@pellux/goodvibes-tui 1.27.1 → 2.0.1

package/src/renderer/settings-modal-helpers.ts

@@ -87,6 +87,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   automation: 'Scheduled and automated run settings, concurrency, timeout, catch-up, cooldown, and retention behavior.',
   checkin: 'Proactive check-in: on a cadence, a briefing is judged and you are contacted only when something warrants it. Off by default; every run — scheduled or manual — leaves a receipt (see /checkin) recording whether it stayed quiet, delivered a message, or was skipped.',
   occasions: 'Proactive occasions and plans: dated, usually-recurring things that need an action (birthdays, anniversaries) and dated ranges that need only to be known about (a vacation). On by default. Lead time before a date, active hours nudges are allowed to arrive in, the nudge channel (empty makes it pull-only through /occasions), cadence while a window is open and the daily final stretch before it closes, whether an away plan moves a nudge earlier, whether a confirmed occasion mirrors to the calendar and whether a mirrored one suppresses its own nudge, how many questions the gift interview asks, how many years of gift history it keeps, and how often the sweep pass runs. The nudge itself never names the date — only how soon.',
+  hostedSessions: 'Sessions whose conversation loop runs INSIDE the daemon instead of this terminal, so the work does not end when the window that started it closes. What happens when the last client leaves is the detach policy: the shipped default is `kill` — exactly what closing a client has always done — and `survive` is the opt-in that leaves the session idle and reattachable. A session created with /hosted new --survive or --kill overrides the setting for itself. The remaining rows bound the capability: how many hosted sessions may run at once, how many messages one keeps, and how long a terminated session\'s record (with the reason it ended) is retained before it is retired.',
   watchers: 'File/process watcher heartbeat, polling, and recovery-window behavior, plus the trigger family (watchers.triggers.*, rendered as its own unit): stream watchers that regex-filter and batch a long-lived command\'s output, model-free condition checks running a probe/extract/rule pipeline with no LLM in the loop, and one-shot on-exit triggers that fire exactly one payload when a launched command terminates. The trigger family is off by default — a trigger supervises real processes with nobody watching — and its rows tune the backoff ladder, the strike breaker, retention bounds, batching, and process caps.',
   runtime: 'Runtime guardrails such as companion chat limiter and event bus listener caps.',
   telemetry: 'Telemetry payload policy.',
@@ -143,6 +144,7 @@ export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], strin
   automation: 'Automation',
   checkin: 'Check-in',
   occasions: 'Occasions & Plans',
+  hostedSessions: 'Hosted Sessions',
   watchers: 'Watchers',
   runtime: 'Runtime',
   telemetry: 'Telemetry',

package/src/renderer/settings-modal.ts

@@ -5,10 +5,10 @@
  * roomy workspace with contextual documentation, not a cramped modal list.
  */
 
-import type { Line } from '../types/grid.ts';
+import type { Line } from '@pellux/goodvibes-sdk/platform/types';
 import type { SettingsModal, SettingEntry, McpEntry, SubscriptionEntry, SettingsCategory } from '../input/settings-modal.ts';
 import { SETTINGS_CATEGORIES, SETTINGS_CATEGORY_GROUPS } from '../input/settings-modal.ts';
-import { FEATURE_SETTINGS_BY_ID, isFeatureValueEnabled } from '../runtime/feature-settings.ts';
+import { FEATURE_SETTINGS_BY_ID, isFeatureValueEnabled } from '@pellux/goodvibes-terminal-shell';
 import { getDisplayWidth, wrapText } from '../utils/terminal-width.ts';
 import { CATEGORY_INFO, CATEGORY_LABELS, describeUiRouting, formatValue, getSettingLabel, inferSubscriptionRouteReason, valueColor } from './settings-modal-helpers.ts';
 import { buildConnectionContext, renderConnectionRows } from './settings-modal-connections.ts';

