ctx.setEditingMode(false);
+      ctx.setEditBuffer('');
+      ctx.setMcpAllowAllConfirmationTarget(null);
+      return true;
+    }
+
+    const nextMode = ctx.editBuffer.trim() as McpEntry['trustMode'];
+    const validModes: McpEntry['trustMode'][] = ['constrained', 'ask-on-risk', 'allow-all', 'blocked'];
+    if (!validModes.includes(nextMode)) {
+      ctx.setEditingMode(false);
+      ctx.setEditBuffer('');
+      ctx.setMcpAllowAllConfirmationTarget(null);
+      return false;
+    }
+    if (nextMode === 'allow-all' && entry.trustMode !== 'allow-all') {
+      ctx.setMcpAllowAllConfirmationTarget(entry.name);
+      ctx.setEditBuffer('');
+      return false;
+    }
+    ctx.mcpRegistry.setServerTrustMode(entry.name, nextMode);
+    ctx.setMcpEntries(buildMcpEntries(ctx.mcpRegistry));
+    ctx.setEditingMode(false);
+    ctx.setEditBuffer('');
+    ctx.setMcpAllowAllConfirmationTarget(null);
+    return true;
+  }
+
+  const entry = ctx.getSelected();
+  if (!entry || !ctx.configManager) return false;
+
+  const { setting } = entry;
+  let parsed: unknown = ctx.editBuffer;
+
+  if (setting.type === 'number') {
+    parsed = Number(ctx.editBuffer);
+    if (isNaN(parsed as number)) {
+      ctx.setEditingMode(false);
+      ctx.setEditBuffer('');
+      return false;
+    }
+  }
+
+  if (setting.type === 'object') {
+    // Object-typed keys (e.g. pricing.modelPrices) edit as JSON; the
+    // schema's validate() below still rules on the parsed shape.
+    try {
+      parsed = JSON.parse(ctx.editBuffer);
+    } catch {
+      ctx.setEditingMode(false);
+      ctx.setEditBuffer('');
+      return false;
+    }
+  }
+
+  if (setting.validate && !setting.validate(parsed)) {
+    ctx.setEditingMode(false);
+    ctx.setEditBuffer('');
+    return false;
+  }
+
+  if (isWorktreeSetupListConfigKey(setting.key)) {
+    // Comma-separated display/edit convention for the array-backed
+    // worktree.setup.* keys — see worktree-setup-config.ts.
+    ctx.setValue(setting.key, parseWorktreeSetupListInput(ctx.editBuffer));
+  } else if (isSandboxExecListConfigKey(setting.key)) {
+    // Same comma-separated convention for the array-backed
+    // sandbox.egressAllowlist / sandbox.workspaceWritable keys — see
+    // sandbox-exec-config.ts.
+    ctx.setValue(setting.key, parseSandboxExecListInput(ctx.editBuffer));
+  } else if (isExecEnvScrubAllowlistConfigKey(setting.key)) {
+    // Same comma-separated convention for permissions.execEnvScrubAllowlist
+    // — see exec-env-scrub-config.ts.
+    ctx.setValue(setting.key, parseExecEnvScrubAllowlistInput(ctx.editBuffer));
+  } else if (setting.type === 'string' && isSecretConfigKey(setting.key)) {
+    setSecretBackedSettingValue({
+      key: setting.key,
+      value: String(parsed ?? ''),
+      configManager: ctx.configManager,
+      secretsManager: ctx.secretsManager,
+      setConfigValue: (key, value) => ctx.setValue(key, value),
+    });
+  } else {
+    ctx.setValue(setting.key as ConfigKey, parsed);
+  }
+  ctx.setEditingMode(false);
+  ctx.setEditBuffer('');
+  return true;
+}

