@pellux/goodvibes-tui 1.7.0 → 1.9.1

package/src/input/handler-feed.ts

@@ -32,6 +32,7 @@ import {
   handlePromptTextToken,
   type PanelMouseLayout,
 } from './handler-feed-routes.ts';
+import type { PanelBurstGuardState } from './panel-paste-flood-guard.ts';
 import type { WrappedPromptInfo } from './handler-prompt-buffer.ts';
 import { handleModalTokenRoutes } from './handler-modal-token-routes.ts';
 import { handleCommandModeToken } from './handler-command-route.ts';
@@ -130,6 +131,8 @@ export interface InputFeedContext {
   readonly killRing: KillRing;
   /** Terminal focus tracker (W2.3) — updated here from 'focus' tokens, read by the unfocused-alert notifiers in core/. */
   readonly focusTracker: FocusTracker;
+  /** DEBT-5 item 5 — the paste-flood guard's persistent state, mutated in place across tokens by handlePanelFocusToken (see panel-paste-flood-guard.ts). Never reallocated. */
+  readonly panelBurstGuard: PanelBurstGuardState;
   readonly getHistory: () => InfiniteBuffer;
   readonly getViewportHeight: () => number;
   readonly getScrollTop: () => number;
@@ -199,6 +202,11 @@ export function feedInputTokens(context: InputFeedContext, tokens: readonly Inpu
   // several batched into one feed() by render-tick latency — arrive as
   // separate 1-char 'text' tokens. The old per-feed sum misread two quick nav
   // keystrokes (e.g. j then k in one drain) as a "burst" and yanked focus.
+  // DEBT-5 item 5's flood guard reuses that same per-token model but adds
+  // real timing: one `now` per feed() call (not per token) is intentional —
+  // a genuine flood delivers many tokens in one drain, and they should all
+  // measure as arriving "at once", not spread across meaningless sub-ms noise.
+  const now = Date.now();
   for (const token of tokens) {
     // Focus-reporting tokens (CSI ?1004h, W2.3) never reach the composer or any
     // modal route — consumed here, first, unconditionally. No render needed.
@@ -279,6 +287,12 @@ export function feedInputTokens(context: InputFeedContext, tokens: readonly Inpu
       // focusTarget and self-heals it, and context.panelFocused was seeded from
       // it at feed entry — so no manual "unfocus if panels vanished" patch is
       // needed here anymore.
+      // Snapshot these four BEFORE dispatch so the write-back below can tell
+      // a pipeline-driven change (see comment there) from a stale copy.
+      const promptBefore = context.prompt;
+      const cursorPosBefore = context.cursorPos;
+      const commandModeBefore = context.commandMode;
+      const panelFocusedBefore = context.panelFocused;
       const shortcutState = {
         panelFocused: context.panelFocused,
         prompt: context.prompt,
@@ -312,10 +326,22 @@ export function feedInputTokens(context: InputFeedContext, tokens: readonly Inpu
         killRing: context.killRing,
       };
       if (handleGlobalShortcutToken(shortcutState, token, viewportHeight)) {
-        context.prompt = shortcutState.prompt;
-        context.cursorPos = shortcutState.cursorPos;
-        context.commandMode = shortcutState.commandMode;
-        context.panelFocused = shortcutState.panelFocused;
+        // Some branches (handleEscape, handleCtrlC, handleUndo, handleRedo,
+        // handlePaste) mutate handler state directly and immediately sync it
+        // into this same `context` via syncFeedContextMutableFields — e.g.
+        // Escape closing the slash-command palette clears context.prompt and
+        // context.commandMode on the live handler mid-call. `shortcutState`
+        // above is a snapshot taken BEFORE that call, so applying it
+        // unconditionally would stomp the live update right back to its
+        // stale pre-action value (undoing the very close it just performed,
+        // and even re-arming the palette below). This is the same class of
+        // bug as the overlay-flag write-back guard in handler.ts's feed().
+        // Only apply the snapshot for a field the dispatched action did NOT
+        // already update out from under us.
+        context.prompt = context.prompt === promptBefore ? shortcutState.prompt : context.prompt;
+        context.cursorPos = context.cursorPos === cursorPosBefore ? shortcutState.cursorPos : context.cursorPos;
+        context.commandMode = context.commandMode === commandModeBefore ? shortcutState.commandMode : context.commandMode;
+        context.panelFocused = context.panelFocused === panelFocusedBefore ? shortcutState.panelFocused : context.panelFocused;
         if (context.commandMode) {
           if (!context.prompt.startsWith('/')) {
             context.commandMode = false;
@@ -344,6 +370,8 @@ export function feedInputTokens(context: InputFeedContext, tokens: readonly Inpu
       panelManager: context.panelManager,
       keybindingsManager: context.keybindingsManager,
       onPanelInputConsumed: context.onPanelInputConsumed,
+      now,
+      burstGuard: context.panelBurstGuard,
       // Per-token paste classification (Invariant B): a paste is a single
       // 'text' token whose value holds more than one character.
       isPasteToken: token.type === 'text' && token.value.length > 1,

