@pellux/goodvibes-tui 1.25.0 → 1.27.0

package/src/input/settings-modal.ts

@@ -21,19 +21,14 @@ import type { ModelPickerTarget } from './model-picker.ts';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { SubscriptionManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { ServiceInspectionQuery } from '../runtime/ui-service-queries.ts';
-import { isSecretConfigKey } from '../config/secret-config.ts';
-import {
-  setSecretBackedSettingValue,
-  type SettingsSecretsManager,
-} from './settings-modal-secrets.ts';
+import type { SettingsSecretsManager } from './settings-modal-secrets.ts';
+import { CVV_PROMPT_TRADEOFF_WARNING } from '@pellux/goodvibes-sdk/platform/payments';
+import { PAYMENTS_CVV_HANDLING_CONFIG_KEY } from './payments-config.ts';
 import type { FeatureFlagManager } from '@/runtime/index.ts';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
 import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
 import type { ConnectionStatus } from './commands/connection-status.ts';
 import { initialConnectionEntries, refreshConnectionEntries } from './settings-modal-connections.ts';
-import { isWorktreeSetupListConfigKey, parseWorktreeSetupListInput } from './worktree-setup-config.ts';
-import { isSandboxExecListConfigKey, parseSandboxExecListInput } from './sandbox-exec-config.ts';
-import { isExecEnvScrubAllowlistConfigKey, parseExecEnvScrubAllowlistInput } from './exec-env-scrub-config.ts';
 
 import {
   SETTINGS_CATEGORIES,
@@ -74,6 +69,7 @@ import {
   handleResetConfirmKey as _handleResetConfirmKey,
   type ResetConfirmKeyResult,
 } from './settings-modal-reset.ts';
+import { commitEditValue as _commitEditValue } from './settings-modal-commit.ts';
 
 export interface SettingsModalChange {
   readonly key: ConfigKey;
@@ -555,105 +551,22 @@ export class SettingsModal {
    * Returns true on success, false if validation failed.
    */
   commitEdit(): boolean {
-    if (!this.editingMode) return false;
-
-    if (this.currentCategory === 'mcp') {
-      const entry = this.getSelectedMcp();
-      if (!entry || !this.mcpRegistry) return false;
-      if (this.mcpAllowAllConfirmationTarget) {
-        const expected = `ALLOW ALL ${this.mcpAllowAllConfirmationTarget}`;
-        if (this.editBuffer.trim() !== expected) {
-          return false;
-        }
-        this.mcpRegistry.setServerTrustMode(entry.name, 'allow-all');
-        this.mcpEntries = buildMcpEntries(this.mcpRegistry);
-        this.editingMode = false;
-        this.editBuffer = '';
-        this.mcpAllowAllConfirmationTarget = null;
-        return true;
-      }
-
-      const nextMode = this.editBuffer.trim() as McpEntry['trustMode'];
-      const validModes: McpEntry['trustMode'][] = ['constrained', 'ask-on-risk', 'allow-all', 'blocked'];
-      if (!validModes.includes(nextMode)) {
-        this.editingMode = false;
-        this.editBuffer = '';
-        this.mcpAllowAllConfirmationTarget = null;
-        return false;
-      }
-      if (nextMode === 'allow-all' && entry.trustMode !== 'allow-all') {
-        this.mcpAllowAllConfirmationTarget = entry.name;
-        this.editBuffer = '';
-        return false;
-      }
-      this.mcpRegistry.setServerTrustMode(entry.name, nextMode);
-      this.mcpEntries = buildMcpEntries(this.mcpRegistry);
-      this.editingMode = false;
-      this.editBuffer = '';
-      this.mcpAllowAllConfirmationTarget = null;
-      return true;
-    }
-
-    const entry = this.getSelected();
-    if (!entry || !this.configManager) return false;
-
-    const { setting } = entry;
-    let parsed: unknown = this.editBuffer;
-
-    if (setting.type === 'number') {
-      parsed = Number(this.editBuffer);
-      if (isNaN(parsed as number)) {
-        this.editingMode = false;
-        this.editBuffer = '';
-        return false;
-      }
-    }
-
-    if (setting.type === 'object') {
-      // Object-typed keys (e.g. pricing.modelPrices) edit as JSON; the
-      // schema's validate() below still rules on the parsed shape.
-      try {
-        parsed = JSON.parse(this.editBuffer);
-      } catch {
-        this.editingMode = false;
-        this.editBuffer = '';
-        return false;
-      }
-    }
-
-    if (setting.validate && !setting.validate(parsed)) {
-      this.editingMode = false;
-      this.editBuffer = '';
-      return false;
-    }
-
-    if (isWorktreeSetupListConfigKey(setting.key)) {
-      // Comma-separated display/edit convention for the array-backed
-      // worktree.setup.* keys — see worktree-setup-config.ts.
-      this._setValue(setting.key, parseWorktreeSetupListInput(this.editBuffer));
-    } else if (isSandboxExecListConfigKey(setting.key)) {
-      // Same comma-separated convention for the array-backed
-      // sandbox.egressAllowlist / sandbox.workspaceWritable keys — see
-      // sandbox-exec-config.ts.
-      this._setValue(setting.key, parseSandboxExecListInput(this.editBuffer));
-    } else if (isExecEnvScrubAllowlistConfigKey(setting.key)) {
-      // Same comma-separated convention for permissions.execEnvScrubAllowlist
-      // — see exec-env-scrub-config.ts.
-      this._setValue(setting.key, parseExecEnvScrubAllowlistInput(this.editBuffer));
-    } else if (setting.type === 'string' && isSecretConfigKey(setting.key)) {
-      setSecretBackedSettingValue({
-        key: setting.key,
-        value: String(parsed ?? ''),
-        configManager: this.configManager,
-        secretsManager: this.secretsManager,
-        setConfigValue: (key, value) => this._setValue(key, value),
-      });
-    } else {
-      this._setValue(setting.key as ConfigKey, parsed);
-    }
-    this.editingMode = false;
-    this.editBuffer = '';
-    return true;
+    return _commitEditValue({
+      editingMode: this.editingMode,
+      currentCategory: this.currentCategory,
+      editBuffer: this.editBuffer,
+      configManager: this.configManager,
+      secretsManager: this.secretsManager,
+      mcpRegistry: this.mcpRegistry,
+      mcpAllowAllConfirmationTarget: this.mcpAllowAllConfirmationTarget,
+      getSelectedMcp: () => this.getSelectedMcp(),
+      getSelected: () => this.getSelected(),
+      setValue: (key, value) => this._setValue(key, value),
+      setEditingMode: (v) => { this.editingMode = v; },
+      setEditBuffer: (v) => { this.editBuffer = v; },
+      setMcpEntries: (entries) => { this.mcpEntries = entries; },
+      setMcpAllowAllConfirmationTarget: (v) => { this.mcpAllowAllConfirmationTarget = v; },
+    });
   }
 