package/src/renderer/shell-surface.ts

@@ -1,4 +1,4 @@
-import type { Line } from '../types/grid.ts';
+import type { Line } from '@pellux/goodvibes-sdk/platform/types';
 import { renderProcessIndicator, renderVoiceCaptureIndicator } from './process-indicator.ts';
 import { UIFactory } from './ui-factory.ts';
 import { voiceCaptureRowVisible, type VoiceCaptureIndicatorState } from '../core/voice-capture-status.ts';
@@ -78,7 +78,7 @@ export interface ShellFooterBuildOptions {
   /**
    * Cross-surface session-spine posture for the context-info segment.
    * Set ONLY in adopted-daemon mode ('online'/'offline'); left undefined in
-   * embedded/local mode so no segment renders.
+   * local-only mode so no segment renders.
    */
   readonly sessionSpineStatus?: 'online' | 'offline';
   /** The web surface's reachable URL, when that surface is enabled; a persistent footer segment. */

package/src/renderer/system-message.ts

@@ -1,4 +1,4 @@
-import { type Line } from '../types/grid.ts';
+import { type Line } from '@pellux/goodvibes-sdk/platform/types';
 import { BORDERS } from './layout.ts';
 import { renderConversationNotice } from './conversation-surface.ts';
 import { activeUiTones } from './theme.ts';

package/src/renderer/tab-strip.ts

@@ -1,4 +1,4 @@
-import type { Line } from '../types/grid.ts';
+import type { Line } from '@pellux/goodvibes-sdk/platform/types';
 import { getDisplayWidth } from '../utils/terminal-width.ts';
 import { buildStyledPanelLine, type StyledPanelSegment } from '../panels/polish.ts';
 

package/src/renderer/theme-mode-config.ts

@@ -8,7 +8,7 @@
  * DEFAULT_CONFIG, and adding an `appearance` section would require an SDK schema
  * change (out of scope for this TUI-only work order). Storing under `display`
  * reuses the same proven "TUI-local synthetic setting" pattern the codebase
- * already uses for tts.speed / behavior.notifyAfterSeconds / storage.codeIndexEnabled:
+ * already uses for behavior.notifyAfterSeconds / storage.codeIndexEnabled:
  * ConfigManager.setDynamic writes it to settings.json and get() reads it back,
  * with zero SDK changes.
  *

package/src/renderer/theme.ts

@@ -5,11 +5,11 @@
  * conversation-rendering pipeline, resolved to concrete hex or ANSI-256 values
  * per background mode.
  *
- * Dark mode values are the historically used colours.
- * Light mode values are defined now for correctness parity; they are consumed
- * when background-detection (terminal-bg-probe) lands and passes the
- * resolved mode down. Callers that do not yet have mode detection MUST call
- * resolveTheme('dark') as the safe default.
+ * Dark mode values are the historically used colours. Light mode values are
+ * consumed when the terminal-background probe (terminal-bg-probe.ts) resolves a
+ * light background under `display.themeMode: auto`, or when the owner forces
+ * light. A caller with no mode of its own passes 'dark', the safe default for a
+ * terminal whose background is unknown.
  *
  * IMPORTANT: inline code has NO background token. The bg:#1a1a1a hardcode
  * that previously existed caused a near-black box on light terminals.
@@ -20,14 +20,13 @@
  * status colours). It composes the same ThemeMode dimension so that
  * DEFAULT_PANEL_PALETTE, DEFAULT_STYLE, FULLSCREEN_PALETTE and
  * DEFAULT_OVERLAY_PALETTE all read through ONE mode-resolved path instead of
- * importing the static UI_TONES constant directly. Mode stays 'dark'
- * everywhere until the terminal-bg-probe lands (see) — the light
- * entry is type-complete, not a shipped light theme.
+ * importing the static UI_TONES constant directly, so one mode flip reaches
+ * every one of them.
  */
 
 import { UI_TONES } from './ui-primitives.ts';
 
-/** Background mode — dark is the safe default until terminal-bg-probe lands. */
+/** Background mode — dark is the safe default for an unprobed terminal. */
 export type ThemeMode = 'dark' | 'light';
 
 /** Resolved semantic colour tokens (concrete hex strings or ANSI-256 indices). */
@@ -150,8 +149,8 @@ const LIGHT: ThemeTokens = {
 /**
  * resolveTheme — Return the semantic token set for the given background mode.
  *
- * Call with 'dark' (the safe default) until terminal-bg-probe lands.
- * The returned object is frozen; callers should not mutate it.
+ * Call with the session's resolved mode; 'dark' is the safe default for a
+ * caller that has none. The returned object is frozen — do not mutate it.
  */
 export function resolveTheme(mode: ThemeMode): Readonly<ThemeTokens> {
   return mode === 'light' ? LIGHT : DARK;
@@ -242,7 +241,7 @@ export function resolveUiTones(mode: ThemeMode): Readonly<UiToneTokens> {
 }
 
