@pellux/goodvibes-tui 1.27.1 → 2.0.1

package/src/input/handler-types.ts

@@ -19,8 +19,8 @@ import type { UiRuntimeServices } from '../runtime/ui-services.ts';
 import type { CommandContext } from './command-registry.ts';
 import type { ConversationManager } from '../core/conversation';
 import type { ModelPickerModal, ModelPickerTarget } from './model-picker.ts';
-import type { SelectionManager } from './selection.ts';
-import type { InfiniteBuffer } from '../core/history.ts';
+import type { SelectionManager } from '@pellux/goodvibes-terminal-shell';
+import type { InfiniteBuffer } from '@pellux/goodvibes-terminal-shell';
 import type { AutocompleteEngine } from './autocomplete.ts';
 import type { BookmarkModal } from './bookmark-modal.ts';
 import type { SettingsModal } from './settings-modal.ts';

package/src/input/handler-ui-state.ts

@@ -1,5 +1,5 @@
 import type { InputToken } from '@pellux/goodvibes-sdk/platform/core';
-import type { InfiniteBuffer } from '../core/history.ts';
+import type { InfiniteBuffer } from '@pellux/goodvibes-terminal-shell';
 import type { SearchManager } from './search.ts';
 import type { HistorySearch } from './input-history.ts';
 import type { ConversationManager } from '../core/conversation';

package/src/input/handler.ts

@@ -9,8 +9,8 @@ import type { OnboardingRuntimePosture } from './handler-types.ts';
 import { beginOpenAICodexLogin, exchangeOpenAICodexCode } from '@pellux/goodvibes-sdk/platform/config';
 import { openExternalUrl } from '@pellux/goodvibes-sdk/platform/utils';
 import { buildProviderAccountSnapshot } from '@/runtime/index.ts';
-import { SelectionManager } from './selection.ts';
-import type { InfiniteBuffer } from '../core/history.ts';
+import { SelectionManager } from '@pellux/goodvibes-terminal-shell';
+import type { InfiniteBuffer } from '@pellux/goodvibes-terminal-shell';
 import type { CommandRegistry, CommandContext } from './command-registry.ts';
 import { AutocompleteEngine } from './autocomplete.ts';
 import { FilePickerModal } from './file-picker.ts';
@@ -25,7 +25,7 @@ import { ContextInspectorModal } from '../renderer/context-inspector.ts';
 import { BookmarkModal } from './bookmark-modal.ts';
 import { SettingsModal } from './settings-modal.ts';
 import { McpWorkspace } from './mcp-workspace.ts';
-import { SessionPickerModal } from './session-picker-modal.ts';
+import { SessionPickerModal, getSharedHostedSessionRoster } from './session-picker-modal.ts';
 import { ConfigModal } from './config-modal.ts';
 import { ProfilePickerModal } from './profile-picker-modal.ts';
 import type { PanelBurstGuardState } from './panel-paste-flood-guard.ts';
@@ -283,7 +283,7 @@ export class InputHandler implements InputHandlerLike {
     // retirement: ProcessModal/LiveTailModal/AgentDetailModal were removed
     // — F2 now opens the Fleet panel, which subsumes the live process tree.
     this.bookmarkModal = new BookmarkModal(uiServices.shell.bookmarkManager);
-    this.sessionPickerModal = new SessionPickerModal(uiServices.sessions.sessionManager, uiServices.sessions.sessionBroker);
+    this.sessionPickerModal = new SessionPickerModal(uiServices.sessions.sessionManager, uiServices.sessions.sessionBroker, getSharedHostedSessionRoster(), () => this.requestRender()); // third source: the daemon-hosted roster
     this.profilePickerModal = new ProfilePickerModal(uiServices.shell.profileManager);
     this.selectionQueue = attachSelectionModalQueue(this); // wires exitApp teardown too — see selection-modal-queue.ts
     this.initFeedContext();

package/src/input/input-history.ts

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { atomicWriteFileSync } from '@/config/atomic-write.ts';
+import { atomicWriteFileSync } from '@pellux/goodvibes-sdk/platform/config';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 

package/src/input/onboarding/onboarding-feature-units.ts

@@ -14,8 +14,8 @@
  * lockstep with the SDK feature-flag set.
  */
 
-import type { ConfigKey } from '../../config/index.ts';
-import { getFeatureSetting, isFeatureDefaultEnabled } from '../../runtime/feature-settings.ts';
+import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
+import { getFeatureSetting, isFeatureDefaultEnabled } from '@pellux/goodvibes-terminal-shell';
 import type {
   OnboardingWizardControllerLike,
   OnboardingWizardFieldDefinition,