   /** Cancel inline edit without saving. */
@@ -781,6 +694,13 @@ export class SettingsModal {
       this.lastSettingEffectMessage = result.effectMessage;
     }
     // No-op (result.changed === false, effectMessage === null): leave lastSettingEffectMessage untouched.
+
+    // Selecting 'prompt' for payments.cvvHandling states the tradeoff at the
+    // moment of selection, not just in the documentation pane — see the
+    // SDK's own CVV_PROMPT_TRADEOFF_WARNING (platform/payments).
+    if (key === PAYMENTS_CVV_HANDLING_CONFIG_KEY && value === 'prompt') {
+      this.lastSettingEffectMessage = CVV_PROMPT_TRADEOFF_WARNING;
+    }
   }
 
   /** Refresh live/persisted/pending state for every feature header bound to `key`. */

package/src/main.ts

@@ -55,6 +55,7 @@ import { applyInitialTuiCliState, reportFatalStartupError } from './cli/tui-star
 import { applyConfiguredHitlMode, applyRuntimeConfigValue, applyTuiRuntimeConfigDefaults } from './cli/config-overrides.ts';
 import { renderToolCallBlock } from './renderer/tool-call.ts';
 import { wireSpokenTurnRuntime } from './audio/spoken-turn-wiring.ts';
+import { installVoiceCapture } from './shell/voice-capture-shell.ts';
 import { attachSpokenTurnModelRouting, createSpokenTurnInputOptions } from './audio/spoken-turn-model-routing.ts';
 import { allowTerminalWrite, installTuiTerminalOutputGuard } from './runtime/terminal-output-guard.ts';
 import { installProcessLifecycle } from './runtime/process-lifecycle.ts';
@@ -189,6 +190,8 @@ async function main() {
   const failoverState = createFailoverTurnState();
 
   const getPromptContentWidth = () => computePromptContentWidth(stdout.columns);
+  // Live-microphone footer row (push-to-talk or the wake detector); assigned once voice capture is wired below, null until then so pre-wiring frames size correctly.
+  let voiceCaptureStatus: () => import('./core/voice-capture-status.ts').VoiceCaptureIndicatorState | null = () => null;
 
   const getViewportHeight = (): number => {
     if (input.onboardingWizard.active) return stdout.rows || 24;
@@ -197,7 +200,7 @@ async function main() {
     const contextWindow = providerRegistry.getContextWindowForModel(currentModel);
     const rows = stdout.rows || 24;
     // Compact threshold must match buildShellFooter's `compact: height < 30` posture below, else estimateShellFooterHeight's cached-height fast path answers with the wrong mode.
-    return rows - 2 - estimateShellFooterHeight(promptLines, contextWindow, rows < 30);
+    return rows - 2 - estimateShellFooterHeight(promptLines, contextWindow, rows < 30, voiceCaptureStatus());
   };
 
   const scroll = (delta: number) => {
@@ -333,8 +336,7 @@ async function main() {
     render();
   };
 
-  commandContext.submitInput = submitInput;
-  commandContext.submitSpokenInput = (text, content) => submitInput(text, content, { spokenOutput: true });
+  commandContext.submitInput = submitInput; commandContext.submitSpokenInput = (text, content) => submitInput(text, content, { spokenOutput: true });
   commandContext.stopSpokenOutput = () => spokenTurns.stop(); commandContext.pasteFromClipboard = () => input.handlePaste();
   // Read-only view of pending [TEXT: pN, M lines] fold markers, so /pastes
   // can preview a folded paste's actual content before the user submits it.
@@ -418,19 +420,19 @@ async function main() {
     },
   );
 
-  orchestratorRefs.getViewportHeight = getViewportHeight;
-  orchestratorRefs.scrollToEnd = scrollToEnd;
+  orchestratorRefs.getViewportHeight = getViewportHeight; orchestratorRefs.scrollToEnd = scrollToEnd;
 
   input.setCommandRegistry(commandRegistry, commandContext);
   commandContext.openComposerEditor = makeComposerEditorOpener({ buffer: input, stdin, stdout, writeGuard: allowTerminalWrite, repaint: () => { compositor.resetDiff(); render(); }, cwd: workingDir, env: process.env, notify: (m) => systemMessageRouter.high(m) });
   input.setConversationManager(conversation);
-  input.setContentWidth(getPromptContentWidth());
-  input.filePicker.setOnUpdate(() => render());
+  input.setContentWidth(getPromptContentWidth()); input.filePicker.setOnUpdate(() => render());
   // retirement: agentDetailModal/processModal setOnRefresh wiring removed —
   // those modals were deleted (Fleet subsumes the live process tree via F2).
 
