@pellux/goodvibes-tui 1.24.2 → 1.26.0

package/src/input/settings-modal.ts

@@ -21,16 +21,14 @@ import type { ModelPickerTarget } from './model-picker.ts';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { SubscriptionManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { ServiceInspectionQuery } from '../runtime/ui-service-queries.ts';
-import { isSecretConfigKey } from '../config/secret-config.ts';
-import {
-  setSecretBackedSettingValue,
-  type SettingsSecretsManager,
-} from './settings-modal-secrets.ts';
+import type { SettingsSecretsManager } from './settings-modal-secrets.ts';
+import { CVV_PROMPT_TRADEOFF_WARNING } from '@pellux/goodvibes-sdk/platform/payments';
+import { PAYMENTS_CVV_HANDLING_CONFIG_KEY } from './payments-config.ts';
 import type { FeatureFlagManager } from '@/runtime/index.ts';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
-import { isWorktreeSetupListConfigKey, parseWorktreeSetupListInput } from './worktree-setup-config.ts';
-import { isSandboxExecListConfigKey, parseSandboxExecListInput } from './sandbox-exec-config.ts';
-import { isExecEnvScrubAllowlistConfigKey, parseExecEnvScrubAllowlistInput } from './exec-env-scrub-config.ts';
+import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { ConnectionStatus } from './commands/connection-status.ts';
+import { initialConnectionEntries, refreshConnectionEntries } from './settings-modal-connections.ts';
 
 import {
   SETTINGS_CATEGORIES,
@@ -71,6 +69,7 @@ import {
   handleResetConfirmKey as _handleResetConfirmKey,
   type ResetConfirmKeyResult,
 } from './settings-modal-reset.ts';
+import { commitEditValue as _commitEditValue } from './settings-modal-commit.ts';
 
 export interface SettingsModalChange {
   readonly key: ConfigKey;
@@ -86,6 +85,10 @@ export type SettingsModalChangeHandler = (change: SettingsModalChange) => Settin
 
 export interface SettingsModalOpenOptions {
   readonly onSettingApplied?: SettingsModalChangeHandler;
+  /** In-process catalog the Connections category probes; see that module. */
+  readonly gatewayMethods?: GatewayMethodCatalog;
+  /** Called when an async connection refresh has new rows to paint. */
+  readonly requestRender?: () => void;
 }
 
 export {
@@ -154,6 +157,11 @@ export class SettingsModal {
   public mcpEntries: McpEntry[] = [];
   /** Provider subscription entries (populated when subscriptions tab is active). */
   public subscriptionEntries: SubscriptionEntry[] = [];
+  /** Connections-tab state; all of it driven by settings-modal-connections.ts. */
+  public connectionEntries: ConnectionStatus[] = initialConnectionEntries();
+  public gatewayMethods: GatewayMethodCatalog | null = null;
+  public requestRender: (() => void) | null = null;
+  public connectionsRefreshing = false;
 