package/src/input/onboarding/onboarding-runtime-status.ts

@@ -38,6 +38,11 @@ export function runtimePortDiagnostic(
       const version = status.version ? ` version ${status.version}` : '';
       return `An existing GoodVibes service was verified at ${status.baseUrl}${version}.`;
     }
+    // The only mode left after every named branch above is 'embedded', and this
+    // function reads either endpoint's status (see getRuntimeEndpointStatus):
+    // the daemon status can never carry it in this product (adoptOnly is
+    // hardcoded — see bootstrap.ts), but the HTTP listener's status legitimately
+    // does, since the SDK always reports its in-process listener as 'embedded'.
     return `An embedded GoodVibes service is running at ${status.baseUrl}.`;
   }
   if (portInUse) {
@@ -58,6 +63,11 @@ export function isRuntimeEndpointActive(
   endpoint: OnboardingRuntimeEndpoint,
 ): boolean {
   const status = getRuntimeEndpointStatus(state, endpoint);
+  // This helper serves both endpoints (see handler-onboarding.ts's daemon and
+  // httpListener calls), so the 'embedded' arm stays live for httpListener even
+  // though a daemon status here is never 'embedded' in this product (adoptOnly
+  // is hardcoded — see bootstrap.ts). Dropping the arm would mark a running
+  // HTTP listener as inactive.
   if (status) return status.mode === 'embedded' || status.mode === 'external';
   return endpoint === 'daemon'
     ? state?.daemonRunning === true
@@ -70,7 +80,9 @@ export function isRuntimeEndpointOccupyingConfiguredPort(
 ): boolean {
   const status = getRuntimeEndpointStatus(state, endpoint);
   // 'incompatible' means a GoodVibes daemon holds the configured port (we just
-  // did not adopt it) — the port IS occupied, so report it as such.
+  // did not adopt it) — the port IS occupied, so report it as such. As with
+  // isRuntimeEndpointActive above, 'embedded' stays live here for httpListener
+  // (daemon status never carries it in this product).
   if (status) return status.mode === 'embedded' || status.mode === 'external' || status.mode === 'blocked' || status.mode === 'incompatible';
   return endpoint === 'daemon'
     ? state?.daemonRunning === true || state?.daemonPortInUse === true
@@ -87,6 +99,8 @@ export function formatRuntimeActiveSuccessMessage(
     const version = status.version ? ` version ${status.version}` : '';
     return `${label} is already running as a verified external GoodVibes service at ${status.baseUrl}${version}.`;
   }
+  // Reachable for httpListener (the SDK always reports its in-process listener
+  // as 'embedded'); a daemon status never carries this mode in this product.
   if (status?.mode === 'embedded') {
     return `${label} is running as an embedded service at ${status.baseUrl}.`;
   }

package/src/input/onboarding/onboarding-wizard-apply.ts

@@ -1,7 +1,7 @@
 import type { OnboardingAcknowledgementTarget, OnboardingApplyOperation, OnboardingApplyRequest } from '../../runtime/onboarding/index.ts';
-import { formatProviderModel } from '../../config/provider-model.ts';
-import { getServerSurfaceFeatureFlags } from '../../runtime/surface-feature-flags.ts';
-import { featureEnablementWrite } from '../../runtime/feature-settings.ts';
+import { formatProviderModel } from '@pellux/goodvibes-sdk/platform/providers';
+import { getServerSurfaceFeatureFlags } from '@pellux/goodvibes-sdk/platform/runtime/operations';
+import { featureEnablementWrite } from '@pellux/goodvibes-terminal-shell';
 import {
   buildCloudflareApiTokenRef,
   buildCloudflareOperationalTokenRef,
@@ -303,14 +303,23 @@ function addCloudflareOperations(
     setConfig('batch.mode', batchMode);
     setConfig('batch.queueBackend', batchMode !== 'off' && components.queues ? 'cloudflare' : 'local');
     // Zero Trust Tunnel auto-enables trustProxy on both services so the
-    // login-rate-limiter keys on the real CF-Connecting-IP rather than the tunnel
-    // egress address. RESIDUAL RISK: until the SDK validates CF-Connecting-IP
-    // against Cloudflare's published IP ranges (SDK handoff Item 5), a client
-    // that reaches the listener directly can spoof the header to bypass the
-    // per-IP limiter. The wizard surfaces this in the cloudflare step notice.
+    // login-rate-limiter keys on the client address the tunnel forwards rather
+    // than the tunnel's own egress address. On its own, that address is read
+    // from X-Forwarded-For, which a client reaching the listener directly can
+    // set for itself — so it could still choose which address the rate limiter
+    // and the audit log recorded.
+    //
+    // httpListener.trustCloudflare is what closes that: the listener reads
+    // CF-Connecting-IP instead, and only when the connecting peer is inside a
+    // published Cloudflare range, so a direct client cannot name its own
+    // address. This route puts the listener behind the tunnel, which is exactly
+    // the deployment the stricter read is for, so the wizard turns it on rather
+    // than leaving it to be found in the settings list. It is a no-op without
+    // trustProxy, which the same branch writes.
     if (components.zeroTrustTunnel) {
       setConfig('controlPlane.trustProxy', true);
       setConfig('httpListener.trustProxy', true);
+      setConfig('httpListener.trustCloudflare', true);
     }
   }
 