   // Model picker callback is handled in bootstrap.ts — do not duplicate here.
   input.setHistory(inputHistory);
+  // ONE microphone path, shared by push-to-talk voice input (Alt+V) and wake-word detection; opens no device by itself (shell/voice-capture-shell.ts).
+  voiceCaptureStatus = installVoiceCapture({ configManager, shellPaths: ctx.services.shellPaths, homeDirectory, sessionId: ctx.runtime.sessionId, commandContext, unsubs, buffer: input, submitInput, notify: (m) => { systemMessageRouter.high(m); render(); }, render: () => render() });
 
   const toolCount = toolRegistry.list().length;
   conversation.splashOptions = {
@@ -511,7 +513,7 @@ async function main() {
       composerMode: composerState.modeLabel,
       composerStatus: composerState.statusLabel,
       composerFlags: composerState.flags,
-      composerPendingRisk: composerState.pendingRisk, permissionMode: configManager.get('permissions.mode') as string,
+      composerPendingRisk: composerState.pendingRisk, permissionMode: configManager.get('permissions.mode') as string, voiceCapture: voiceCaptureStatus(),
     }).lines;
 
     const onboardingOwnsScreen = input.onboardingWizard.active;
@@ -735,9 +737,7 @@ async function main() {
   process.on('exit', exitListener);
 
   // --- Terminal setup ---
-  stdin.setRawMode(true);
-  stdin.resume();
-  stdin.setEncoding('utf8');
+  stdin.setRawMode(true); stdin.resume(); stdin.setEncoding('utf8');
   allowTerminalWrite(() => stdout.write((cli.flags.noAltScreen ? '' : ALT_SCREEN_ENTER) + CLEAR_SCREEN + CURSOR_HIDE + MOUSE_ENABLE + KEYBOARD_EXT_ENABLE + PASTE_ENABLE + FOCUS_ENABLE));
   // forced dark/light applies before first paint; auto (TTY only) fires the
   // OSC 11 probe and repaints once if light wins. filterInput strips the reply from stdin.
@@ -771,9 +771,7 @@ async function main() {
 
     input.feed(data);
   });
-  process.on('SIGINT', sigintHandler);
-  process.on('unhandledRejection', unhandledRejectionHandler);
-  stdout.on('resize', resizeHandler);
+  process.on('SIGINT', sigintHandler); process.on('unhandledRejection', unhandledRejectionHandler); stdout.on('resize', resizeHandler);
 
   // State restores happen ONLY when the user explicitly asks — a CLI flag
   // (--continue/--resume/--fork), a slash command (/session resume,

package/src/panels/modals/marketplace-modal.ts

@@ -207,6 +207,11 @@ export function createMarketplaceModalSurface(deps: MarketplaceModalDeps): Confi
  * missing paths with existsSync → [], so refresh() finds nothing and renders the
  * honest empty-state copy). The random tmp path never appears in the
  * rendered lines (the empty-state copy is static), so the golden is byte-stable.
+ *
+ * This is production code (ships in the real binary), not test scratch, so
+ * it stays rooted at the real OS temp dir rather than the test-only
+ * makeProjectTempDir helper. Created and removed synchronously in the same
+ * call, so the on-disk window is negligible.
  */
 export function marketplaceModalGoldenSurface(): ConfigModalSurface {
   const root = mkdtempSync(join(tmpdir(), 'gv-marketplace-golden-'));

package/src/panels/modals/skills-modal.ts

@@ -180,6 +180,11 @@ export function createSkillsModalSurface(deps: SkillsModalDeps): ConfigModalSurf
  * homeDir and removed immediately (scanSkillDirectorySync catches missing dirs →
  * []), so refresh() finds no `.goodvibes/skills` directories and renders the
  * static empty-state copy. The random tmp path never appears in the output.
+ *
+ * This is production code (ships in the real binary), not test scratch, so
+ * it stays rooted at the real OS temp dir rather than the test-only
+ * makeProjectTempDir helper. Created and removed synchronously in the same
+ * call, so the on-disk window is negligible.
  */
 export function skillsModalGoldenSurface(): ConfigModalSurface {
   const root = mkdtempSync(join(tmpdir(), 'gv-skills-golden-'));

package/src/renderer/process-indicator.ts

@@ -4,6 +4,7 @@ import { truncateDisplay } from '../utils/terminal-width.ts';
 import { GLYPHS, UI_TONES } from './ui-primitives.ts';
 import { activeUiTones } from './theme.ts';
 import { formatHints } from './hint-grammar.ts';
+import { voiceCaptureRowVisible, type VoiceCaptureIndicatorState } from '../core/voice-capture-status.ts';
 