   /**
    * Whether the user has entered search mode (pressed / or a printable key
@@ -217,6 +225,9 @@ export class SettingsModal {
     this.groups = buildSettingGroups(configManager, featureFlagManager);
     this.mcpEntries = buildMcpEntries(this.mcpRegistry);
     this.subscriptionEntries = buildSubscriptionEntries(subscriptionManager, serviceRegistry);
+    this.gatewayMethods = options?.gatewayMethods ?? null;
+    this.requestRender = options?.requestRender ?? null;
+    this.connectionEntries = initialConnectionEntries();
     this.categoryIndex = 0;
     this.selectedIndex = 0;
     this.focusPane = 'categories';
@@ -256,6 +267,11 @@ export class SettingsModal {
     this.searchResults = [];
     this.searchFocused = false;
     this.contextScroll = 0;
+    // A probe still in flight checks `active` before writing, so a reopen
+    // starts from `checking` rather than from a finished session's answer.
+    this.gatewayMethods = null;
+    this.requestRender = null;
+    this.connectionEntries = initialConnectionEntries();
     this.serviceRegistry = null;
     this.secretsManager = null;
     this.onSettingApplied = null;
@@ -357,6 +373,8 @@ export class SettingsModal {
       } else if (this.currentCategory === 'subscriptions' && this.subscriptionEntries.length > 0) {
         this.selectedIndex = (this.selectedIndex - 1 + this.subscriptionEntries.length) % this.subscriptionEntries.length;
         this.subscriptionLogoutConfirmationTarget = null;
+      } else if (this.currentCategory === 'connections' && this.connectionEntries.length > 0) {
+        this.selectedIndex = (this.selectedIndex - 1 + this.connectionEntries.length) % this.connectionEntries.length;
       }
       return;
     }
@@ -380,6 +398,8 @@ export class SettingsModal {
       } else if (this.currentCategory === 'subscriptions' && this.subscriptionEntries.length > 0) {
         this.selectedIndex = (this.selectedIndex + 1) % this.subscriptionEntries.length;
         this.subscriptionLogoutConfirmationTarget = null;
+      } else if (this.currentCategory === 'connections' && this.connectionEntries.length > 0) {
+        this.selectedIndex = (this.selectedIndex + 1) % this.connectionEntries.length;
       }
       return;
     }
@@ -531,105 +551,22 @@ export class SettingsModal {
    * Returns true on success, false if validation failed.
    */
   commitEdit(): boolean {
-    if (!this.editingMode) return false;
-
-    if (this.currentCategory === 'mcp') {
-      const entry = this.getSelectedMcp();
-      if (!entry || !this.mcpRegistry) return false;
-      if (this.mcpAllowAllConfirmationTarget) {
-        const expected = `ALLOW ALL ${this.mcpAllowAllConfirmationTarget}`;
-        if (this.editBuffer.trim() !== expected) {
-          return false;
-        }
-        this.mcpRegistry.setServerTrustMode(entry.name, 'allow-all');
-        this.mcpEntries = buildMcpEntries(this.mcpRegistry);
-        this.editingMode = false;
-        this.editBuffer = '';
-        this.mcpAllowAllConfirmationTarget = null;
-        return true;
-      }
-
-      const nextMode = this.editBuffer.trim() as McpEntry['trustMode'];
-      const validModes: McpEntry['trustMode'][] = ['constrained', 'ask-on-risk', 'allow-all', 'blocked'];
-      if (!validModes.includes(nextMode)) {
-        this.editingMode = false;
-        this.editBuffer = '';
-        this.mcpAllowAllConfirmationTarget = null;
-        return false;
-      }
-      if (nextMode === 'allow-all' && entry.trustMode !== 'allow-all') {
-        this.mcpAllowAllConfirmationTarget = entry.name;
-        this.editBuffer = '';
-        return false;
-      }
-      this.mcpRegistry.setServerTrustMode(entry.name, nextMode);
-      this.mcpEntries = buildMcpEntries(this.mcpRegistry);
-      this.editingMode = false;
-      this.editBuffer = '';
-      this.mcpAllowAllConfirmationTarget = null;
-      return true;
-    }
-
-    const entry = this.getSelected();
-    if (!entry || !this.configManager) return false;
-
-    const { setting } = entry;
-    let parsed: unknown = this.editBuffer;
-
-    if (setting.type === 'number') {
-      parsed = Number(this.editBuffer);
-      if (isNaN(parsed as number)) {
-        this.editingMode = false;
-        this.editBuffer = '';
-        return false;
-      }
-    }
-
-    if (setting.type === 'object') {
-      // Object-typed keys (e.g. pricing.modelPrices) edit as JSON; the
-      // schema's validate() below still rules on the parsed shape.
-      try {
-        parsed = JSON.parse(this.editBuffer);
-      } catch {
-        this.editingMode = false;
-        this.editBuffer = '';
-        return false;
-      }
-    }
-
-    if (setting.validate && !setting.validate(parsed)) {
-      this.editingMode = false;
-      this.editBuffer = '';
-      return false;
-    }
-
-    if (isWorktreeSetupListConfigKey(setting.key)) {
-      // Comma-separated display/edit convention for the array-backed
-      // worktree.setup.* keys — see worktree-setup-config.ts.
-      this._setValue(setting.key, parseWorktreeSetupListInput(this.editBuffer));
-    } else if (isSandboxExecListConfigKey(setting.key)) {
-      // Same comma-separated convention for the array-backed
-      // sandbox.egressAllowlist / sandbox.workspaceWritable keys — see
-      // sandbox-exec-config.ts.
-      this._setValue(setting.key, parseSandboxExecListInput(this.editBuffer));
-    } else if (isExecEnvScrubAllowlistConfigKey(setting.key)) {
-      // Same comma-separated convention for permissions.execEnvScrubAllowlist
-      // — see exec-env-scrub-config.ts.
-      this._setValue(setting.key, parseExecEnvScrubAllowlistInput(this.editBuffer));
-    } else if (setting.type === 'string' && isSecretConfigKey(setting.key)) {
-      setSecretBackedSettingValue({
-        key: setting.key,
-        value: String(parsed ?? ''),
-        configManager: this.configManager,
-        secretsManager: this.secretsManager,
-        setConfigValue: (key, value) => this._setValue(key, value),
-      });
-    } else {
-      this._setValue(setting.key as ConfigKey, parsed);
-    }
-    this.editingMode = false;
-    this.editBuffer = '';
-    return true;
+    return _commitEditValue({
+      editingMode: this.editingMode,
+      currentCategory: this.currentCategory,
+      editBuffer: this.editBuffer,
+      configManager: this.configManager,
+      secretsManager: this.secretsManager,
+      mcpRegistry: this.mcpRegistry,
+      mcpAllowAllConfirmationTarget: this.mcpAllowAllConfirmationTarget,
+      getSelectedMcp: () => this.getSelectedMcp(),
+      getSelected: () => this.getSelected(),
+      setValue: (key, value) => this._setValue(key, value),
+      setEditingMode: (v) => { this.editingMode = v; },
+      setEditBuffer: (v) => { this.editBuffer = v; },
+      setMcpEntries: (entries) => { this.mcpEntries = entries; },
+      setMcpAllowAllConfirmationTarget: (v) => { this.mcpAllowAllConfirmationTarget = v; },
+    });
   }
 
