@pellux/goodvibes-tui 1.26.0 → 1.27.0

package/src/input/onboarding/onboarding-feature-units.ts

@@ -231,7 +231,7 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
       {
         flagId: 'otel-remote-export',
         label: 'OTLP remote export',
-        hint: 'Export spans over OTLP/gRPC to a collector. Enabling this also turns on the OpenTelemetry foundation.',
+        hint: 'Export spans over OTLP/HTTP JSON to a collector. Enabling this also turns on the OpenTelemetry foundation. Span export reads the OTEL_EXPORTER_OTLP_* environment variables; decision export reads telemetry.decisionOtlpEndpoint — this unit sets the latter.',
         requiresFlags: ['otel-foundation'],
         impliedConfig: [{ key: 'telemetry.decisionOtlpEnabled' as ConfigKey, value: true }],
         subOptions: [
@@ -239,10 +239,10 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
             key: 'endpoint',
             configKey: 'telemetry.decisionOtlpEndpoint' as ConfigKey,
             label: 'Collector endpoint',
-            hint: 'OTLP collector URL (e.g. http://localhost:4317). Leave blank to set it later in /settings.',
+            hint: 'OTLP collector URL (e.g. http://localhost:4318). Leave blank to set it later in /settings.',
             valueType: 'text',
             defaultValue: '',
-            placeholder: 'http://localhost:4317',
+            placeholder: 'http://localhost:4318',
           },
         ],
       },
@@ -326,7 +326,7 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
     stepId: 'features-devices',
     title: 'Paired devices and voice input',
     shortLabel: 'Devices',
-    description: 'What a paired phone may be asked to do on your behalf, and whether GoodVibes listens for a spoken wake phrase. Every phone capability asks the person holding the phone before it runs; the wake word is off and states plainly that it is not wired up in this build.',
+    description: 'What a paired phone may be asked to do on your behalf, and whether GoodVibes listens for a spoken wake phrase. Every phone capability asks the person holding the phone before it runs; the wake word is off by default because holding a microphone open must be an explicit act, and turning it on does open one on this terminal.',
     units: [
       {
         flagId: 'paired-device-capabilities',
@@ -349,7 +349,7 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
         flagId: 'wake-word-detection',
         label: 'Wake-word detection',
         hint: 'Listen continuously on a capture device for the pinned "hey goodvibes" phrase and hand the utterance that follows to speech-to-text. Off by default because holding a microphone open must be an explicit act.',
-        note: 'NOT AVAILABLE IN THIS BUILD — turning this on does nothing yet. The detector is complete, but no surface captures microphone audio or supplies it an inference runtime, so nothing is listening. Your choice is remembered and takes effect in the release that adds capture.',
+        note: 'On this terminal, turning this on starts a recorder (pw-record, parecord, arecord, ffmpeg or sox — whichever is installed), scores every frame with the pinned classifier, plays a short chime the moment a wake confirms, and shows a persistent "listening" row in the footer for as long as it runs. What follows a wake goes to speech-to-text and lands in the composer, or is sent straight away if you turn voice.wake.autoSubmit on. The model it scores with is already here — installing GoodVibes downloads and checksum-verifies it, and a running daemon retries at boot if the install could not reach the network — so turning this on normally needs no setup step. What it will NOT do on its own is download anything at the moment you turn it on: a host whose artifacts are missing or fail verification says which and names /voice wake setup, instead of pretending to listen. That same provisioning fetches the speech gate, so voice.wake.vadThreshold above 0 screens frames once it has run and refuses to start before it has, rather than scoring frames it claims to be screening. voice.wake.noiseSuppression: speex runs here too — the filter travels with the platform, so there is nothing to install for it.',
       },
     ],
   },

package/src/input/settings-modal-types.ts

@@ -63,6 +63,14 @@ export type SettingsCategory =
   // and reachable only by hand-editing a settings file — see the push.* and
   // cluster.* comments in settings-modal-data.ts for the two times that happened.
   | 'profile'
+  // occasions.* — the proactive occasions/plans loop (docs/occasions.md §8):
+  // lead time, active hours, nudge channel and cadence, away-date adjustment,
+  // calendar mirroring, interview length, gift-history retention, and the
+  // sweep interval. Same mandatory-dual-membership rule as profile above, or
+  // all twelve keys are dropped from the workspace and reachable only by
+  // hand-editing a settings file — a third occurrence of the push.*/cluster.*
+  // class the profile comment already names two of.
+  | 'occasions'
   | 'danger';
 
 export type SettingsFocusPane = 'categories' | 'settings';
@@ -75,7 +83,12 @@ export const SETTINGS_CATEGORY_GROUPS: ReadonlyArray<{
   { label: 'AI Routing', categories: ['provider', 'pricing', 'subscriptions', 'helper', 'tools', 'tts', 'voice'] },
   { label: 'Service & Network', categories: ['service', 'daemon', 'network', 'controlPlane', 'httpListener', 'web', 'relay'] },
   { label: 'Surfaces & Cloud', categories: ['surfaces', 'device', 'conversationGate', 'integrations', 'connections', 'mcp', 'cloudflare'] },
-  { label: 'Automation', categories: ['batch', 'automation', 'checkin', 'watchers', 'orchestration', 'planner', 'wrfc', 'payments'] },
+  // 'occasions' sits beside 'checkin': both are proactive background loops
+  // (a cadence, a judgment pass, a conditional channel delivery) rather than
+  // facts held about the owner — the data occasions/plans declare lives in
+  // the owner profile file itself (docs/occasions.md §3), but these SETTINGS
+  // rows tune the loop, exactly like checkin's.
+  { label: 'Automation', categories: ['batch', 'automation', 'checkin', 'occasions', 'watchers', 'orchestration', 'planner', 'wrfc', 'payments'] },
   // 'profile' sits beside 'memory' and 'learning': all three are what the
   // platform retains about the person using it, and this is the group a reader
   // looking for "what does it know about me" already scans — Interface is

