@pellux/goodvibes-tui 1.24.2 → 1.26.0

package/src/input/commands/calendar-runtime.ts

@@ -0,0 +1,245 @@
+/**
+ * calendar-runtime.ts — `/calendar`, the terminal surface over the daemon's
+ * calendar capability.
+ *
+ * As with `/mail`, no calendar logic lives here. CalDAV, ICS parsing, settings
+ * resolution and the confirmation gate are all in
+ * `src/daemon/handlers/calendar/`; this file parses arguments, renders results,
+ * and refuses honestly when the capability is not set up.
+ *
+ * ## What is exposed, and what is not
+ *
+ * `list` (the agenda) and `get` are exposed: knowing what is next without
+ * leaving the terminal is the whole value of a calendar on this surface.
+ * `create` is exposed behind the same preview-then-`--confirm` step `/mail
+ * send` uses, because the daemon gates it on both `body.confirm` and an
+ * explicit user request, and because an event created by a typo is a real
+ * nuisance to undo.
+ *
+ * `calendar.ics.import` and `calendar.ics.export` are deliberately NOT given a
+ * command. They are bulk file-level transfers of a whole calendar — an
+ * operation whose natural home is a file path and a scheduled job, not a line
+ * typed into a coding session. They stay available to any surface through the
+ * same catalog; this product simply does not claim to be the right place for
+ * them. That is a scoping decision, recorded here so it reads as a choice
+ * rather than an omission.
+ */
+
+import type { CommandContext, CommandRegistry } from '../command-registry.ts';
+import {
+  EXPLICIT_WRITE_INVOCATION_CONTEXT,
+  READ_INVOCATION_CONTEXT,
+  errorText,
+  probeConnection,
+  renderConnectionStatus,
+} from './connection-status.ts';
+
+/** Agenda item, exactly the daemon's `calendar.events.list` item shape. */
+interface CalendarEvent {
+  readonly id: string;
+  readonly title: string;
+  readonly start: string;
+  readonly end: string;
+  readonly location?: string;
+  readonly description?: string;
+  readonly attendees?: readonly string[];
+}
+
+const DEFAULT_LIST_LIMIT = 20;
+const MAX_LIST_LIMIT = 200;
+
+/**
+ * Render a timestamp for a terminal agenda.
+ *
+ * An unparseable value is printed verbatim rather than replaced with a
+ * placeholder — showing what the server actually returned is more useful than
+ * hiding it behind "invalid date".
+ */
+export function formatWhen(raw: string): string {
+  const parsed = new Date(raw);
+  if (Number.isNaN(parsed.getTime())) return raw;
+  const date = parsed.toISOString().slice(0, 10);
+  const time = parsed.toISOString().slice(11, 16);
+  return `${date} ${time}`;
+}
+
+function truncate(value: string, width: number): string {
+  const flat = value.replace(/\s+/g, ' ').trim();
+  return flat.length <= width ? flat : `${flat.slice(0, width - 1)}…`;
+}
+
+export function renderAgenda(events: readonly CalendarEvent[]): string {
+  if (events.length === 0) return 'No events in this window.';
+  const lines = [`Agenda — ${events.length} event${events.length === 1 ? '' : 's'}:`];
+  for (const event of events) {
+    const where = event.location ? `  @ ${truncate(event.location, 24)}` : '';
+    lines.push(`  ${formatWhen(event.start)}  ${truncate(event.title, 44).padEnd(44)}${where}`);
+  }
+  lines.push('', '  /calendar get <id> — open one event');
+  return lines.join('\n');
+}
+
+export function renderEvent(event: CalendarEvent): string {
+  const lines = [
+    `Title:  ${event.title}`,
+    `Start:  ${formatWhen(event.start)}`,
+    `End:    ${formatWhen(event.end)}`,
+  ];
+  if (event.location) lines.push(`Where:  ${event.location}`);
+  const attendees = event.attendees ?? [];
+  if (attendees.length > 0) lines.push(`With:   ${attendees.join(', ')}`);
+  if (event.description && event.description.trim().length > 0) {
+    lines.push('', event.description.trimEnd());
+  }
+  return lines.join('\n');
+}
+
+/**
+ * Split `title | start | end` on unescaped pipes — same separator rule as
+ * `/mail`, for the same reason: titles contain spaces and per-command quoting
+ * conventions are their own bug source.