 /**
  * renderProcessIndicator — shows a one-line summary of active background
@@ -95,3 +96,68 @@ export function renderProcessIndicator(
   const hint = `  ${formatHints([{ key: 'Enter', verb: 'View' }])}`;
   return renderPlainStatus(`${label}${hint}`, { fg: activeUiTones().accent.brand, bold: true });
 }
+
+/**
+ * Sentence each capture state renders as. Written out per state rather than
+ * assembled from fragments because these are the words that tell a user whether
+ * their microphone is open — "listening" and "recording" mean different things
+ * and a row that blurred them would be worse than no row.
+ */
+const VOICE_CAPTURE_LABELS: Record<VoiceCaptureIndicatorState['kind'], string> = {
+  requesting: 'opening the microphone',
+  recording: 'recording — press the voice-input key again to stop',
+  transcribing: 'transcribing what you said',
+  'wake-listening': 'listening for the wake phrase',
+  'wake-capturing': 'wake heard — recording what follows',
+  'wake-restarting': 'capture stream ended — restarting',
+  'wake-latched': 'wake detection stopped',
+};
+
+/**
+ * renderVoiceCaptureIndicator — the persistent row shown while a microphone is
+ * open, below the input area beside the process indicator.
+ *
+ * It exists because a held-open capture device is otherwise invisible: wake
+ * detection runs for as long as the feature is on, and nothing else on screen
+ * would say so. `voice.wake.indicator` chooses between `statusline` (one dim
+ * row), `banner` (a highlighted row that is hard to miss) and `off`; a
+ * push-to-talk recording always renders, because the user pressed a key one
+ * moment ago and is waiting on it.
+ *
+ * Returns no lines when nothing is captured, or when the wake rows are turned
+ * off — the caller splices whatever comes back, so an empty array is "no row".
+ */
+export function renderVoiceCaptureIndicator(
+  width: number,
+  state: VoiceCaptureIndicatorState | null,
+): Line[] {
+  if (!voiceCaptureRowVisible(state) || state === null) return [];
+  const tones = activeUiTones();
+  const marker = state.kind === 'wake-latched' ? GLYPHS.status.blocked : GLYPHS.status.active;
+  const device = state.deviceLabel !== null ? ` ${GLYPHS.navigation.pipeSeparator} ${state.deviceLabel}` : '';
+  const extra = state.detail !== undefined && state.detail.length > 0
+    ? ` ${GLYPHS.navigation.pipeSeparator} ${state.detail}`
+    : '';
+  const body = `${marker} Voice: ${VOICE_CAPTURE_LABELS[state.kind]}${device}${extra}`;
+  const isWakeRow = state.kind.startsWith('wake-');
+  const fg = state.kind === 'wake-latched' || state.kind === 'wake-restarting'
+    ? tones.chrome.warn
+    : tones.accent.control;
+
+  if (isWakeRow && state.indicator === 'banner') {
+    // The prominent variant: the row is filled to the terminal width on the
+    // footer background so it reads as a standing condition, not a passing note.
+    const line = UIFactory.stringToLine(' '.repeat(width), width, { fg: tones.chrome.faint });
+    const text = ` ${truncateDisplay(body, Math.max(0, width - 4), '…')} `;
+    for (let i = 0; i < text.length && 1 + i < width - 1; i++) {
+      const cell = line[1 + i]!;
+      cell.char = text[i]!;
+      cell.fg = fg;
+      cell.bg = tones.bg.footer;
+      cell.bold = true;
+      cell.dim = false;
+    }
+    return [line];
+  }
+  return [UIFactory.stringToLine(`   ${truncateDisplay(body, Math.max(0, width - 4), '…')}`, width, { fg, bold: true })];
+}

