@pellux/goodvibes-tui 1.25.0 → 1.27.0

package/src/input/payments-config.ts

@@ -0,0 +1,167 @@
+/**
+ * payments-config.ts — TUI-local synthetic settings for the payment card
+ * capability's card MATERIAL fields.
+ *
+ * The SDK's CONFIG_SCHEMA now has a full real `payments` section (28 keys:
+ * enabled, defaultCardId, currency, cvvHandling, the six budget keys,
+ * shipping.preferredTier, the fourteen billing/shipping address sub-fields
+ * (name, line1, line2, city, region, postalCode, country — each repeated for
+ * billingAddress and shippingAddress), the two window keys, and
+ * notifyChannels — see `@pellux/goodvibes-sdk/platform/config`). Every one of
+ * those keys reads and writes through the ordinary CONFIG_SCHEMA-driven path
+ * in settings-modal-data.ts's buildSettingGroups, exactly like `relay.*` or
+ * any other real SDK domain — no synthetic entry or dedicated store is needed
+ * for them, and this module builds none. (An earlier round of this module
+ * modeled billing/shipping address as two flat TUI-local strings; the SDK's
+ * own structured per-field keys superseded that the moment they shipped, so
+ * those two synthetic entries are gone from this file entirely.)
+ *
+ * What this module still builds synthetic entries for is the four card
+ * MATERIAL fields: number, expiry, CVV, cardholder name. Per the SDK's own
+ * design (see its schema-domain-payments.ts header and `platform/payments`'s
+ * method catalog), card material is deliberately never a config path at all:
+ * it lives write-only in the daemon secret store, named by keys the daemon's
+ * own `payments.cards.create` control-plane method derives internally. The
+ * SDK does not yet expose an equivalent config-level path for a single
+ * implicit card the way this app's `/payments card` flow models it, so these
+ * four fields are synthetic sub-keys under the SDK's real `payments`
+ * section — the same established pattern this codebase already uses for
+ * `tts.speed`, `behavior.notifyAfterSeconds`, etc.: a key one level under an
+ * EXISTING section that CONFIG_SCHEMA hasn't grown a scalar entry for yet.
+ *
+ * That one-level-under-an-existing-section shape matters mechanically: the
+ * real ConfigManager's dotted-path resolver only throws "Invalid config path"
+ * when an INTERMEDIATE segment is missing (e.g. `payments.card.number`, where
+ * `card` is not itself a section) — it does not throw for a final leaf that
+ * the schema hasn't declared (`payments.cardNumber`), the same tolerance
+ * `tts.speed` already relies on under `tts`. So these four keys are named
+ * FLAT (`payments.cardNumber`, not `payments.card.number`) specifically so
+ * `ConfigManager.get/setDynamic` accepts them — verified against the real
+ * ConfigManager (not the fake store this module used before this round): a
+ * flat sub-key persists to the real daemon-owned settings file precisely
+ * because `payments.` is a `DAEMON_OWNED_CONFIG_PREFIXES` entry, which is
+ * exactly what makes the daemon (and every other surface) able to see it
+ * after this TUI closes — the thing the local JSON store this module used to
+ * use never gave them.
+ *
+ * All four keys are secret-tier (see config/secret-config.ts's
+ * SECRET_CONFIG_KEYS). Primary entry for those is the concealed-input flow in
+ * commands/payment-card-intake.ts, itself gated on the SDK's
+ * `mayOfferCardEntryFlow` (card details may only be typed at a local
+ * terminal or the webui, never over a remote messaging surface — see that
+ * file's header); they are also reachable as ordinary secret-backed settings
+ * rows here, which is what makes them masked mid-edit — see
+ * renderer/settings-modal.ts's currentSettingValue().
+ *
+ * cvvHandling — real now, not built here — selects whether the CVV is stored
+ * (the default, per the 2026-07-27 payment-capability ruling) or requested at
+ * purchase time; see `CVV_PROMPT_TRADEOFF_WARNING`, imported directly from
+ * `@pellux/goodvibes-sdk/platform/payments` by every caller that needs it
+ * (renderer/settings-modal.ts, settings-modal.ts) — no local copy lives here
+ * or anywhere else in this app.
+ */
+
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { ConfigKey } from '../config/index.ts';
+import type { SettingEntry } from './settings-modal-types.ts';
+
+/** Real ConfigManager's read surface — these four keys are defensive reads (see header comment). */