package/src/main.ts

@@ -55,6 +55,7 @@ import { applyInitialTuiCliState, reportFatalStartupError } from './cli/tui-star
 import { applyConfiguredHitlMode, applyRuntimeConfigValue, applyTuiRuntimeConfigDefaults } from './cli/config-overrides.ts';
 import { renderToolCallBlock } from './renderer/tool-call.ts';
 import { wireSpokenTurnRuntime } from './audio/spoken-turn-wiring.ts';
+import { installVoiceCapture } from './shell/voice-capture-shell.ts';
 import { attachSpokenTurnModelRouting, createSpokenTurnInputOptions } from './audio/spoken-turn-model-routing.ts';
 import { allowTerminalWrite, installTuiTerminalOutputGuard } from './runtime/terminal-output-guard.ts';
 import { installProcessLifecycle } from './runtime/process-lifecycle.ts';
@@ -189,6 +190,8 @@ async function main() {
   const failoverState = createFailoverTurnState();
 
   const getPromptContentWidth = () => computePromptContentWidth(stdout.columns);
+  // Live-microphone footer row (push-to-talk or the wake detector); assigned once voice capture is wired below, null until then so pre-wiring frames size correctly.
+  let voiceCaptureStatus: () => import('./core/voice-capture-status.ts').VoiceCaptureIndicatorState | null = () => null;
 
   const getViewportHeight = (): number => {
     if (input.onboardingWizard.active) return stdout.rows || 24;
@@ -197,7 +200,7 @@ async function main() {
     const contextWindow = providerRegistry.getContextWindowForModel(currentModel);
     const rows = stdout.rows || 24;
     // Compact threshold must match buildShellFooter's `compact: height < 30` posture below, else estimateShellFooterHeight's cached-height fast path answers with the wrong mode.
-    return rows - 2 - estimateShellFooterHeight(promptLines, contextWindow, rows < 30);
+    return rows - 2 - estimateShellFooterHeight(promptLines, contextWindow, rows < 30, voiceCaptureStatus());
   };
 
   const scroll = (delta: number) => {
@@ -333,8 +336,7 @@ async function main() {
     render();
   };
 
-  commandContext.submitInput = submitInput;
-  commandContext.submitSpokenInput = (text, content) => submitInput(text, content, { spokenOutput: true });
+  commandContext.submitInput = submitInput; commandContext.submitSpokenInput = (text, content) => submitInput(text, content, { spokenOutput: true });
   commandContext.stopSpokenOutput = () => spokenTurns.stop(); commandContext.pasteFromClipboard = () => input.handlePaste();
   // Read-only view of pending [TEXT: pN, M lines] fold markers, so /pastes
   // can preview a folded paste's actual content before the user submits it.
@@ -418,19 +420,19 @@ async function main() {
     },
   );
 
-  orchestratorRefs.getViewportHeight = getViewportHeight;
-  orchestratorRefs.scrollToEnd = scrollToEnd;
+  orchestratorRefs.getViewportHeight = getViewportHeight; orchestratorRefs.scrollToEnd = scrollToEnd;
 
   input.setCommandRegistry(commandRegistry, commandContext);
   commandContext.openComposerEditor = makeComposerEditorOpener({ buffer: input, stdin, stdout, writeGuard: allowTerminalWrite, repaint: () => { compositor.resetDiff(); render(); }, cwd: workingDir, env: process.env, notify: (m) => systemMessageRouter.high(m) });
   input.setConversationManager(conversation);
-  input.setContentWidth(getPromptContentWidth());
-  input.filePicker.setOnUpdate(() => render());
+  input.setContentWidth(getPromptContentWidth()); input.filePicker.setOnUpdate(() => render());
   // retirement: agentDetailModal/processModal setOnRefresh wiring removed —
   // those modals were deleted (Fleet subsumes the live process tree via F2).
 
   // Model picker callback is handled in bootstrap.ts — do not duplicate here.
   input.setHistory(inputHistory);
+  // ONE microphone path, shared by push-to-talk voice input (Alt+V) and wake-word detection; opens no device by itself (shell/voice-capture-shell.ts).
+  voiceCaptureStatus = installVoiceCapture({ configManager, shellPaths: ctx.services.shellPaths, homeDirectory, sessionId: ctx.runtime.sessionId, commandContext, unsubs, buffer: input, submitInput, notify: (m) => { systemMessageRouter.high(m); render(); }, render: () => render() });
 
   const toolCount = toolRegistry.list().length;
   conversation.splashOptions = {
@@ -511,7 +513,7 @@ async function main() {
       composerMode: composerState.modeLabel,
       composerStatus: composerState.statusLabel,
       composerFlags: composerState.flags,
-      composerPendingRisk: composerState.pendingRisk, permissionMode: configManager.get('permissions.mode') as string,
+      composerPendingRisk: composerState.pendingRisk, permissionMode: configManager.get('permissions.mode') as string, voiceCapture: voiceCaptureStatus(),
     }).lines;
 
     const onboardingOwnsScreen = input.onboardingWizard.active;
@@ -735,9 +737,7 @@ async function main() {
   process.on('exit', exitListener);
 