package/src/input/onboarding/onboarding-wizard-cloudflare-step.ts

@@ -264,9 +264,9 @@ export function buildCloudflareStep(controller: OnboardingWizardControllerLike):
       fields.push({
         kind: 'status',
         id: 'cloudflare.trust-proxy-notice',
-        label: 'trustProxy will be enabled for control plane and HTTP listener',
+        label: 'Forwarded-address handling will be configured for this route',
         defaultValue: 'Notice',
-        hint: 'Selecting Zero Trust Tunnel auto-writes controlPlane.trustProxy=true and httpListener.trustProxy=true so the login rate-limiter keys on the real client IP (CF-Connecting-IP) rather than the tunnel egress address. RESIDUAL RISK: until the SDK validates CF-Connecting-IP against Cloudflare published IP ranges (handoff Item 5), a client that reaches the listener directly can spoof this header to bypass the per-IP rate-limiter. See docs/deployment-and-services.md for the full risk posture.',
+        hint: 'Selecting Zero Trust Tunnel auto-writes controlPlane.trustProxy=true and httpListener.trustProxy=true, so the login rate-limiter keys on the client address the tunnel forwards rather than the tunnel egress address. On their own those two read that address from X-Forwarded-For, which a client reaching the port directly can set for itself. It also writes httpListener.trustCloudflare=true, which is ON for this route: the HTTP listener instead reads CF-Connecting-IP and only accepts it from a peer inside a published Cloudflare range, so a direct client cannot name its own address to pick which rate-limit bucket and audit-log entry it lands in. The control plane has no equivalent setting, so keep it reachable only through the tunnel. See docs/deployment-and-services.md for the full posture.',
       });
     }
 
@@ -476,7 +476,9 @@ export function buildCloudflareStep(controller: OnboardingWizardControllerLike):
       `Components: ${enabled ? componentCount : 0} selected`,
       `Token setup: ${enabled ? setupSource : 'not used'}`,
       `Provision on final apply: ${enabled ? controller.getStringFieldValue('cloudflare.provision-on-apply', 'no') : 'no'}`,
-      ...(enabled && components.zeroTrustTunnel ? ['trustProxy: enabled for control plane and HTTP listener (see security notice)'] : []),
+      ...(enabled && components.zeroTrustTunnel
+        ? ['trustProxy: enabled for control plane and HTTP listener; trustCloudflare: ON for the HTTP listener (see notice)']
+        : []),
     ],
     fields,
   };

package/src/input/onboarding/onboarding-wizard-external-surfaces.ts

@@ -34,7 +34,7 @@ import type {
   ChannelSetupFieldKind,
   ChannelSurface,
 } from '@pellux/goodvibes-sdk/platform/channels';
-import { DEFAULT_CONFIG, type ConfigKey } from '../../config/index.ts';
+import { DEFAULT_CONFIG, type ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import type { OnboardingSnapshotState } from '../../runtime/onboarding/index.ts';
 import { TELEGRAM_MODE_OPTIONS, WHATSAPP_PROVIDER_OPTIONS } from './onboarding-wizard-constants.ts';
 import type { ExternalSurfaceSetupFieldSpec, ExternalSurfaceSpec, OnboardingWizardRadioOption } from './onboarding-wizard-types.ts';