package/src/input/handler-modal-routes.ts

@@ -94,16 +94,26 @@ export function handleSelectionModalToken(state: SelectionRouteState, token: Inp
         if (selected) {
           dispatchSelectionAction(action, selected);
         }
+      } else if (state.selectionModal.allowSearch) {
+        // UX-C instant filter: an unclaimed keystroke arms search AND starts
+        // the query immediately, instead of silently doing nothing until the
+        // user discovers '/' first (the "help search needs '/' arming while
+        // the palette filters instantly" evaluator finding — /help has no
+        // customActions, so every letter used to be swallowed here). '/'
+        // above still works too; this is additive, not a replacement, and
+        // never fires for a claimed hotkey letter (checked first, above).
+        state.selectionModal.focusSearch();
+        state.selectionModal.setQuery(token.value);
       }
     }
   } else if (token.type === 'key') {
     if (token.logicalName === 'escape') {
-      if (state.selectionModal.allowSearch && state.selectionModal.searchFocused) {
-        if (state.selectionModal.query.length > 0) state.selectionModal.setQuery('');
-        else state.selectionModal.blurSearch();
-        state.requestRender();
-        return true;
-      }
+      // UX-C: ONE Escape always closes the modal, regardless of search state.
+      // Clearing an in-progress query is Backspace's job, not Esc's — the old
+      // two-stage contract (1st Esc clears query, 2nd blurs search, 3rd
+      // finally closes) was the "help modal took 3 Escapes after searching"
+      // evaluator finding (searchFocused is not modal-specific — every
+      // SelectionModal-based picker had the same multi-Esc pattern).
       state.handleEscape();
       return true;
     }
@@ -545,19 +555,56 @@ type ConfigModalRouteState = {
 /**
  * Route a key to the generic config-modal host (W6.1 MIGRATE-TO-MODAL
  * surfaces). The host owns the reserved navigation keys (Esc, up/down/j/k tab
- * left/right); every other key is offered to the active surface's declarative
- * action table (fireAction handles the two-press confirm for destructive
- * actions). Any unrecognised key is absorbed so the modal stays modal — this is
- * the same "active modal captures all keys" shape as the other modal routers.
+ * left/right, and now '/' — DEBT-5 item 1's type-to-filter, armed the same
+ * way as scrollable-list-panel.ts's opt-in filter and SettingsModal's own
+ * '/'-armed search); every other key is offered to the active surface's
+ * declarative action table (fireAction handles the two-press confirm for
+ * destructive actions). Any unrecognised key is absorbed so the modal stays
+ * modal — this is the same "active modal captures all keys" shape as the
+ * other modal routers.
+ *
+ * While the filter is armed (`configModal.isFilterActive()`), printable text
+ * tokens go to the query instead of nav/action dispatch — this is WHY 'j'/'k'
+ * lose their vim-nav meaning mid-filter (you're typing, not navigating) but
+ * Escape, Backspace, and the arrow/tab nav keys keep their ordinary meaning
+ * (arrows navigate the FILTERED list; Enter still acts on the selected row).
  */
 export function handleConfigModalToken(state: ConfigModalRouteState, token: InputToken): boolean {
   if (!state.configModal.active) return false;
 