+export type PaymentsConfigReader = Pick<ConfigManager, 'get'>;
+
+export const PAYMENTS_CARD_NUMBER_CONFIG_KEY = 'payments.cardNumber' as ConfigKey;
+export const PAYMENTS_CARD_EXPIRY_CONFIG_KEY = 'payments.cardExpiry' as ConfigKey;
+export const PAYMENTS_CARD_CVV_CONFIG_KEY = 'payments.cardCvv' as ConfigKey;
+export const PAYMENTS_CARD_CARDHOLDER_NAME_CONFIG_KEY = 'payments.cardholderName' as ConfigKey;
+
+/** The real SDK schema key for the CVV-handling selector — no longer synthetic. */
+export const PAYMENTS_CVV_HANDLING_CONFIG_KEY = 'payments.cvvHandling' as ConfigKey;
+
+function readStringField(configManager: PaymentsConfigReader, key: ConfigKey): string {
+  // Defensive try/catch, same rationale as worktree-setup-config.ts's
+  // readWorktreeSetupList and this codebase's other one-level-under-a-real-
+  // section synthetic reads (tts.speed, behavior.notifyAfterSeconds): the real
+  // ConfigManager never throws for these particular keys (verified — see
+  // header comment), but degrading to empty rather than crashing the whole
+  // settings modal is the same posture every synthetic setting here takes
+  // toward an unexpected value.
+  try {
+    const raw = configManager.get(key);
+    return typeof raw === 'string' ? raw : '';
+  } catch {
+    return '';
+  }
+}
+
+function buildStringFieldEntry(
+  configManager: PaymentsConfigReader,
+  key: ConfigKey,
+  description: string,
+): SettingEntry {
+  const currentValue = readStringField(configManager, key);
+  return {
+    setting: { key, type: 'string', default: '', description },
+    currentValue,
+    isDefault: currentValue === '',
+  };
+}
+
+export function buildPaymentsCardNumberEntry(configManager: PaymentsConfigReader): SettingEntry {
+  return buildStringFieldEntry(
+    configManager,
+    PAYMENTS_CARD_NUMBER_CONFIG_KEY,
+    'Payment card number. Stored through the secret manager at daemon scope; entering it here or via /payments card never shows the typed characters in plaintext.',
+  );
+}
+
+export function buildPaymentsCardExpiryEntry(configManager: PaymentsConfigReader): SettingEntry {
+  return buildStringFieldEntry(
+    configManager,
+    PAYMENTS_CARD_EXPIRY_CONFIG_KEY,
+    'Payment card expiry (MM/YY). Stored through the secret manager at daemon scope, same handling as the card number.',
+  );
+}
+
+export function buildPaymentsCardCvvEntry(configManager: PaymentsConfigReader): SettingEntry {
+  return buildStringFieldEntry(
+    configManager,
+    PAYMENTS_CARD_CVV_CONFIG_KEY,
+    'Payment card CVV. Stored through the secret manager at daemon scope: never logged, never rendered, never shown mid-edit, excluded from every export and diagnostic dump.',
+  );
+}
+
+export function buildPaymentsCardCardholderNameEntry(configManager: PaymentsConfigReader): SettingEntry {
+  return buildStringFieldEntry(
+    configManager,
+    PAYMENTS_CARD_CARDHOLDER_NAME_CONFIG_KEY,
+    'Name on the payment card. Stored through the secret manager at daemon scope, same handling as the card number.',
+  );
+}
+
+/** All payments synthetic entries (the four card-material fields), in the order they should render. */
+export function buildPaymentsSyntheticEntries(configManager: PaymentsConfigReader): SettingEntry[] {
+  return [
+    buildPaymentsCardNumberEntry(configManager),
+    buildPaymentsCardExpiryEntry(configManager),
+    buildPaymentsCardCvvEntry(configManager),
+    buildPaymentsCardCardholderNameEntry(configManager),
+  ];
+}
+
+/** Every payments synthetic config key this module owns, for refresh-loop membership checks. */
+export const PAYMENTS_SYNTHETIC_CONFIG_KEYS: readonly ConfigKey[] = [
+  PAYMENTS_CARD_NUMBER_CONFIG_KEY,
+  PAYMENTS_CARD_EXPIRY_CONFIG_KEY,
+  PAYMENTS_CARD_CVV_CONFIG_KEY,
+  PAYMENTS_CARD_CARDHOLDER_NAME_CONFIG_KEY,
+];
+
+export function isPaymentsSyntheticConfigKey(key: string): key is ConfigKey {
+  return (PAYMENTS_SYNTHETIC_CONFIG_KEYS as readonly string[]).includes(key);
+}
+
+/** Refresh one payments synthetic entry's currentValue/isDefault in place. */
+export function refreshPaymentsSyntheticEntry(entry: SettingEntry, configManager: PaymentsConfigReader): void {
+  const currentValue = readStringField(configManager, entry.setting.key as ConfigKey);
+  entry.currentValue = currentValue;
+  entry.isDefault = currentValue === '';
+}