+ */
+export function parseEventArgs(raw: string): { title: string; start: string; end: string } | null {
+  const parts = raw.split('|').map((part) => part.trim());
+  if (parts.length !== 3) return null;
+  const [title, start, end] = parts;
+  if (!title || !start || !end) return null;
+  return { title, start, end };
+}
+
+function parseLimit(raw: string | undefined): number {
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_LIST_LIMIT;
+  return Math.min(MAX_LIST_LIMIT, Math.floor(parsed));
+}
+
+const USAGE = [
+  'Usage:',
+  '  /calendar                   connection status and the agenda ahead',
+  '  /calendar status            connection status only',
+  '  /calendar list [n]          the next n events (default 20)',
+  '  /calendar get <id>          open one event',
+  '  /calendar create <title | start | end> [--confirm]   preview, then create',
+  '',
+  '  Times are ISO-8601, e.g. 2026-08-01T14:00:00Z',
+].join('\n');
+
+export function registerCalendarRuntimeCommands(registry: CommandRegistry): void {
+  registry.register({
+    name: 'calendar',
+    aliases: ['cal'],
+    description: 'Calendar over the daemon: connection status, agenda, event detail, create',
+    usage: '[status|list|get|create] …',
+    argsHint: '[status|list <n>|get <id>|create]',
+    async handler(args, ctx) {
+      const gateway = ctx.workspace.gatewayMethods;
+      const sub = (args[0] ?? '').toLowerCase();
+
+      if (sub === 'status') {
+        ctx.print(renderConnectionStatus(await probeConnection(gateway, 'calendar')));
+        return;
+      }
+
+      if (!gateway) {
+        ctx.print(renderConnectionStatus(await probeConnection(undefined, 'calendar')));
+        return;
+      }
+
+      if (sub === '' || sub === 'list') {
+        await listEvents(ctx, gateway, parseLimit(args[1]), sub === '');
+        return;
+      }
+      if (sub === 'get') {
+        await getEvent(ctx, gateway, args[1]);
+        return;
+      }
+      if (sub === 'create') {
+        await createEvent(ctx, gateway, args.slice(1));
+        return;
+      }
+      ctx.print(USAGE);
+    },
+  });
+}
+
+type Gateway = NonNullable<CommandContext['workspace']['gatewayMethods']>;
+
+async function withStatusOnFailure(
+  ctx: CommandContext,
+  gateway: Gateway,
+  label: string,
+  run: () => Promise<void>,
+): Promise<void> {
+  try {
+    await run();
+  } catch (error) {
+    ctx.print(`[calendar ${label}] ${errorText(error)}`);
+    ctx.print(renderConnectionStatus(await probeConnection(gateway, 'calendar')));
+  }
+}
+
+async function listEvents(ctx: CommandContext, gateway: Gateway, limit: number, withStatus: boolean): Promise<void> {
+  await withStatusOnFailure(ctx, gateway, 'list', async () => {
+    const result = await gateway.invoke('calendar.events.list', {
+      ...READ_INVOCATION_CONTEXT,
+      body: { limit, from: new Date().toISOString() },
+    }) as { readonly events?: readonly CalendarEvent[] };
+    if (withStatus) {
+      ctx.print(renderConnectionStatus({
+        surface: 'calendar',
+        state: 'ready',
+        detail: 'Calendar is connected — the daemon reached the server and returned a result.',
+        nextActions: [],
+      }));
+    }
+    ctx.print(renderAgenda(result.events ?? []));
+  });
+}
+
+async function getEvent(ctx: CommandContext, gateway: Gateway, eventId: string | undefined): Promise<void> {
+  if (!eventId) {
+    ctx.print('Usage: /calendar get <id> — the id from /calendar list.');
+    return;
+  }
+  await withStatusOnFailure(ctx, gateway, 'get', async () => {
+    const event = await gateway.invoke('calendar.events.get', {
+      ...READ_INVOCATION_CONTEXT,
+      body: { eventId },
+    }) as CalendarEvent;
+    ctx.print(renderEvent(event));
+  });
+}
+
+async function createEvent(ctx: CommandContext, gateway: Gateway, rest: readonly string[]): Promise<void> {
+  const raw = rest.filter((part) => part !== '--confirm').join(' ');
+  const confirmed = rest.includes('--confirm');
+  const parsed = parseEventArgs(raw);
+  if (parsed === null) {
+    ctx.print([
+      'Usage: /calendar create <title | start | end>',
+      '  Three fields separated by | — for example:',
+      '  /calendar create Design review | 2026-08-01T14:00:00Z | 2026-08-01T15:00:00Z',
+    ].join('\n'));
+    return;
+  }
+
+  if (!confirmed) {
+    ctx.print([
+      'This would create:',
+      `  Title: ${parsed.title}`,
+      `  Start: ${formatWhen(parsed.start)}`,
+      `  End:   ${formatWhen(parsed.end)}`,
+      '',
+      'Nothing has been created. Re-run the same line with --confirm to create it.',
+    ].join('\n'));