   // --- Terminal setup ---
-  stdin.setRawMode(true);
-  stdin.resume();
-  stdin.setEncoding('utf8');
+  stdin.setRawMode(true); stdin.resume(); stdin.setEncoding('utf8');
   allowTerminalWrite(() => stdout.write((cli.flags.noAltScreen ? '' : ALT_SCREEN_ENTER) + CLEAR_SCREEN + CURSOR_HIDE + MOUSE_ENABLE + KEYBOARD_EXT_ENABLE + PASTE_ENABLE + FOCUS_ENABLE));
   // forced dark/light applies before first paint; auto (TTY only) fires the
   // OSC 11 probe and repaints once if light wins. filterInput strips the reply from stdin.
@@ -771,9 +771,7 @@ async function main() {
 
     input.feed(data);
   });
-  process.on('SIGINT', sigintHandler);
-  process.on('unhandledRejection', unhandledRejectionHandler);
-  stdout.on('resize', resizeHandler);
+  process.on('SIGINT', sigintHandler); process.on('unhandledRejection', unhandledRejectionHandler); stdout.on('resize', resizeHandler);
 
   // State restores happen ONLY when the user explicitly asks — a CLI flag
   // (--continue/--resume/--fork), a slash command (/session resume,

package/src/renderer/process-indicator.ts

@@ -4,6 +4,7 @@ import { truncateDisplay } from '../utils/terminal-width.ts';
 import { GLYPHS, UI_TONES } from './ui-primitives.ts';
 import { activeUiTones } from './theme.ts';
 import { formatHints } from './hint-grammar.ts';
+import { voiceCaptureRowVisible, type VoiceCaptureIndicatorState } from '../core/voice-capture-status.ts';
 
 /**
  * renderProcessIndicator — shows a one-line summary of active background
@@ -95,3 +96,68 @@ export function renderProcessIndicator(
   const hint = `  ${formatHints([{ key: 'Enter', verb: 'View' }])}`;
   return renderPlainStatus(`${label}${hint}`, { fg: activeUiTones().accent.brand, bold: true });
 }
+
+/**
+ * Sentence each capture state renders as. Written out per state rather than
+ * assembled from fragments because these are the words that tell a user whether
+ * their microphone is open — "listening" and "recording" mean different things
+ * and a row that blurred them would be worse than no row.
+ */
+const VOICE_CAPTURE_LABELS: Record<VoiceCaptureIndicatorState['kind'], string> = {
+  requesting: 'opening the microphone',
+  recording: 'recording — press the voice-input key again to stop',
+  transcribing: 'transcribing what you said',
+  'wake-listening': 'listening for the wake phrase',
+  'wake-capturing': 'wake heard — recording what follows',
+  'wake-restarting': 'capture stream ended — restarting',
+  'wake-latched': 'wake detection stopped',
+};
+
+/**
+ * renderVoiceCaptureIndicator — the persistent row shown while a microphone is
+ * open, below the input area beside the process indicator.
+ *
+ * It exists because a held-open capture device is otherwise invisible: wake
+ * detection runs for as long as the feature is on, and nothing else on screen
+ * would say so. `voice.wake.indicator` chooses between `statusline` (one dim
+ * row), `banner` (a highlighted row that is hard to miss) and `off`; a
+ * push-to-talk recording always renders, because the user pressed a key one
+ * moment ago and is waiting on it.
+ *
+ * Returns no lines when nothing is captured, or when the wake rows are turned
+ * off — the caller splices whatever comes back, so an empty array is "no row".
+ */
+export function renderVoiceCaptureIndicator(
+  width: number,
+  state: VoiceCaptureIndicatorState | null,
+): Line[] {
+  if (!voiceCaptureRowVisible(state) || state === null) return [];
+  const tones = activeUiTones();
+  const marker = state.kind === 'wake-latched' ? GLYPHS.status.blocked : GLYPHS.status.active;
+  const device = state.deviceLabel !== null ? ` ${GLYPHS.navigation.pipeSeparator} ${state.deviceLabel}` : '';
+  const extra = state.detail !== undefined && state.detail.length > 0
+    ? ` ${GLYPHS.navigation.pipeSeparator} ${state.detail}`
+    : '';
+  const body = `${marker} Voice: ${VOICE_CAPTURE_LABELS[state.kind]}${device}${extra}`;
+  const isWakeRow = state.kind.startsWith('wake-');
+  const fg = state.kind === 'wake-latched' || state.kind === 'wake-restarting'
+    ? tones.chrome.warn
+    : tones.accent.control;
+
+  if (isWakeRow && state.indicator === 'banner') {
+    // The prominent variant: the row is filled to the terminal width on the
+    // footer background so it reads as a standing condition, not a passing note.
+    const line = UIFactory.stringToLine(' '.repeat(width), width, { fg: tones.chrome.faint });
+    const text = ` ${truncateDisplay(body, Math.max(0, width - 4), '…')} `;
+    for (let i = 0; i < text.length && 1 + i < width - 1; i++) {
+      const cell = line[1 + i]!;
+      cell.char = text[i]!;
+      cell.fg = fg;
+      cell.bg = tones.bg.footer;
+      cell.bold = true;
+      cell.dim = false;
+    }
+    return [line];
+  }
+  return [UIFactory.stringToLine(`   ${truncateDisplay(body, Math.max(0, width - 4), '…')}`, width, { fg, bold: true })];
+}

