@pellux/goodvibes-tui 1.25.0 → 1.26.0

package/src/input/settings-modal-commit.ts

@@ -0,0 +1,146 @@
+/**
+ * settings-modal-commit.ts — commitEdit(), extracted out of the SettingsModal
+ * class body so the class file can stay under the repo's architecture
+ * line-count gate without trimming arbitrary lines to clear the number.
+ *
+ * Same dependency-injection shape as settings-modal-activation.ts /
+ * settings-modal-adjustment.ts / settings-modal-reset.ts: explicit getters
+ * and setter callbacks instead of a bound `this`, so the logic is
+ * unit-testable without a live SettingsModal instance and the class method
+ * stays a thin delegator.
+ */
+
+import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
+import { isSecretConfigKey } from '../config/secret-config.ts';
+import { setSecretBackedSettingValue, type SettingsSecretsManager } from './settings-modal-secrets.ts';
+import { buildMcpEntries } from './settings-modal-data.ts';
+import { isWorktreeSetupListConfigKey, parseWorktreeSetupListInput } from './worktree-setup-config.ts';
+import { isSandboxExecListConfigKey, parseSandboxExecListInput } from './sandbox-exec-config.ts';
+import { isExecEnvScrubAllowlistConfigKey, parseExecEnvScrubAllowlistInput } from './exec-env-scrub-config.ts';
+import type { McpEntry, SettingEntry } from './settings-modal-types.ts';
+
+export interface CommitEditContext {
+  readonly editingMode: boolean;
+  readonly currentCategory: string;
+  readonly editBuffer: string;
+  readonly configManager: ConfigManager | null;
+  readonly secretsManager: SettingsSecretsManager | null;
+  readonly mcpRegistry: McpRegistry | null;
+  readonly mcpAllowAllConfirmationTarget: string | null;
+  getSelectedMcp(): McpEntry | null;
+  getSelected(): SettingEntry | null;
+  setValue(key: ConfigKey, value: unknown): void;
+  setEditingMode(value: boolean): void;
+  setEditBuffer(value: string): void;
+  setMcpEntries(entries: McpEntry[]): void;
+  setMcpAllowAllConfirmationTarget(value: string | null): void;
+}
+
+/**
+ * Commit the current editBuffer to the config. Returns true on success,
+ * false if validation failed (the caller always clears editingMode/editBuffer
+ * regardless — a failed commit never leaves stale edit state behind).
+ */
+export function commitEditValue(ctx: CommitEditContext): boolean {
+  if (!ctx.editingMode) return false;
+
+  if (ctx.currentCategory === 'mcp') {
+    const entry = ctx.getSelectedMcp();
+    if (!entry || !ctx.mcpRegistry) return false;
+    if (ctx.mcpAllowAllConfirmationTarget) {
+      const expected = `ALLOW ALL ${ctx.mcpAllowAllConfirmationTarget}`;
+      if (ctx.editBuffer.trim() !== expected) {
+        return false;
+      }
+      ctx.mcpRegistry.setServerTrustMode(entry.name, 'allow-all');
+      ctx.setMcpEntries(buildMcpEntries(ctx.mcpRegistry));
+      ctx.setEditingMode(false);
+      ctx.setEditBuffer('');
+      ctx.setMcpAllowAllConfirmationTarget(null);
+      return true;