 // ===========================================================================
-// Active-mode runtime (terminal-bg-probe landing).
+// Active-mode runtime.
 //
 // The mode is decided ONCE at startup — from appearance config (display.themeMode
 // forced dark/light) or the terminal-background probe (auto) — and is then stable

package/src/renderer/thinking.ts

@@ -1,4 +1,4 @@
-import { type Line } from '../types/grid.ts';
+import { type Line } from '@pellux/goodvibes-sdk/platform/types';
 import { BORDERS } from './layout.ts';
 import { renderConversationNotice } from './conversation-surface.ts';
 import { activeUiTones } from './theme.ts';

package/src/renderer/tool-call.ts

@@ -1,4 +1,4 @@
-import { type Line, createStyledCell, createEmptyLine } from '../types/grid.ts';
+import { type Line, createStyledCell, createEmptyLine } from '@pellux/goodvibes-sdk/platform/types';
 import { LAYOUT, TOOL_STATUS } from './layout.ts';
 import { getDisplayWidth, truncateDisplay } from '../utils/terminal-width.ts';
 import type { ToolCall } from '@pellux/goodvibes-sdk/platform/types';
@@ -6,7 +6,7 @@ import { stripDangerousAnsi } from './ansi-sanitize.ts';
 import { formatElapsed } from '../utils/format-elapsed.ts';
 import { GLYPHS } from './ui-primitives.ts';
 import { activeUiTones } from './theme.ts';
-import { treeContentCol, treeTextCol, writeTreeStatusMarker } from './conversation-tree.ts';
+import { treeContentCol, treeTextCol, writeTreeStatusMarker } from '@pellux/goodvibes-terminal-shell';
 
 const TOOL_NAME_MIN_WIDTH = 8;
 const TOOL_NAME_MAX_WIDTH = 20;

package/src/renderer/tool-result-expanded-lines.ts

@@ -11,7 +11,7 @@
  * each other and both can disagree with what Tab actually reveals.
  */
 
-import type { Line } from '../types/grid.ts';
+import type { Line } from '@pellux/goodvibes-sdk/platform/types';
 import { renderMarkdownTracked } from './markdown.ts';
 import { renderDiffView } from './diff-view.ts';
 

package/src/renderer/turn-injection.ts

@@ -7,11 +7,10 @@
  * ring, default 20 entries) and appends the same record to the agent's
  * session transcript as `{type:'knowledge_injection', turn, ...record}`.
  *
- * `TurnInjectionRecord` itself is not re-exported from the SDK's
- * `platform/agents` barrel (only `AgentRecord.turnInjections` carries its
- * structural shape through the already-public `platform/tools` barrel), so
- * the entry type here is DERIVED from `AgentRecord` rather than imported by
- * name — this needs no SDK export change.
+ * `TurnInjectionRecord` was reachable only as the element type of
+ * `AgentRecord.turnInjections`, so the entry type here was derived positionally
+ * from that array rather than named. The `platform/agents` barrel exports the
+ * record type now, and this names it.
  *
  * Reality check (since updated): the TUI's main interactive
  * session DOES route through this engine. The SDK `Orchestrator` runs per-turn
@@ -24,10 +23,10 @@
  * record onto their own `AgentRecord.turnInjections`, rendered per-agent by
  * `buildTurnInjectionsText` when an explicit agent id is given.
  */
-import type { AgentRecord } from '@pellux/goodvibes-sdk/platform/tools';
+import type { TurnInjectionRecord } from '@pellux/goodvibes-sdk/platform/agents';
 