package/src/input/onboarding/onboarding-wizard-types.ts

@@ -9,7 +9,7 @@ import {
   type OnboardingStep1CapabilityItem,
   type OnboardingStepDerivationState,
 } from '../../runtime/onboarding/index.ts';
-import type { ConfigKey } from '../../config/index.ts';
+import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 
 export type OnboardingWizardMode = OnboardingMode;
 

package/src/input/payments-config.ts

@@ -26,15 +26,15 @@
  * implicit card the way this app's `/payments card` flow models it, so these
  * four fields are synthetic sub-keys under the SDK's real `payments`
  * section — the same established pattern this codebase already uses for
- * `tts.speed`, `behavior.notifyAfterSeconds`, etc.: a key one level under an
- * EXISTING section that CONFIG_SCHEMA hasn't grown a scalar entry for yet.
+ * `behavior.notifyAfterSeconds`, `display.themeMode`, etc.: a key one level
+ * under an EXISTING section that CONFIG_SCHEMA has no scalar entry for.
  *
  * That one-level-under-an-existing-section shape matters mechanically: the
  * real ConfigManager's dotted-path resolver only throws "Invalid config path"
  * when an INTERMEDIATE segment is missing (e.g. `payments.card.number`, where
  * `card` is not itself a section) — it does not throw for a final leaf that
- * the schema hasn't declared (`payments.cardNumber`), the same tolerance
- * `tts.speed` already relies on under `tts`. So these four keys are named
+ * the schema has not declared (`payments.cardNumber`), the same tolerance
+ * `display.themeMode` relies on under `display`. So these four keys are named
  * FLAT (`payments.cardNumber`, not `payments.card.number`) specifically so
  * `ConfigManager.get/setDynamic` accepts them — verified against the real
  * ConfigManager (not the fake store this module used before this round): a
@@ -62,7 +62,7 @@
  */
 
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
-import type { ConfigKey } from '../config/index.ts';
+import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import type { SettingEntry } from './settings-modal-types.ts';
 
 /** Real ConfigManager's read surface — these four keys are defensive reads (see header comment). */
@@ -79,7 +79,7 @@ export const PAYMENTS_CVV_HANDLING_CONFIG_KEY = 'payments.cvvHandling' as Config
 function readStringField(configManager: PaymentsConfigReader, key: ConfigKey): string {
   // Defensive try/catch, same rationale as worktree-setup-config.ts's
   // readWorktreeSetupList and this codebase's other one-level-under-a-real-
-  // section synthetic reads (tts.speed, behavior.notifyAfterSeconds): the real
+  // section synthetic reads (behavior.notifyAfterSeconds, display.themeMode): the real
   // ConfigManager never throws for these particular keys (verified — see
   // header comment), but degrading to empty rather than crashing the whole
   // settings modal is the same posture every synthetic setting here takes

package/src/input/search.ts

@@ -1,4 +1,4 @@
-import type { InfiniteBuffer } from '../core/history.ts';
+import type { InfiniteBuffer } from '@pellux/goodvibes-terminal-shell';
 import type { ConversationManager } from '../core/conversation';
 
 export interface SearchMatch {

package/src/input/session-picker-modal.ts

@@ -17,6 +17,17 @@
  * selectable for load/delete. `sessionBroker` is optional so every existing
  * caller/test that only cares about local saved-session management keeps
  * working unchanged.
+ *
+ * Hosted sessions: a third, also read-only section lists the conversations
+ * running INSIDE the daemon (`sessions.hosted.list`, held by the shared roster
+ * in runtime/client/hosted-roster.ts). They belong in the place a person
+ * already goes to ask "what sessions are there" — a hosted session is exactly
+ * that, one whose loop happens to live elsewhere. Joining one is `/hosted
+ * attach <id>` rather than an Enter here, for the same reason cross-surface
+ * rows are not loadable: there is no on-disk transcript this process can
+ * `load()`, and attaching opens a live stream that the picker has no business
+ * owning. The id is rendered in full so the command can be typed straight from
+ * the row.
  */
 