+    }
+
+    const nextMode = ctx.editBuffer.trim() as McpEntry['trustMode'];
+    const validModes: McpEntry['trustMode'][] = ['constrained', 'ask-on-risk', 'allow-all', 'blocked'];
+    if (!validModes.includes(nextMode)) {
+      ctx.setEditingMode(false);
+      ctx.setEditBuffer('');
+      ctx.setMcpAllowAllConfirmationTarget(null);
+      return false;
+    }
+    if (nextMode === 'allow-all' && entry.trustMode !== 'allow-all') {
+      ctx.setMcpAllowAllConfirmationTarget(entry.name);
+      ctx.setEditBuffer('');
+      return false;
+    }
+    ctx.mcpRegistry.setServerTrustMode(entry.name, nextMode);
+    ctx.setMcpEntries(buildMcpEntries(ctx.mcpRegistry));
+    ctx.setEditingMode(false);
+    ctx.setEditBuffer('');
+    ctx.setMcpAllowAllConfirmationTarget(null);
+    return true;
+  }
+
+  const entry = ctx.getSelected();
+  if (!entry || !ctx.configManager) return false;
+
+  const { setting } = entry;
+  let parsed: unknown = ctx.editBuffer;
+
+  if (setting.type === 'number') {
+    parsed = Number(ctx.editBuffer);
+    if (isNaN(parsed as number)) {
+      ctx.setEditingMode(false);
+      ctx.setEditBuffer('');
+      return false;
+    }
+  }
+
+  if (setting.type === 'object') {
+    // Object-typed keys (e.g. pricing.modelPrices) edit as JSON; the
+    // schema's validate() below still rules on the parsed shape.
+    try {
+      parsed = JSON.parse(ctx.editBuffer);
+    } catch {
+      ctx.setEditingMode(false);
+      ctx.setEditBuffer('');
+      return false;
+    }
+  }
+
+  if (setting.validate && !setting.validate(parsed)) {
+    ctx.setEditingMode(false);
+    ctx.setEditBuffer('');
+    return false;
+  }
+
+  if (isWorktreeSetupListConfigKey(setting.key)) {
+    // Comma-separated display/edit convention for the array-backed
+    // worktree.setup.* keys — see worktree-setup-config.ts.
+    ctx.setValue(setting.key, parseWorktreeSetupListInput(ctx.editBuffer));
+  } else if (isSandboxExecListConfigKey(setting.key)) {
+    // Same comma-separated convention for the array-backed
+    // sandbox.egressAllowlist / sandbox.workspaceWritable keys — see
+    // sandbox-exec-config.ts.
+    ctx.setValue(setting.key, parseSandboxExecListInput(ctx.editBuffer));
+  } else if (isExecEnvScrubAllowlistConfigKey(setting.key)) {
+    // Same comma-separated convention for permissions.execEnvScrubAllowlist
+    // — see exec-env-scrub-config.ts.
+    ctx.setValue(setting.key, parseExecEnvScrubAllowlistInput(ctx.editBuffer));
+  } else if (setting.type === 'string' && isSecretConfigKey(setting.key)) {
+    setSecretBackedSettingValue({
+      key: setting.key,
+      value: String(parsed ?? ''),
+      configManager: ctx.configManager,
+      secretsManager: ctx.secretsManager,
+      setConfigValue: (key, value) => ctx.setValue(key, value),
+    });
+  } else {
+    ctx.setValue(setting.key as ConfigKey, parsed);
+  }
+  ctx.setEditingMode(false);
+  ctx.setEditBuffer('');
+  return true;
+}

