@pellux/goodvibes-tui 1.26.0 → 1.27.1

package/src/daemon/fatal-boot-report.ts

@@ -0,0 +1,111 @@
+/**
+ * fatal-boot-report.ts — saying why, on a stream, before the process stops.
+ *
+ * ── Where this module comes from ──────────────────────────────────────────
+ *
+ * This is a local mirror of the SDK's `platform/daemon/fatal-boot-report.ts`,
+ * kept identical in shape and in exported names (`writeFatalLine`,
+ * `writeExitingStdoutLine`, `reportFatalBootFailure`). It lives here only
+ * because the published `@pellux/goodvibes-sdk` this repository compiles
+ * against predates that export — importing it would not typecheck and CI
+ * builds against the published package regardless. Delete this file and switch
+ * every importer to the SDK's copy at the next re-pin — but check the SDK's
+ * `package.json` "exports" map first: as of the 1.21.0 re-pin (2026-07-30),
+ * the compiled `dist/platform/daemon/fatal-boot-report.js` still exists
+ * inside the published tarball and `cli.js` still imports it internally, but
+ * there is no `./platform/daemon/fatal-boot-report` (or any other) entry in
+ * "exports" that makes it importable from outside the package — confirmed by
+ * attempting `import { reportFatalBootFailure } from
+ * '@pellux/goodvibes-sdk/platform/daemon/fatal-boot-report'`, which Bun
+ * refuses to resolve. This file stays load-bearing until a future SDK release
+ * adds that subpath export.
+ *
+ * ── The failure this exists to close ──────────────────────────────────────
+ *
+ * The shipped daemon died mute. Measured, against the released 1.27.0 binary
+ * in an isolated home with an unparseable `.goodvibes/daemon/settings.json`:
+ * exit code 1, **zero bytes on stdout, zero bytes on stderr, and no activity
+ * log written at all**. It crash-looped 77 times overnight and the only signal
+ * an operator had was that everything had stopped.
+ *
+ * The mechanism was not buffering and not a bypassed handler. It was simpler:
+ * `daemon/cli.ts` reported the failure to the activity LOGGER and exited, and
+ * at that point in boot the logger had no destination — the daemon entrypoint
+ * never called `configureActivityLogger` at all — so the line went nowhere and
+ * no file descriptor was ever touched. A `logger.error` is not a disclosure.
+ * Only a write to a file descriptor is.
+ *
+ * ── Why `writeSync(2, …)` and not `process.stderr.write` ──────────────────
+ *
+ * Because the fatal path must not depend on anything a host can replace or
+ * defer. `process.stderr.write` is a property on a mutable global, and THIS
+ * repository is the one that replaces it: `src/runtime/terminal-output-guard.ts`
+ * intercepts terminal output to keep the rendered screen clean, and a replaced
+ * writer that records instead of printing turns a fatal error into silence. It
+ * is also a stream, so a write issued immediately before `process.exit()` can
+ * still be in flight when the process stops existing.
+ *
+ * `writeSync(fd, …)` is neither. It is a direct write to the descriptor the
+ * service journal is attached to, it has completed when it returns, and no
+ * amount of replacing `process.stderr` upstream can intercept it. That is the
+ * whole property this module provides, and it is why every early-exit site in
+ * the daemon boot path routes through here.
+ */
+
+import { writeSync } from 'node:fs';
+import { flushActivityLogSync, logger, summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+
+/** stdout and stderr, as the file descriptors they actually are. */
+const STDOUT_FD = 1;
+const STDERR_FD = 2;
+
+function writeLineToFd(fd: number, line: string): void {
+  try {
+    writeSync(fd, line.endsWith('\n') ? line : `${line}\n`);
+  } catch {
+    // A closed or unwritable descriptor must never turn a diagnostic into a
+    // second failure. There is nothing further to fall back to: this IS the
+    // fallback.
+  }
+}
+
+/**
+ * Write one line to stderr synchronously, immune to a replaced
+ * `process.stderr` and to exit-time truncation. Use this for anything that
+ * gates a process exit.
+ */
+export function writeFatalLine(line: string): void {
+  writeLineToFd(STDERR_FD, line);
+}
+
+/**
+ * The stdout twin, for output that must survive an exit that follows it — the
+ * help text, the version line, the service-subcommand receipt and the cluster
+ * output are all printed and then immediately exited on, which is the same
+ * race.
+ */
+export function writeExitingStdoutLine(line: string): void {
+  writeLineToFd(STDOUT_FD, line);
+}
+
+/**
+ * Report a fatal boot failure everywhere it can be found, then leave the exit
+ * to the caller.
+ *
+ * The stream write happens FIRST and synchronously. The activity log is
+ * attempted after, because it is the part that can fail — it needs a
+ * configured destination, a writable directory, and a flush — and the
+ * guarantee this function makes is the stream line, not the log line.
+ */
+export function reportFatalBootFailure(error: unknown, context = 'goodvibes daemon host'): void {
+  const summary = summarizeError(error);
+  writeFatalLine(`${context} failed: ${summary}`);
+  if (error instanceof Error && error.stack) writeFatalLine(error.stack);
+  try {
+    logger.error(`${context} failed`, { error: summary });
+    flushActivityLogSync();
+  } catch {
+    // The reason is already on stderr, which is the guarantee. A log that
+    // cannot be written must not escalate into a different failure.
+  }
+}