 import { unlinkSync } from 'node:fs';
@@ -25,6 +36,20 @@ import type { SharedSessionRecord } from '@pellux/goodvibes-sdk/platform/control
 import type { CrossSurfaceView, SessionReadFacade } from '@pellux/goodvibes-sdk/platform/runtime/session-spine';
 import type { ConversationManager } from '../core/conversation';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import type { HostedRosterSnapshot } from '../runtime/client/hosted-roster.ts';
+// Re-exported so the composition site (input/handler.ts) reaches the picker and
+// its hosted roster through ONE import — that file sits on this repo's 800-line
+// per-file gate and a second import line there is a real cost.
+export { getSharedHostedSessionRoster } from '../runtime/client/hosted-roster.ts';
+
+/** What the picker needs of the hosted roster: the last answer, and a way to ask again. */
+export interface SessionPickerHostedRoster {
+  snapshot(): HostedRosterSnapshot;
+  refresh(): Promise<void>;
+}
+
+/** Honest default when no roster was wired: nothing has been read, and nothing is claimed. */
+const UNREAD_HOSTED_ROSTER: HostedRosterSnapshot = { sessions: [], capturedAt: null, note: null };
 
 // ---------------------------------------------------------------------------
 // SessionPickerModal
@@ -51,12 +76,22 @@ export class SessionPickerModal {
   public visibleRows = 8;
   public deleteConfirmationTarget: string | null = null;
 
+  /** Daemon-hosted sessions (view-only) — see class doc. Never a fabricated empty list. */
+  public hostedRoster: HostedRosterSnapshot = UNREAD_HOSTED_ROSTER;
+
   /** Last status message to show in the modal (e.g. error or success). */
   public statusMessage = '';
 
   public constructor(
     private readonly sessionManager: SessionManager,
     private readonly sessionBroker?: SessionReadFacade,
+    private readonly hostedRosterSource?: SessionPickerHostedRoster,
+    /**
+     * Called when a late roster refresh lands, so the frame the user is looking
+     * at picks it up. Without it the refresh still happens; it just shows on the
+     * next keystroke, which is what a modal with no render hook can honestly do.
+     */
+    private readonly onRosterRefreshed?: () => void,
   ) {}
 
   /**
@@ -72,6 +107,17 @@ export class SessionPickerModal {
       this.crossSurfaceSessions = [];
       this.crossSurfaceView = DORMANT_CROSS_SURFACE_VIEW;
     }
+    // The roster's LAST answer renders immediately (a round trip must not delay
+    // the modal), and a refresh is asked for behind it. A refusal keeps the last
+    // rows and records why, so the section never silently empties.
+    this.hostedRoster = this.hostedRosterSource?.snapshot() ?? UNREAD_HOSTED_ROSTER;
+    if (this.hostedRosterSource) {
+      const source = this.hostedRosterSource;
+      void source.refresh().then(() => {
+        this.hostedRoster = source.snapshot();
+        this.onRosterRefreshed?.();
+      });
+    }
     this.selectedIndex = 0;
     this.scrollOffset = 0;
     this.statusMessage = '';

package/src/input/settings-modal-activation.ts

@@ -16,7 +16,7 @@ import { buildMcpEntries, buildSubscriptionEntries } from './settings-modal-data
 import { modelPickerLaunchForKey } from './settings-modal-behavior.ts';
 import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import type { SubscriptionManager } from '@pellux/goodvibes-sdk/platform/config';
-import type { ServiceInspectionQuery } from '../runtime/ui-service-queries.ts';
+import type { ServiceInspectionQuery } from '@/runtime/index.ts';
 import type { ModelPickerTarget } from './model-picker.ts';
 
 // ---------------------------------------------------------------------------

package/src/input/settings-modal-behavior.ts

@@ -33,10 +33,10 @@ export function getNumericAdjustmentMeta(setting: ConfigSetting): {
   if (setting.key === 'wrfc.scoreThreshold') {
     return { step: 0.1, min: 0, max: 10, precision: 1 };
   }
-  if ((setting.key as string) === 'tts.speed') {
-    // Speed multiplier: 0.1 increments, min 0.1, no hard max (provider-defined).
-    // tts.speed is not yet a ConfigKey in the SDK schema; cast required.
-    return { step: 0.1, min: 0.1, precision: 1 };
+  if (setting.key === 'tts.speed') {
+    // Speed multiplier, 0.1 increments across the schema's own supported range
+    // (see the key's numRange in the SDK config schema).
+    return { step: 0.1, min: 0.25, max: 4, precision: 1 };
   }
   return { step: 1, precision: 0 };
 }