+    return;
+  }
+
+  await withStatusOnFailure(ctx, gateway, 'create', async () => {
+    const result = await gateway.invoke('calendar.events.create', {
+      ...EXPLICIT_WRITE_INVOCATION_CONTEXT,
+      body: { title: parsed.title, start: parsed.start, end: parsed.end, confirm: true },
+    }) as { readonly eventId: string; readonly createdAt: string };
+    ctx.print(`Created "${parsed.title}" (event id ${result.eventId}, at ${result.createdAt}).`);
+  });
+}

package/src/input/commands/config.ts

@@ -1,6 +1,13 @@
-import type { CommandRegistry } from '../command-registry.ts';
+import type { CommandContext, CommandRegistry } from '../command-registry.ts';
 import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import { setActiveThemeMode, type ThemeMode } from '../../renderer/theme.ts';
+import {
+  buildGoodVibesSecretKey,
+  defaultSecretBackedScope,
+  isSecretConfigKey,
+  persistSecretBackedConfigValue,
+} from '../../config/secret-config.ts';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 export function registerConfigCommand(registry: CommandRegistry): void {
   registry.register({
@@ -9,7 +16,7 @@ export function registerConfigCommand(registry: CommandRegistry): void {
     description: 'Open the fullscreen configuration workspace, or set a key directly',
     usage: '[category|key] | set <key> <value>',
     argsHint: '[category|key] | set <key> <value>',
-    handler(args, ctx) {
+    async handler(args, ctx) {
       // An earlier replay fix: `/config set <key> <value>` used to fall through to
       // the workspace with the assignment silently ignored — the dishonest-
       // fallthrough class. `set` is now a real verb.
@@ -20,6 +27,17 @@ export function registerConfigCommand(registry: CommandRegistry): void {
           ctx.print('Usage: /config set <key> <value> — e.g. /config set display.themeMode light');
           return;
         }
+        // A credential key must never take the generic path below: setDynamic
+        // writes the value it is handed straight into a settings JSON file, so
+        // `/config set surfaces.email.password hunter2` used to put the mailbox
+        // password in cleartext on disk. The settings modal already routes these
+        // keys through the secret manager (settings-modal-secrets.ts); this
+        // command has to route them the same way, or the two ways of setting the
+        // same key disagree about where the value lands.
+        if (isSecretConfigKey(key)) {
+          await handleSecretConfigSet(ctx, key as ConfigKey, value);
+          return;
+        }
         try {
           const before = ctx.platform.configManager.get(key as ConfigKey);
           ctx.platform.configManager.setDynamic(key as ConfigKey, coerceConfigValue(value));
@@ -49,6 +67,54 @@ export function registerConfigCommand(registry: CommandRegistry): void {
   });
 }
 
+/**
+ * Store a credential-bearing config key through the secret manager instead of
+ * writing it into a config file: the value goes to the secret store and the
+ * config key keeps only a `goodvibes://secrets/...` reference to it.
+ *
+ * The entered value is never echoed. The transcript is a diagnostic surface —
+ * it is scrolled back through, copied into support threads and captured in
+ * screen recordings — so it gets the reference and the store key, never the
+ * secret.
+ *
+ * With no secret manager in this runtime there is nowhere safe to put it, and
+ * the command REFUSES rather than falling back to a plaintext config write.
+ */
+async function handleSecretConfigSet(
+  ctx: CommandContext,
+  key: ConfigKey,
+  value: string,
+): Promise<void> {
+  const secretKey = buildGoodVibesSecretKey(key);
+  const secretsManager = ctx.platform?.secretsManager;
+  if (!secretsManager) {
+    ctx.print(
+      `${key} holds a credential, and this runtime has no secret store to put it in — `
+      + `refusing rather than writing it in cleartext into a config file.\n`
+      + `  Store it with: /secrets set ${secretKey} <value>`,
+    );
+    return;
+  }
+  try {
+    const configValue = await persistSecretBackedConfigValue(
+      ctx.platform.configManager,
+      secretsManager,
+      key,
+      value,
+    );
+    const scope = defaultSecretBackedScope(key);
+    ctx.print(
+      `Set ${key}: stored in the ${scope} secret tier as ${secretKey} (value hidden).\n`
+      + `  ${key} now holds the reference ${configValue} — the value itself is never written to a config file.`
+      + (scope === 'daemon'
+        ? '\n  The daemon reads that tier, so this keeps working with this client closed.'