package/src/input/provider-key-intake.ts

@@ -12,6 +12,7 @@
  */
 
 import type { LLMProvider } from '@pellux/goodvibes-sdk/platform/providers';
+import type { SecretScope } from '../config/secrets.ts';
 import type { ConcealedInputRequest } from './concealed-input.ts';
 import type { CommandContext } from './command-registry.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
@@ -58,7 +59,7 @@ export interface ProviderKeyIntakeDeps {
   readonly provider: LLMProvider | undefined;
   /** Canonical secret store — the same path /secrets set writes through. */
   readonly secretsManager?: {
-    set(key: string, value: string, options?: { scope?: 'project' | 'user'; medium?: 'secure' | 'plaintext' }): Promise<void>;
+    set(key: string, value: string, options?: { scope?: SecretScope; medium?: 'secure' | 'plaintext' }): Promise<void>;
   } | undefined;
   /** Re-resolves credentials and re-registers providers live (no restart). */
   readonly refreshProviderCredentials?: (() => Promise<void>) | undefined;
@@ -112,7 +113,14 @@ export function runProviderKeyIntake(
       }
       void (async () => {
         try {
-          await secretsManager.set(secretKey, value, { scope: 'user', medium: 'secure' });
+          // Daemon scope, not user scope. The DAEMON is the process that runs
+          // the model — it answers Telegram, ntfy, mail and every scheduled
+          // run with this TUI closed. A model key filed in this surface's own
+          // tier is readable only while the TUI is open, so the daemon has no
+          // provider to call and cannot answer at all. Daemon tier is the one
+          // home every surface and the daemon read, so a key entered here works
+          // everywhere, which is the point of configuring it once.
+          await secretsManager.set(secretKey, value, { scope: 'daemon', medium: 'secure' });
           await deps.refreshProviderCredentials?.();
           deps.print(`Stored the API key for ${label} and registered it live (value hidden). No restart needed.`);
         } catch (error) {