package/src/daemon/provision-wake-model.ts

@@ -0,0 +1,81 @@
+// ---------------------------------------------------------------------------
+// provision-wake-model.ts — `goodvibes-daemon provision-wake-model`.
+//
+// WHAT THIS IS FOR
+//
+// The curl installer needs to put the wake-word model on the machine, and it must
+// not hold the pinned URLs, byte counts or checksums to do it. Those live in ONE
+// place — the SDK's wake-word manifest — and a shell script that copied them
+// would be a second copy of a pin, drifting silently the first time the model is
+// retrained. So the installer runs the binary it just installed and lets the SDK
+// do what the SDK owns.
+//
+// IT EXITS 0 EVEN WHEN THE DOWNLOAD FAILS, ON PURPOSE
+//
+// The caller is an installer. A wake-word model is not a reason to fail installing
+// a coding tool, and an installer that aborts half-way through is worse than one
+// that finishes without a wake word. The outcome is printed either way — one plain
+// line naming what happened and how to retry — and a running daemon retries at
+// every boot. `--strict` is there for a caller that genuinely wants the exit code
+// to carry the result (a test, a provisioning script that is checking); the
+// installer does not pass it.
+//
+// It composes NOTHING. No runtime, no config manager, no gateway: this reads a
+// home directory, derives the managed voice root the same way the running daemon
+// does, and calls one SDK function. Composing a runtime here would start a second
+// set of pollers on a machine whose daemon is probably already running.
+// ---------------------------------------------------------------------------
+
+import {
+  provisionWakeWordModelsAtInstall,
+  resolveManagedVoiceRoot,
+} from '@pellux/goodvibes-sdk/platform/voice';
+
+export interface ProvisionWakeModelResult {
+  readonly exitCode: number;
+  readonly lines: readonly string[];
+}
+
+export interface ProvisionWakeModelDeps {
+  /** The home directory whose `.goodvibes/voice` tree receives the artifacts. */
+  readonly homeDirectory: string;
+  readonly env?: Readonly<Record<string, string | undefined>> | undefined;
+  /** Injected in tests: the SDK policy, so nothing downloads. */
+  readonly provisionAtInstall?: typeof provisionWakeWordModelsAtInstall | undefined;
+}
+
+/**
+ * Run the install-time provision and report it.
+ *
+ * `--strict` makes a degraded outcome exit 1. Without it, every outcome exits 0,
+ * because the caller is an installer and the alternative is an aborted install
+ * over an optional model.
+ */
+export async function runProvisionWakeModelCommand(
+  argv: readonly string[],
+  deps: ProvisionWakeModelDeps,
+): Promise<ProvisionWakeModelResult> {
+  const strict = argv.includes('--strict');
+  const provision = deps.provisionAtInstall ?? provisionWakeWordModelsAtInstall;
+  let managedRoot: string;
+  try {
+    managedRoot = resolveManagedVoiceRoot(deps.homeDirectory);
+  } catch (error) {
+    // A home directory this process cannot make sense of is still not a reason to
+    // fail an install, so it is reported on the same terms as a failed download.
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      exitCode: strict ? 1 : 0,
+      lines: [`wake-word model: skipped — ${message}`],
+    };
+  }
+  const outcome = await provision({
+    managedRoot,
+    recoveryHint: '/voice wake setup',
+    ...(deps.env !== undefined ? { env: deps.env } : {}),
+  });
+  return {
+    exitCode: strict && outcome.state === 'degraded' ? 1 : 0,
+    lines: [`wake-word model: ${outcome.message}`],
+  };
+}

package/src/input/command-registry.ts

@@ -108,6 +108,12 @@ export interface CommandUiActions {
   deleteQueuedMessage?: (id: string) => boolean;
   /** Toggle the drill-in of the "used N memories" provenance chip (memory.showProvenance). */
   toggleMemoryProvenance?: () => void;
+  /**
+   * Start voice input, or stop the recording already running and transcribe it
+   * into the composer. Two discrete presses rather than a hold, because a
+   * terminal delivers key events and never key-release state.
+   */
+  toggleVoiceInput?: () => void;
   /** The current host sleep-ownership projection (power.status.get, flattened) — chip, held-because, lid-split. */
   getPowerState?: () => import('../core/power-status.ts').PowerSurfaceState;
   /** Set the daemon-held keep-awake toggle (power.keepAwake.set), acquiring/releasing the inhibitor live; returns the new state. */

package/src/input/commands/experience-runtime.ts

@@ -3,6 +3,10 @@ import { dirname, resolve } from 'node:path';
 import type { CommandRegistry } from '../command-registry.ts';
 import { requirePanelManager, requireShellPaths } from './runtime-services.ts';
 import { createVoiceProvisionGateway, renderVoiceProvision, runVoiceSetupWithProgress, VOICE_SETUP_ANNOUNCEMENT } from '../../core/voice-provision-gateway.ts';
+import { resolveWakeRuntimeSettings } from '@pellux/goodvibes-sdk/platform/voice/wake/runtime';
+import { terminalWakeCapabilities } from '../../core/wake-provision-status.ts';
+import { printWakeStatus, runWakeProvision } from '../../core/wake-provision-runner.ts';
+import { wakeProvisionStatus } from '@pellux/goodvibes-sdk/platform/voice';
 