-/** One TurnInjectionRecord entry, derived from AgentRecord (see module doc). */
-export type TurnInjectionEntry = NonNullable<AgentRecord['turnInjections']>[number];
+/** One per-turn injection record, under the name this renderer already used. */
+export type TurnInjectionEntry = TurnInjectionRecord;
 
 function fmtN(n: number): string {
   return n.toLocaleString();

package/src/renderer/ui-factory.ts

@@ -1,4 +1,4 @@
-import { type Line, type Cell, createEmptyLine, createEmptyCell } from '../types/grid.ts';
+import { type Line, type Cell, createEmptyLine, createEmptyCell } from '@pellux/goodvibes-sdk/platform/types';
 import { LAYOUT } from './layout.ts';
 import { VERSION } from '../version.ts';
 import { fitDisplay, getDisplayWidth, truncateDisplay, wrapText, interpolateColor, joinPrioritizedSegments, type PrioritizedSegment } from '../utils/terminal-width.ts';
@@ -13,7 +13,7 @@ import { computeContextUsage } from '../core/context-usage.ts';
 import { permissionModeLabel, permissionModeTone } from '../core/permission-mode.ts';
 import { SLEEP_DISABLED_CHIP } from '../core/power-status.ts';
 import { renderQueuedMessageList, renderMemoryProvenanceChip, type MemoryProvenanceEntry } from './composer-fragments.ts';
-import { calcSessionCost, isModelPriced } from '../export/cost-utils.ts';
+import { calcSessionCost, isModelPriced } from '@pellux/goodvibes-sdk/platform/providers';
 import { buildFooterTip, isAgentActive } from './footer-tips.ts';
 import type { StreamMetrics } from '../core/stream-event-wiring.ts';
 import { waitingPhrase, type WaitingState } from '@pellux/goodvibes-sdk/platform/presentation';
@@ -145,7 +145,7 @@ export class UIFactory {
     composerPendingRisk?: 'none' | 'approval-wait' | 'shell' | 'command' | 'remote',
     compact: boolean = false,
     // Honest cross-surface spine posture. Defined ONLY in adopted-daemon
-    // mode (undefined in embedded/local), so the segment is absent otherwise.
+    // mode (undefined in local-only mode), so the segment is absent otherwise.
     sessionSpineStatus?: 'online' | 'offline',
     // Session permission mode (config value). Rendered as a leading pill in the
     // posture block; undefined suppresses the pill (e.g. bare test callers).

package/src/runtime/bootstrap-command-context.ts

@@ -19,8 +19,8 @@ import type { PolicyRuntimeState } from '@/runtime/index.ts';
 import type { FileUndoManager } from '@pellux/goodvibes-sdk/platform/state';
 import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
 import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
-import type { WorkspaceTrustManager } from './trust/workspace-trust.ts';
-import type { WorkspaceRegistrationManager } from './trust/workspace-registration.ts';
+import type { WorkspaceTrustManager } from '@pellux/goodvibes-sdk/platform/runtime/operations';
+import type { WorkspaceRegistrationManager } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
 import type { MemoryRegistry } from '@pellux/goodvibes-sdk/platform/state';
 import type { IntegrationHelperService } from '@/runtime/index.ts';
@@ -91,7 +91,7 @@ export type CreateBootstrapCommandContextOptions = {
   knowledgeService?: KnowledgeService;
   projectPlanningService?: import('@pellux/goodvibes-sdk/platform/knowledge').ProjectPlanningService;
   projectPlanningProjectId?: string;
-  workPlanStore?: import('../work-plans/work-plan-store.ts').WorkPlanStore;
+  workPlanStore?: import('@pellux/goodvibes-sdk/platform/workflow').WorkPlanStore;
   providerOptimizer?: import('@pellux/goodvibes-sdk/platform/providers').ProviderOptimizer;
   pluginManager?: PluginManager;
   hookWorkbench?: HookWorkbench;
@@ -134,7 +134,7 @@ export type CreateBootstrapCommandContextOptions = {
   wrfcController?: import('@pellux/goodvibes-sdk/platform/agents').WrfcController;
   componentHealthMonitor: import('@/runtime/index.ts').ComponentHealthMonitor;
   hydrateSessionUsage?: () => void;
-  workstreamEngine?: import('./workstream-services.ts').WorkstreamCommandService;
+  workstreamEngine?: import('@pellux/goodvibes-sdk/platform/orchestration').WorkstreamCommandService;
   codeIndexStore?: import('@pellux/goodvibes-sdk/platform/state').CodeIndexStore;
   codeIndexReindexScheduler?: import('@pellux/goodvibes-sdk/platform/state').CodeIndexReindexScheduler;
   isPassiveCodeInjectionFlagEnabled?: () => boolean;