+  // Every token that reaches the modal is a user interaction — after the
+  // first one, structure freezes to interaction boundaries (liveness rule).
+  // Before it, renders may sync structure so async onOpen loads appear
+  // without a keypress (batch refutation finding 3).
+  state.configModal.noteInteraction();
+
+  const filtering = state.configModal.isFilterActive();
+
   if (token.type === 'key') {
-    switch (token.logicalName) {
-      case 'escape':
-        state.handleEscape();
+    if (token.logicalName === 'escape') {
+      // Two-stage Esc, but ONLY while there is a query to clear (the one
+      // documented exception to single-Esc-close): clearFilterOrFallthrough
+      // returns false on an empty query, so an armed-but-empty filter (or no
+      // filter at all) closes the modal in one press, same as every other
+      // modal here.
+      if (state.configModal.clearFilterOrFallthrough()) {
+        state.requestRender();
         return true;
+      }
+      state.handleEscape();
+      return true;
+    }
+    if (filtering && isTextBackspace(token.logicalName ?? '')) {
+      state.configModal.backspaceFilter();
+      state.requestRender();
+      return true;
+    }
+    if (!filtering && token.logicalName === '/') {
+      state.configModal.activateFilter();
+      state.requestRender();
+      return true;
+    }
+    switch (token.logicalName) {
       case 'up':
         state.configModal.moveUp();
         state.requestRender();
@@ -576,16 +623,34 @@ export function handleConfigModalToken(state: ConfigModalRouteState, token: Inpu
         state.requestRender();
         return true;
     }
+    // Any other 'key' token (e.g. 'enter') falls through to the action table
+    // below even while filtering — only printable TEXT tokens are captured
+    // by the filter (below), so Enter still fires on the current selection.
   } else if (token.type === 'text') {
+    if (!filtering && token.value === '/') {
+      state.configModal.activateFilter();
+      state.requestRender();
+      return true;
+    }
+    if (filtering) {
+      // The WHOLE token value lands in the filter in one call — including a
+      // multi-char paste token — never split into per-char nav/action
+      // dispatch (the text-capture invariant this item's brief calls out).
+      state.configModal.appendFilterText(token.value);
+      state.requestRender();
+      return true;
+    }
     if (token.value === 'j') { state.configModal.moveDown(); state.requestRender(); return true; }
     if (token.value === 'k') { state.configModal.moveUp(); state.requestRender(); return true; }
   }
 
   const actionKey = token.type === 'key' ? (token.logicalName ?? '') : token.type === 'text' ? token.value : '';
+  const submitInput = state.commandContext?.submitInput;
   const fired = actionKey.length > 0 && state.configModal.fireAction(actionKey, {
     print: (message: string) => state.commandContext?.print(message),
     executeCommand: state.commandContext?.executeCommand,
     openModal: state.commandContext?.openModal,
+    ...(submitInput ? { submitInput: (text: string) => submitInput(text) } : {}),
   });
   if (fired) {
     state.requestRender();

package/src/input/handler-modal-stack.ts

@@ -148,8 +148,17 @@ export function handleEscape(state: EscapeState): {
           if (state.modalStack[i] === 'command') state.modalStack.splice(i, 1);
         }
         state.autocompleteReset();
-        prompt = '';
-        cursorPos = 0;
+        // Esc's palette-dismiss convention: a bare '/' with nothing typed
+        // after it IS the palette, so Esc clears it along with the slash
+        // (first Esc, one step, done — no lingering '/' to backspace out).
+        // Once the user has typed a command name (or anything else) past
+        // the slash, Esc's job is only to dismiss the ghost-suggestion
+        // overlay; the typed text is real composer content and stays put,
+        // just no longer treated as an in-progress command.
+        if (prompt === '/') {
+          prompt = '';
+          cursorPos = 0;
+        }
       },
     });
   };