package/src/input/settings-modal-data.ts

@@ -55,6 +55,11 @@ import { enrichRelaySettingDescriptions } from './relay-settings-descriptions.ts
 import { enrichDaemonOwnedSettingDescriptions } from './daemon-owned-settings-descriptions.ts';
 import { applyFeatureUnitLayout } from './feature-unit-layout.ts';
 import { FEATURE_SETTINGS_BY_ID } from '../runtime/feature-settings.ts';
+import {
+  buildPaymentsSyntheticEntries,
+  isPaymentsSyntheticConfigKey,
+  refreshPaymentsSyntheticEntry,
+} from './payments-config.ts';
 
 // ---------------------------------------------------------------------------
 // deepEqual — structural equality for isDefault comparisons
@@ -249,6 +254,19 @@ export function buildSettingGroups(
   injectSandboxExecSyntheticEntries(groups, configManager);
   injectExecEnvScrubSyntheticEntry(groups, configManager);
 
+  // Payment card capability (see payments-config.ts): the CONFIG_SCHEMA loop
+  // above already populated 'payments' with the fourteen real SDK settings
+  // (enabled, defaultCardId, currency, cvvHandling, budgets, shipping,
+  // windows, notifyChannels). What's injected here are the four secret-tier
+  // card-material fields and the two ordinary address fields, which are
+  // TUI-local synthetic sub-keys under that real section (not yet SDK
+  // CONFIG_SCHEMA entries — see payments-config.ts's header comment), backed
+  // by the same real configManager as everything else in this group.
+  const paymentsEntries = groups.get('payments');
+  if (paymentsEntries && !paymentsEntries.some((e) => isPaymentsSyntheticConfigKey(e.setting.key))) {
+    paymentsEntries.push(...buildPaymentsSyntheticEntries(configManager));
+  }
+
   // relay.* is a real SDK CONFIG_SCHEMA domain; append the threat-model note
   // the SDK's own descriptions don't carry (see relay-settings-descriptions.ts).
   enrichRelaySettingDescriptions(groups);
@@ -656,6 +674,14 @@ export function refreshEntryValues(
         entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
         continue;
       }
+      // payments.* synthetic sub-keys (card material + addresses — see
+      // payments-config.ts): real configManager-backed now, but still
+      // defensively normalized (undefined -> '') the same way the initial
+      // build does, so isDefault stays consistent between build and refresh.
+      if (isPaymentsSyntheticConfigKey(entry.setting.key)) {
+        refreshPaymentsSyntheticEntry(entry, configManager);
+        continue;
+      }
       const raw = configManager.get(entry.setting.key as ConfigKey);
       // Synthetic entries (e.g. tts.speed) that have no SDK schema key return
       // undefined from configManager. Normalize using the same logic used at
@@ -694,6 +720,10 @@ export function updateEntryForKey(
         entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
         continue;
       }
+      if (isPaymentsSyntheticConfigKey(key)) {
+        refreshPaymentsSyntheticEntry(entry, configManager);
+        continue;
+      }
       if (isSandboxExecListConfigKey(key)) {
         entry.currentValue = readSandboxExecList(configManager, key);
         entry.isDefault = (entry.currentValue as string[]).length === 0;

package/src/input/settings-modal-reset.ts

@@ -15,7 +15,7 @@
 
 import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
-import { buildGoodVibesSecretKey, isSecretConfigKey } from '../config/secret-config.ts';
+import { buildGoodVibesSecretKey, defaultSecretBackedScope, isSecretConfigKey } from '../config/secret-config.ts';
 import type { SettingEntry, SettingsCategory } from './settings-modal-types.ts';
 import type { SettingsSecretsManager } from './settings-modal-secrets.ts';
 
@@ -41,7 +41,11 @@ export function resetSelected({
   const key = selected.setting.key as ConfigKey;
   setValue(key, selected.setting.default);
   if (isSecretConfigKey(key) && secretsManager) {
-    void secretsManager.delete(buildGoodVibesSecretKey(key), { scope: 'user' }).catch((error) => {
+    // Delete from the tier the write went to. A daemon-owned key was stored in
+    // the daemon tier (defaultSecretBackedScope), so a delete narrowed to 'user'
+    // would report a cleared setting while the daemon kept using the live
+    // credential — the reset that isn't one.
+    void secretsManager.delete(buildGoodVibesSecretKey(key), { scope: defaultSecretBackedScope(key) }).catch((error) => {
       logger.error('SettingsModal: failed to clear secret while resetting setting', { key, error: summarizeError(error) });
     });
   }

package/src/input/settings-modal-secrets.ts

@@ -5,6 +5,7 @@ import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { SecretsManager } from '../config/secrets.ts';
 import {
   buildSecretBackedConfigUpdate,
+  defaultSecretBackedScope,
   getSecretWriteMedium,
 } from '../config/secret-config.ts';
 
@@ -24,16 +25,22 @@ export function setSecretBackedSettingValue(args: {
   }
 
   const update = buildSecretBackedConfigUpdate(key, value);
+  // A daemon-owned key (surfaces.*, payments.*, controlPlane.*, ...) names a
+  // credential the daemon itself executes with, so its secret material lands in
+  // the daemon tier — the one the daemon reads with every surface closed —
+  // regardless of which client edited it. Everything else stays at user scope.
+  // See secret-config.ts's defaultSecretBackedScope.
+  const scope = defaultSecretBackedScope(key);
   if (update.secretKey && update.secretValue !== undefined) {
     void secretsManager.set(update.secretKey, update.secretValue, {
-      scope: 'user',
+      scope,
       medium: getSecretWriteMedium(configManager.get('storage.secretPolicy')),
     }).catch((error) => {
       logger.error('SettingsModal: failed to store secret config value', { key, error: summarizeError(error) });
     });
   }
   if (update.clearSecretKey) {
-    void secretsManager.delete(update.clearSecretKey, { scope: 'user' }).catch((error) => {
+    void secretsManager.delete(update.clearSecretKey, { scope }).catch((error) => {
       logger.error('SettingsModal: failed to clear secret config value', { key, error: summarizeError(error) });
     });
   }