package/src/input/settings-modal-commit.ts

@@ -0,0 +1,146 @@
+/**
+ * settings-modal-commit.ts — commitEdit(), extracted out of the SettingsModal
+ * class body so the class file can stay under the repo's architecture
+ * line-count gate without trimming arbitrary lines to clear the number.
+ *
+ * Same dependency-injection shape as settings-modal-activation.ts /
+ * settings-modal-adjustment.ts / settings-modal-reset.ts: explicit getters
+ * and setter callbacks instead of a bound `this`, so the logic is
+ * unit-testable without a live SettingsModal instance and the class method
+ * stays a thin delegator.
+ */
+
+import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
+import { isSecretConfigKey } from '../config/secret-config.ts';
+import { setSecretBackedSettingValue, type SettingsSecretsManager } from './settings-modal-secrets.ts';
+import { buildMcpEntries } from './settings-modal-data.ts';
+import { isWorktreeSetupListConfigKey, parseWorktreeSetupListInput } from './worktree-setup-config.ts';
+import { isSandboxExecListConfigKey, parseSandboxExecListInput } from './sandbox-exec-config.ts';
+import { isExecEnvScrubAllowlistConfigKey, parseExecEnvScrubAllowlistInput } from './exec-env-scrub-config.ts';
+import type { McpEntry, SettingEntry } from './settings-modal-types.ts';
+
+export interface CommitEditContext {
+  readonly editingMode: boolean;
+  readonly currentCategory: string;
+  readonly editBuffer: string;
+  readonly configManager: ConfigManager | null;
+  readonly secretsManager: SettingsSecretsManager | null;
+  readonly mcpRegistry: McpRegistry | null;
+  readonly mcpAllowAllConfirmationTarget: string | null;
+  getSelectedMcp(): McpEntry | null;
+  getSelected(): SettingEntry | null;
+  setValue(key: ConfigKey, value: unknown): void;
+  setEditingMode(value: boolean): void;
+  setEditBuffer(value: string): void;
+  setMcpEntries(entries: McpEntry[]): void;
+  setMcpAllowAllConfirmationTarget(value: string | null): void;
+}
+
+/**
+ * Commit the current editBuffer to the config. Returns true on success,
+ * false if validation failed (the caller always clears editingMode/editBuffer
+ * regardless — a failed commit never leaves stale edit state behind).
+ */
+export function commitEditValue(ctx: CommitEditContext): boolean {
+  if (!ctx.editingMode) return false;
+
+  if (ctx.currentCategory === 'mcp') {
+    const entry = ctx.getSelectedMcp();
+    if (!entry || !ctx.mcpRegistry) return false;
+    if (ctx.mcpAllowAllConfirmationTarget) {
+      const expected = `ALLOW ALL ${ctx.mcpAllowAllConfirmationTarget}`;
+      if (ctx.editBuffer.trim() !== expected) {
+        return false;
+      }
+      ctx.mcpRegistry.setServerTrustMode(entry.name, 'allow-all');
+      ctx.setMcpEntries(buildMcpEntries(ctx.mcpRegistry));
+      ctx.setEditingMode(false);
+      ctx.setEditBuffer('');
+      ctx.setMcpAllowAllConfirmationTarget(null);
+      return true;
+    }
+