 interface VoiceBundle {
   readonly version: 1;
@@ -223,11 +227,41 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
 
   registry.register({
     name: 'voice',
-    description: 'Review or toggle always-speak mode, provision the managed local voice runtime (setup/status), and package portable voice metadata',
-    usage: '[review|status|setup|enable|disable|bundle export <path>|bundle inspect <path>]',
+    description: 'Review or toggle always-speak mode, provision the managed local voice runtime and the wake-word models (setup/status), and package portable voice metadata',
+    usage: '[review|status|setup|enable|disable|wake status|wake setup|bundle export <path>|bundle inspect <path>]',
     async handler(args, ctx) {
       const shellPaths = requireShellPaths(ctx);
       const sub = (args[0] ?? 'review').toLowerCase();
+      if (sub === 'wake') {
+        // The wake models are provisioned locally by the SDK (checksum-pinned
+        // download), not through a daemon verb, so this path needs no gateway.
+        // Installation already provisions them and a daemon retries at boot;
+        // `setup` here is the recovery act, and nothing downloads unless the user
+        // typed it — see wake-provision-runner.ts.
+        const wakeSub = (args[1] ?? 'status').toLowerCase();
+        const managedRoot = shellPaths.resolveUserPath('voice');
+        const runner = {
+          managedRoot,
+          settings: resolveWakeRuntimeSettings(
+            (key: string) => ctx.platform.configManager.get(key as Parameters<typeof ctx.platform.configManager.get>[0]),
+            'tui',
+            // Read from disk, so `/voice wake status` reports the speech gate as
+            // available exactly when its artifact is there and verified.
+            terminalWakeCapabilities(wakeProvisionStatus({ managedRoot })),
+          ),
+          print: (block: string) => ctx.print(block),
+        };
+        if (wakeSub === 'setup') {
+          await runWakeProvision(runner);
+          return;
+        }
+        if (wakeSub === 'status') {
+          printWakeStatus(runner);
+          return;
+        }
+        ctx.print('Usage: /voice wake [status|setup]');
+        return;
+      }
       if (sub === 'status' || sub === 'setup') {
         // The one-act managed install returns a final receipt (no per-phase
         // streaming over the verb), so the announcement block prints first and
@@ -294,7 +328,7 @@ export function registerExperienceRuntimeCommands(registry: CommandRegistry): vo
           return;
         }
       }
-      ctx.print('Usage: /voice [review|status|setup|enable|disable|bundle export <path>|bundle inspect <path>]');
+      ctx.print('Usage: /voice [review|status|setup|enable|disable|wake status|wake setup|bundle export <path>|bundle inspect <path>]');
     },
   });
 }

package/src/input/handler-shortcuts.ts

@@ -132,6 +132,14 @@ export function handleGlobalShortcutToken(
       state.commandContext?.toggleMemoryProvenance?.();
       return true;
 
+    case 'voice-input':
+      // Start recording, or stop the recording already running. Routed globally so
+      // the key works whether focus is on the composer or the panel workspace —
+      // dictation is not a composer-only act. Still consumed when voice input is
+      // not wired, so a stray Alt+V never lands in the prompt as text.
+      state.commandContext?.toggleVoiceInput?.();
+      return true;
+
     case 'toggle-keep-awake': {
       // Flip the daemon-held keep-awake toggle; the always-visible "sleep
       // disabled" chip is the confirmation. Fire-and-forget (the seam renders on

package/src/input/keybindings.ts

@@ -71,7 +71,8 @@ export type KeyAction =
   | 'yank-pop'
   | 'cancel-tool-call'
   | 'toggle-keep-awake'
-  | 'toggle-memory-provenance';
+  | 'toggle-memory-provenance'
+  | 'voice-input';
 
 /** Human-readable description for each action (used in /keybindings display). */
 export const ACTION_DESCRIPTIONS: Record<KeyAction, string> = {
@@ -117,6 +118,10 @@ export const ACTION_DESCRIPTIONS: Record<KeyAction, string> = {
   'cancel-tool-call':      'Cancel the running tool call (the turn continues)',
   'toggle-keep-awake':     'Toggle keep-awake (the "sleep disabled" chip)',
   'toggle-memory-provenance': 'List/hide the memories a turn used (provenance chip drill-in)',
+  // Named for what it actually does. A terminal delivers key EVENTS, not held-key
+  // state — there is no release event to watch — so this is two discrete presses,
+  // and the description says so instead of implying a hold that cannot exist.
+  'voice-input':           'Voice input: press to start recording, press again to stop and transcribe into the composer',
 };
 