package/src/input/handler-onboarding-daemon-adopt.ts

@@ -0,0 +1,149 @@
+/**
+ * F1 (One-Platform Wave 2 friction fix): the onboarding wizard's "Connect to
+ * this daemon now" action, wired from the Network step's `network.daemon-source`
+ * = 'adopt' fields. Extracted from handler-onboarding.ts to keep that file
+ * under the architecture line cap.
+ */
+import { join } from 'node:path';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { resolveDaemonCompanionToken } from '../runtime/operator-token-cleanup.ts';
+import {
+  buildManagedDaemonServiceManager,
+  detectLegacyUnit,
+  resolveInstalledDaemonBinary,
+  runLegacyDaemonMigration,
+  MANAGED_SERVICE_NAME,
+} from '../runtime/legacy-daemon-migration.ts';
+import type { InputHandlerLike as InputHandler } from './handler-types.ts';
+import {
+  formatRuntimeActiveSuccessMessage,
+  getRuntimeEndpointStatus,
+  isRuntimeEndpointActive,
+  runtimePortDiagnostic,
+} from './onboarding/onboarding-runtime-status.ts';
+
+/**
+ * Immediately (not deferred to the final wizard Apply):
+ *   1. Installs the pasted token into <homeDirectory>/.goodvibes/daemon/operator-tokens.json
+ *      via `resolveDaemonCompanionToken` — the same durable-persistence logic
+ *      the `GOODVIBES_DAEMON_TOKEN` non-interactive override uses.
+ *   2. Points `controlPlane.host`/`controlPlane.port` at the pasted host/port.
+ *   3. Restarts the external-services controller and reports back, honestly,
+ *      whether the daemon at that host/port was actually adopted — reusing
+ *      the same `onboarding-runtime-status.ts` helpers the normal
+ *      start-a-new-daemon path uses to report success/failure after Apply.
+ *
+ * Feedback is printed to the conversation feed (matching the existing
+ * start-openai-subscription action's pattern) rather than stored as wizard
+ * field state, because a 'status' field's value is recomputed fresh from the
+ * step builder on every render and is not a place to durably stash an
+ * out-of-band result.
+ */
+export async function handleConnectExistingDaemonForHandler(handler: InputHandler): Promise<void> {
+  if (handler.onboardingApplyPending) return;
+  const host = handler.onboardingWizard.getStringFieldValue('network.adopt-daemon-host', '127.0.0.1').trim() || '127.0.0.1';
+  const port = handler.onboardingWizard.getPortFieldValue('network.adopt-daemon-port', 3421);
+  const token = handler.onboardingWizard.getStringFieldValue('network.adopt-daemon-token', '').trim();
+  if (token.length === 0) {
+    handler.commandContext?.print?.('Connect to existing daemon: paste that daemon\'s token first.');
+    return;
+  }
+
+  const externalServices = handler.uiServices.platform.externalServices;
+  if (!externalServices) {
+    handler.commandContext?.print?.('Connect to existing daemon: background service controller is unavailable in this build.');
+    return;
+  }
+
+  handler.onboardingApplyPending = true;
+  handler.requestRender();
+  try {
+    const daemonHomeDir = join(handler.uiServices.environment.homeDirectory, '.goodvibes', 'daemon');
+    resolveDaemonCompanionToken(daemonHomeDir, token);
+    handler.uiServices.platform.configManager.setDynamic('controlPlane.host', host);
+    handler.uiServices.platform.configManager.setDynamic('controlPlane.port', port);
+
+    const state = await externalServices.restart();
+    const binding = { label: 'GoodVibes daemon', host, port };
+    if (isRuntimeEndpointActive(state, 'daemon')) {
+      handler.commandContext?.print?.([