package/src/runtime/bootstrap-command-parts.ts

@@ -1,4 +1,4 @@
-import { getConfigSnapshot } from '../config/index.ts';
+import { getConfigSnapshot } from '@pellux/goodvibes-sdk/platform/config';
 import {
   describeServingEffort,
   publishActiveEffortOptions,
@@ -27,8 +27,8 @@ import type { PolicyRuntimeState } from '@/runtime/index.ts';
 import type { CodeIndexStore, FileUndoManager } from '@pellux/goodvibes-sdk/platform/state';
 import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
 import type { GatewayMethodCatalog } from '@pellux/goodvibes-sdk/platform/control-plane';
-import type { WorkspaceTrustManager } from './trust/workspace-trust.ts';
-import type { WorkspaceRegistrationManager } from './trust/workspace-registration.ts';
+import type { WorkspaceTrustManager } from '@pellux/goodvibes-sdk/platform/runtime/operations';
+import type { WorkspaceRegistrationManager } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
 import type { MemoryRegistry } from '@pellux/goodvibes-sdk/platform/state';
 import type { IntegrationHelperService } from '@/runtime/index.ts';
@@ -113,7 +113,7 @@ export interface BootstrapCommandSectionOptions {
   readonly knowledgeService?: KnowledgeService;
   readonly projectPlanningService?: import('@pellux/goodvibes-sdk/platform/knowledge').ProjectPlanningService;
   readonly projectPlanningProjectId?: string;
-  readonly workPlanStore?: import('../work-plans/work-plan-store.ts').WorkPlanStore;
+  readonly workPlanStore?: import('@pellux/goodvibes-sdk/platform/workflow').WorkPlanStore;
   readonly pluginManager?: PluginManager;
   readonly hookWorkbench?: HookWorkbench;
   readonly providerOptimizer?: import('@pellux/goodvibes-sdk/platform/providers').ProviderOptimizer;
@@ -134,7 +134,7 @@ export interface BootstrapCommandSectionOptions {
   readonly wrfcController?: import('@pellux/goodvibes-sdk/platform/agents').WrfcController;
   readonly changeTracker?: import('@pellux/goodvibes-sdk/platform/sessions').SessionChangeTracker;
   readonly hydrateSessionUsage?: () => void;
-  readonly workstreamEngine?: import('./workstream-services.ts').WorkstreamCommandService;
+  readonly workstreamEngine?: import('@pellux/goodvibes-sdk/platform/orchestration').WorkstreamCommandService;
   readonly codeIndexStore?: CodeIndexStore;
   readonly codeIndexReindexScheduler?: import('@pellux/goodvibes-sdk/platform/state').CodeIndexReindexScheduler;
   readonly isPassiveCodeInjectionFlagEnabled?: () => boolean;