package/src/input/settings-modal-types.ts

@@ -52,6 +52,17 @@ export type SettingsCategory =
   | 'update'
   | 'power'
   | 'memory'
+  // payments.* — the card on file for daemon-initiated purchases. Like
+  // 'profile' below, this entry and its SETTINGS_CATEGORY_GROUPS membership are
+  // both mandatory or the whole prefix is dropped from the workspace.
+  | 'payments'
+  // profile.* — the owner profile (docs/owner-profile.md §12.1). This entry and
+  // its SETTINGS_CATEGORY_GROUPS membership below are both mandatory:
+  // buildSettingGroups guards every push with `if (groups.has(cat))`, so a
+  // config prefix with no category here is dropped from the workspace entirely
+  // and reachable only by hand-editing a settings file — see the push.* and
+  // cluster.* comments in settings-modal-data.ts for the two times that happened.
+  | 'profile'
   | 'danger';
 
 export type SettingsFocusPane = 'categories' | 'settings';
@@ -64,8 +75,12 @@ export const SETTINGS_CATEGORY_GROUPS: ReadonlyArray<{
   { label: 'AI Routing', categories: ['provider', 'pricing', 'subscriptions', 'helper', 'tools', 'tts', 'voice'] },
   { label: 'Service & Network', categories: ['service', 'daemon', 'network', 'controlPlane', 'httpListener', 'web', 'relay'] },
   { label: 'Surfaces & Cloud', categories: ['surfaces', 'device', 'conversationGate', 'integrations', 'connections', 'mcp', 'cloudflare'] },
-  { label: 'Automation', categories: ['batch', 'automation', 'checkin', 'watchers', 'orchestration', 'planner', 'wrfc'] },
-  { label: 'Runtime & Data', categories: ['storage', 'atRest', 'sandbox', 'fetch', 'agents', 'runtime', 'power', 'memory', 'cache', 'telemetry', 'diagnostics', 'learning'] },
+  { label: 'Automation', categories: ['batch', 'automation', 'checkin', 'watchers', 'orchestration', 'planner', 'wrfc', 'payments'] },
+  // 'profile' sits beside 'memory' and 'learning': all three are what the
+  // platform retains about the person using it, and this is the group a reader
+  // looking for "what does it know about me" already scans — Interface is
+  // presentation and permission posture, and nothing there is a store of facts.
+  { label: 'Runtime & Data', categories: ['storage', 'atRest', 'sandbox', 'fetch', 'agents', 'runtime', 'power', 'profile', 'memory', 'cache', 'telemetry', 'diagnostics', 'learning'] },
   { label: 'Advanced', categories: ['release', 'update', 'danger'] },
 ];
 

package/src/input/settings-modal.ts

@@ -21,19 +21,14 @@ import type { ModelPickerTarget } from './model-picker.ts';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { SubscriptionManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { ServiceInspectionQuery } from '../runtime/ui-service-queries.ts';
-import { isSecretConfigKey } from '../config/secret-config.ts';
-import {
-  setSecretBackedSettingValue,
-  type SettingsSecretsManager,
-} from './settings-modal-secrets.ts';
+import type { SettingsSecretsManager } from './settings-modal-secrets.ts';
+import { CVV_PROMPT_TRADEOFF_WARNING } from '@pellux/goodvibes-sdk/platform/payments';
+import { PAYMENTS_CVV_HANDLING_CONFIG_KEY } from './payments-config.ts';
 import type { FeatureFlagManager } from '@/runtime/index.ts';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
 import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
 import type { ConnectionStatus } from './commands/connection-status.ts';
 import { initialConnectionEntries, refreshConnectionEntries } from './settings-modal-connections.ts';
-import { isWorktreeSetupListConfigKey, parseWorktreeSetupListInput } from './worktree-setup-config.ts';
-import { isSandboxExecListConfigKey, parseSandboxExecListInput } from './sandbox-exec-config.ts';
-import { isExecEnvScrubAllowlistConfigKey, parseExecEnvScrubAllowlistInput } from './exec-env-scrub-config.ts';
 