package/src/renderer/settings-modal-helpers.ts

@@ -77,7 +77,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   wrfc: 'Work-review-fix-cycle thresholds, retry limits, and automatic commit behavior.',
   helper: 'Helper model defaults used by helper subsystems when they do not use the main chat route.',
   tts: 'Text-to-speech provider, voice, and optional spoken-turn LLM overrides.',
-  voice: 'Two independent voice capabilities. Local engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro — all empty by default, configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error); once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension. Wake-word detection (voice.wake.*, rendered as its own unit below): listening continuously for a spoken wake phrase and handing the utterance that follows to speech-to-text — off by default, because holding a microphone open is meant to be an explicit act. Its published recall figures are measured on synthesised speech only, so no human recording of the phrase is behind them.',
+  voice: 'Two independent voice capabilities. Local engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro — all empty by default, configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error); once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension. Wake-word detection (voice.wake.*, rendered as its own unit below): listening continuously for a spoken wake phrase and handing the utterance that follows to speech-to-text — off by default, because holding a microphone open is meant to be an explicit act. It is live on this terminal: enabling it starts a recorder subprocess (voice.wake.captureCommand), scores every frame with the pinned classifier through a WASM runtime, plays voice.wake.activationSound at a confirmed wake, shows a persistent footer row per voice.wake.indicator, and sends what follows to the same speech-to-text call — into the composer, or submitted outright when voice.wake.autoSubmit is on. The same capture path backs push-to-talk voice input (Alt+V by default), which always lands in the composer. voice.wake.noiseSuppression: speex runs here — the filter travels with the platform, so there is nothing to install for it — and voice.wake.vadThreshold above 0 screens frames with the pinned speech gate once provisioning has fetched it, refusing to start before that rather than scoring frames it claims to be screening. The model is already on this machine: installing goodvibes downloads and checksum-verifies it, and a running daemon retries at boot if the install could not reach the network — so switching this on normally needs no setup step. Switching it on never downloads anything itself; a host whose artifacts are missing or fail verification says which and names /voice wake setup rather than pretending to listen. Its published recall figures are measured on synthesised speech only, so no human recording of the phrase is behind them.',
   service: 'Background service posture: enabled state, autostart, restart behavior, service name, platform, and logs.',
   daemon: 'Local session daemon. It hosts the shared session broker and companion chat so a session started here is visible and steerable from other surfaces. On by default, bound to loopback (127.0.0.1) only.',
   controlPlane: 'Daemon control-plane settings for local admin/API access.',
@@ -86,6 +86,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   batch: 'Batch execution settings, including local vs Cloudflare queue behavior.',
   automation: 'Scheduled and automated run settings, concurrency, timeout, catch-up, cooldown, and retention behavior.',
   checkin: 'Proactive check-in: on a cadence, a briefing is judged and you are contacted only when something warrants it. Off by default; every run — scheduled or manual — leaves a receipt (see /checkin) recording whether it stayed quiet, delivered a message, or was skipped.',
+  occasions: 'Proactive occasions and plans: dated, usually-recurring things that need an action (birthdays, anniversaries) and dated ranges that need only to be known about (a vacation). On by default. Lead time before a date, active hours nudges are allowed to arrive in, the nudge channel (empty makes it pull-only through /occasions), cadence while a window is open and the daily final stretch before it closes, whether an away plan moves a nudge earlier, whether a confirmed occasion mirrors to the calendar and whether a mirrored one suppresses its own nudge, how many questions the gift interview asks, how many years of gift history it keeps, and how often the sweep pass runs. The nudge itself never names the date — only how soon.',
   watchers: 'File/process watcher heartbeat, polling, and recovery-window behavior, plus the trigger family (watchers.triggers.*, rendered as its own unit): stream watchers that regex-filter and batch a long-lived command\'s output, model-free condition checks running a probe/extract/rule pipeline with no LLM in the loop, and one-shot on-exit triggers that fire exactly one payload when a launched command terminates. The trigger family is off by default — a trigger supervises real processes with nobody watching — and its rows tune the backoff ladder, the strike breaker, retention bounds, batching, and process caps.',
   runtime: 'Runtime guardrails such as companion chat limiter and event bus listener caps.',
   telemetry: 'Telemetry payload policy.',
@@ -94,7 +95,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   mcp: 'MCP server trust and scope review. Trust changes can expose local files, tools, databases, browsers, or remote automation depending on the server.',
   sandbox: 'Isolation strategy for REPL, MCP, Windows, and QEMU-backed execution. Use these settings to separate risky tools from the host shell.',
   surfaces: 'External app surfaces such as Slack, Discord, ntfy, Home Assistant, Telegram, webhooks, chat bridges, and messaging providers.',
-  device: 'Posture for using a PAIRED phone as a tool — its cameras, its screen, its location, its clipboard, and a small set of device effects. Two rows change behaviour today. device.capabilities.mode is the live switch: off stops every capability request reaching any paired device, ask-every-time asks on every single request and never consults a durable grant, and honor-grants (stock) asks the first time and every time after unless you chose "always allow" for that one capability on that one phone. device.nodes.maxPaired is enforced at the moment a device pairs: at the cap a NEW device is refused with a message naming the setting, the cap and how many are already paired, while a phone that is already in the list simply supersedes its own record and keeps working. Lowering the cap below the number already paired unpairs no one — existing devices keep working and only the next new pairing is refused; a device moving off the legacy shared token to its own is exempt so it cannot be stranded; and a nonsensical cap (zero, negative, not a number) is read as no cap at all, because a broken setting must never lock you out of your own daemon. The cap is re-read at every pairing, so a change applies without a restart. The remaining rows state the posture the capability service is built to honour — which capabilities may be granted durably, how long a phone has to answer, how exact a location it reports, whether the clipboard can be read, how long captures and grants live, and how often housekeeping sweeps. They are recorded and read back exactly as you set them, but no surface in THIS build maps them into a running capability session — the capability service currently runs on its own matching defaults. Your values are kept and take effect in the release that wires the session up.',
+  device: 'Posture for using a PAIRED phone as a tool — its cameras, its screen, its location, its clipboard, and a small set of device effects. Every row here changes behaviour, and every change applies to the next request without a restart. device.capabilities.mode is the master switch: off stops every capability request reaching any paired device (nothing is dispatched and nobody is asked), ask-every-time asks on every single request and never consults or offers a durable grant, and honor-grants (stock) asks the first time and every time after unless you chose "always allow" for that one capability on that one phone. allowAlwaysOffer decides which capabilities may offer that durable grant at all: every-capability (stock), standard-only (the elevated ones — front camera, screen capture, precise location, clipboard read — keep asking and an "always" answer is honoured for that one request only), or never. requestTimeoutSeconds is the deadline on three things at once: how long the phone has to answer, the deadline written into the request the phone receives, and how long the confirmation prompt itself stays open. device.location.precision gates the street-level fix (coarse-only refuses it and still serves approximate; ask-precise serves it but never remembers it), and device.clipboard.readMode gates reading the clipboard the same way — putting text ON the clipboard is a different capability and is unaffected. Captures from the camera and the screen are kept for capture.retentionHours and capped at capture.maxArtifacts, whichever bites first; housekeeping runs at every start and then every capture.sweepIntervalMinutes, deleting expired grants and captures and recording what it removed and why. A grant lasts grants.expiryDays and is never honoured past it, one phone holds at most grants.maxPerNode grants (the oldest are reaped past the cap), and the ledger of grants given, used, revoked and expired is kept for grants.auditRetentionDays. device.nodes.maxPaired is enforced at the moment a device pairs: at the cap a NEW device is refused with a message naming the setting, the cap and how many are already paired, while a phone that is already in the list simply supersedes its own record and keeps working. Lowering the cap below the number already paired unpairs no one — existing devices keep working and only the next new pairing is refused; a device moving off the legacy shared token to its own is exempt so it cannot be stranded. A nonsensical value anywhere here (zero, negative, not a number, an enum value that is not on the list) is read as the stock value rather than passed through, so a broken setting can neither lock you out of your own daemon nor widen the posture.',
   conversationGate: 'What a message arriving from one of those channels does. By default it gets a conversational answer, and work is proposed and waits for your agreement rather than starting on its own; you can instead confirm every run, or restore the old behavior where a message starts work immediately. Also how long a pending proposal stays answerable and how many can wait at once. This governs messages from channels only — what you type here always runs, and schedules and triggers were authorized when created.',
   cloudflare: 'Optional Cloudflare control plane, batch queue, Worker, Tunnel, Access, DNS, KV, Durable Objects, Secrets Store, and R2 settings.',
   release: 'Release-channel preference.',
@@ -141,6 +142,7 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   batch: 'Batch',
   automation: 'Automation',
   checkin: 'Check-in',
+  occasions: 'Occasions & Plans',
   watchers: 'Watchers',
   runtime: 'Runtime',
   telemetry: 'Telemetry',