package/src/renderer/settings-modal-helpers.ts

@@ -77,7 +77,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   wrfc: 'Work-review-fix-cycle thresholds, retry limits, and automatic commit behavior.',
   helper: 'Helper model defaults used by helper subsystems when they do not use the main chat route.',
   tts: 'Text-to-speech provider, voice, and optional spoken-turn LLM overrides.',
-  voice: 'Two independent voice capabilities. Local engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro — all empty by default, configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error); once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension. Wake-word detection (voice.wake.*, rendered as its own unit below): listening continuously for a spoken wake phrase and handing the utterance that follows to speech-to-text — off by default, because holding a microphone open is meant to be an explicit act. Its published recall figures are measured on synthesised speech only, so no human recording of the phrase is behind them.',
+  voice: 'Two independent voice capabilities. Local engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro — all empty by default, configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error); once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension. Wake-word detection (voice.wake.*, rendered as its own unit below): listening continuously for a spoken wake phrase and handing the utterance that follows to speech-to-text — off by default, because holding a microphone open is meant to be an explicit act. It is live on this terminal: enabling it starts a recorder subprocess (voice.wake.captureCommand), scores every frame with the pinned classifier through a WASM runtime, plays voice.wake.activationSound at a confirmed wake, shows a persistent footer row per voice.wake.indicator, and sends what follows to the same speech-to-text call — into the composer, or submitted outright when voice.wake.autoSubmit is on. The same capture path backs push-to-talk voice input (Alt+V by default), which always lands in the composer. voice.wake.noiseSuppression: speex runs here — the filter travels with the platform, so there is nothing to install for it — and voice.wake.vadThreshold above 0 screens frames with the pinned speech gate once provisioning has fetched it, refusing to start before that rather than scoring frames it claims to be screening. The model is already on this machine: installing goodvibes downloads and checksum-verifies it, and a running daemon retries at boot if the install could not reach the network — so switching this on normally needs no setup step. Switching it on never downloads anything itself; a host whose artifacts are missing or fail verification says which and names /voice wake setup rather than pretending to listen. Its published recall figures are measured on synthesised speech only, so no human recording of the phrase is behind them.',
   service: 'Background service posture: enabled state, autostart, restart behavior, service name, platform, and logs.',
   daemon: 'Local session daemon. It hosts the shared session broker and companion chat so a session started here is visible and steerable from other surfaces. On by default, bound to loopback (127.0.0.1) only.',
   controlPlane: 'Daemon control-plane settings for local admin/API access.',
@@ -86,6 +86,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   batch: 'Batch execution settings, including local vs Cloudflare queue behavior.',
   automation: 'Scheduled and automated run settings, concurrency, timeout, catch-up, cooldown, and retention behavior.',
   checkin: 'Proactive check-in: on a cadence, a briefing is judged and you are contacted only when something warrants it. Off by default; every run — scheduled or manual — leaves a receipt (see /checkin) recording whether it stayed quiet, delivered a message, or was skipped.',
+  occasions: 'Proactive occasions and plans: dated, usually-recurring things that need an action (birthdays, anniversaries) and dated ranges that need only to be known about (a vacation). On by default. Lead time before a date, active hours nudges are allowed to arrive in, the nudge channel (empty makes it pull-only through /occasions), cadence while a window is open and the daily final stretch before it closes, whether an away plan moves a nudge earlier, whether a confirmed occasion mirrors to the calendar and whether a mirrored one suppresses its own nudge, how many questions the gift interview asks, how many years of gift history it keeps, and how often the sweep pass runs. The nudge itself never names the date — only how soon.',
   watchers: 'File/process watcher heartbeat, polling, and recovery-window behavior, plus the trigger family (watchers.triggers.*, rendered as its own unit): stream watchers that regex-filter and batch a long-lived command\'s output, model-free condition checks running a probe/extract/rule pipeline with no LLM in the loop, and one-shot on-exit triggers that fire exactly one payload when a launched command terminates. The trigger family is off by default — a trigger supervises real processes with nobody watching — and its rows tune the backoff ladder, the strike breaker, retention bounds, batching, and process caps.',
   runtime: 'Runtime guardrails such as companion chat limiter and event bus listener caps.',
   telemetry: 'Telemetry payload policy.',
@@ -94,7 +95,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   mcp: 'MCP server trust and scope review. Trust changes can expose local files, tools, databases, browsers, or remote automation depending on the server.',
   sandbox: 'Isolation strategy for REPL, MCP, Windows, and QEMU-backed execution. Use these settings to separate risky tools from the host shell.',
   surfaces: 'External app surfaces such as Slack, Discord, ntfy, Home Assistant, Telegram, webhooks, chat bridges, and messaging providers.',
-  device: 'Posture for using a PAIRED phone as a tool — its cameras, its screen, its location, its clipboard, and a small set of device effects. Two rows change behaviour today. device.capabilities.mode is the live switch: off stops every capability request reaching any paired device, ask-every-time asks on every single request and never consults a durable grant, and honor-grants (stock) asks the first time and every time after unless you chose "always allow" for that one capability on that one phone. device.nodes.maxPaired is enforced at the moment a device pairs: at the cap a NEW device is refused with a message naming the setting, the cap and how many are already paired, while a phone that is already in the list simply supersedes its own record and keeps working. Lowering the cap below the number already paired unpairs no one — existing devices keep working and only the next new pairing is refused; a device moving off the legacy shared token to its own is exempt so it cannot be stranded; and a nonsensical cap (zero, negative, not a number) is read as no cap at all, because a broken setting must never lock you out of your own daemon. The cap is re-read at every pairing, so a change applies without a restart. The remaining rows state the posture the capability service is built to honour — which capabilities may be granted durably, how long a phone has to answer, how exact a location it reports, whether the clipboard can be read, how long captures and grants live, and how often housekeeping sweeps. They are recorded and read back exactly as you set them, but no surface in THIS build maps them into a running capability session — the capability service currently runs on its own matching defaults. Your values are kept and take effect in the release that wires the session up.',
+  device: 'Posture for using a PAIRED phone as a tool — its cameras, its screen, its location, its clipboard, and a small set of device effects. Every row here changes behaviour, and every change applies to the next request without a restart. device.capabilities.mode is the master switch: off stops every capability request reaching any paired device (nothing is dispatched and nobody is asked), ask-every-time asks on every single request and never consults or offers a durable grant, and honor-grants (stock) asks the first time and every time after unless you chose "always allow" for that one capability on that one phone. allowAlwaysOffer decides which capabilities may offer that durable grant at all: every-capability (stock), standard-only (the elevated ones — front camera, screen capture, precise location, clipboard read — keep asking and an "always" answer is honoured for that one request only), or never. requestTimeoutSeconds is the deadline on three things at once: how long the phone has to answer, the deadline written into the request the phone receives, and how long the confirmation prompt itself stays open. device.location.precision gates the street-level fix (coarse-only refuses it and still serves approximate; ask-precise serves it but never remembers it), and device.clipboard.readMode gates reading the clipboard the same way — putting text ON the clipboard is a different capability and is unaffected. Captures from the camera and the screen are kept for capture.retentionHours and capped at capture.maxArtifacts, whichever bites first; housekeeping runs at every start and then every capture.sweepIntervalMinutes, deleting expired grants and captures and recording what it removed and why. A grant lasts grants.expiryDays and is never honoured past it, one phone holds at most grants.maxPerNode grants (the oldest are reaped past the cap), and the ledger of grants given, used, revoked and expired is kept for grants.auditRetentionDays. device.nodes.maxPaired is enforced at the moment a device pairs: at the cap a NEW device is refused with a message naming the setting, the cap and how many are already paired, while a phone that is already in the list simply supersedes its own record and keeps working. Lowering the cap below the number already paired unpairs no one — existing devices keep working and only the next new pairing is refused; a device moving off the legacy shared token to its own is exempt so it cannot be stranded. A nonsensical value anywhere here (zero, negative, not a number, an enum value that is not on the list) is read as the stock value rather than passed through, so a broken setting can neither lock you out of your own daemon nor widen the posture.',
   conversationGate: 'What a message arriving from one of those channels does. By default it gets a conversational answer, and work is proposed and waits for your agreement rather than starting on its own; you can instead confirm every run, or restore the old behavior where a message starts work immediately. Also how long a pending proposal stays answerable and how many can wait at once. This governs messages from channels only — what you type here always runs, and schedules and triggers were authorized when created.',
   cloudflare: 'Optional Cloudflare control plane, batch queue, Worker, Tunnel, Access, DNS, KV, Durable Objects, Secrets Store, and R2 settings.',
   release: 'Release-channel preference.',
@@ -112,6 +113,8 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   notifications: 'Notification router burst-suppression tuning: burst window, threshold, and cooldown. Gated by the Adaptive Notification Suppression feature.',
   relay: 'Outbound zero-knowledge relay reachability, for reaching this daemon from outside the LAN without opening an inbound port. Off by default — relay.enabled is the switch. The relay operator sees only ciphertext and connection metadata — self-host your own relay for full control.',
   learning: 'Idle-time memory consolidation: merging duplicate standing memory records and decaying/archiving stale ones. Off by default — nothing runs until enabled.',
+  payments: 'Payment card on file for daemon-initiated purchases: card number, expiry, CVV, cardholder name, billing and shipping address, and whether the CVV is stored or requested at purchase time. Card fields are entered through /payments card (concealed input) and are secret-tier — never rendered in plaintext.',
+  profile: 'What the platform knows about you — your name, how to reach you, where you are, how you like answers written, the people and places you mention — kept as one Markdown file at daemon scope that you can open and edit by hand at any time; your edits win and are never rewritten. These rows decide whether it is loaded at all, whether the assistant records facts it learns from things you say directly to it, whether it tells you in one line each time it does, whether the harmless part (how you are addressed, your city, your timezone, your formatting preferences, your style) is put in the model\'s context so it stops guessing, whether using a private detail such as your address is announced in the reply, whether settings left unset read their value from the profile, and where the file lives. Everything private — your name, contact details, home address, billing and shipping details, quiet hours, and the People, Places, Work and Notes sections — is never put in context in bulk and is reachable only by a named lookup that is disclosed when it happens. Run /profile to read the whole thing, /profile where <field> to see the surface, date and your exact words behind any recorded line, and /profile forget <field> to delete one.',
 };
 