package/src/input/settings-modal-connections.ts

@@ -0,0 +1,102 @@
+/**
+ * settings-modal-connections.ts — the Connections category of the settings
+ * workspace: whether mail and calendar are actually usable, and if not, the
+ * exact next step.
+ *
+ * This category exists because a capability reachable only by typing a slash
+ * command is not, as far as someone clicking through the workspace is
+ * concerned, wired up at all. `/mail status` and `/calendar status` answer the
+ * same question; a person opening `/settings` to see what is connected should
+ * not have to already know those commands exist.
+ *
+ * ## Why the rows arrive asynchronously
+ *
+ * Every other settings category reads a value out of config and renders it.
+ * This one cannot: "is mail connected?" is only answerable by asking the
+ * daemon's handler, which is real I/O. The workspace renders synchronously, so
+ * the rows start in `checking` — which is true — and the refresh replaces them
+ * and asks for a re-render, the same contract the Services surface uses for its
+ * inspections. Nothing is ever shown as "not configured" merely because an
+ * answer has not arrived yet; that would be a guess rendered as a fact.
+ *
+ * No credential is read, held, or rendered here. The probe asks each surface
+ * for one item and keeps only whether it failed and why.
+ */
+
+import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
+import {
+  connectionSurfaceLabel,
+  probeConnection,
+  type ConnectionStatus,
+  type ConnectionSurface,
+} from './commands/connection-status.ts';
+
+/** The surfaces this category covers, in display order. */
+export const CONNECTION_SURFACES: readonly ConnectionSurface[] = ['mail', 'calendar'];
+
+/**
+ * The pre-probe rows.
+ *
+ * Stated as `checking` rather than blank so the category is never empty and
+ * never asserts a state it has not established.
+ */
+export function initialConnectionEntries(): ConnectionStatus[] {
+  return CONNECTION_SURFACES.map((surface) => ({
+    surface,
+    state: 'checking' as const,
+    detail: `Asking the daemon whether ${connectionSurfaceLabel(surface).toLowerCase()} is reachable…`,
+    nextActions: [],
+  }));
+}
+
+/**
+ * Probe every surface. Returns rows in `CONNECTION_SURFACES` order so the
+ * category never reorders itself under the cursor between refreshes.
+ */
+export async function buildConnectionEntries(
+  gateway: GatewayMethodCatalog | undefined,
+): Promise<ConnectionStatus[]> {
+  return Promise.all(CONNECTION_SURFACES.map((surface) => probeConnection(gateway, surface)));
+}
+
+/**
+ * The mutable slice of the settings workspace this module drives. Declared
+ * structurally rather than importing the class, so the split stays a file-size
+ * split and does not become an import cycle.
+ */
+export interface ConnectionsHost {
+  active: boolean;
+  selectedIndex: number;
+  connectionEntries: ConnectionStatus[];
+  connectionsRefreshing: boolean;
+  gatewayMethods: GatewayMethodCatalog | null;
+  requestRender: (() => void) | null;
+}
+
+/**
+ * Refresh the rows from the daemon and repaint.
+ *
+ * A second call while one is in flight is dropped: entering the tab repeatedly
+ * should not queue a probe per keystroke. A probe that lands after the
+ * workspace closed is discarded rather than written, so reopening starts from
+ * `checking` instead of resurrecting an answer about a finished session.
+ */
+export async function refreshConnectionEntries(host: ConnectionsHost): Promise<void> {
+  if (host.connectionsRefreshing) return;
+  host.connectionsRefreshing = true;
+  try {
+    const entries = await buildConnectionEntries(host.gatewayMethods ?? undefined);
+    if (!host.active) return;
+    host.connectionEntries = entries;
+    host.requestRender?.();
+  } finally {
+    host.connectionsRefreshing = false;
+  }
+}
+
+/** The selected row, clamped, or null when the category is empty. */
+export function selectedConnectionEntry(host: ConnectionsHost): ConnectionStatus | null {
+  const entries = host.connectionEntries;
+  if (entries.length === 0) return null;
+  return entries[Math.max(0, Math.min(entries.length - 1, host.selectedIndex))] ?? null;
+}

package/src/input/settings-modal-data.ts

@@ -55,6 +55,11 @@ import { enrichRelaySettingDescriptions } from './relay-settings-descriptions.ts
 import { enrichDaemonOwnedSettingDescriptions } from './daemon-owned-settings-descriptions.ts';
 import { applyFeatureUnitLayout } from './feature-unit-layout.ts';
 import { FEATURE_SETTINGS_BY_ID } from '../runtime/feature-settings.ts';
+import {
+  buildPaymentsSyntheticEntries,
+  isPaymentsSyntheticConfigKey,
+  refreshPaymentsSyntheticEntry,
+} from './payments-config.ts';
 