   /** Cancel inline edit without saving. */
@@ -702,6 +639,8 @@ export class SettingsModal {
       this.mcpEntries = buildMcpEntries(this.mcpRegistry);
     } else if (this.currentCategory === 'subscriptions') {
       this.subscriptionEntries = buildSubscriptionEntries(this.subscriptionManager, this.serviceRegistry);
+    } else if (this.currentCategory === 'connections') {
+      void refreshConnectionEntries(this);
     }
   }
 
@@ -714,6 +653,7 @@ export class SettingsModal {
     if (
       this.currentCategory === 'mcp'
       || this.currentCategory === 'subscriptions'
+      || this.currentCategory === 'connections'
     ) return [];
     const items = this.groups.get(this.currentCategory) ?? [];
     if (this.currentCategory === 'network') {
@@ -754,6 +694,13 @@ export class SettingsModal {
       this.lastSettingEffectMessage = result.effectMessage;
     }
     // No-op (result.changed === false, effectMessage === null): leave lastSettingEffectMessage untouched.
+
+    // Selecting 'prompt' for payments.cvvHandling states the tradeoff at the
+    // moment of selection, not just in the documentation pane — see the
+    // SDK's own CVV_PROMPT_TRADEOFF_WARNING (platform/payments).
+    if (key === PAYMENTS_CVV_HANDLING_CONFIG_KEY && value === 'prompt') {
+      this.lastSettingEffectMessage = CVV_PROMPT_TRADEOFF_WARNING;
+    }
   }
 
   /** Refresh live/persisted/pending state for every feature header bound to `key`. */

package/src/main.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { homedir } from 'node:os';
+import { resolveGoodVibesDaemonHome, resolveGoodVibesHome } from './config/goodvibes-home.ts';
 import { Compositor } from './renderer/compositor.ts';
 import { type Line } from './types/grid.ts';
 import { UIFactory } from './renderer/ui-factory.ts';
@@ -87,9 +87,12 @@ import { VERSION } from './version.ts';
 async function main() {
   const stdout = process.stdout;
   const stdin = process.stdin;
+  // Both roots come from the one resolver the daemon CLI also uses. This line
+  // called homedir() unconditionally, so a harness that redirected the tree got
+  // a client that wrote the real one — secret store included.
   const { cli, configManager, bootstrapWorkingDir, bootstrapHomeDirectory } = await prepareShellCliRuntime(process.argv.slice(2), {
     defaultWorkingDirectory: process.env['GOODVIBES_WORKING_DIR'] ?? process.cwd(),
-    homeDirectory: homedir(),
+    homeDirectory: resolveGoodVibesHome(),
   }, 'goodvibes');
 