 /** Default key bindings for all actions. */
@@ -207,6 +212,10 @@ export const DEFAULT_KEYBINDINGS: Record<KeyAction, KeyCombo[]> = {
   // Alt+M: expand/collapse the "used N memories" provenance chip's drill-in.
   // Alt+M is unused by any other default. A no-op when the chip is not showing.
   'toggle-memory-provenance': [{ key: 'm', alt: true }],
+  // Alt+V: start/stop voice input. Alt+V is unused by any other default (Ctrl+V
+  // is paste and stays paste). Two presses rather than a hold: see the action's
+  // description — a terminal has no key-release event to hold against.
+  'voice-input':           [{ key: 'v', alt: true }],
 };
 
 /** Resolved overrides type: each key can be a single combo or array. */

package/src/input/onboarding/onboarding-feature-units.ts

@@ -231,7 +231,7 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
       {
         flagId: 'otel-remote-export',
         label: 'OTLP remote export',
-        hint: 'Export spans over OTLP/gRPC to a collector. Enabling this also turns on the OpenTelemetry foundation.',
+        hint: 'Export spans over OTLP/HTTP JSON to a collector. Enabling this also turns on the OpenTelemetry foundation. Span export reads the OTEL_EXPORTER_OTLP_* environment variables; decision export reads telemetry.decisionOtlpEndpoint — this unit sets the latter.',
         requiresFlags: ['otel-foundation'],
         impliedConfig: [{ key: 'telemetry.decisionOtlpEnabled' as ConfigKey, value: true }],
         subOptions: [
@@ -239,10 +239,10 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
             key: 'endpoint',
             configKey: 'telemetry.decisionOtlpEndpoint' as ConfigKey,
             label: 'Collector endpoint',
-            hint: 'OTLP collector URL (e.g. http://localhost:4317). Leave blank to set it later in /settings.',
+            hint: 'OTLP collector URL (e.g. http://localhost:4318). Leave blank to set it later in /settings.',
             valueType: 'text',
             defaultValue: '',
-            placeholder: 'http://localhost:4317',
+            placeholder: 'http://localhost:4318',
           },
         ],
       },
@@ -326,7 +326,7 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
     stepId: 'features-devices',
     title: 'Paired devices and voice input',
     shortLabel: 'Devices',
-    description: 'What a paired phone may be asked to do on your behalf, and whether GoodVibes listens for a spoken wake phrase. Every phone capability asks the person holding the phone before it runs; the wake word is off and states plainly that it is not wired up in this build.',
+    description: 'What a paired phone may be asked to do on your behalf, and whether GoodVibes listens for a spoken wake phrase. Every phone capability asks the person holding the phone before it runs; the wake word is off by default because holding a microphone open must be an explicit act, and turning it on does open one on this terminal.',
     units: [
       {
         flagId: 'paired-device-capabilities',
@@ -349,7 +349,7 @@ export const FEATURE_ONBOARDING_SECTIONS: readonly FeatureSection[] = [
         flagId: 'wake-word-detection',
         label: 'Wake-word detection',
         hint: 'Listen continuously on a capture device for the pinned "hey goodvibes" phrase and hand the utterance that follows to speech-to-text. Off by default because holding a microphone open must be an explicit act.',
-        note: 'NOT AVAILABLE IN THIS BUILD — turning this on does nothing yet. The detector is complete, but no surface captures microphone audio or supplies it an inference runtime, so nothing is listening. Your choice is remembered and takes effect in the release that adds capture.',
+        note: 'On this terminal, turning this on starts a recorder (pw-record, parecord, arecord, ffmpeg or sox — whichever is installed), scores every frame with the pinned classifier, plays a short chime the moment a wake confirms, and shows a persistent "listening" row in the footer for as long as it runs. What follows a wake goes to speech-to-text and lands in the composer, or is sent straight away if you turn voice.wake.autoSubmit on. The model it scores with is already here — installing GoodVibes downloads and checksum-verifies it, and a running daemon retries at boot if the install could not reach the network — so turning this on normally needs no setup step. What it will NOT do on its own is download anything at the moment you turn it on: a host whose artifacts are missing or fail verification says which and names /voice wake setup, instead of pretending to listen. That same provisioning fetches the speech gate, so voice.wake.vadThreshold above 0 screens frames once it has run and refuses to start before it has, rather than scoring frames it claims to be screening. voice.wake.noiseSuppression: speex runs here too — the filter travels with the platform, so there is nothing to install for it.',
       },
     ],
   },

package/src/input/settings-modal-types.ts

@@ -63,6 +63,14 @@ export type SettingsCategory =
   // and reachable only by hand-editing a settings file — see the push.* and
   // cluster.* comments in settings-modal-data.ts for the two times that happened.
   | 'profile'
+  // occasions.* — the proactive occasions/plans loop (docs/occasions.md §8):
+  // lead time, active hours, nudge channel and cadence, away-date adjustment,
+  // calendar mirroring, interview length, gift-history retention, and the
+  // sweep interval. Same mandatory-dual-membership rule as profile above, or
+  // all twelve keys are dropped from the workspace and reachable only by
+  // hand-editing a settings file — a third occurrence of the push.*/cluster.*
+  // class the profile comment already names two of.
+  | 'occasions'
   | 'danger';
 