 import {
   SETTINGS_CATEGORIES,
@@ -74,6 +69,7 @@ import {
   handleResetConfirmKey as _handleResetConfirmKey,
   type ResetConfirmKeyResult,
 } from './settings-modal-reset.ts';
+import { commitEditValue as _commitEditValue } from './settings-modal-commit.ts';
 
 export interface SettingsModalChange {
   readonly key: ConfigKey;
@@ -555,105 +551,22 @@ export class SettingsModal {
    * Returns true on success, false if validation failed.
    */
   commitEdit(): boolean {
-    if (!this.editingMode) return false;
-
-    if (this.currentCategory === 'mcp') {
-      const entry = this.getSelectedMcp();
-      if (!entry || !this.mcpRegistry) return false;
-      if (this.mcpAllowAllConfirmationTarget) {
-        const expected = `ALLOW ALL ${this.mcpAllowAllConfirmationTarget}`;
-        if (this.editBuffer.trim() !== expected) {
-          return false;
-        }
-        this.mcpRegistry.setServerTrustMode(entry.name, 'allow-all');
-        this.mcpEntries = buildMcpEntries(this.mcpRegistry);
-        this.editingMode = false;
-        this.editBuffer = '';
-        this.mcpAllowAllConfirmationTarget = null;
-        return true;
-      }
-
-      const nextMode = this.editBuffer.trim() as McpEntry['trustMode'];
-      const validModes: McpEntry['trustMode'][] = ['constrained', 'ask-on-risk', 'allow-all', 'blocked'];
-      if (!validModes.includes(nextMode)) {
-        this.editingMode = false;
-        this.editBuffer = '';
-        this.mcpAllowAllConfirmationTarget = null;
-        return false;
-      }
-      if (nextMode === 'allow-all' && entry.trustMode !== 'allow-all') {
-        this.mcpAllowAllConfirmationTarget = entry.name;
-        this.editBuffer = '';
-        return false;
-      }
-      this.mcpRegistry.setServerTrustMode(entry.name, nextMode);
-      this.mcpEntries = buildMcpEntries(this.mcpRegistry);
-      this.editingMode = false;
-      this.editBuffer = '';
-      this.mcpAllowAllConfirmationTarget = null;
-      return true;
-    }
-
-    const entry = this.getSelected();
-    if (!entry || !this.configManager) return false;
-
-    const { setting } = entry;
-    let parsed: unknown = this.editBuffer;
-
-    if (setting.type === 'number') {
-      parsed = Number(this.editBuffer);
-      if (isNaN(parsed as number)) {
-        this.editingMode = false;
-        this.editBuffer = '';
-        return false;
-      }
-    }
-
-    if (setting.type === 'object') {
-      // Object-typed keys (e.g. pricing.modelPrices) edit as JSON; the
-      // schema's validate() below still rules on the parsed shape.
-      try {
-        parsed = JSON.parse(this.editBuffer);
-      } catch {
-        this.editingMode = false;
-        this.editBuffer = '';
-        return false;
-      }
-    }
-
-    if (setting.validate && !setting.validate(parsed)) {
-      this.editingMode = false;
-      this.editBuffer = '';
-      return false;
-    }
-
-    if (isWorktreeSetupListConfigKey(setting.key)) {
-      // Comma-separated display/edit convention for the array-backed
-      // worktree.setup.* keys — see worktree-setup-config.ts.
-      this._setValue(setting.key, parseWorktreeSetupListInput(this.editBuffer));
-    } else if (isSandboxExecListConfigKey(setting.key)) {
-      // Same comma-separated convention for the array-backed
-      // sandbox.egressAllowlist / sandbox.workspaceWritable keys — see
-      // sandbox-exec-config.ts.
-      this._setValue(setting.key, parseSandboxExecListInput(this.editBuffer));
-    } else if (isExecEnvScrubAllowlistConfigKey(setting.key)) {
-      // Same comma-separated convention for permissions.execEnvScrubAllowlist
-      // — see exec-env-scrub-config.ts.
-      this._setValue(setting.key, parseExecEnvScrubAllowlistInput(this.editBuffer));
-    } else if (setting.type === 'string' && isSecretConfigKey(setting.key)) {
-      setSecretBackedSettingValue({
-        key: setting.key,
-        value: String(parsed ?? ''),
-        configManager: this.configManager,
-        secretsManager: this.secretsManager,
-        setConfigValue: (key, value) => this._setValue(key, value),
-      });
-    } else {
-      this._setValue(setting.key as ConfigKey, parsed);
-    }
-    this.editingMode = false;
-    this.editBuffer = '';
-    return true;
+    return _commitEditValue({
+      editingMode: this.editingMode,
+      currentCategory: this.currentCategory,
+      editBuffer: this.editBuffer,
+      configManager: this.configManager,
+      secretsManager: this.secretsManager,
+      mcpRegistry: this.mcpRegistry,
+      mcpAllowAllConfirmationTarget: this.mcpAllowAllConfirmationTarget,
+      getSelectedMcp: () => this.getSelectedMcp(),
+      getSelected: () => this.getSelected(),
+      setValue: (key, value) => this._setValue(key, value),
+      setEditingMode: (v) => { this.editingMode = v; },
+      setEditBuffer: (v) => { this.editBuffer = v; },
+      setMcpEntries: (entries) => { this.mcpEntries = entries; },
+      setMcpAllowAllConfirmationTarget: (v) => { this.mcpAllowAllConfirmationTarget = v; },
+    });
   }
 