   // Between binary start and the first frame, boot used to be silent (config
@@ -106,6 +109,8 @@ async function main() {
     configManager,
     workingDir: bootstrapWorkingDir,
     homeDirectory: bootstrapHomeDirectory,
+    // Named, so GOODVIBES_DAEMON_HOME on its own moves the client's daemon tier.
+    daemonHomeDirectory: resolveGoodVibesDaemonHome(bootstrapHomeDirectory),
   });
   const {
     conversation,

package/src/panels/modals/marketplace-modal.ts

@@ -207,6 +207,11 @@ export function createMarketplaceModalSurface(deps: MarketplaceModalDeps): Confi
  * missing paths with existsSync → [], so refresh() finds nothing and renders the
  * honest empty-state copy). The random tmp path never appears in the
  * rendered lines (the empty-state copy is static), so the golden is byte-stable.
+ *
+ * This is production code (ships in the real binary), not test scratch, so
+ * it stays rooted at the real OS temp dir rather than the test-only
+ * makeProjectTempDir helper. Created and removed synchronously in the same
+ * call, so the on-disk window is negligible.
  */
 export function marketplaceModalGoldenSurface(): ConfigModalSurface {
   const root = mkdtempSync(join(tmpdir(), 'gv-marketplace-golden-'));

package/src/panels/modals/skills-modal.ts

@@ -180,6 +180,11 @@ export function createSkillsModalSurface(deps: SkillsModalDeps): ConfigModalSurf
  * homeDir and removed immediately (scanSkillDirectorySync catches missing dirs →
  * []), so refresh() finds no `.goodvibes/skills` directories and renders the
  * static empty-state copy. The random tmp path never appears in the output.
+ *
+ * This is production code (ships in the real binary), not test scratch, so
+ * it stays rooted at the real OS temp dir rather than the test-only
+ * makeProjectTempDir helper. Created and removed synchronously in the same
+ * call, so the on-disk window is negligible.
  */
 export function skillsModalGoldenSurface(): ConfigModalSurface {
   const root = mkdtempSync(join(tmpdir(), 'gv-skills-golden-'));

package/src/renderer/settings-modal-connections.ts

@@ -0,0 +1,63 @@
+/**
+ * settings-modal-connections.ts — rendering for the Connections category of the
+ * settings workspace.
+ *
+ * Split out of settings-modal.ts for the 800-line file cap, the same reason
+ * settings-modal-helpers.ts exists. Pure rendering: every value shown here was
+ * decided by the daemon probe in input/commands/connection-status.ts.
+ */
+
+import type { SettingsModal } from '../input/settings-modal.ts';
+import { selectedConnectionEntry } from '../input/settings-modal-connections.ts';
+import { connectionSurfaceLabel, type ConnectionStatus } from '../input/commands/connection-status.ts';
+import { GLYPHS } from './ui-primitives.ts';
+import { clamp, padDisplay, stableWindow } from './fullscreen-workspace.ts';
+
+/**
+ * The Connections rows: one line per surface, saying what it actually is.
+ *
+ * `checking` is rendered as its own state rather than blanked, because a row
+ * that showed nothing while the probe was in flight would read as "nothing
+ * configured" — the one thing this category exists to stop claiming falsely.
+ */
+export function renderConnectionRows(modal: SettingsModal, width: number, height: number): string[] {
+  const rows: string[] = [];
+  const items = modal.connectionEntries;
+  if (items.length === 0) return ['No connection surfaces are known to this build.'];
+  const selectedIndex = clamp(modal.selectedIndex, 0, items.length - 1);
+  const surfaceWidth = clamp(Math.floor(width * 0.16), 10, 20);
+  const stateWidth = 12;
+  const detailWidth = Math.max(16, width - surfaceWidth - stateWidth - 8);
+  rows.push(`  ${padDisplay('Surface', surfaceWidth)}  ${padDisplay('State', stateWidth)}  ${padDisplay('Detail', detailWidth)}`);
+  const window = stableWindow(items.length, selectedIndex, Math.max(1, height - 2));
+  if (window.start > 0) rows.push(`${GLYPHS.navigation.moreAbove} ${window.start} more connection(s) above`);
+  for (let index = window.start; index < window.end; index += 1) {
+    const entry = items[index]!;
+    const selected = index === selectedIndex;
+    const marker = selected ? (modal.focusPane === 'settings' ? GLYPHS.navigation.selected : '\u2022') : ' ';
+    rows.push(`${marker} ${padDisplay(connectionSurfaceLabel(entry.surface), surfaceWidth)}  ${padDisplay(entry.state, stateWidth)}  ${padDisplay(entry.detail, detailWidth)}`);
+  }
+  if (window.end < items.length) rows.push(`${GLYPHS.navigation.moreBelow} ${items.length - window.end} more connection(s) below`);
+  return rows.slice(0, height);
+}
+
+/**
+ * The detail pane for one connection: the state, what it means, and every next
+ * step verbatim. The next steps are the daemon's requirements, so they are
+ * listed in full rather than summarized — a truncated instruction is a wrong
+ * instruction.
+ */
+export function buildConnectionContext(modal: SettingsModal): string[] {
+  const entry = selectedConnectionEntry(modal);
+  if (!entry) return ['Connections', 'No connection surface is selected.'];
+  return [
+    connectionSurfaceLabel(entry.surface),
+    `State: ${entry.state}`,
+    entry.detail,
+    ...(entry.nextActions.length > 0 ? ['', 'Next steps:', ...entry.nextActions] : []),
+    '',
+    entry.surface === 'mail'
+      ? 'Use it from the transcript with /mail (status, list, read, draft, send).'
+      : 'Use it from the transcript with /calendar (status, list, get, create).',
+  ];
+}