+    const nextMode = ctx.editBuffer.trim() as McpEntry['trustMode'];
+    const validModes: McpEntry['trustMode'][] = ['constrained', 'ask-on-risk', 'allow-all', 'blocked'];
+    if (!validModes.includes(nextMode)) {
+      ctx.setEditingMode(false);
+      ctx.setEditBuffer('');
+      ctx.setMcpAllowAllConfirmationTarget(null);
+      return false;
+    }
+    if (nextMode === 'allow-all' && entry.trustMode !== 'allow-all') {
+      ctx.setMcpAllowAllConfirmationTarget(entry.name);
+      ctx.setEditBuffer('');
+      return false;
+    }
+    ctx.mcpRegistry.setServerTrustMode(entry.name, nextMode);
+    ctx.setMcpEntries(buildMcpEntries(ctx.mcpRegistry));
+    ctx.setEditingMode(false);
+    ctx.setEditBuffer('');
+    ctx.setMcpAllowAllConfirmationTarget(null);
+    return true;
+  }
+
+  const entry = ctx.getSelected();
+  if (!entry || !ctx.configManager) return false;
+
+  const { setting } = entry;
+  let parsed: unknown = ctx.editBuffer;
+
+  if (setting.type === 'number') {
+    parsed = Number(ctx.editBuffer);
+    if (isNaN(parsed as number)) {
+      ctx.setEditingMode(false);
+      ctx.setEditBuffer('');
+      return false;
+    }
+  }
+
+  if (setting.type === 'object') {
+    // Object-typed keys (e.g. pricing.modelPrices) edit as JSON; the
+    // schema's validate() below still rules on the parsed shape.
+    try {
+      parsed = JSON.parse(ctx.editBuffer);
+    } catch {
+      ctx.setEditingMode(false);
+      ctx.setEditBuffer('');
+      return false;
+    }
+  }
+
+  if (setting.validate && !setting.validate(parsed)) {
+    ctx.setEditingMode(false);
+    ctx.setEditBuffer('');
+    return false;
+  }
+
+  if (isWorktreeSetupListConfigKey(setting.key)) {
+    // Comma-separated display/edit convention for the array-backed
+    // worktree.setup.* keys — see worktree-setup-config.ts.
+    ctx.setValue(setting.key, parseWorktreeSetupListInput(ctx.editBuffer));
+  } else if (isSandboxExecListConfigKey(setting.key)) {
+    // Same comma-separated convention for the array-backed
+    // sandbox.egressAllowlist / sandbox.workspaceWritable keys — see
+    // sandbox-exec-config.ts.
+    ctx.setValue(setting.key, parseSandboxExecListInput(ctx.editBuffer));
+  } else if (isExecEnvScrubAllowlistConfigKey(setting.key)) {
+    // Same comma-separated convention for permissions.execEnvScrubAllowlist
+    // — see exec-env-scrub-config.ts.
+    ctx.setValue(setting.key, parseExecEnvScrubAllowlistInput(ctx.editBuffer));
+  } else if (setting.type === 'string' && isSecretConfigKey(setting.key)) {
+    setSecretBackedSettingValue({
+      key: setting.key,
+      value: String(parsed ?? ''),
+      configManager: ctx.configManager,
+      secretsManager: ctx.secretsManager,
+      setConfigValue: (key, value) => ctx.setValue(key, value),
+    });
+  } else {
+    ctx.setValue(setting.key as ConfigKey, parsed);
+  }
+  ctx.setEditingMode(false);
+  ctx.setEditBuffer('');
+  return true;
+}