package/src/input/settings-modal-commit.ts

@@ -19,6 +19,7 @@ import { buildMcpEntries } from './settings-modal-data.ts';
 import { isWorktreeSetupListConfigKey, parseWorktreeSetupListInput } from './worktree-setup-config.ts';
 import { isSandboxExecListConfigKey, parseSandboxExecListInput } from './sandbox-exec-config.ts';
 import { isExecEnvScrubAllowlistConfigKey, parseExecEnvScrubAllowlistInput } from './exec-env-scrub-config.ts';
+import type { SettingsDaemonCredentialWriter } from './settings-modal-secrets.ts';
 import type { McpEntry, SettingEntry } from './settings-modal-types.ts';
 
 export interface CommitEditContext {
@@ -27,6 +28,14 @@ export interface CommitEditContext {
   readonly editBuffer: string;
   readonly configManager: ConfigManager | null;
   readonly secretsManager: SettingsSecretsManager | null;
+  /**
+   * The daemon's credential write, when a daemon is adopted. A daemon-scoped
+   * credential must land where the daemon reads it, not in this surface's own
+   * tree — see settings-modal-secrets.ts.
+   */
+  readonly daemonCredentials?: SettingsDaemonCredentialWriter | null;
+  /** Renders a refused credential write; without it a failure would be silent. */
+  readonly reportError?: ((message: string) => void) | undefined;
   readonly mcpRegistry: McpRegistry | null;
   readonly mcpAllowAllConfirmationTarget: string | null;
   getSelectedMcp(): McpEntry | null;
@@ -135,7 +144,9 @@ export function commitEditValue(ctx: CommitEditContext): boolean {
       value: String(parsed ?? ''),
       configManager: ctx.configManager,
       secretsManager: ctx.secretsManager,
+      daemonCredentials: ctx.daemonCredentials ?? null,
       setConfigValue: (key, value) => ctx.setValue(key, value),
+      ...(ctx.reportError ? { onError: ctx.reportError } : {}),
     });
   } else {
     ctx.setValue(setting.key as ConfigKey, parsed);

package/src/input/settings-modal-data.ts

@@ -13,8 +13,8 @@ import type { FeatureFlagManager } from '@/runtime/index.ts';
 import type { McpRegistry } from '@pellux/goodvibes-sdk/platform/mcp';
 import { buildSubscriptionEntries } from './settings-modal-subscriptions.ts';
 import type { SubscriptionManager } from '@pellux/goodvibes-sdk/platform/config';
-import type { ServiceInspectionQuery } from '../runtime/ui-service-queries.ts';
-import { CODE_INDEX_ENABLED_CONFIG_KEY } from '../runtime/code-index-services.ts';
+import type { ServiceInspectionQuery } from '@/runtime/index.ts';
+import { CODE_INDEX_ENABLED_CONFIG_KEY } from '@pellux/goodvibes-sdk/platform/runtime/operations';
 import {
   WORKTREE_SETUP_CARRY_OVER_GLOBS_CONFIG_KEY,
   WORKTREE_SETUP_COMMANDS_CONFIG_KEY,
@@ -23,7 +23,7 @@ import {
   isWorktreeSetupListConfigKey,
   readWorktreeSetupList,
 } from './worktree-setup-config.ts';
-import { BUDGET_ALERT_USD_CONFIG_KEY, BUDGET_ALERT_USD_DEFAULT, readBudgetAlertUsd } from '../export/cost-utils.ts';
+import { BUDGET_ALERT_USD_CONFIG_KEY, BUDGET_ALERT_USD_DEFAULT, readBudgetAlertUsd } from '@pellux/goodvibes-sdk/platform/providers';
 import { MEMORY_PROJECTION_DIR_CONFIG_KEY, buildMemoryProjectionDirSyntheticEntry } from './commands/recall-files-config.ts';
 import { MEMORY_SHOW_PROVENANCE_CONFIG_KEY, buildMemoryProvenanceSyntheticEntry } from '../core/memory-provenance.ts';
 import {
@@ -54,7 +54,7 @@ import {
 import { enrichRelaySettingDescriptions } from './relay-settings-descriptions.ts';
 import { enrichDaemonOwnedSettingDescriptions } from './daemon-owned-settings-descriptions.ts';
 import { applyFeatureUnitLayout } from './feature-unit-layout.ts';
-import { FEATURE_SETTINGS_BY_ID } from '../runtime/feature-settings.ts';
+import { FEATURE_SETTINGS_BY_ID } from '@pellux/goodvibes-terminal-shell';
 import {
   buildPaymentsSyntheticEntries,
   isPaymentsSyntheticConfigKey,
@@ -172,11 +172,6 @@ export function buildSettingGroups(
     }
   }
 