+        : ''),
+    );
+  } catch (e) {
+    ctx.print(`Could not set ${key}: ${summarizeError(e)}`);
+  }
+}
+
 /** Coerce CLI text to the JSON-ish scalar the config schema expects. */
 function coerceConfigValue(raw: string): unknown {
   if (raw === 'true') return true;

package/src/input/commands/connection-status.ts

@@ -0,0 +1,258 @@
+/**
+ * connection-status.ts — honest connection state for the mail and calendar
+ * capabilities, derived from the daemon's own answer rather than re-decided
+ * here.
+ *
+ * The daemon owns mail (IMAP/SMTP) and calendar (CalDAV/ICS) end to end: the
+ * settings resolution, the credential read, the connectors, the confirmation
+ * posture (see src/daemon/handlers/email and src/daemon/handlers/calendar).
+ * The TUI holds no second copy of any of it. So "is mail connected?" is not a
+ * question this file answers from config — it is a question it ASKS, by
+ * invoking the cheapest read verb and reading the failure code that comes back:
+ *
+ *   EMAIL_NOT_CONFIGURED       host/user are missing
+ *   EMAIL_CREDENTIALS_MISSING  host/user are set, the password secret is not
+ *   CALENDAR_NOT_CONFIGURED    CalDAV url/user are missing
+ *
+ * Those codes are the daemon's, and the next step each one implies is the
+ * daemon's requirement, not a guess here. If the daemon changes what it needs,
+ * this surface follows, because it never encoded the rule.
+ *
+ * ## Why the in-process catalog and not the operator HTTP wire
+ *
+ * Every `email.*` / `calendar.*` descriptor the SDK catalogs carries
+ * `invokable: false`. On the generic HTTP/WS dispatch path that flag is checked
+ * by `validateGatewayInvocation` BEFORE any handler lookup and answered with a
+ * flat 400 `NOT_INVOKABLE` — so `sdk.operator.invoke('email.inbox.list', …)`
+ * cannot reach these verbs no matter what is configured, and a surface built on
+ * it would be a dead button.
+ *
+ * `GatewayMethodCatalog.invoke()` deliberately does NOT consult that flag: a
+ * runtime that has registered a real handler is authoritative over whether its
+ * own method works. This product registers those handlers into its own catalog
+ * at composition time (`createDaemonHandlerComposition`, called by the shared
+ * `createRuntimeServices` root that both the TUI and the daemon boot from), so
+ * the in-process catalog is a live, correct route to the same code — the same
+ * seam `/review` already uses for `checkpoints.*`. That is what these surfaces
+ * call.
+ *
+ * Nothing here reads, holds, or renders a credential. The probe asks for one
+ * item and discards it; only presence or absence of a failure reaches the UI.
+ */
+
+import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
+
+export type ConnectionSurface = 'mail' | 'calendar';
+
+/**
+ * What a surface can be.
+ *
+ * `checking` exists because the probe is real I/O and the settings workspace
+ * renders synchronously — a row has to say something true while the answer is
+ * in flight, and "checking" is true where "not configured" would be invented.
+ */
+export type ConnectionState = 'ready' | 'needs-setup' | 'unreachable' | 'checking';
+
+export interface ConnectionStatus {
+  readonly surface: ConnectionSurface;
+  readonly state: ConnectionState;
+  /** One line stating what is actually true right now. Never a credential. */
+  readonly detail: string;
+  /** Concrete next steps. Empty only when the state is `ready`. */
+  readonly nextActions: readonly string[];
+}
+
+/** Display label for a surface. */
+export function connectionSurfaceLabel(surface: ConnectionSurface): string {
+  return surface === 'mail' ? 'Mail' : 'Calendar';
+}
+
+/** The read verb each surface is probed with — the cheapest read it has. */
+export const CONNECTION_PROBE_METHOD = {
+  mail: 'email.inbox.list',
+  calendar: 'calendar.events.list',
+} as const;
+
+/**
+ * The setup steps each daemon failure code implies.