 export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], string> = {
@@ -139,6 +142,7 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   batch: 'Batch',
   automation: 'Automation',
   checkin: 'Check-in',
+  occasions: 'Occasions & Plans',
   watchers: 'Watchers',
   runtime: 'Runtime',
   telemetry: 'Telemetry',
@@ -165,6 +169,8 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   connections: 'Connections',
   policy: 'Policy-as-Code',
   notifications: 'Notifications',
+  payments: 'Payments',
+  profile: 'Owner Profile',
 };
 
 const SETTING_LABELS: Partial<Record<string, string>> = {

package/src/renderer/settings-modal.ts

@@ -13,6 +13,8 @@ import { getDisplayWidth, wrapText } from '../utils/terminal-width.ts';
 import { CATEGORY_INFO, CATEGORY_LABELS, describeUiRouting, formatValue, getSettingLabel, inferSubscriptionRouteReason, valueColor } from './settings-modal-helpers.ts';
 import { buildConnectionContext, renderConnectionRows } from './settings-modal-connections.ts';
 import { isSecretConfigKey } from '../config/secret-config.ts';
+import { maskConcealedText } from '../input/concealed-input.ts';
+import { CVV_PROMPT_TRADEOFF_WARNING } from '@pellux/goodvibes-sdk/platform/payments';
 import { GLYPHS } from './ui-primitives.ts';
 import { formatHints, joinHints } from './hint-grammar.ts';
 import {
@@ -105,6 +107,10 @@ const ENUM_VALUE_DESCRIPTIONS: Record<string, Record<string, string>> = {
     'meta-cloud': 'Use Meta Cloud API credentials and identifiers.',
     bridge: 'Use a bridge service URL/token flow instead of direct Meta Cloud API delivery.',
   },
+  'payments.cvvHandling': {
+    stored: 'Store the CVV through the secret manager so the daemon can complete a purchase unattended.',
+    prompt: CVV_PROMPT_TRADEOFF_WARNING,
+  },
 };
 
 function paddedWrapped(text: string, width: number, prefix = ''): string[] {
@@ -121,7 +127,16 @@ function formatDefaultValue(value: unknown): string {
 }
 