-  // Synthetic tts.speed (not yet an SDK ConfigKey) — surfaced with an honest caveat.
-  if (ttsEntries && !ttsEntries.some((e) => e.setting.key === ('tts.speed' as ConfigKey))) {
-    ttsEntries.push(buildTtsSpeedSyntheticEntry(configManager));
-  }
-
   // Synthetic behavior.notifyAfterSeconds (TUI-local): long-task push threshold.
   const behaviorEntries = groups.get('behavior');
   if (behaviorEntries && !behaviorEntries.some((e) => e.setting.key === ('behavior.notifyAfterSeconds' as ConfigKey))) {
@@ -288,52 +283,6 @@ export function buildSettingGroups(
   return groups;
 }
 
-// ---------------------------------------------------------------------------
-// TTS_SPEED_DEFAULT — the pending-SDK default for tts.speed
-// ---------------------------------------------------------------------------
-
-/**
- * Pending default for tts.speed. Matches the value the SDK will use once
- * the schema field is added: 1 (normal speed, provider default).
- * Used for the synthetic settings-modal entry and isDefault comparisons.
- */
-export const TTS_SPEED_DEFAULT = 1;
-
-/**
- * The synthetic ConfigSetting descriptor for tts.speed.
- * `tts.speed` is not yet a ConfigKey in the SDK schema. This descriptor is
- * TUI-local and is injected into the tts settings group so users can see
- * and interact with the setting before the SDK schema catches up.
- *
- * The key is cast to ConfigKey because ConfigSetting requires it and the SDK
- * will add this key in a future release. The cast is safe: configManager.get
- * returns undefined for unknown keys rather than throwing.
- */
-export const TTS_SPEED_SYNTHETIC_SETTING: ConfigSetting = {
-  key: 'tts.speed' as ConfigKey,
-  type: 'number',
-  default: TTS_SPEED_DEFAULT,
-  description: 'Playback speed multiplier passed to the TTS provider (1.0 = normal). Takes effect immediately via the TUI bridge; SDK schema registration is pending (native typing only).',
-};
-
-/**
- * Build the synthetic SettingEntry for tts.speed.
- *
- * Reads the raw value from configManager using a cast key (tts.speed is not
- * yet a valid ConfigKey). If the value is absent or not a positive finite
- * number, falls back to TTS_SPEED_DEFAULT and marks isDefault true.
- */
-export function buildTtsSpeedSyntheticEntry(configManager: Pick<ConfigManager, 'get'>): SettingEntry {
-  const raw = configManager.get('tts.speed' as ConfigKey);
-  const parsed = typeof raw === 'number' ? raw : parseFloat(String(raw ?? ''));
-  const currentValue: number = isFinite(parsed) && parsed > 0 ? parsed : TTS_SPEED_DEFAULT;
-  return {
-    setting: TTS_SPEED_SYNTHETIC_SETTING,
-    currentValue,
-    isDefault: deepEqual(currentValue, TTS_SPEED_DEFAULT),
-  };
-}
-
 // ---------------------------------------------------------------------------
 // display.themeMode synthetic setting (light theme)
 // ---------------------------------------------------------------------------
@@ -628,16 +577,6 @@ export function buildNetworkFilteredItems(
 // refreshEntryValues — re-reads currentValue/isDefault for all loaded entries
 // ---------------------------------------------------------------------------
 