package/src/renderer/shell-surface.ts

@@ -1,6 +1,7 @@
 import type { Line } from '../types/grid.ts';
-import { renderProcessIndicator } from './process-indicator.ts';
+import { renderProcessIndicator, renderVoiceCaptureIndicator } from './process-indicator.ts';
 import { UIFactory } from './ui-factory.ts';
+import { voiceCaptureRowVisible, type VoiceCaptureIndicatorState } from '../core/voice-capture-status.ts';
 
 export interface ShellFooterBuildOptions {
   readonly width: number;
@@ -84,6 +85,14 @@ export interface ShellFooterBuildOptions {
   readonly webSurfaceUrl?: string;
   /** True while power.keepAwake holds — renders the always-visible "sleep disabled" chip. */
   readonly powerKeepAwake?: boolean;
+  /**
+   * Live microphone state — a push-to-talk recording, or the wake detector for
+   * as long as it runs. Rendered as a persistent row beside the process
+   * indicator, because a capture device held open with nothing on screen saying
+   * so is the one state a voice feature must never be in. Null (or a wake state
+   * with `voice.wake.indicator: off`) renders nothing.
+   */
+  readonly voiceCapture?: VoiceCaptureIndicatorState | null;
 }
 
 export interface ShellFooterBuildResult {
@@ -98,6 +107,8 @@ export interface ShellFooterBuildResult {
 const FOOTER_BASE_ROWS = 5;
 const CONTEXT_PROGRESS_ROWS = 1;
 const PROCESS_INDICATOR_ROWS = 1;
+/** The live-microphone row, when one is showing (see renderVoiceCaptureIndicator). */
+const VOICE_CAPTURE_ROWS = 1;
 // Compact posture drops the context-info line (and never shows the context
 // bar or process indicator), leaving just: prompt-box top border, bottom
 // border, token-usage line, and the help/exit line.
@@ -151,6 +162,7 @@ export function estimateShellFooterHeight(
   promptLineCount: number,
   contextWindow?: number,
   compact = false,
+  voiceCapture: VoiceCaptureIndicatorState | null = null,
 ): number {
   if (lastRenderedFooterHeight !== null && lastRenderedFooterHeight.compact === compact) {
     return lastRenderedFooterHeight.height;
@@ -160,7 +172,11 @@ export function estimateShellFooterHeight(
     return COMPACT_FOOTER_BASE_ROWS + safePromptLines;
   }
   const progressRows = contextWindow && contextWindow > 0 ? CONTEXT_PROGRESS_ROWS : 0;
-  return FOOTER_BASE_ROWS + safePromptLines + progressRows + PROCESS_INDICATOR_ROWS;
+  // Counted on the cold-start path too: a shell launched with the wake detector
+  // already listening renders that row in its very first frame, and a viewport
+  // sized one row too tall would draw the transcript's last line under it.
+  const voiceRows = voiceCaptureRowVisible(voiceCapture) ? VOICE_CAPTURE_ROWS : 0;
+  return FOOTER_BASE_ROWS + safePromptLines + progressRows + PROCESS_INDICATOR_ROWS + voiceRows;
 }
 