   /** Cancel inline edit without saving. */
@@ -781,6 +694,13 @@ export class SettingsModal {
       this.lastSettingEffectMessage = result.effectMessage;
     }
     // No-op (result.changed === false, effectMessage === null): leave lastSettingEffectMessage untouched.
+
+    // Selecting 'prompt' for payments.cvvHandling states the tradeoff at the
+    // moment of selection, not just in the documentation pane — see the
+    // SDK's own CVV_PROMPT_TRADEOFF_WARNING (platform/payments).
+    if (key === PAYMENTS_CVV_HANDLING_CONFIG_KEY && value === 'prompt') {
+      this.lastSettingEffectMessage = CVV_PROMPT_TRADEOFF_WARNING;
+    }
   }
 
   /** Refresh live/persisted/pending state for every feature header bound to `key`. */

package/src/panels/modals/marketplace-modal.ts

@@ -207,6 +207,11 @@ export function createMarketplaceModalSurface(deps: MarketplaceModalDeps): Confi
  * missing paths with existsSync → [], so refresh() finds nothing and renders the
  * honest empty-state copy). The random tmp path never appears in the
  * rendered lines (the empty-state copy is static), so the golden is byte-stable.
+ *
+ * This is production code (ships in the real binary), not test scratch, so
+ * it stays rooted at the real OS temp dir rather than the test-only
+ * makeProjectTempDir helper. Created and removed synchronously in the same
+ * call, so the on-disk window is negligible.
  */
 export function marketplaceModalGoldenSurface(): ConfigModalSurface {
   const root = mkdtempSync(join(tmpdir(), 'gv-marketplace-golden-'));

package/src/panels/modals/skills-modal.ts

@@ -180,6 +180,11 @@ export function createSkillsModalSurface(deps: SkillsModalDeps): ConfigModalSurf
  * homeDir and removed immediately (scanSkillDirectorySync catches missing dirs →
  * []), so refresh() finds no `.goodvibes/skills` directories and renders the
  * static empty-state copy. The random tmp path never appears in the output.
+ *
+ * This is production code (ships in the real binary), not test scratch, so
+ * it stays rooted at the real OS temp dir rather than the test-only
+ * makeProjectTempDir helper. Created and removed synchronously in the same
+ * call, so the on-disk window is negligible.
  */
 export function skillsModalGoldenSurface(): ConfigModalSurface {
   const root = mkdtempSync(join(tmpdir(), 'gv-skills-golden-'));