-/**
- * Normalize a raw config value for the tts.speed synthetic entry.
- * Returns the raw value if it is a positive finite number, otherwise falls
- * back to TTS_SPEED_DEFAULT. Mirrors the logic in buildTtsSpeedSyntheticEntry.
- */
-function normalizeTtsSpeedValue(raw: unknown): number {
-  const parsed = typeof raw === 'number' ? raw : parseFloat(String(raw ?? ''));
-  return isFinite(parsed) && parsed > 0 ? parsed : TTS_SPEED_DEFAULT;
-}
-
 export function refreshEntryValues(
   groups: Map<SettingsCategory, SettingEntry[]>,
   configManager: ConfigManager,
@@ -683,16 +622,12 @@ export function refreshEntryValues(
         continue;
       }
       const raw = configManager.get(entry.setting.key as ConfigKey);
-      // Synthetic entries (e.g. tts.speed) that have no SDK schema key return
-      // undefined from configManager. Normalize using the same logic used at
-      // construction time so isDefault stays accurate.
-      if (entry.setting.key === ('tts.speed' as ConfigKey)) {
-        entry.currentValue = normalizeTtsSpeedValue(raw);
-      } else if (entry.setting.key === (THEME_MODE_CONFIG_KEY as ConfigKey)) {
-        entry.currentValue = coerceThemeModeSetting(raw);
-      } else {
-        entry.currentValue = raw;
-      }
+      // Synthetic entries that have no SDK schema key return undefined from
+      // configManager. Normalize using the same logic used at construction
+      // time so isDefault stays accurate.
+      entry.currentValue = entry.setting.key === (THEME_MODE_CONFIG_KEY as ConfigKey)
+        ? coerceThemeModeSetting(raw)
+        : raw;
       entry.isDefault = deepEqual(entry.currentValue, entry.setting.default);
     }
   }
@@ -736,11 +671,9 @@ export function updateEntryForKey(
       }
       const raw = configManager.get(key);
       // Synthetic entries: normalize using the same fallback logic as construction.
-      entry.currentValue = key === ('tts.speed' as ConfigKey)
-        ? normalizeTtsSpeedValue(raw)
-        : key === (THEME_MODE_CONFIG_KEY as ConfigKey)
-          ? coerceThemeModeSetting(raw)
-          : raw;
+      entry.currentValue = key === (THEME_MODE_CONFIG_KEY as ConfigKey)
+        ? coerceThemeModeSetting(raw)
+        : raw;
       entry.isDefault = deepEqual(entry.currentValue, entry.setting.default);
     }
   }

package/src/input/settings-modal-mutations.ts

@@ -39,6 +39,21 @@ export type SettingAppliedCallback = (change: {
 // applySettingValue
 // ---------------------------------------------------------------------------
 
+/**
+ * Where a DAEMON-owned setting is written.
+ *
+ * `surfaces.*`, `controlPlane.*`, `watchers.*`, `device.*`, `automation.*` and
+ * the rest are executed by the daemon, unattended, with every surface closed.
+ * Writing one into this surface's own settings file reports success and
+ * configures nothing — the daemon reads a different file and never sees it.
+ * So a daemon-owned write goes over `config.set`, and a write with no reachable
+ * daemon FAILS rather than landing somewhere harmless-looking.
+ */
+export interface DaemonOwnedConfigWriter {
+  ownsKey(key: string): boolean;
+  set(key: string, value: unknown): Promise<void>;
+}
+
 export function applySettingValue({
   key,
   value,
@@ -46,6 +61,8 @@ export function applySettingValue({
   groups,
   onSettingApplied,
   refreshGroups,
+  daemonConfig,
+  onAsyncError,
 }: {
   key: ConfigKey;
   value: unknown;
@@ -54,6 +71,10 @@ export function applySettingValue({
   onSettingApplied: SettingAppliedCallback | null;
   /** Called after applying the value so the caller can re-read currentValues. */
   refreshGroups: () => void;
+  /** Present when a daemon is configured; absent keeps every write local. */
+  daemonConfig?: DaemonOwnedConfigWriter | null | undefined;
+  /** Renders a refused daemon write, so a failed save is never silent. */
+  onAsyncError?: ((message: string) => void) | undefined;
 }): ApplyValueResult {
   // Defensive: a handful of TUI-local synthetic keys (see worktree-setup-config.ts)
   // live under a config section CONFIG_SCHEMA/DEFAULT_CONFIG has never populated
@@ -73,7 +94,19 @@ export function applySettingValue({
   // we detect restart-triggering keys by sub-key name heuristic below.
   const isRestartKey = ['host', 'port', 'hostMode', 'enabled'].includes(key.split('.')[1] ?? '');
 
+  const daemonOwned = daemonConfig?.ownsKey(key) === true;
   try {
+    if (daemonOwned && daemonConfig) {
+      // The daemon's store is the one that counts for this key. The local
+      // manager is still written so this session's own reads and the rows
+      // below reflect the edit immediately; the daemon's copy is what the
+      // daemon acts on, and a refusal from it is surfaced rather than
+      // swallowed — the local value would then be the lie.
+      void daemonConfig.set(key, value).catch((error) => {
+        logger.error('SettingsModal: the daemon refused a daemon-owned config write', { key, error: summarizeError(error) });
+        onAsyncError?.(`That setting is applied by the daemon and saving it there failed: ${summarizeError(error)}`);
+      });
+    }
     configManager.setDynamic(key, value);
   } catch (e) {
     logger.error('SettingsModal: failed to set config value', { key, error: summarizeError(e) });