package/src/input/settings-modal-data.ts

@@ -55,6 +55,11 @@ import { enrichRelaySettingDescriptions } from './relay-settings-descriptions.ts
 import { enrichDaemonOwnedSettingDescriptions } from './daemon-owned-settings-descriptions.ts';
 import { applyFeatureUnitLayout } from './feature-unit-layout.ts';
 import { FEATURE_SETTINGS_BY_ID } from '../runtime/feature-settings.ts';
+import {
+  buildPaymentsSyntheticEntries,
+  isPaymentsSyntheticConfigKey,
+  refreshPaymentsSyntheticEntry,
+} from './payments-config.ts';
 
 // ---------------------------------------------------------------------------
 // deepEqual — structural equality for isDefault comparisons
@@ -249,6 +254,19 @@ export function buildSettingGroups(
   injectSandboxExecSyntheticEntries(groups, configManager);
   injectExecEnvScrubSyntheticEntry(groups, configManager);
 
+  // Payment card capability (see payments-config.ts): the CONFIG_SCHEMA loop
+  // above already populated 'payments' with the fourteen real SDK settings
+  // (enabled, defaultCardId, currency, cvvHandling, budgets, shipping,
+  // windows, notifyChannels). What's injected here are the four secret-tier
+  // card-material fields and the two ordinary address fields, which are
+  // TUI-local synthetic sub-keys under that real section (not yet SDK
+  // CONFIG_SCHEMA entries — see payments-config.ts's header comment), backed
+  // by the same real configManager as everything else in this group.
+  const paymentsEntries = groups.get('payments');
+  if (paymentsEntries && !paymentsEntries.some((e) => isPaymentsSyntheticConfigKey(e.setting.key))) {
+    paymentsEntries.push(...buildPaymentsSyntheticEntries(configManager));
+  }
+
   // relay.* is a real SDK CONFIG_SCHEMA domain; append the threat-model note
   // the SDK's own descriptions don't carry (see relay-settings-descriptions.ts).
   enrichRelaySettingDescriptions(groups);
@@ -656,6 +674,14 @@ export function refreshEntryValues(
         entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
         continue;
       }
+      // payments.* synthetic sub-keys (card material + addresses — see
+      // payments-config.ts): real configManager-backed now, but still
+      // defensively normalized (undefined -> '') the same way the initial
+      // build does, so isDefault stays consistent between build and refresh.
+      if (isPaymentsSyntheticConfigKey(entry.setting.key)) {
+        refreshPaymentsSyntheticEntry(entry, configManager);
+        continue;
+      }
       const raw = configManager.get(entry.setting.key as ConfigKey);
       // Synthetic entries (e.g. tts.speed) that have no SDK schema key return
       // undefined from configManager. Normalize using the same logic used at
@@ -694,6 +720,10 @@ export function updateEntryForKey(
         entry.currentValue = refreshed.currentValue; entry.isDefault = refreshed.isDefault;
         continue;
       }
+      if (isPaymentsSyntheticConfigKey(key)) {
+        refreshPaymentsSyntheticEntry(entry, configManager);
+        continue;
+      }
       if (isSandboxExecListConfigKey(key)) {
         entry.currentValue = readSandboxExecList(configManager, key);
         entry.isDefault = (entry.currentValue as string[]).length === 0;

package/src/input/settings-modal-reset.ts

@@ -15,7 +15,7 @@
 
 import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import { logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
-import { buildGoodVibesSecretKey, isSecretConfigKey } from '../config/secret-config.ts';
+import { buildGoodVibesSecretKey, defaultSecretBackedScope, isSecretConfigKey } from '../config/secret-config.ts';
 import type { SettingEntry, SettingsCategory } from './settings-modal-types.ts';
 import type { SettingsSecretsManager } from './settings-modal-secrets.ts';
 
@@ -41,7 +41,11 @@ export function resetSelected({
   const key = selected.setting.key as ConfigKey;
   setValue(key, selected.setting.default);
   if (isSecretConfigKey(key) && secretsManager) {
-    void secretsManager.delete(buildGoodVibesSecretKey(key), { scope: 'user' }).catch((error) => {
+    // Delete from the tier the write went to. A daemon-owned key was stored in
+    // the daemon tier (defaultSecretBackedScope), so a delete narrowed to 'user'
+    // would report a cleared setting while the daemon kept using the live
+    // credential — the reset that isn't one.
+    void secretsManager.delete(buildGoodVibesSecretKey(key), { scope: defaultSecretBackedScope(key) }).catch((error) => {
       logger.error('SettingsModal: failed to clear secret while resetting setting', { key, error: summarizeError(error) });
     });
   }

package/src/input/settings-modal-secrets.ts

@@ -5,6 +5,7 @@ import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { SecretsManager } from '../config/secrets.ts';
 import {
   buildSecretBackedConfigUpdate,
+  defaultSecretBackedScope,
   getSecretWriteMedium,
 } from '../config/secret-config.ts';
 
@@ -24,16 +25,22 @@ export function setSecretBackedSettingValue(args: {
   }
 
   const update = buildSecretBackedConfigUpdate(key, value);
+  // A daemon-owned key (surfaces.*, payments.*, controlPlane.*, ...) names a
+  // credential the daemon itself executes with, so its secret material lands in
+  // the daemon tier — the one the daemon reads with every surface closed —
+  // regardless of which client edited it. Everything else stays at user scope.
+  // See secret-config.ts's defaultSecretBackedScope.
+  const scope = defaultSecretBackedScope(key);
   if (update.secretKey && update.secretValue !== undefined) {
     void secretsManager.set(update.secretKey, update.secretValue, {
-      scope: 'user',
+      scope,
       medium: getSecretWriteMedium(configManager.get('storage.secretPolicy')),
     }).catch((error) => {
       logger.error('SettingsModal: failed to store secret config value', { key, error: summarizeError(error) });
     });
   }
   if (update.clearSecretKey) {
-    void secretsManager.delete(update.clearSecretKey, { scope: 'user' }).catch((error) => {
+    void secretsManager.delete(update.clearSecretKey, { scope }).catch((error) => {
       logger.error('SettingsModal: failed to clear secret config value', { key, error: summarizeError(error) });
     });
   }