+ *
+ * The `surfaces.*` settings are daemon-owned by prefix (see the SDK's
+ * `config-ownership`), so `/config set` on them lands in the daemon's own
+ * store and keeps working with this client closed — which is the requirement.
+ *
+ * The PASSWORDS now have it too, and these steps changed the round the platform
+ * gave it to them. A credential is filed in the daemon's tier only when a
+ * daemon-owned config path declares it, and the two keys this product's daemon
+ * reads — `surfaces.email.password` and `surfaces.calendar.caldavPassword` —
+ * were declared in neither `CONFIG_SCHEMA` nor the platform's non-schema
+ * daemon-owned path list. `isDaemonOwnedSecretKey()` answered false for both,
+ * so a `/secrets set` filed them in THIS client's store where the daemon never
+ * looks, and telling anyone to run it would have been handing them a step that
+ * silently did nothing. The instruction was the daemon's own environment
+ * instead, because that genuinely reached it.
+ *
+ * The platform release that began serving `email.*` and `calendar.*` declares
+ * the whole mail and CalDAV connection as daemon-owned, so both keys answer
+ * true now and a write carrying an explicit scope is RELOCATED to the daemon
+ * tier rather than filed where it was asked for. `/secrets set` is therefore the
+ * step that works, and it is the better one: it needs no restart and no shell
+ * access to the machine the daemon runs on. The environment still resolves
+ * first, so an operator who already set it there is not broken by this.
+ */
+const DAEMON_TIER_NOTE =
+  'The password reaches the DAEMON: a daemon-owned credential is filed in its tier '
+  + 'no matter which surface stores it, so this keeps working with this client closed.';
+
+const SETUP_STEPS: Readonly<Record<string, readonly string[]>> = {
+  EMAIL_NOT_CONFIGURED: [
+    '/config set surfaces.email.host imap.example.com',
+    '/config set surfaces.email.user you@example.com',
+    `/secrets set GOODVIBES_SURFACES_EMAIL_PASSWORD <password>. ${DAEMON_TIER_NOTE}`,
+  ],
+  EMAIL_CREDENTIALS_MISSING: [
+    `/secrets set GOODVIBES_SURFACES_EMAIL_PASSWORD <password>. ${DAEMON_TIER_NOTE}`,
+  ],
+  CALENDAR_NOT_CONFIGURED: [
+    '/config set surfaces.calendar.caldavUrl https://example.com/dav/',
+    '/config set surfaces.calendar.caldavUser you@example.com',
+    `/secrets set GOODVIBES_SURFACES_CALENDAR_CALDAV_PASSWORD <password>. ${DAEMON_TIER_NOTE}`,
+  ],
+};
+
+/** Message text off an unknown thrown value, without assuming Error. */
+export function errorText(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+/**
+ * Pull the daemon's machine code off a thrown handler error.
+ *
+ * In-process the throw is the daemon's own `HandlerError`, which carries
+ * `code` directly. The structured wire body is also checked so the same
+ * derivation keeps working if a surface ever reaches these verbs over HTTP.
+ */
+export function daemonErrorCode(error: unknown): string | null {
+  if (typeof error !== 'object' || error === null) return null;
+  const direct = (error as { readonly code?: unknown }).code;
+  if (typeof direct === 'string' && direct.length > 0) return direct;
+  const body = (error as { readonly body?: unknown }).body;
+  if (typeof body === 'object' && body !== null) {
+    const bodyCode = (body as { readonly code?: unknown }).code;
+    if (typeof bodyCode === 'string' && bodyCode.length > 0) return bodyCode;
+  }
+  return null;
+}
+
+/**
+ * Turn a probe outcome into a status. Pure — the caller does the I/O, so every
+ * daemon answer is exercised in tests without a daemon.
+ *
+ * `error === null` means the read verb returned. That is the only evidence
+ * that counts as ready: settings resolved, credential read, server reached.
+ */
+export function describeConnectionProbe(
+  surface: ConnectionSurface,
+  error: unknown,
+): ConnectionStatus {
+  const label = connectionSurfaceLabel(surface);
+
+  if (error === null) {
+    return {
+      surface,
+      state: 'ready',
+      detail: `${label} is connected — the daemon reached the server and returned a result.`,
+      nextActions: [],
+    };
+  }
+
+  const code = daemonErrorCode(error);
+  const steps = code === null ? undefined : SETUP_STEPS[code];
+  if (steps !== undefined) {
+    return {
+      surface,
+      state: 'needs-setup',
+      detail: `${label} is not set up yet: ${errorText(error)}`,
+      nextActions: steps,
+    };
+  }
+
+  // A missing descriptor is a real answer and a different problem from "not
+  // configured". Saying "not set up" here would send the owner off to set
+  // config keys that would change nothing.