 export type SettingsFocusPane = 'categories' | 'settings';
@@ -75,7 +83,12 @@ export const SETTINGS_CATEGORY_GROUPS: ReadonlyArray<{
   { label: 'AI Routing', categories: ['provider', 'pricing', 'subscriptions', 'helper', 'tools', 'tts', 'voice'] },
   { label: 'Service & Network', categories: ['service', 'daemon', 'network', 'controlPlane', 'httpListener', 'web', 'relay'] },
   { label: 'Surfaces & Cloud', categories: ['surfaces', 'device', 'conversationGate', 'integrations', 'connections', 'mcp', 'cloudflare'] },
-  { label: 'Automation', categories: ['batch', 'automation', 'checkin', 'watchers', 'orchestration', 'planner', 'wrfc', 'payments'] },
+  // 'occasions' sits beside 'checkin': both are proactive background loops
+  // (a cadence, a judgment pass, a conditional channel delivery) rather than
+  // facts held about the owner — the data occasions/plans declare lives in
+  // the owner profile file itself (docs/occasions.md §3), but these SETTINGS
+  // rows tune the loop, exactly like checkin's.
+  { label: 'Automation', categories: ['batch', 'automation', 'checkin', 'occasions', 'watchers', 'orchestration', 'planner', 'wrfc', 'payments'] },
   // 'profile' sits beside 'memory' and 'learning': all three are what the
   // platform retains about the person using it, and this is the group a reader
   // looking for "what does it know about me" already scans — Interface is

package/src/main.ts

@@ -55,6 +55,7 @@ import { applyInitialTuiCliState, reportFatalStartupError } from './cli/tui-star
 import { applyConfiguredHitlMode, applyRuntimeConfigValue, applyTuiRuntimeConfigDefaults } from './cli/config-overrides.ts';
 import { renderToolCallBlock } from './renderer/tool-call.ts';
 import { wireSpokenTurnRuntime } from './audio/spoken-turn-wiring.ts';
+import { installVoiceCapture } from './shell/voice-capture-shell.ts';
 import { attachSpokenTurnModelRouting, createSpokenTurnInputOptions } from './audio/spoken-turn-model-routing.ts';
 import { allowTerminalWrite, installTuiTerminalOutputGuard } from './runtime/terminal-output-guard.ts';
 import { installProcessLifecycle } from './runtime/process-lifecycle.ts';
@@ -189,6 +190,8 @@ async function main() {
   const failoverState = createFailoverTurnState();
 
   const getPromptContentWidth = () => computePromptContentWidth(stdout.columns);
+  // Live-microphone footer row (push-to-talk or the wake detector); assigned once voice capture is wired below, null until then so pre-wiring frames size correctly.
+  let voiceCaptureStatus: () => import('./core/voice-capture-status.ts').VoiceCaptureIndicatorState | null = () => null;
 
   const getViewportHeight = (): number => {
     if (input.onboardingWizard.active) return stdout.rows || 24;
@@ -197,7 +200,7 @@ async function main() {
     const contextWindow = providerRegistry.getContextWindowForModel(currentModel);
     const rows = stdout.rows || 24;
     // Compact threshold must match buildShellFooter's `compact: height < 30` posture below, else estimateShellFooterHeight's cached-height fast path answers with the wrong mode.
-    return rows - 2 - estimateShellFooterHeight(promptLines, contextWindow, rows < 30);
+    return rows - 2 - estimateShellFooterHeight(promptLines, contextWindow, rows < 30, voiceCaptureStatus());
   };
 
   const scroll = (delta: number) => {
@@ -333,8 +336,7 @@ async function main() {
     render();
   };
 
-  commandContext.submitInput = submitInput;
-  commandContext.submitSpokenInput = (text, content) => submitInput(text, content, { spokenOutput: true });
+  commandContext.submitInput = submitInput; commandContext.submitSpokenInput = (text, content) => submitInput(text, content, { spokenOutput: true });
   commandContext.stopSpokenOutput = () => spokenTurns.stop(); commandContext.pasteFromClipboard = () => input.handlePaste();
   // Read-only view of pending [TEXT: pN, M lines] fold markers, so /pastes
   // can preview a folded paste's actual content before the user submits it.
@@ -418,19 +420,19 @@ async function main() {
     },
   );
 
-  orchestratorRefs.getViewportHeight = getViewportHeight;
-  orchestratorRefs.scrollToEnd = scrollToEnd;
+  orchestratorRefs.getViewportHeight = getViewportHeight; orchestratorRefs.scrollToEnd = scrollToEnd;
 
   input.setCommandRegistry(commandRegistry, commandContext);
   commandContext.openComposerEditor = makeComposerEditorOpener({ buffer: input, stdin, stdout, writeGuard: allowTerminalWrite, repaint: () => { compositor.resetDiff(); render(); }, cwd: workingDir, env: process.env, notify: (m) => systemMessageRouter.high(m) });
   input.setConversationManager(conversation);
-  input.setContentWidth(getPromptContentWidth());
-  input.filePicker.setOnUpdate(() => render());
+  input.setContentWidth(getPromptContentWidth()); input.filePicker.setOnUpdate(() => render());
   // retirement: agentDetailModal/processModal setOnRefresh wiring removed —
   // those modals were deleted (Fleet subsumes the live process tree via F2).
 