package/src/input/settings-modal-types.ts

@@ -52,6 +52,25 @@ export type SettingsCategory =
   | 'update'
   | 'power'
   | 'memory'
+  // payments.* — the card on file for daemon-initiated purchases. Like
+  // 'profile' below, this entry and its SETTINGS_CATEGORY_GROUPS membership are
+  // both mandatory or the whole prefix is dropped from the workspace.
+  | 'payments'
+  // profile.* — the owner profile (docs/owner-profile.md §12.1). This entry and
+  // its SETTINGS_CATEGORY_GROUPS membership below are both mandatory:
+  // buildSettingGroups guards every push with `if (groups.has(cat))`, so a
+  // config prefix with no category here is dropped from the workspace entirely
+  // and reachable only by hand-editing a settings file — see the push.* and
+  // cluster.* comments in settings-modal-data.ts for the two times that happened.
+  | 'profile'
+  // occasions.* — the proactive occasions/plans loop (docs/occasions.md §8):
+  // lead time, active hours, nudge channel and cadence, away-date adjustment,
+  // calendar mirroring, interview length, gift-history retention, and the
+  // sweep interval. Same mandatory-dual-membership rule as profile above, or
+  // all twelve keys are dropped from the workspace and reachable only by
+  // hand-editing a settings file — a third occurrence of the push.*/cluster.*
+  // class the profile comment already names two of.
+  | 'occasions'
   | 'danger';
 
 export type SettingsFocusPane = 'categories' | 'settings';
@@ -64,8 +83,17 @@ export const SETTINGS_CATEGORY_GROUPS: ReadonlyArray<{
   { label: 'AI Routing', categories: ['provider', 'pricing', 'subscriptions', 'helper', 'tools', 'tts', 'voice'] },
   { label: 'Service & Network', categories: ['service', 'daemon', 'network', 'controlPlane', 'httpListener', 'web', 'relay'] },
   { label: 'Surfaces & Cloud', categories: ['surfaces', 'device', 'conversationGate', 'integrations', 'connections', 'mcp', 'cloudflare'] },
-  { label: 'Automation', categories: ['batch', 'automation', 'checkin', 'watchers', 'orchestration', 'planner', 'wrfc'] },
-  { label: 'Runtime & Data', categories: ['storage', 'atRest', 'sandbox', 'fetch', 'agents', 'runtime', 'power', 'memory', 'cache', 'telemetry', 'diagnostics', 'learning'] },
+  // 'occasions' sits beside 'checkin': both are proactive background loops
+  // (a cadence, a judgment pass, a conditional channel delivery) rather than
+  // facts held about the owner — the data occasions/plans declare lives in
+  // the owner profile file itself (docs/occasions.md §3), but these SETTINGS
+  // rows tune the loop, exactly like checkin's.
+  { label: 'Automation', categories: ['batch', 'automation', 'checkin', 'occasions', 'watchers', 'orchestration', 'planner', 'wrfc', 'payments'] },
+  // 'profile' sits beside 'memory' and 'learning': all three are what the
+  // platform retains about the person using it, and this is the group a reader
+  // looking for "what does it know about me" already scans — Interface is
+  // presentation and permission posture, and nothing there is a store of facts.
+  { label: 'Runtime & Data', categories: ['storage', 'atRest', 'sandbox', 'fetch', 'agents', 'runtime', 'power', 'profile', 'memory', 'cache', 'telemetry', 'diagnostics', 'learning'] },
   { label: 'Advanced', categories: ['release', 'update', 'danger'] },
 ];