+  if (code === 'METHOD_NOT_FOUND' || code === 'NOT_INVOKABLE') {
+    return {
+      surface,
+      state: 'unreachable',
+      detail: `This build does not serve ${CONNECTION_PROBE_METHOD[surface]} (${code}).`,
+      nextActions: [`Update to a build whose daemon serves the ${surface} methods.`],
+    };
+  }
+
+  return {
+    surface,
+    state: 'unreachable',
+    detail: `${label} could not be checked: ${errorText(error)}`,
+    nextActions: ['Check that the runtime composed its daemon handlers: /doctor'],
+  };
+}
+
+/** The status for a surface when the gateway catalog is not wired at all. */
+export function unwiredConnectionStatus(surface: ConnectionSurface): ConnectionStatus {
+  return {
+    surface,
+    state: 'unreachable',
+    detail: `${connectionSurfaceLabel(surface)} runs through the gateway method catalog, which is not wired into this session.`,
+    nextActions: ['Start the full runtime (this surface is unavailable in a reduced harness).'],
+  };
+}
+
+/** The invocation envelope every read on these surfaces uses. */
+export const READ_INVOCATION_CONTEXT = { context: { clientKind: 'tui' as const } };
+
+/**
+ * The invocation envelope a confirmation-gated write needs.
+ *
+ * The daemon's register wrapper demands BOTH `body.confirm === true` and
+ * `context.metadata.explicitUserRequest === true`. The second is set only on
+ * paths where a person typed the command that performs the write, which is the
+ * whole point of the flag — it is never set on a read or on a background
+ * refresh.
+ */
+export const EXPLICIT_WRITE_INVOCATION_CONTEXT = {
+  context: { clientKind: 'tui' as const, metadata: { explicitUserRequest: true } },
+};
+
+/**
+ * Probe one surface against the in-process gateway catalog.
+ *
+ * Asks for a single item — enough to prove the whole path (settings →
+ * credential → connector → server) without pulling a mailbox into memory.
+ */
+export async function probeConnection(
+  gateway: GatewayMethodCatalog | undefined,
+  surface: ConnectionSurface,
+): Promise<ConnectionStatus> {
+  if (!gateway) return unwiredConnectionStatus(surface);
+  try {
+    await gateway.invoke(CONNECTION_PROBE_METHOD[surface], {
+      ...READ_INVOCATION_CONTEXT,
+      body: { limit: 1 },
+    });
+    return describeConnectionProbe(surface, null);
+  } catch (error) {
+    return describeConnectionProbe(surface, error);
+  }
+}
+
+/** Render one status as transcript lines. Used by `/mail` and `/calendar`. */
+export function renderConnectionStatus(status: ConnectionStatus): string {
+  const lines = [
+    `${connectionSurfaceLabel(status.surface)}: ${status.state}`,
+    `  ${status.detail}`,
+  ];
+  if (status.nextActions.length > 0) {
+    lines.push('  Next:');
+    for (const action of status.nextActions) lines.push(`    ${action}`);
+  }
+  return lines.join('\n');
+}

package/src/input/commands/local-provider-runtime.ts

@@ -130,7 +130,15 @@ export function registerLocalProviderRuntimeCommands(registry: CommandRegistry):
               }
               void (async () => {
                 try {
-                  await secretsManager.set(keyName, value, { scope: 'user', medium: 'secure' });
+                  // Daemon scope, stated explicitly here rather than left to the
+                  // platform's daemon-owned credential registry: that registry
+                  // recognises credentials by NAME, and this name is derived
+                  // from an operator-chosen provider name
+                  // (customProviderKeyName above), so no shipped list can
+                  // contain it. The daemon is what runs the model, so the key
+                  // has to reach the daemon tier or a locally-hosted endpoint
+                  // is usable only while this TUI is open.
+                  await secretsManager.set(keyName, value, { scope: 'daemon', medium: 'secure' });
                   ctx.print(`Stored the API key for '${name}' (value hidden). It resolves live for this provider — no restart needed.`);
                 } catch (error) {
                   ctx.print(`Could not store the key for '${name}': ${summarizeError(error)}`);