 function currentSettingValue(modal: SettingsModal, entry: SettingEntry, selected: boolean): string {
-  if (selected && modal.editingMode) return `${modal.editBuffer}${GLYPHS.surface.cursor}`;
+  if (selected && modal.editingMode) {
+    // Secret-backed keys (surfaces.*.botToken, .signingSecret, etc. — see
+    // secret-config.ts) must never echo the in-progress plaintext buffer:
+    // not in the row, not in the "Current: ..." context line, not in search
+    // results. Reuse the composer's concealed-input mask (concealed-input.ts)
+    // rather than a second masking implementation — same bullet-per-character
+    // shape, so keystrokes still visibly register without revealing content.
+    const buffer = isSecretConfigKey(entry.setting.key) ? maskConcealedText(modal.editBuffer) : modal.editBuffer;
+    return `${buffer}${GLYPHS.surface.cursor}`;
+  }
   return formatValue(entry);
 }
 

package/src/renderer/shell-surface.ts

@@ -1,6 +1,7 @@
 import type { Line } from '../types/grid.ts';
-import { renderProcessIndicator } from './process-indicator.ts';
+import { renderProcessIndicator, renderVoiceCaptureIndicator } from './process-indicator.ts';
 import { UIFactory } from './ui-factory.ts';
+import { voiceCaptureRowVisible, type VoiceCaptureIndicatorState } from '../core/voice-capture-status.ts';
 
 export interface ShellFooterBuildOptions {
   readonly width: number;
@@ -84,6 +85,14 @@ export interface ShellFooterBuildOptions {
   readonly webSurfaceUrl?: string;
   /** True while power.keepAwake holds — renders the always-visible "sleep disabled" chip. */
   readonly powerKeepAwake?: boolean;
+  /**
+   * Live microphone state — a push-to-talk recording, or the wake detector for
+   * as long as it runs. Rendered as a persistent row beside the process
+   * indicator, because a capture device held open with nothing on screen saying
+   * so is the one state a voice feature must never be in. Null (or a wake state
+   * with `voice.wake.indicator: off`) renders nothing.
+   */
+  readonly voiceCapture?: VoiceCaptureIndicatorState | null;
 }
 
 export interface ShellFooterBuildResult {
@@ -98,6 +107,8 @@ export interface ShellFooterBuildResult {
 const FOOTER_BASE_ROWS = 5;
 const CONTEXT_PROGRESS_ROWS = 1;
 const PROCESS_INDICATOR_ROWS = 1;
+/** The live-microphone row, when one is showing (see renderVoiceCaptureIndicator). */
+const VOICE_CAPTURE_ROWS = 1;
 // Compact posture drops the context-info line (and never shows the context
 // bar or process indicator), leaving just: prompt-box top border, bottom
 // border, token-usage line, and the help/exit line.
@@ -151,6 +162,7 @@ export function estimateShellFooterHeight(
   promptLineCount: number,
   contextWindow?: number,
   compact = false,
+  voiceCapture: VoiceCaptureIndicatorState | null = null,
 ): number {
   if (lastRenderedFooterHeight !== null && lastRenderedFooterHeight.compact === compact) {
     return lastRenderedFooterHeight.height;
@@ -160,7 +172,11 @@ export function estimateShellFooterHeight(
     return COMPACT_FOOTER_BASE_ROWS + safePromptLines;
   }
   const progressRows = contextWindow && contextWindow > 0 ? CONTEXT_PROGRESS_ROWS : 0;
-  return FOOTER_BASE_ROWS + safePromptLines + progressRows + PROCESS_INDICATOR_ROWS;
+  // Counted on the cold-start path too: a shell launched with the wake detector
+  // already listening renders that row in its very first frame, and a viewport
+  // sized one row too tall would draw the transcript's last line under it.
+  const voiceRows = voiceCaptureRowVisible(voiceCapture) ? VOICE_CAPTURE_ROWS : 0;
+  return FOOTER_BASE_ROWS + safePromptLines + progressRows + PROCESS_INDICATOR_ROWS + voiceRows;
 }
 
 export function buildShellFooter(
@@ -206,7 +222,10 @@ export function buildShellFooter(
       options.runningAgentProgress,
     );
     const inputBoxRows = Math.max(1, options.promptLineCount) + 2;
-    lines.splice(inputBoxRows, 0, ...processIndicator);
+    // The voice row sits directly under the prompt box, ABOVE the process
+    // indicator: an open microphone is a live condition the user is acting inside,
+    // while the process indicator is a background summary.
+    lines.splice(inputBoxRows, 0, ...renderVoiceCaptureIndicator(options.width, options.voiceCapture ?? null), ...processIndicator);
     // Scriptable status line — dim informational line above the prompt. Unshifted
     // before the context hint so the context hint (if any) sits above it.
     if (options.scriptableStatusLine) {