 // ---------------------------------------------------------------------------
 // deepEqual — structural equality for isDefault comparisons
@@ -249,6 +254,19 @@ export function buildSettingGroups(
   injectSandboxExecSyntheticEntries(groups, configManager);
   injectExecEnvScrubSyntheticEntry(groups, configManager);
 
+  // Payment card capability (see payments-config.ts): the CONFIG_SCHEMA loop
+  // above already populated 'payments' with the fourteen real SDK settings
+  // (enabled, defaultCardId, currency, cvvHandling, budgets, shipping,
+  // windows, notifyChannels). What's injected here are the four secret-tier
+  // card-material fields and the two ordinary address fields, which are
+  // TUI-local synthetic sub-keys under that real section (not yet SDK
+  // CONFIG_SCHEMA entries — see payments-config.ts's header comment), backed
+  // by the same real configManager as everything else in this group.
+  const paymentsEntries = groups.get('payments');
+  if (paymentsEntries && !paymentsEntries.some((e) => isPaymentsSyntheticConfigKey(e.setting.key))) {
+    paymentsEntries.push(...buildPaymentsSyntheticEntries(configManager));
+  }
+
   // relay.* is a real SDK CONFIG_SCHEMA domain; append the threat-model note
   // the SDK's own descriptions don't carry (see relay-settings-descriptions.ts).
   enrichRelaySettingDescriptions(groups);
@@ -656,6 +674,14 @@ export function refreshEntryValues(
         entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
         continue;
       }
+      // payments.* synthetic sub-keys (card material + addresses — see
+      // payments-config.ts): real configManager-backed now, but still
+      // defensively normalized (undefined -> '') the same way the initial
+      // build does, so isDefault stays consistent between build and refresh.
+      if (isPaymentsSyntheticConfigKey(entry.setting.key)) {
+        refreshPaymentsSyntheticEntry(entry, configManager);
+        continue;
+      }
       const raw = configManager.get(entry.setting.key as ConfigKey);
       // Synthetic entries (e.g. tts.speed) that have no SDK schema key return
       // undefined from configManager. Normalize using the same logic used at
@@ -694,6 +720,10 @@ export function updateEntryForKey(
         entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
         continue;
       }
+      if (isPaymentsSyntheticConfigKey(key)) {
+        refreshPaymentsSyntheticEntry(entry, configManager);
+        continue;
+      }
       if (isSandboxExecListConfigKey(key)) {
         entry.currentValue = readSandboxExecList(configManager, key);
         entry.isDefault = (entry.currentValue as string[]).length === 0;

package/src/input/settings-modal-reset.ts

@@ -15,7 +15,7 @@
 
 import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
-import { buildGoodVibesSecretKey, isSecretConfigKey } from '../config/secret-config.ts';
+import { buildGoodVibesSecretKey, defaultSecretBackedScope, isSecretConfigKey } from '../config/secret-config.ts';
 import type { SettingEntry, SettingsCategory } from './settings-modal-types.ts';
 import type { SettingsSecretsManager } from './settings-modal-secrets.ts';
 
@@ -41,7 +41,11 @@ export function resetSelected({
   const key = selected.setting.key as ConfigKey;
   setValue(key, selected.setting.default);
   if (isSecretConfigKey(key) && secretsManager) {
-    void secretsManager.delete(buildGoodVibesSecretKey(key), { scope: 'user' }).catch((error) => {
+    // Delete from the tier the write went to. A daemon-owned key was stored in
+    // the daemon tier (defaultSecretBackedScope), so a delete narrowed to 'user'
+    // would report a cleared setting while the daemon kept using the live
+    // credential — the reset that isn't one.
+    void secretsManager.delete(buildGoodVibesSecretKey(key), { scope: defaultSecretBackedScope(key) }).catch((error) => {
       logger.error('SettingsModal: failed to clear secret while resetting setting', { key, error: summarizeError(error) });
     });
   }

package/src/input/settings-modal-secrets.ts

@@ -5,6 +5,7 @@ import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { SecretsManager } from '../config/secrets.ts';
 import {
   buildSecretBackedConfigUpdate,
+  defaultSecretBackedScope,
   getSecretWriteMedium,
 } from '../config/secret-config.ts';
 