package/src/renderer/settings-modal-helpers.ts

@@ -107,10 +107,13 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   agents: 'Sub-agent context-window awareness and per-turn passive knowledge/code injection: token budget, relevance floor, code-chunk limit, and the compaction threshold. Gated by the agent context/injection features.',
   security: 'API token scope and rotation auditing: rotation cadence, warning lead time, and whether overdue/over-scoped tokens are blocked or only reported. Gated by the Token Scope and Rotation Audit feature.',
   integrations: 'Integration delivery reliability (Slack/Discord/webhook): retry counts, backoff bounds, dead-letter queue size, and SLO enforcement. Gated by the Integration Delivery SLO feature.',
+  connections: 'Whether mail and calendar are actually usable right now. Each row is answered by asking the daemon that owns the connection, not by reading config here, so a row says ready only when a real request succeeded.',
   policy: 'Policy-as-code bundle loading: where the startup policy bundle is loaded from and its file path. Gated by the Policy-as-Code feature.',
   notifications: 'Notification router burst-suppression tuning: burst window, threshold, and cooldown. Gated by the Adaptive Notification Suppression feature.',
   relay: 'Outbound zero-knowledge relay reachability, for reaching this daemon from outside the LAN without opening an inbound port. Off by default — relay.enabled is the switch. The relay operator sees only ciphertext and connection metadata — self-host your own relay for full control.',
   learning: 'Idle-time memory consolidation: merging duplicate standing memory records and decaying/archiving stale ones. Off by default — nothing runs until enabled.',
+  payments: 'Payment card on file for daemon-initiated purchases: card number, expiry, CVV, cardholder name, billing and shipping address, and whether the CVV is stored or requested at purchase time. Card fields are entered through /payments card (concealed input) and are secret-tier — never rendered in plaintext.',
+  profile: 'What the platform knows about you — your name, how to reach you, where you are, how you like answers written, the people and places you mention — kept as one Markdown file at daemon scope that you can open and edit by hand at any time; your edits win and are never rewritten. These rows decide whether it is loaded at all, whether the assistant records facts it learns from things you say directly to it, whether it tells you in one line each time it does, whether the harmless part (how you are addressed, your city, your timezone, your formatting preferences, your style) is put in the model\'s context so it stops guessing, whether using a private detail such as your address is announced in the reply, whether settings left unset read their value from the profile, and where the file lives. Everything private — your name, contact details, home address, billing and shipping details, quiet hours, and the People, Places, Work and Notes sections — is never put in context in bulk and is reachable only by a named lookup that is disclosed when it happens. Run /profile to read the whole thing, /profile where <field> to see the surface, date and your exact words behind any recorded line, and /profile forget <field> to delete one.',
 };
 