   // Model picker callback is handled in bootstrap.ts — do not duplicate here.
   input.setHistory(inputHistory);
+  // ONE microphone path, shared by push-to-talk voice input (Alt+V) and wake-word detection; opens no device by itself (shell/voice-capture-shell.ts).
+  voiceCaptureStatus = installVoiceCapture({ configManager, shellPaths: ctx.services.shellPaths, homeDirectory, sessionId: ctx.runtime.sessionId, commandContext, unsubs, buffer: input, submitInput, notify: (m) => { systemMessageRouter.high(m); render(); }, render: () => render() });
 
   const toolCount = toolRegistry.list().length;
   conversation.splashOptions = {
@@ -511,7 +513,7 @@ async function main() {
       composerMode: composerState.modeLabel,
       composerStatus: composerState.statusLabel,
       composerFlags: composerState.flags,
-      composerPendingRisk: composerState.pendingRisk, permissionMode: configManager.get('permissions.mode') as string,
+      composerPendingRisk: composerState.pendingRisk, permissionMode: configManager.get('permissions.mode') as string, voiceCapture: voiceCaptureStatus(),
     }).lines;
 
     const onboardingOwnsScreen = input.onboardingWizard.active;
@@ -735,9 +737,7 @@ async function main() {
   process.on('exit', exitListener);
 
   // --- Terminal setup ---
-  stdin.setRawMode(true);
-  stdin.resume();
-  stdin.setEncoding('utf8');
+  stdin.setRawMode(true); stdin.resume(); stdin.setEncoding('utf8');
   allowTerminalWrite(() => stdout.write((cli.flags.noAltScreen ? '' : ALT_SCREEN_ENTER) + CLEAR_SCREEN + CURSOR_HIDE + MOUSE_ENABLE + KEYBOARD_EXT_ENABLE + PASTE_ENABLE + FOCUS_ENABLE));
   // forced dark/light applies before first paint; auto (TTY only) fires the
   // OSC 11 probe and repaints once if light wins. filterInput strips the reply from stdin.
@@ -771,9 +771,7 @@ async function main() {
 
     input.feed(data);
   });
-  process.on('SIGINT', sigintHandler);
-  process.on('unhandledRejection', unhandledRejectionHandler);
-  stdout.on('resize', resizeHandler);
+  process.on('SIGINT', sigintHandler); process.on('unhandledRejection', unhandledRejectionHandler); stdout.on('resize', resizeHandler);
 
   // State restores happen ONLY when the user explicitly asks — a CLI flag
   // (--continue/--resume/--fork), a slash command (/session resume,

package/src/renderer/process-indicator.ts

@@ -4,6 +4,7 @@ import { truncateDisplay } from '../utils/terminal-width.ts';
 import { GLYPHS, UI_TONES } from './ui-primitives.ts';
 import { activeUiTones } from './theme.ts';
 import { formatHints } from './hint-grammar.ts';
+import { voiceCaptureRowVisible, type VoiceCaptureIndicatorState } from '../core/voice-capture-status.ts';
 
 /**
  * renderProcessIndicator — shows a one-line summary of active background
@@ -95,3 +96,68 @@ export function renderProcessIndicator(
   const hint = `  ${formatHints([{ key: 'Enter', verb: 'View' }])}`;
   return renderPlainStatus(`${label}${hint}`, { fg: activeUiTones().accent.brand, bold: true });
 }
+
+/**
+ * Sentence each capture state renders as. Written out per state rather than
+ * assembled from fragments because these are the words that tell a user whether
+ * their microphone is open — "listening" and "recording" mean different things
+ * and a row that blurred them would be worse than no row.
+ */
+const VOICE_CAPTURE_LABELS: Record<VoiceCaptureIndicatorState['kind'], string> = {
+  requesting: 'opening the microphone',
+  recording: 'recording — press the voice-input key again to stop',
+  transcribing: 'transcribing what you said',
+  'wake-listening': 'listening for the wake phrase',
+  'wake-capturing': 'wake heard — recording what follows',
+  'wake-restarting': 'capture stream ended — restarting',
+  'wake-latched': 'wake detection stopped',
+};
+
+/**
+ * renderVoiceCaptureIndicator — the persistent row shown while a microphone is
+ * open, below the input area beside the process indicator.
+ *
+ * It exists because a held-open capture device is otherwise invisible: wake
+ * detection runs for as long as the feature is on, and nothing else on screen
+ * would say so. `voice.wake.indicator` chooses between `statusline` (one dim
+ * row), `banner` (a highlighted row that is hard to miss) and `off`; a
+ * push-to-talk recording always renders, because the user pressed a key one
+ * moment ago and is waiting on it.
+ *
+ * Returns no lines when nothing is captured, or when the wake rows are turned
+ * off — the caller splices whatever comes back, so an empty array is "no row".
+ */
+export function renderVoiceCaptureIndicator(
+  width: number,
+  state: VoiceCaptureIndicatorState | null,
+): Line[] {
+  if (!voiceCaptureRowVisible(state) || state === null) return [];
+  const tones = activeUiTones();
+  const marker = state.kind === 'wake-latched' ? GLYPHS.status.blocked : GLYPHS.status.active;
+  const device = state.deviceLabel !== null ? ` ${GLYPHS.navigation.pipeSeparator} ${state.deviceLabel}` : '';
+  const extra = state.detail !== undefined && state.detail.length > 0
+    ? ` ${GLYPHS.navigation.pipeSeparator} ${state.detail}`
+    : '';
+  const body = `${marker} Voice: ${VOICE_CAPTURE_LABELS[state.kind]}${device}${extra}`;
+  const isWakeRow = state.kind.startsWith('wake-');
+  const fg = state.kind === 'wake-latched' || state.kind === 'wake-restarting'
+    ? tones.chrome.warn
+    : tones.accent.control;
+
+  if (isWakeRow && state.indicator === 'banner') {
+    // The prominent variant: the row is filled to the terminal width on the
+    // footer background so it reads as a standing condition, not a passing note.
+    const line = UIFactory.stringToLine(' '.repeat(width), width, { fg: tones.chrome.faint });
+    const text = ` ${truncateDisplay(body, Math.max(0, width - 4), '…')} `;
+    for (let i = 0; i < text.length && 1 + i < width - 1; i++) {
+      const cell = line[1 + i]!;
+      cell.char = text[i]!;
+      cell.fg = fg;
+      cell.bg = tones.bg.footer;
+      cell.bold = true;
+      cell.dim = false;
+    }
+    return [line];
+  }
+  return [UIFactory.stringToLine(`   ${truncateDisplay(body, Math.max(0, width - 4), '…')}`, width, { fg, bold: true })];
+}