@@ -24,16 +25,22 @@ export function setSecretBackedSettingValue(args: {
   }
 
   const update = buildSecretBackedConfigUpdate(key, value);
+  // A daemon-owned key (surfaces.*, payments.*, controlPlane.*, ...) names a
+  // credential the daemon itself executes with, so its secret material lands in
+  // the daemon tier — the one the daemon reads with every surface closed —
+  // regardless of which client edited it. Everything else stays at user scope.
+  // See secret-config.ts's defaultSecretBackedScope.
+  const scope = defaultSecretBackedScope(key);
   if (update.secretKey && update.secretValue !== undefined) {
     void secretsManager.set(update.secretKey, update.secretValue, {
-      scope: 'user',
+      scope,
       medium: getSecretWriteMedium(configManager.get('storage.secretPolicy')),
     }).catch((error) => {
       logger.error('SettingsModal: failed to store secret config value', { key, error: summarizeError(error) });
     });
   }
   if (update.clearSecretKey) {
-    void secretsManager.delete(update.clearSecretKey, { scope: 'user' }).catch((error) => {
+    void secretsManager.delete(update.clearSecretKey, { scope }).catch((error) => {
       logger.error('SettingsModal: failed to clear secret config value', { key, error: summarizeError(error) });
     });
   }

package/src/input/settings-modal-types.ts

@@ -45,12 +45,24 @@ export type SettingsCategory =
   | 'agents'
   | 'security'
   | 'integrations'
+  | 'connections'
   | 'policy'
   | 'notifications'
   | 'release'
   | 'update'
   | 'power'
   | 'memory'
+  // payments.* — the card on file for daemon-initiated purchases. Like
+  // 'profile' below, this entry and its SETTINGS_CATEGORY_GROUPS membership are
+  // both mandatory or the whole prefix is dropped from the workspace.
+  | 'payments'
+  // profile.* — the owner profile (docs/owner-profile.md §12.1). This entry and
+  // its SETTINGS_CATEGORY_GROUPS membership below are both mandatory:
+  // buildSettingGroups guards every push with `if (groups.has(cat))`, so a
+  // config prefix with no category here is dropped from the workspace entirely
+  // and reachable only by hand-editing a settings file — see the push.* and
+  // cluster.* comments in settings-modal-data.ts for the two times that happened.
+  | 'profile'
   | 'danger';
 
 export type SettingsFocusPane = 'categories' | 'settings';
@@ -62,9 +74,13 @@ export const SETTINGS_CATEGORY_GROUPS: ReadonlyArray<{
   { label: 'Interface', categories: ['display', 'ui', 'behavior', 'notifications', 'permissions', 'policy', 'security'] },
   { label: 'AI Routing', categories: ['provider', 'pricing', 'subscriptions', 'helper', 'tools', 'tts', 'voice'] },
   { label: 'Service & Network', categories: ['service', 'daemon', 'network', 'controlPlane', 'httpListener', 'web', 'relay'] },
-  { label: 'Surfaces & Cloud', categories: ['surfaces', 'device', 'conversationGate', 'integrations', 'mcp', 'cloudflare'] },
-  { label: 'Automation', categories: ['batch', 'automation', 'checkin', 'watchers', 'orchestration', 'planner', 'wrfc'] },
-  { label: 'Runtime & Data', categories: ['storage', 'atRest', 'sandbox', 'fetch', 'agents', 'runtime', 'power', 'memory', 'cache', 'telemetry', 'diagnostics', 'learning'] },
+  { label: 'Surfaces & Cloud', categories: ['surfaces', 'device', 'conversationGate', 'integrations', 'connections', 'mcp', 'cloudflare'] },
+  { label: 'Automation', categories: ['batch', 'automation', 'checkin', 'watchers', 'orchestration', 'planner', 'wrfc', 'payments'] },
+  // 'profile' sits beside 'memory' and 'learning': all three are what the
+  // platform retains about the person using it, and this is the group a reader
+  // looking for "what does it know about me" already scans — Interface is
+  // presentation and permission posture, and nothing there is a store of facts.
+  { label: 'Runtime & Data', categories: ['storage', 'atRest', 'sandbox', 'fetch', 'agents', 'runtime', 'power', 'profile', 'memory', 'cache', 'telemetry', 'diagnostics', 'learning'] },
   { label: 'Advanced', categories: ['release', 'update', 'danger'] },
 ];