 export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], string> = {
@@ -161,8 +164,11 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   agents: 'Agents & Context',
   security: 'Token Security',
   integrations: 'Integration Delivery',
+  connections: 'Connections',
   policy: 'Policy-as-Code',
   notifications: 'Notifications',
+  payments: 'Payments',
+  profile: 'Owner Profile',
 };
 
 const SETTING_LABELS: Partial<Record<string, string>> = {

package/src/renderer/settings-modal.ts

@@ -11,7 +11,10 @@ import { SETTINGS_CATEGORIES, SETTINGS_CATEGORY_GROUPS } from '../input/settings
 import { FEATURE_SETTINGS_BY_ID, isFeatureValueEnabled } from '../runtime/feature-settings.ts';
 import { getDisplayWidth, wrapText } from '../utils/terminal-width.ts';
 import { CATEGORY_INFO, CATEGORY_LABELS, describeUiRouting, formatValue, getSettingLabel, inferSubscriptionRouteReason, valueColor } from './settings-modal-helpers.ts';
+import { buildConnectionContext, renderConnectionRows } from './settings-modal-connections.ts';
 import { isSecretConfigKey } from '../config/secret-config.ts';
+import { maskConcealedText } from '../input/concealed-input.ts';
+import { CVV_PROMPT_TRADEOFF_WARNING } from '@pellux/goodvibes-sdk/platform/payments';
 import { GLYPHS } from './ui-primitives.ts';
 import { formatHints, joinHints } from './hint-grammar.ts';
 import {
@@ -104,6 +107,10 @@ const ENUM_VALUE_DESCRIPTIONS: Record<string, Record<string, string>> = {
     'meta-cloud': 'Use Meta Cloud API credentials and identifiers.',
     bridge: 'Use a bridge service URL/token flow instead of direct Meta Cloud API delivery.',
   },
+  'payments.cvvHandling': {
+    stored: 'Store the CVV through the secret manager so the daemon can complete a purchase unattended.',
+    prompt: CVV_PROMPT_TRADEOFF_WARNING,
+  },
 };
 
 function paddedWrapped(text: string, width: number, prefix = ''): string[] {
@@ -120,7 +127,16 @@ function formatDefaultValue(value: unknown): string {
 }
 
 function currentSettingValue(modal: SettingsModal, entry: SettingEntry, selected: boolean): string {
-  if (selected && modal.editingMode) return `${modal.editBuffer}${GLYPHS.surface.cursor}`;
+  if (selected && modal.editingMode) {
+    // Secret-backed keys (surfaces.*.botToken, .signingSecret, etc. — see
+    // secret-config.ts) must never echo the in-progress plaintext buffer:
+    // not in the row, not in the "Current: ..." context line, not in search
+    // results. Reuse the composer's concealed-input mask (concealed-input.ts)
+    // rather than a second masking implementation — same bullet-per-character
+    // shape, so keystrokes still visibly register without revealing content.
+    const buffer = isSecretConfigKey(entry.setting.key) ? maskConcealedText(modal.editBuffer) : modal.editBuffer;
+    return `${buffer}${GLYPHS.surface.cursor}`;
+  }
   return formatValue(entry);
 }
 
@@ -360,6 +376,8 @@ function buildContextLines(modal: SettingsModal, width: number): string[] {
     lines.push(...buildMcpContext(modal, modal.getSelectedMcp()));
   } else if (category === 'subscriptions') {
     lines.push(...buildSubscriptionContext(modal, modal.getSelectedSubscription()));
+  } else if (category === 'connections') {
+    lines.push(...buildConnectionContext(modal));
   } else {
     const selected = modal.getSelected();
     // A feature-unit header shows the feature's documentation (full
@@ -386,6 +404,7 @@ function buildContextLines(modal: SettingsModal, width: number): string[] {
 function categoryItemCount(modal: SettingsModal, category: SettingsCategory): number {
   if (category === 'mcp') return modal.mcpEntries.length;
   if (category === 'subscriptions') return modal.subscriptionEntries.length;
+  if (category === 'connections') return modal.connectionEntries.length;
   return modal.groups.get(category)?.length ?? 0;
 }
 