 export function buildShellFooter(
@@ -206,7 +222,10 @@ export function buildShellFooter(
       options.runningAgentProgress,
     );
     const inputBoxRows = Math.max(1, options.promptLineCount) + 2;
-    lines.splice(inputBoxRows, 0, ...processIndicator);
+    // The voice row sits directly under the prompt box, ABOVE the process
+    // indicator: an open microphone is a live condition the user is acting inside,
+    // while the process indicator is a background summary.
+    lines.splice(inputBoxRows, 0, ...renderVoiceCaptureIndicator(options.width, options.voiceCapture ?? null), ...processIndicator);
     // Scriptable status line — dim informational line above the prompt. Unshifted
     // before the context hint so the context hint (if any) sits above it.
     if (options.scriptableStatusLine) {

package/src/runtime/bootstrap-core.ts

@@ -20,11 +20,11 @@ import { createRuntimeStore, createDomainDispatch, type RuntimeStore } from './s
 import {
   type MutableRuntimeState, type SessionEvent, bindFeatureSettingsBridge, createFeatureFlagManager, deriveFeatureStates, RuntimeEventBus, ForensicsCollector,
   ForensicsRegistry, generateUserSessionId, loadBootstrapSystemPrompt, syncConfiguredServices,
-  registerBootstrapHookBridge, registerBootstrapRuntimeEvents,
+  registerBootstrapHookBridge, registerBootstrapRuntimeEvents, configureRuntimeEventBusDefaults, runtimeEventBusOptionsFrom,
 } from '@/runtime/index.ts';
 import { readExecEnvScrubAllowlist } from '../input/exec-env-scrub-config.ts';
 import { createSandboxExecAsk, sandboxExecAskDepsFromRuntime } from '../permissions/sandbox-exec-gate.ts';
-import { createRuntimeServices, type RuntimeServices } from './services.ts';
+import { createRuntimeServices, installDevicePosture, type RuntimeServices } from './services.ts';
 import { createHostPowerSeam } from '@pellux/goodvibes-sdk/platform/power';
 import { runBootMemoryFold } from './memory-fold.ts';
 import { wireCostPricing } from '../export/cost-utils.ts';
@@ -238,7 +238,7 @@ export async function initializeBootstrapCore(
   bindFeatureSettingsBridge(configManager, featureFlags);
 
   const userSessionId = `user-${generateUserSessionId()}`;
-  const runtimeBus = new RuntimeEventBus();
+  configureRuntimeEventBusDefaults(runtimeEventBusOptionsFrom((key) => configManager.get(key))); const runtimeBus = new RuntimeEventBus(); // cap from runtime.eventBus.maxListeners before the first bus exists
   const store = createRuntimeStore();
   const domainDispatch = createDomainDispatch(store);
   let getConversationTitle = (): string | undefined => undefined;
@@ -249,9 +249,9 @@ export async function initializeBootstrapCore(
     runtimeStore: store,
     getConversationTitle: () => getConversationTitle(),
     workingDir, homeDirectory, ...(options.daemonHomeDirectory === undefined ? {} : { daemonHomeDirectory: options.daemonHomeDirectory }),
-    // Embedded topology: the in-process runtime IS the daemon and holds its own OS
-    // inhibitor, so opt into the real host seam (fork default is non-spawning). See services.ts.
-    powerSeam: createHostPowerSeam(),
+    // Embedded topology: the in-process runtime IS the daemon, so it holds its own OS inhibitor (fork
+    // default is non-spawning) and owns the wake-model boot retry a standalone daemon would. See services.ts.
+    powerSeam: createHostPowerSeam(), provisionWakeModelsAtBoot: true,
   });
   await services.workspaceTrustManager.load(); // settle any already-persisted trust decision before any tool runs
   const providerRegistry = services.providerRegistry;
@@ -381,7 +381,7 @@ export async function initializeBootstrapCore(
     contextAccountingHolder: services.contextAccountingHolder,
     // First contained (sandboxed) command run announces "commands now run contained" once — recorded and surfaced now.
     onSandboxedRun: createSandboxContainmentNotice({ configManager, notify: (text) => conversation.log(`[Sandbox] ${text}`, { fg: '135' }) }),
-  });
+  }); installDevicePosture(toolRegistry, services.devicePosture); // the `phone` tool is the only path that reaches the device capability service, so without this every `device.*` posture key governs nothing a session can observe; the housekeeping timer starts here (not at composition) so building a runtime in a test sweeps nothing
   // Note: installWrfcAgentToolGuard is called after routeOrBuffer is defined (further below) so the onTrace callback routes guard decisions through the pre-router buffer.
   services.agentOrchestrator.setDependencies({
     surfaceRoot: services.surface.surfaceRoot,

package/src/runtime/bootstrap.ts

@@ -264,7 +264,7 @@ export async function bootstrapRuntime(
   }, ACP_TASK_SYNC_INTERVAL_MS);
   bootstrapUnsubs.push(() => clearInterval(acpTaskSyncInterval));
   orchestrator.registerDelegateTool(acpManager);
-  const opsTaskManager = createTaskManager(store, runtimeBus, userSessionId);
+  const opsTaskManager = createTaskManager(store, runtimeBus, userSessionId, services.featureFlags); // featureFlags required: without it runtime.unifiedTasks configured nothing (permissive fallback); SDK default matches shipped behaviour, so this is a no-op for existing installs.
   // Operator interventions ride the control-plane gateway capability
   // (controlPlane.gateway, on by default; the old never-registered gate id shipped this dead).
   const opsControlPlane = services.featureFlags.isEnabled('control-plane-gateway')