package/src/renderer/settings-modal-helpers.ts

@@ -112,6 +112,8 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   notifications: 'Notification router burst-suppression tuning: burst window, threshold, and cooldown. Gated by the Adaptive Notification Suppression feature.',
   relay: 'Outbound zero-knowledge relay reachability, for reaching this daemon from outside the LAN without opening an inbound port. Off by default — relay.enabled is the switch. The relay operator sees only ciphertext and connection metadata — self-host your own relay for full control.',
   learning: 'Idle-time memory consolidation: merging duplicate standing memory records and decaying/archiving stale ones. Off by default — nothing runs until enabled.',
+  payments: 'Payment card on file for daemon-initiated purchases: card number, expiry, CVV, cardholder name, billing and shipping address, and whether the CVV is stored or requested at purchase time. Card fields are entered through /payments card (concealed input) and are secret-tier — never rendered in plaintext.',
+  profile: 'What the platform knows about you — your name, how to reach you, where you are, how you like answers written, the people and places you mention — kept as one Markdown file at daemon scope that you can open and edit by hand at any time; your edits win and are never rewritten. These rows decide whether it is loaded at all, whether the assistant records facts it learns from things you say directly to it, whether it tells you in one line each time it does, whether the harmless part (how you are addressed, your city, your timezone, your formatting preferences, your style) is put in the model\'s context so it stops guessing, whether using a private detail such as your address is announced in the reply, whether settings left unset read their value from the profile, and where the file lives. Everything private — your name, contact details, home address, billing and shipping details, quiet hours, and the People, Places, Work and Notes sections — is never put in context in bulk and is reachable only by a named lookup that is disclosed when it happens. Run /profile to read the whole thing, /profile where <field> to see the surface, date and your exact words behind any recorded line, and /profile forget <field> to delete one.',
 };
 
 export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], string> = {
@@ -165,6 +167,8 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   connections: 'Connections',
   policy: 'Policy-as-Code',
   notifications: 'Notifications',
+  payments: 'Payments',
+  profile: 'Owner Profile',
 };
 
 const SETTING_LABELS: Partial<Record<string, string>> = {

package/src/renderer/settings-modal.ts

@@ -13,6 +13,8 @@ import { getDisplayWidth, wrapText } from '../utils/terminal-width.ts';
 import { CATEGORY_INFO, CATEGORY_LABELS, describeUiRouting, formatValue, getSettingLabel, inferSubscriptionRouteReason, valueColor } from './settings-modal-helpers.ts';
 import { buildConnectionContext, renderConnectionRows } from './settings-modal-connections.ts';
 import { isSecretConfigKey } from '../config/secret-config.ts';
+import { maskConcealedText } from '../input/concealed-input.ts';
+import { CVV_PROMPT_TRADEOFF_WARNING } from '@pellux/goodvibes-sdk/platform/payments';
 import { GLYPHS } from './ui-primitives.ts';
 import { formatHints, joinHints } from './hint-grammar.ts';
 import {
@@ -105,6 +107,10 @@ const ENUM_VALUE_DESCRIPTIONS: Record<string, Record<string, string>> = {
     'meta-cloud': 'Use Meta Cloud API credentials and identifiers.',
     bridge: 'Use a bridge service URL/token flow instead of direct Meta Cloud API delivery.',
   },
+  'payments.cvvHandling': {
+    stored: 'Store the CVV through the secret manager so the daemon can complete a purchase unattended.',
+    prompt: CVV_PROMPT_TRADEOFF_WARNING,
+  },
 };
 
 function paddedWrapped(text: string, width: number, prefix = ''): string[] {
@@ -121,7 +127,16 @@ function formatDefaultValue(value: unknown): string {
 }
 