package/src/renderer/settings-modal-helpers.ts

@@ -77,7 +77,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   wrfc: 'Work-review-fix-cycle thresholds, retry limits, and automatic commit behavior.',
   helper: 'Helper model defaults used by helper subsystems when they do not use the main chat route.',
   tts: 'Text-to-speech provider, voice, and optional spoken-turn LLM overrides.',
-  voice: 'Two independent voice capabilities. Local engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro — all empty by default, configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error); once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension. Wake-word detection (voice.wake.*, rendered as its own unit below): listening continuously for a spoken wake phrase and handing the utterance that follows to speech-to-text — off by default, because holding a microphone open is meant to be an explicit act. Its published recall figures are measured on synthesised speech only, so no human recording of the phrase is behind them.',
+  voice: 'Two independent voice capabilities. Local engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro — all empty by default, configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error); once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension. Wake-word detection (voice.wake.*, rendered as its own unit below): listening continuously for a spoken wake phrase and handing the utterance that follows to speech-to-text — off by default, because holding a microphone open is meant to be an explicit act. It is live on this terminal: enabling it starts a recorder subprocess (voice.wake.captureCommand), scores every frame with the pinned classifier through a WASM runtime, plays voice.wake.activationSound at a confirmed wake, shows a persistent footer row per voice.wake.indicator, and sends what follows to the same speech-to-text call — into the composer, or submitted outright when voice.wake.autoSubmit is on. The same capture path backs push-to-talk voice input (Alt+V by default), which always lands in the composer. voice.wake.noiseSuppression: speex runs here — the filter travels with the platform, so there is nothing to install for it — and voice.wake.vadThreshold above 0 screens frames with the pinned speech gate once provisioning has fetched it, refusing to start before that rather than scoring frames it claims to be screening. The model is already on this machine: installing goodvibes downloads and checksum-verifies it, and a running daemon retries at boot if the install could not reach the network — so switching this on normally needs no setup step. Switching it on never downloads anything itself; a host whose artifacts are missing or fail verification says which and names /voice wake setup rather than pretending to listen. Its published recall figures are measured on synthesised speech only, so no human recording of the phrase is behind them.',
   service: 'Background service posture: enabled state, autostart, restart behavior, service name, platform, and logs.',
   daemon: 'Local session daemon. It hosts the shared session broker and companion chat so a session started here is visible and steerable from other surfaces. On by default, bound to loopback (127.0.0.1) only.',
   controlPlane: 'Daemon control-plane settings for local admin/API access.',
@@ -86,6 +86,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   batch: 'Batch execution settings, including local vs Cloudflare queue behavior.',
   automation: 'Scheduled and automated run settings, concurrency, timeout, catch-up, cooldown, and retention behavior.',
   checkin: 'Proactive check-in: on a cadence, a briefing is judged and you are contacted only when something warrants it. Off by default; every run — scheduled or manual — leaves a receipt (see /checkin) recording whether it stayed quiet, delivered a message, or was skipped.',
+  occasions: 'Proactive occasions and plans: dated, usually-recurring things that need an action (birthdays, anniversaries) and dated ranges that need only to be known about (a vacation). On by default. Lead time before a date, active hours nudges are allowed to arrive in, the nudge channel (empty makes it pull-only through /occasions), cadence while a window is open and the daily final stretch before it closes, whether an away plan moves a nudge earlier, whether a confirmed occasion mirrors to the calendar and whether a mirrored one suppresses its own nudge, how many questions the gift interview asks, how many years of gift history it keeps, and how often the sweep pass runs. The nudge itself never names the date — only how soon.',
   watchers: 'File/process watcher heartbeat, polling, and recovery-window behavior, plus the trigger family (watchers.triggers.*, rendered as its own unit): stream watchers that regex-filter and batch a long-lived command\'s output, model-free condition checks running a probe/extract/rule pipeline with no LLM in the loop, and one-shot on-exit triggers that fire exactly one payload when a launched command terminates. The trigger family is off by default — a trigger supervises real processes with nobody watching — and its rows tune the backoff ladder, the strike breaker, retention bounds, batching, and process caps.',
   runtime: 'Runtime guardrails such as companion chat limiter and event bus listener caps.',
   telemetry: 'Telemetry payload policy.',
@@ -94,7 +95,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   mcp: 'MCP server trust and scope review. Trust changes can expose local files, tools, databases, browsers, or remote automation depending on the server.',
   sandbox: 'Isolation strategy for REPL, MCP, Windows, and QEMU-backed execution. Use these settings to separate risky tools from the host shell.',