package/src/runtime/device-posture-composition.ts

@@ -0,0 +1,110 @@
+/**
+ * device-posture-composition.ts — the paired-phone feature inside THIS daemon.
+ *
+ * A phone pairs with whichever daemon the person runs, and for this owner that
+ * daemon is hosted by the terminal app. Until this module existed the app had no
+ * device posture at all: `device.nodes.maxPaired` was enforced at the pairing
+ * path (SDK-side) and `device.capabilities.mode` was an onboarding toggle, while
+ * the other eleven `device.*` keys were recorded, read back, and governed
+ * nothing — the capability service they describe was never built here, so there
+ * was nothing for them to govern.
+ *
+ * The feature itself is platform-owned (`platform/devices`): the settings→policy
+ * mapping, the grants ledger, the capture store, the housekeeping sweeps, the
+ * confirmation flow, and the `phone` tool. This module supplies the three seams
+ * that are actually ours and nothing else:
+ *
+ *   - the peer transport — the same DistributedRuntimeManager the remote surface
+ *     pairs devices onto, so a phone paired here is a node here,
+ *   - the approval path — the shared approval broker, so the confirmation
+ *     appears wherever the person is looking (terminal, web app, companion),
+ *   - the storage root and the live config manager.
+ *
+ * Constructing this starts nothing. `startHousekeeping()` is called from the
+ * bootstrap tail: grants and captures both outlive a restart, so a grant whose
+ * phone is gone, or a capture torn by a crash, is reaped BEFORE the first
+ * request of this run is served — and the periodic sweep after it is what keeps
+ * a long-running daemon from going days without one. A failed sweep is logged
+ * and the app still runs: housekeeping failing is a reason to say so, not a
+ * reason to refuse to start.
+ */
+import { logger } from '@pellux/goodvibes-sdk/platform/utils';
+import { createDevicePostureRuntime, registerDevicePhoneTool } from '@pellux/goodvibes-sdk/platform/devices';
+import type {
+  DeviceApprovalBridge,
+  DevicePeerTransport,
+  DevicePhoneToolRegistry,
+  DevicePostureRuntime,
+} from '@pellux/goodvibes-sdk/platform/devices';
+import { registerDevicesGatewayMethods } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
+
+/** Who this surface records in the device audit trail. */
+export const TUI_DEVICE_ACTOR = 'tui:phone-tool';
+
+export interface DevicePostureCompositionOptions {
+  readonly configManager: ConfigManager;
+  /** The runtime devices pair onto; its listPeers/invokePeer are the transport. */
+  readonly distributedRuntime: DevicePeerTransport;
+  readonly approvals: DeviceApprovalBridge;
+  /** Surface-scoped directory the grants ledger, captures and disclosure live in. */
+  readonly stateDirectory: string;
+  /**
+   * Binding the catalog turns devices.nodes.list / devices.grants.* /
+   * devices.housekeeping.run from cataloged-but-unhandled into real handlers,
+   * which is what makes the grants surface work in the web app and the companion
+   * rather than only through this app's own tool.
+   */
+  readonly gatewayMethods?: GatewayMethodCatalog | undefined;
+  readonly getSessionId?: (() => string | undefined) | undefined;
+}
+
+export interface DevicePostureServices {
+  readonly devicePosture: DevicePostureRuntime;
+}
+
+/** Build the device posture runtime and bind the device verbs to it. */
+export function createDevicePostureServices(options: DevicePostureCompositionOptions): DevicePostureServices {
+  const devicePosture = createDevicePostureRuntime({
+    transport: options.distributedRuntime,
+    approvals: options.approvals,
+    config: options.configManager,
+    stateDirectory: options.stateDirectory,
+    actor: TUI_DEVICE_ACTOR,
+    ...(options.getSessionId ? { getSessionId: options.getSessionId } : {}),
+  });
+  if (options.gatewayMethods) registerDevicesGatewayMethods(options.gatewayMethods, devicePosture);
+  return { devicePosture };
+}
+
+/**
+ * Everything a host with a tool registry has to do once it is up: register the
+ * `phone` tool — the only path that reaches the capability service, so without it
+ * the posture keys govern nothing a session can observe — and start housekeeping.
+ *
+ * One call, because these two belong to the same feature and a host that did the
+ * first and forgot the second would serve requests while never reaping a grant
+ * whose phone is gone.
+ */
+export function installDevicePosture(
+  toolRegistry: DevicePhoneToolRegistry,
+  devicePosture: DevicePostureRuntime,
+): void {
+  registerDevicePhoneTool(toolRegistry, devicePosture);
+  startDeviceHousekeeping(devicePosture);
+}
+
+/**
+ * The recovery sweep plus the periodic timer. Separate from construction so
+ * composing a runtime in a test starts no timer and touches no disk, and
+ * separate from the call above so the standalone daemon — which registers no
+ * tools — still sweeps.
+ */
+export function startDeviceHousekeeping(devicePosture: DevicePostureRuntime): void {
+  void devicePosture.startHousekeeping().catch((error: unknown) => {
+    logger.warn('Device housekeeping sweep failed at startup', {
+      error: error instanceof Error ? error.message : String(error),
+    });
+  });
+}