 function currentSettingValue(modal: SettingsModal, entry: SettingEntry, selected: boolean): string {
-  if (selected && modal.editingMode) return `${modal.editBuffer}${GLYPHS.surface.cursor}`;
+  if (selected && modal.editingMode) {
+    // Secret-backed keys (surfaces.*.botToken, .signingSecret, etc. — see
+    // secret-config.ts) must never echo the in-progress plaintext buffer:
+    // not in the row, not in the "Current: ..." context line, not in search
+    // results. Reuse the composer's concealed-input mask (concealed-input.ts)
+    // rather than a second masking implementation — same bullet-per-character
+    // shape, so keystrokes still visibly register without revealing content.
+    const buffer = isSecretConfigKey(entry.setting.key) ? maskConcealedText(modal.editBuffer) : modal.editBuffer;
+    return `${buffer}${GLYPHS.surface.cursor}`;
+  }
   return formatValue(entry);
 }
 

package/src/runtime/bootstrap.ts

@@ -41,7 +41,7 @@ import { initializeBootstrapCore } from './bootstrap-core.ts';
 import { ensureBootModelResolvable } from './provider-fallback.ts';
 import { createBootstrapShell } from './bootstrap-shell.ts';
 import { announceResumeState } from './resume-notice.ts';
-import { announceInstallSelfCheck } from './install-self-check-startup.ts';
+import { announceInstallHealth } from './install-self-check-startup.ts';
 import { buildSharedOrchestratorCoreServices, refreshMemoryRecallSnapshot } from './orchestrator-core-services.ts';
 import { consumeDaemonAttachNotices, consumeExternalDaemonAttachNotices } from './daemon-attach-notices.ts';
 import { wireContextAccountingSource } from './context-accounting-source.ts';
@@ -322,7 +322,7 @@ export async function bootstrapRuntime(
   }).catch(() => {
     // Best-effort — never let the resume notice block or crash boot.
   });
-  announceInstallSelfCheck(systemMessageRouter);
+  announceInstallHealth(systemMessageRouter);
   const { gitStatusProvider, inputHistory, lastGitInfoRef } = shell;
   // FIX 2: dispose the header's live-repo-state poll (git-status.ts
   // startPolling) on shutdown, same pattern as acpTaskSyncInterval above.

package/src/runtime/install-self-check-startup.ts

@@ -17,6 +17,7 @@
 import { existsSync } from 'node:fs';
 import { getGoodVibesPackageRoot, resolveGoodVibesDaemonExecutable } from '../cli/service-posture.ts';
 import { runInstallSelfCheck } from './install-self-check.ts';
+import { announceReachability } from './path-shadow-startup.ts';
 import type { SystemMessageRouter } from '../core/system-message-router.ts';
 
 export function announceInstallSelfCheck(router: SystemMessageRouter): void {
@@ -34,3 +35,25 @@ export function announceInstallSelfCheck(router: SystemMessageRouter): void {
     // Best-effort — an install self-check must never block or crash boot.
   }
 }
+
+/**
+ * The one call boot makes about the state of this install: is it complete
+ * (the check above), is it the copy the shell actually reaches, and is it the
+ * current release (path-shadow-startup).
+ *
+ * They are announced together because they are the same question from the
+ * user's side — "am I looking at the build I think I am" — and because the
+ * three answers are useless apart: a complete install nobody can reach, or a
+ * reachable install three versions old, both end with the product appearing
+ * to have lost a capability it never had.
+ *
+ * The reachability half is async (it may look up the latest release) and is
+ * deliberately not awaited: boot continues, the notice arrives through the
+ * same router a moment later.
+ */
+export function announceInstallHealth(router: SystemMessageRouter): void {
+  announceInstallSelfCheck(router);
+  void announceReachability(router).catch(() => {
+    // Best-effort — a reachability check must never block or crash boot.
+  });
+}

package/src/runtime/onboarding/types.ts

@@ -281,7 +281,12 @@ export type OnboardingApplyOperation =
       readonly kind: 'set-secret';
       readonly key: string;
       readonly value: string;
-      readonly scope?: 'project' | 'user';
+      /**
+       * Which secret tier the value is filed in. 'daemon' is the tier the
+       * daemon reads with every surface closed — see
+       * config/secret-config.ts#defaultSecretBackedScope.
+       */
+      readonly scope?: 'project' | 'user' | 'daemon';
       readonly medium: 'secure' | 'plaintext';
     }
   | {