   surfaces: 'External app surfaces such as Slack, Discord, ntfy, Home Assistant, Telegram, webhooks, chat bridges, and messaging providers.',
-  device: 'Posture for using a PAIRED phone as a tool — its cameras, its screen, its location, its clipboard, and a small set of device effects. Two rows change behaviour today. device.capabilities.mode is the live switch: off stops every capability request reaching any paired device, ask-every-time asks on every single request and never consults a durable grant, and honor-grants (stock) asks the first time and every time after unless you chose "always allow" for that one capability on that one phone. device.nodes.maxPaired is enforced at the moment a device pairs: at the cap a NEW device is refused with a message naming the setting, the cap and how many are already paired, while a phone that is already in the list simply supersedes its own record and keeps working. Lowering the cap below the number already paired unpairs no one — existing devices keep working and only the next new pairing is refused; a device moving off the legacy shared token to its own is exempt so it cannot be stranded; and a nonsensical cap (zero, negative, not a number) is read as no cap at all, because a broken setting must never lock you out of your own daemon. The cap is re-read at every pairing, so a change applies without a restart. The remaining rows state the posture the capability service is built to honour — which capabilities may be granted durably, how long a phone has to answer, how exact a location it reports, whether the clipboard can be read, how long captures and grants live, and how often housekeeping sweeps. They are recorded and read back exactly as you set them, but no surface in THIS build maps them into a running capability session — the capability service currently runs on its own matching defaults. Your values are kept and take effect in the release that wires the session up.',
+  device: 'Posture for using a PAIRED phone as a tool — its cameras, its screen, its location, its clipboard, and a small set of device effects. Every row here changes behaviour, and every change applies to the next request without a restart. device.capabilities.mode is the master switch: off stops every capability request reaching any paired device (nothing is dispatched and nobody is asked), ask-every-time asks on every single request and never consults or offers a durable grant, and honor-grants (stock) asks the first time and every time after unless you chose "always allow" for that one capability on that one phone. allowAlwaysOffer decides which capabilities may offer that durable grant at all: every-capability (stock), standard-only (the elevated ones — front camera, screen capture, precise location, clipboard read — keep asking and an "always" answer is honoured for that one request only), or never. requestTimeoutSeconds is the deadline on three things at once: how long the phone has to answer, the deadline written into the request the phone receives, and how long the confirmation prompt itself stays open. device.location.precision gates the street-level fix (coarse-only refuses it and still serves approximate; ask-precise serves it but never remembers it), and device.clipboard.readMode gates reading the clipboard the same way — putting text ON the clipboard is a different capability and is unaffected. Captures from the camera and the screen are kept for capture.retentionHours and capped at capture.maxArtifacts, whichever bites first; housekeeping runs at every start and then every capture.sweepIntervalMinutes, deleting expired grants and captures and recording what it removed and why. A grant lasts grants.expiryDays and is never honoured past it, one phone holds at most grants.maxPerNode grants (the oldest are reaped past the cap), and the ledger of grants given, used, revoked and expired is kept for grants.auditRetentionDays. device.nodes.maxPaired is enforced at the moment a device pairs: at the cap a NEW device is refused with a message naming the setting, the cap and how many are already paired, while a phone that is already in the list simply supersedes its own record and keeps working. Lowering the cap below the number already paired unpairs no one — existing devices keep working and only the next new pairing is refused; a device moving off the legacy shared token to its own is exempt so it cannot be stranded. A nonsensical value anywhere here (zero, negative, not a number, an enum value that is not on the list) is read as the stock value rather than passed through, so a broken setting can neither lock you out of your own daemon nor widen the posture.',
   conversationGate: 'What a message arriving from one of those channels does. By default it gets a conversational answer, and work is proposed and waits for your agreement rather than starting on its own; you can instead confirm every run, or restore the old behavior where a message starts work immediately. Also how long a pending proposal stays answerable and how many can wait at once. This governs messages from channels only — what you type here always runs, and schedules and triggers were authorized when created.',
   cloudflare: 'Optional Cloudflare control plane, batch queue, Worker, Tunnel, Access, DNS, KV, Durable Objects, Secrets Store, and R2 settings.',
   release: 'Release-channel preference.',
@@ -141,6 +142,7 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   batch: 'Batch',
   automation: 'Automation',
   checkin: 'Check-in',
+  occasions: 'Occasions & Plans',
   watchers: 'Watchers',
   runtime: 'Runtime',
   telemetry: 'Telemetry',