package/src/runtime/bootstrap-core.ts

@@ -1,9 +1,9 @@
 import { ConversationManager } from '../core/conversation';
 import { registerSessionConversation } from './conversation-rewind-port.ts';
-import { SelectionManager } from '../input/selection.ts';
+import { SelectionManager } from '@pellux/goodvibes-terminal-shell';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
-import { ConfigManager, getConfiguredSystemPrompt } from '../config/index.ts';
-import { getProviderIdFromModel } from '../config/provider-model.ts';
+import { ConfigManager, getConfiguredSystemPrompt } from '@pellux/goodvibes-sdk/platform/config';
+import { getProviderIdFromModel } from '@pellux/goodvibes-sdk/platform/providers';
 import { ToolRegistry } from '@pellux/goodvibes-sdk/platform/tools';
 import { registerAllTools } from '@pellux/goodvibes-sdk/platform/tools';
 import { createSandboxContainmentNotice } from './daemon-attach-notices.ts';
@@ -13,7 +13,7 @@ import { Compositor } from '../renderer/compositor.ts';
 import type { PermissionRequestHandler } from '@pellux/goodvibes-sdk/platform/permissions';
 import type { SystemMessageRouter } from '../core/system-message-router.ts';
 import type { ConversationFollowUpItem } from '@pellux/goodvibes-sdk/platform/core';
-import type { OrchestratorUserInputOptions } from '../core/orchestrator.ts';
+import type { OrchestratorUserInputOptions } from '@pellux/goodvibes-sdk/platform/core';
 import type { ControlPlaneRecentEvent } from '@pellux/goodvibes-sdk/platform/control-plane';
 import type { BootstrapOptions } from './context.ts';
 import { createRuntimeStore, createDomainDispatch, type RuntimeStore } from './store/index.ts';
@@ -24,10 +24,11 @@ import {
 } from '@/runtime/index.ts';
 import { readExecEnvScrubAllowlist } from '../input/exec-env-scrub-config.ts';
 import { createSandboxExecAsk, sandboxExecAskDepsFromRuntime } from '../permissions/sandbox-exec-gate.ts';
-import { createRuntimeServices, installDevicePosture, type RuntimeServices } from './services.ts';
+import { createRuntimeServices, type RuntimeServices } from './services.ts';
+import { registerClientPhoneTool } from '@pellux/goodvibes-sdk/platform/runtime/client';
 import { createHostPowerSeam } from '@pellux/goodvibes-sdk/platform/power';
-import { runBootMemoryFold } from './memory-fold.ts';
-import { wireCostPricing } from '../export/cost-utils.ts';
+import { runBootMemoryFold } from '@pellux/goodvibes-sdk/platform/runtime/operations';
+import { wireCostPricing } from '@pellux/goodvibes-sdk/platform/providers';
 import { createUiRuntimeServices, type UiRuntimeServices } from './ui-services.ts';
 import { join } from 'node:path';
 import { installWrfcAgentToolGuard } from '../tools/wrfc-agent-guard.ts';
@@ -35,7 +36,7 @@ import { createWrfcPersistence, type WrfcPersistence } from './wrfc-persistence.
 import type { SystemMessagePriority } from '../core/system-message-router.ts';
 import { SessionSpineClient, SessionUnionCache, TUI_SPINE_PARTICIPANT } from '@pellux/goodvibes-sdk/platform/runtime/session-spine';
 import { SessionInboundInputPoller, createBootstrapInboundInputPoller } from './session-inbound-inputs.ts';
-import { trustGatedAsk, type WorkspaceTrustLevel } from './trust/workspace-trust.ts';
+import { trustGatedAsk, type WorkspaceTrustLevel } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 import { syncNotifierQueueIntegrations } from './bootstrap-notifier-sync.ts';
 
 // --- Pre-router buffer ---
@@ -117,11 +118,11 @@ export interface BootstrapCoreState {
   readonly requestRender: () => void;
   readonly setRenderRequest: (fn: () => void) => void;
   readonly runtimeSessionIdRef: { value: string };
-  /** Cross-surface identity mirror; permanently dormant for embedded/local-only (docs/decisions/2026-07-06-session-spine-mode-branch-is-permanent.md), activated by bootstrap.ts only for an adopted 'external' daemon. */
+  /** Cross-surface identity mirror; dormant for local-only, and for the SDK's 'embedded' HostServiceMode, which no product-facing setting can select — this product only ever adopts an external daemon or runs local-only (see the ADOPT ONLY guard in bootstrap.ts) (docs/decisions/2026-07-06-session-spine-mode-branch-is-permanent.md). Activated by bootstrap.ts only for an adopted 'external' daemon. */
   readonly sessionSpine: SessionSpineClient;
   /** Inbound steer/follow-up delivery; dormant until bootstrap.ts activates it. */
   readonly sessionInboundInputs: SessionInboundInputPoller;
-  /** Cache-backed read facade; bootstrap.ts drives its mode (embedded/external/local-only) from the same HostServiceMode as the spine above. */
+  /** Cache-backed read facade; bootstrap.ts drives its mode (external/local-only in this product — 'embedded' is a HostServiceMode value with no product-facing setting to select it here) from the same HostServiceMode as the spine above. */
   readonly sessionUnionCache: SessionUnionCache;
   /**
    * WRFC chain persistence — call `rehydrate()` once after the SystemMessageRouter
@@ -249,8 +250,8 @@ export async function initializeBootstrapCore(
     runtimeStore: store,
     getConversationTitle: () => getConversationTitle(),
     workingDir, homeDirectory, ...(options.daemonHomeDirectory === undefined ? {} : { daemonHomeDirectory: options.daemonHomeDirectory }),
-    // Embedded topology: the in-process runtime IS the daemon, so it holds its own OS inhibitor (fork
-    // default is non-spawning) and owns the wake-model boot retry a standalone daemon would. See services.ts.
+    // This product only ever adopts an external daemon (or runs local-only), never embedding one,
+    // so it holds its own OS inhibitor (fork default is non-spawning) and owns the wake-model boot retry itself. See services.ts.
     powerSeam: createHostPowerSeam(), provisionWakeModelsAtBoot: true,
   });
   await services.workspaceTrustManager.load(); // settle any already-persisted trust decision before any tool runs
@@ -295,10 +296,11 @@ export async function initializeBootstrapCore(
     surfaceRegistry,
     watcherRegistry,
   } = services;
-  // Permanently dormant for embedded/local-only (nothing to mirror to); bootstrap.ts activates it only for an adopted 'external' daemon.
+  // Dormant for local-only, and for the SDK's 'embedded' HostServiceMode — no product-facing
+  // setting can select it (SDK-internal embedder/test machinery); bootstrap.ts activates this spine only for an adopted 'external' daemon.
   const sessionSpine = new SessionSpineClient({ participant: TUI_SPINE_PARTICIPANT, recordKind: 'tui' });
-  // Cache-backed read facade over the local broker (passthrough until bootstrap.ts marks it
-  // embedded, or activates the adopted-daemon wire union for 'external').
+  // Cache-backed read facade over the local broker (passthrough until bootstrap.ts
+  // activates the adopted-daemon wire union for 'external').
   // selfSessionIds keeps local authoritative for our own wire-mirrored session even when local/wire ids diverge (D-TUI-1).
   const sessionUnionCache = new SessionUnionCache({ local: sharedSessionBroker, selfSessionIds: () => sessionSpine.mirroredSessionIds });
 