package/src/runtime/disposal-wiring.ts

@@ -38,6 +38,14 @@ export { createDisposalScope };
 export interface SurfaceRuntimePollerOwners extends Omit<RuntimePollerOwners, 'stopConfigWatch'> {
   /** Fork-only: the repeating crash-residue sweep (durability-services.ts). */
   readonly stopDurabilityHousekeeping: () => void;
+  /**
+   * Fork-only: the wake-word recovery sweep and a pending boot provision
+   * (voice-setup-services.ts). Started only when an entrypoint opted into boot
+   * provisioning, and a no-op otherwise — but it is on this list unconditionally,
+   * because "the graph did not start it this time" is not a reason for the
+   * teardown path to have no way to stop it.
+   */
+  readonly stopWakeHousekeeping: () => void;
   /**
    * Fork-only: the daemon handler surfaces (daemon-handler-composition.ts).
    *
@@ -47,6 +55,12 @@ export interface SurfaceRuntimePollerOwners extends Omit<RuntimePollerOwners, 's
    * exists, so if this surface does not stop them nothing does.
    */
   readonly daemonHandlers: { readonly unregister: () => void };
+  /**
+   * Fork-only: the paired-phone feature's housekeeping timer
+   * (device-posture-composition.ts). Started by whichever entry point boots the
+   * host, so the stop belongs on this list rather than in one shutdown path.
+   */
+  readonly devicePosture: { readonly stopHousekeeping: () => void };
 }
 
 /**
@@ -72,6 +86,8 @@ export function registerSurfaceRuntimePollers(
 ): void {
   registerRuntimePollers(registry, { ...services, stopConfigWatch: extras.stopConfigWatch });
   registry.add('durability housekeeping', services.stopDurabilityHousekeeping);
+  registry.add('device housekeeping', () => services.devicePosture.stopHousekeeping());
+  registry.add('wake-word housekeeping', services.stopWakeHousekeeping);
   // Registered LAST so it tears down FIRST (the scope unwinds in reverse), which
   // is the order daemon/cli.ts already used by hand: release the handler surfaces
   // — closing the inbox store and stopping its poll timers — before the pollers

package/src/runtime/runtime-services-types.ts

@@ -38,6 +38,7 @@ import type { createDurabilityServices } from './durability-services.ts';
 import type { MemorySpineClient } from '@pellux/goodvibes-sdk/platform/runtime/memory-spine';
 import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
 import type { DomainDispatch, RuntimeStore } from './store/index.ts';
+import type { DevicePostureRuntime } from '@pellux/goodvibes-sdk/platform/devices';
 import type { RuntimeEventBus, DistributedRuntimeManager, RemoteRunnerRegistry, RemoteSupervisor, IntegrationHelperService, IdempotencyStore, ComponentHealthMonitor, WorktreeRegistry, SandboxSessionRegistry, ShellPathService, FeatureFlagManager, PolicyRuntimeState, SessionSurface } from '@/runtime/index.ts';
 import type { VoiceProviderRegistry, VoiceService } from '@pellux/goodvibes-sdk/platform/voice';
 import type { CacheRegistry, PauseController, MemoryGovernor } from '@pellux/goodvibes-sdk/platform/runtime/memory';
@@ -91,6 +92,13 @@ export interface RuntimeServicesOptions {
   readonly powerSeam?: Parameters<typeof wireIdlePowerAndLiveTurn>[0]['powerSeam'];
   /** Live session id, read per crash-residue sweep so the running session is exempt — see durability-services.ts. */
   readonly currentSessionId?: (() => string | null) | undefined;
+  /**
+   * Wake-word boot provisioning opt-in. Same shape as `powerSeam`: the real
+   * entrypoints (daemon/cli.ts, bootstrap-core.ts) ask for it, the one-shot CLI
+   * commands do not, and a test composing this graph gets neither a network fetch
+   * nor an hourly sweep it did not ask for. See voice-setup-services.ts.
+   */
+  readonly provisionWakeModelsAtBoot?: boolean | undefined;
 }
 
 export interface RuntimeServices {
@@ -176,6 +184,13 @@ export interface RuntimeServices {
   readonly providerRegistry: ProviderRegistry;
   readonly toolLLM: ToolLLM;
   readonly distributedRuntime: DistributedRuntimeManager;
+  /**
+   * The paired-phone feature for this host: the grants ledger, the capture
+   * store, the housekeeping sweeps, and the capability service every `device.*`
+   * setting governs. Bound to the `devices.*` verbs at composition; the `phone`
+   * tool is registered on it in the bootstrap tail.
+   */
+  readonly devicePosture: DevicePostureRuntime;
   readonly daemonHandlers: DaemonHandlerSurfaces;
   /** Elects the one node on this network that consumes inbound messages; hand it to the DaemonServer so its consumers share this leadership instead of holding a second election. */
   readonly clusterCoordinator: ClusterCoordinator;
@@ -211,6 +226,8 @@ export interface RuntimeServices {
   readonly appendOnlyRetentionScheduler: ReturnType<typeof createDurabilityServices>['appendOnlyRetentionScheduler']; // periodic append-only sweep; unref'd timers, stop() on teardown
   /** Stops the recurring crash-residue sweep; idempotent, unref'd timer (hosts that tear a runtime down call it). */
   readonly stopDurabilityHousekeeping: () => void;
+  /** Stops the wake-word recovery sweep and a pending boot provision; a no-op unless `provisionWakeModelsAtBoot` was set. */
+  readonly stopWakeHousekeeping: () => void;
   readonly memoryConsolidationScheduler: MemoryConsolidationScheduler;
   readonly powerManager: PowerManager;
   /** The daemon's memory governor (default ON). Backs ops.memory.get and defends the daemon's footprint by tier. */