@@ -601,6 +620,7 @@ function renderControlRows(modal: SettingsModal, width: number, height: number):
   if (modal.searchFocused) return renderSearchRows(modal, width, height);
   if (modal.currentCategory === 'mcp') return renderMcpRows(modal, width, height);
   if (modal.currentCategory === 'subscriptions') return renderSubscriptionRows(modal, width, height);
+  if (modal.currentCategory === 'connections') return renderConnectionRows(modal, width, height);
   return renderSettingRows(modal, width, height);
 }
 

package/src/runtime/bootstrap-core.ts

@@ -248,7 +248,7 @@ export async function initializeBootstrapCore(
     runtimeBus,
     runtimeStore: store,
     getConversationTitle: () => getConversationTitle(),
-    workingDir, homeDirectory,
+    workingDir, homeDirectory, ...(options.daemonHomeDirectory === undefined ? {} : { daemonHomeDirectory: options.daemonHomeDirectory }),
     // Embedded topology: the in-process runtime IS the daemon and holds its own OS
     // inhibitor, so opt into the real host seam (fork default is non-spawning). See services.ts.
     powerSeam: createHostPowerSeam(),

package/src/runtime/bootstrap.ts

@@ -41,7 +41,7 @@ import { initializeBootstrapCore } from './bootstrap-core.ts';
 import { ensureBootModelResolvable } from './provider-fallback.ts';
 import { createBootstrapShell } from './bootstrap-shell.ts';
 import { announceResumeState } from './resume-notice.ts';
-import { announceInstallSelfCheck } from './install-self-check-startup.ts';
+import { announceInstallHealth } from './install-self-check-startup.ts';
 import { buildSharedOrchestratorCoreServices, refreshMemoryRecallSnapshot } from './orchestrator-core-services.ts';
 import { consumeDaemonAttachNotices, consumeExternalDaemonAttachNotices } from './daemon-attach-notices.ts';
 import { wireContextAccountingSource } from './context-accounting-source.ts';
@@ -322,7 +322,7 @@ export async function bootstrapRuntime(
   }).catch(() => {
     // Best-effort — never let the resume notice block or crash boot.
   });
-  announceInstallSelfCheck(systemMessageRouter);
+  announceInstallHealth(systemMessageRouter);
   const { gitStatusProvider, inputHistory, lastGitInfoRef } = shell;
   // FIX 2: dispose the header's live-repo-state poll (git-status.ts
   // startPolling) on shutdown, same pattern as acpTaskSyncInterval above.

package/src/runtime/context.ts

@@ -31,6 +31,15 @@ export interface BootstrapOptions {
   workingDir: string;
   /** App-owned home directory for this runtime instance. */
   homeDirectory: string;
+  /**
+   * The daemon's identity directory for this runtime instance.
+   *
+   * Named rather than derived so the client's daemon-TIER secret reads and
+   * writes follow a GOODVIBES_DAEMON_HOME set on its own. Absent, the secret
+   * store falls back to `<homeDirectory>/.goodvibes/daemon`, which is the same
+   * answer whenever that variable is unset.
+   */
+  daemonHomeDirectory?: string;
   /** Explicit app-owned config manager for this runtime instance. */
   configManager: import('@pellux/goodvibes-sdk/platform/config').ConfigManager;
   /**