@@ -381,7 +383,7 @@ export async function initializeBootstrapCore(
     contextAccountingHolder: services.contextAccountingHolder,
     // First contained (sandboxed) command run announces "commands now run contained" once — recorded and surfaced now.
     onSandboxedRun: createSandboxContainmentNotice({ configManager, notify: (text) => conversation.log(`[Sandbox] ${text}`, { fg: '135' }) }),
-  }); installDevicePosture(toolRegistry, services.devicePosture); // the `phone` tool is the only path that reaches the device capability service, so without this every `device.*` posture key governs nothing a session can observe; the housekeeping timer starts here (not at composition) so building a runtime in a test sweeps nothing
+  }); registerClientPhoneTool(toolRegistry, services.devices); // the `phone` tool follows the LOOP, so it is registered here; the posture runtime it used to call is the daemon's now and this tool reaches it over the devices.* verbs (see the SDK's client/phone-tool.ts)
   // Note: installWrfcAgentToolGuard is called after routeOrBuffer is defined (further below) so the onTrace callback routes guard decisions through the pre-router buffer.
   services.agentOrchestrator.setDependencies({
     surfaceRoot: services.surface.surfaceRoot,
@@ -445,9 +447,9 @@ export async function initializeBootstrapCore(
     } catch (err) {
       logger.error('Render threw; next requestRender will reschedule', { error: String(err) });
     }
-    // Debounced spine heartbeat on turn/render activity (no-op while dormant, i.e.
-    // embedded/local-only): a cheap synchronous no-op unless its own internal window has
-    // elapsed (at most one wire call per heartbeatMinIntervalMs) — safe on the hot path.
+    // Debounced spine heartbeat on turn/render activity (no-op while dormant, i.e. local-only, or
+    // the SDK's 'embedded' mode, for which no product-facing setting exists): a cheap synchronous
+    // no-op unless its own internal window has elapsed (at most one wire call per heartbeatMinIntervalMs) — safe on the hot path.
     sessionSpine.heartbeat(runtimeSessionIdRef.value);
   };
   const requestRender = (): void => {
@@ -464,9 +466,9 @@ export async function initializeBootstrapCore(
       }
     });
   };
-  const permissionPromptRef = {
-    requestPermission: (async () => ({ approved: false, remember: false })) as PermissionRequestHandler,
-  };
+  // THE ref, not a second one: the composition already holds the prompt seam its
+  // client approval raiser calls, so the UI layer patching this patches that.
+  const permissionPromptRef = services.localPromptRef as { requestPermission: PermissionRequestHandler };
   // Trust-at-consequence-time: raised by trustGatedAsk on the first non-read
   // request in an undecided workspace; overridden once the UI layer exists — same ref-patching pattern as permissionPromptRef above.
   const trustPromptRef = { requestTrustDecision: (async () => 'restricted') as () => Promise<WorkspaceTrustLevel> };
@@ -699,16 +701,12 @@ export async function initializeBootstrapCore(
   await syncConfiguredServices(domainDispatch.syncIntegration, services.serviceRegistry);
 