package/src/runtime/bootstrap-core.ts

@@ -20,11 +20,11 @@ import { createRuntimeStore, createDomainDispatch, type RuntimeStore } from './s
 import {
   type MutableRuntimeState, type SessionEvent, bindFeatureSettingsBridge, createFeatureFlagManager, deriveFeatureStates, RuntimeEventBus, ForensicsCollector,
   ForensicsRegistry, generateUserSessionId, loadBootstrapSystemPrompt, syncConfiguredServices,
-  registerBootstrapHookBridge, registerBootstrapRuntimeEvents,
+  registerBootstrapHookBridge, registerBootstrapRuntimeEvents, configureRuntimeEventBusDefaults, runtimeEventBusOptionsFrom,
 } from '@/runtime/index.ts';
 import { readExecEnvScrubAllowlist } from '../input/exec-env-scrub-config.ts';
 import { createSandboxExecAsk, sandboxExecAskDepsFromRuntime } from '../permissions/sandbox-exec-gate.ts';
-import { createRuntimeServices, type RuntimeServices } from './services.ts';
+import { createRuntimeServices, installDevicePosture, type RuntimeServices } from './services.ts';
 import { createHostPowerSeam } from '@pellux/goodvibes-sdk/platform/power';
 import { runBootMemoryFold } from './memory-fold.ts';
 import { wireCostPricing } from '../export/cost-utils.ts';
@@ -238,7 +238,7 @@ export async function initializeBootstrapCore(
   bindFeatureSettingsBridge(configManager, featureFlags);
 
   const userSessionId = `user-${generateUserSessionId()}`;
-  const runtimeBus = new RuntimeEventBus();
+  configureRuntimeEventBusDefaults(runtimeEventBusOptionsFrom((key) => configManager.get(key))); const runtimeBus = new RuntimeEventBus(); // cap from runtime.eventBus.maxListeners before the first bus exists
   const store = createRuntimeStore();
   const domainDispatch = createDomainDispatch(store);
   let getConversationTitle = (): string | undefined => undefined;
@@ -249,9 +249,9 @@ export async function initializeBootstrapCore(
     runtimeStore: store,
     getConversationTitle: () => getConversationTitle(),
     workingDir, homeDirectory, ...(options.daemonHomeDirectory === undefined ? {} : { daemonHomeDirectory: options.daemonHomeDirectory }),
-    // Embedded topology: the in-process runtime IS the daemon and holds its own OS
-    // inhibitor, so opt into the real host seam (fork default is non-spawning). See services.ts.
-    powerSeam: createHostPowerSeam(),
+    // Embedded topology: the in-process runtime IS the daemon, so it holds its own OS inhibitor (fork
+    // default is non-spawning) and owns the wake-model boot retry a standalone daemon would. See services.ts.
+    powerSeam: createHostPowerSeam(), provisionWakeModelsAtBoot: true,
   });
   await services.workspaceTrustManager.load(); // settle any already-persisted trust decision before any tool runs
   const providerRegistry = services.providerRegistry;
@@ -381,7 +381,7 @@ export async function initializeBootstrapCore(
     contextAccountingHolder: services.contextAccountingHolder,
     // First contained (sandboxed) command run announces "commands now run contained" once — recorded and surfaced now.
     onSandboxedRun: createSandboxContainmentNotice({ configManager, notify: (text) => conversation.log(`[Sandbox] ${text}`, { fg: '135' }) }),
-  });
+  }); installDevicePosture(toolRegistry, services.devicePosture); // the `phone` tool is the only path that reaches the device capability service, so without this every `device.*` posture key governs nothing a session can observe; the housekeeping timer starts here (not at composition) so building a runtime in a test sweeps nothing
   // Note: installWrfcAgentToolGuard is called after routeOrBuffer is defined (further below) so the onTrace callback routes guard decisions through the pre-router buffer.
   services.agentOrchestrator.setDependencies({
     surfaceRoot: services.surface.surfaceRoot,

package/src/runtime/bootstrap.ts

@@ -41,7 +41,7 @@ import { initializeBootstrapCore } from './bootstrap-core.ts';
 import { ensureBootModelResolvable } from './provider-fallback.ts';
 import { createBootstrapShell } from './bootstrap-shell.ts';
 import { announceResumeState } from './resume-notice.ts';
-import { announceInstallSelfCheck } from './install-self-check-startup.ts';
+import { announceInstallHealth } from './install-self-check-startup.ts';
 import { buildSharedOrchestratorCoreServices, refreshMemoryRecallSnapshot } from './orchestrator-core-services.ts';
 import { consumeDaemonAttachNotices, consumeExternalDaemonAttachNotices } from './daemon-attach-notices.ts';
 import { wireContextAccountingSource } from './context-accounting-source.ts';
@@ -264,7 +264,7 @@ export async function bootstrapRuntime(
   }, ACP_TASK_SYNC_INTERVAL_MS);
   bootstrapUnsubs.push(() => clearInterval(acpTaskSyncInterval));
   orchestrator.registerDelegateTool(acpManager);
-  const opsTaskManager = createTaskManager(store, runtimeBus, userSessionId);
+  const opsTaskManager = createTaskManager(store, runtimeBus, userSessionId, services.featureFlags); // featureFlags required: without it runtime.unifiedTasks configured nothing (permissive fallback); SDK default matches shipped behaviour, so this is a no-op for existing installs.
   // Operator interventions ride the control-plane gateway capability
   // (controlPlane.gateway, on by default; the old never-registered gate id shipped this dead).
   const opsControlPlane = services.featureFlags.isEnabled('control-plane-gateway')
@@ -322,7 +322,7 @@ export async function bootstrapRuntime(
   }).catch(() => {
     // Best-effort — never let the resume notice block or crash boot.
   });
-  announceInstallSelfCheck(systemMessageRouter);
+  announceInstallHealth(systemMessageRouter);
   const { gitStatusProvider, inputHistory, lastGitInfoRef } = shell;
   // FIX 2: dispose the header's live-repo-state poll (git-status.ts
   // startPolling) on shutdown, same pattern as acpTaskSyncInterval above.