package/src/runtime/credential-composition.ts

@@ -0,0 +1,54 @@
+/**
+ * credential-composition.ts
+ *
+ * The credential and identity seam: the secret store, the step-up ceremony
+ * service that verifies against it, and the per-device pairing tokens.
+ *
+ * These are grouped because they share one fact, and it is the fact this round
+ * had to fix: WHERE the daemon's own credentials live. `daemonHome` is threaded
+ * rather than defaulted, because without it a daemon told to run out of a temp
+ * tree moved its identity directory and nothing else — the credential store
+ * stayed in the real home, so an "isolated" test daemon held live credentials
+ * and long-polled a real account. A default here would silently restore that.
+ *
+ * Extracted from services.ts because that file sits at the 800-line
+ * architecture cap. Moving a coherent seam out is what the cap is for; trimming
+ * unrelated comments to buy headroom is the thing it exists to prevent.
+ */
+
+import { SecretsManager } from '../config/secrets.ts';
+import { StepUpService } from '@pellux/goodvibes-sdk/daemon';
+import { PairingTokenManager } from '@pellux/goodvibes-sdk/platform/pairing';
+
+interface CredentialCompositionInput {
+  readonly workingDirectory: string;
+  readonly homeDirectory: string;
+  /**
+   * The daemon's state root when the host was told one. Absent means "not
+   * overridden" and must stay absent rather than being defaulted — see above.
+   */
+  readonly daemonHomeDirectory?: string | undefined;
+  readonly configManager: ConstructorParameters<typeof SecretsManager>[0]['configManager'];
+  readonly pairingTokenPath: string;
+}
+
+export function composeCredentialServices(input: CredentialCompositionInput): {
+  readonly secretsManager: SecretsManager;
+  readonly stepUpService: StepUpService;
+  readonly pairingTokens: PairingTokenManager;
+} {
+  const secretsManager = new SecretsManager({
+    projectRoot: input.workingDirectory,
+    globalHome: input.homeDirectory,
+    // Threaded, not defaulted: else an isolated daemon reads the real store.
+    ...(input.daemonHomeDirectory === undefined ? {} : { daemonHome: input.daemonHomeDirectory }),
+    configManager: input.configManager,
+  });
+  return {
+    secretsManager,
+    // Shared between the ceremony gateway verbs and the relay gate's verifier,
+    // so both check a step-up against the same store.
+    stepUpService: new StepUpService({ secrets: secretsManager }),
+    pairingTokens: new PairingTokenManager(input.pairingTokenPath),
+  };
+}

package/src/runtime/daemon-handler-composition.ts

@@ -27,8 +27,6 @@ import { registerRouting } from '../daemon/handlers/routing/index.ts';
 import { registerInboxMethods } from '../daemon/handlers/inbox/index.ts';
 import { registerTriagedInbox } from '../daemon/handlers/triage/index.ts';
 import { registerDraftMethods } from '../daemon/handlers/drafts/index.ts';
-import { registerCalendar } from '../daemon/handlers/calendar/index.ts';
-import { registerEmailMethods } from '../daemon/handlers/email/index.ts';
 import { registerRemoteSurface } from '../daemon/handlers/remote/index.ts';
 import { inboxPollerGate } from './cluster-composition.ts';
 
@@ -73,8 +71,6 @@ export function createDaemonHandlerComposition(
           options.clusterCoordinator.register(inboxPollerGate(providerId, control)),
       })).unregister,
     registerDrafts: (ctx) => registerDraftMethods(ctx),
-    registerCalendar,
-    registerEmail: (ctx) => registerEmailMethods(ctx),
     registerRemote: (ctx) => registerRemoteSurface(ctx, { manager: options.distributedRuntime }),
   });
 }

package/src/runtime/install-self-check-startup.ts

@@ -17,6 +17,7 @@
 import { existsSync } from 'node:fs';
 import { getGoodVibesPackageRoot, resolveGoodVibesDaemonExecutable } from '../cli/service-posture.ts';
 import { runInstallSelfCheck } from './install-self-check.ts';
+import { announceReachability } from './path-shadow-startup.ts';
 import type { SystemMessageRouter } from '../core/system-message-router.ts';
 
 export function announceInstallSelfCheck(router: SystemMessageRouter): void {
@@ -34,3 +35,25 @@ export function announceInstallSelfCheck(router: SystemMessageRouter): void {
     // Best-effort — an install self-check must never block or crash boot.
   }
 }
+
+/**
+ * The one call boot makes about the state of this install: is it complete
+ * (the check above), is it the copy the shell actually reaches, and is it the
+ * current release (path-shadow-startup).
+ *
+ * They are announced together because they are the same question from the
+ * user's side — "am I looking at the build I think I am" — and because the
+ * three answers are useless apart: a complete install nobody can reach, or a
+ * reachable install three versions old, both end with the product appearing
+ * to have lost a capability it never had.
+ *
+ * The reachability half is async (it may look up the latest release) and is
+ * deliberately not awaited: boot continues, the notice arrives through the
+ * same router a moment later.
+ */
+export function announceInstallHealth(router: SystemMessageRouter): void {
+  announceInstallSelfCheck(router);
+  void announceReachability(router).catch(() => {
+    // Best-effort — a reachability check must never block or crash boot.
+  });
+}