   const permissionManager = new PermissionManager(
-    // Composed ask layer: the workspace trust gate (outer) wraps the sandbox-aware exec gate (inner); see sandbox-exec-gate.ts. The catastrophic block is untouched.
+    // Composed ask layer: the workspace trust gate (outer) wraps the sandbox-aware exec gate (inner); see sandbox-exec-gate.ts. The catastrophic block is untouched. The innermost ask is the CLIENT raiser: it posts approvals.raise to the daemon and prompts here (see the SDK's platform/runtime/client/approval-raiser.ts).
     trustGatedAsk(
       services.workspaceTrustManager,
       createSandboxExecAsk(
         sandboxExecAskDepsFromRuntime(configManager, featureFlags),
-        (request) => approvalBroker.requestApproval({
-          request,
-          sessionId: runtimeSessionIdRef.value,
-          localPrompt: permissionPromptRef.requestPermission,
-        }),
+        (request) => services.requestApproval({ request }),
       ),
       () => trustPromptRef.requestTrustDecision(), // indirection through the ref, not bound early — main.ts patches the real impl in later
     ),
@@ -729,8 +727,10 @@ export async function initializeBootstrapCore(
     sessionId: userSessionId,
   };
   runtimeSessionIdRef.value = runtime.sessionId;
-  // Register the live conversation so the composed daemon's rewind.plan/apply verbs
-  // can serve conversation scope for this session (see conversation-rewind-port.ts).
+  services.liveSessionIdRef.value = runtime.sessionId; // the session an ask raised on the daemon belongs to
+  // The live conversation, for this process's own /rewind AND for the daemon's
+  // questions about it — only the process holding the messages can count or
+  // drop them (conversation-rewind-port.ts, the SDK's client/conversation-rewind-host.ts).
   registerSessionConversation(runtime.sessionId, conversation);
   void sharedSessionBroker.createSession({
     id: runtime.sessionId,

package/src/runtime/bootstrap-shell.ts

@@ -1,8 +1,8 @@
 import { join } from 'node:path';
-import { readBudgetAlertUsd, BUDGET_ALERT_USD_DEFAULT } from '../export/cost-utils.ts';
+import { readBudgetAlertUsd, BUDGET_ALERT_USD_DEFAULT } from '@pellux/goodvibes-sdk/platform/providers';
 import { refreshMemoryRecallSnapshot } from './orchestrator-core-services.ts';
 import { sumConversationUsage, type ConversationManager } from '../core/conversation';
-import type { Orchestrator } from '../core/orchestrator';
+import type { Orchestrator } from '@pellux/goodvibes-sdk/platform/core';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { RuntimeEventBus } from '@/runtime/index.ts';
 import type { MutableRuntimeState } from '@/runtime/index.ts';
@@ -17,9 +17,9 @@ import { GitStatusProvider } from '../renderer/git-status.ts';
 import type { GitHeaderInfo } from '../renderer/git-status.ts';
 import type { PermissionRequestHandler } from '@pellux/goodvibes-sdk/platform/permissions';
 import { registerBuiltinPanels } from '../panels/builtin-panels.ts';
-import { WorkspaceRegistrationManager } from './trust/workspace-registration.ts';
+import { WorkspaceRegistrationManager } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 import { createSystemMessageRouter, type SystemMessageRouter } from '../core/system-message-router.ts';
-import { getConfigSnapshot } from '../config/index.ts';
+import { getConfigSnapshot } from '@pellux/goodvibes-sdk/platform/config';
 import { createBootstrapCommandContext } from './bootstrap-command-context.ts';
 import { createResumeSessionHandler } from './bootstrap-hook-bridge.ts';
 import { confirmLiveResume } from './session-resume-liveness-confirm.ts';