+        'Connect to existing daemon: succeeded.',
+        `  ${formatRuntimeActiveSuccessMessage('daemon', state)}`,
+        '  This host/port and token are applied now; Apply at the end of the wizard will persist them.',
+      ].join('\n'));
+    } else {
+      const status = getRuntimeEndpointStatus(state, 'daemon');
+      handler.commandContext?.print?.([
+        'Connect to existing daemon: could not verify a connection.',
+        `  ${runtimePortDiagnostic(binding, undefined, status)}`,
+        '  Check the host, port, and token, then try again.',
+      ].join('\n'));
+    }
+  } catch (error) {
+    handler.commandContext?.print?.(`Connect to existing daemon failed: ${summarizeError(error)}`);
+  } finally {
+    handler.onboardingApplyPending = false;
+    handler.requestRender();
+  }
+}
+
+/**
+ * W4-D1: the guided UX entry point for migrating a legacy
+ * `goodvibes-daemon.service` unit (Wave 3 shipped detect+disclose only; this
+ * closes that inheritance). This is a thin wrapper over
+ * `detectLegacyUnit` + `runLegacyDaemonMigration`
+ * (`../runtime/legacy-daemon-migration.ts`) — the actual migration mechanics
+ * (never auto-migrate, new-up-then-old-down with a health check before the
+ * legacy unit is touched, adopt-or-warn for an unrecognized process on the
+ * port) live there and are exercised against fakes in
+ * `src/test/daemon/service-commands.test.ts`; this function only builds the
+ * same `PlatformServiceManager` the daemon CLI's `migrate-service` subcommand
+ * builds (via the shared `buildManagedDaemonServiceManager`, so a migration
+ * triggered from either surface installs the identical unit) and prints the
+ * honest result lines to the conversation feed, mirroring
+ * `handleConnectExistingDaemonForHandler`'s pattern above.
+ *
+ * This lives in `src/input/` rather than importing
+ * `../daemon/service-commands.ts` directly because the architecture gate's
+ * `input-no-entrypoints` rule forbids `src/input/**` from depending on
+ * `src/daemon/**` (input must stay a pure event-handling layer) — the shared
+ * engine lives in the entrypoint-agnostic `src/runtime/` layer instead.
+ *
+ * `confirm` is caller-supplied rather than read from a fixed field name here
+ * so this stays reusable from any surface: the onboarding wizard's Network
+ * step (`onboarding-wizard-network-adopt.ts`'s `pushLegacyDaemonMigrationFields`,
+ * dispatched from `handler-onboarding.ts`'s `migrate-legacy-daemon-service`
+ * action) reads its own `network.migrate-legacy-daemon-confirm` checklist
+ * toggle and passes it through as this parameter — unchecked previews the
+ * dry-run plan (`confirm: false`), checked executes the real migration
+ * (`confirm: true`).
+ */
+export async function handleMigrateLegacyDaemonServiceForHandler(handler: InputHandler, confirm: boolean): Promise<void> {
+  if (handler.onboardingApplyPending) return;
+
+  handler.onboardingApplyPending = true;
+  handler.requestRender();
+  try {
+    const homeDirectory = handler.uiServices.environment.homeDirectory;
+    const configManager = handler.uiServices.platform.configManager;
+    const host = String(configManager.get('controlPlane.host') ?? '127.0.0.1');
+    const port = Number(configManager.get('controlPlane.port') ?? 3421);
+    const binaryPath = resolveInstalledDaemonBinary({ moduleUrl: import.meta.url });
+
+    const manager = buildManagedDaemonServiceManager({ binaryPath, homeDir: homeDirectory, host, port });
+    const legacy = detectLegacyUnit({ homeDir: homeDirectory });
+    const result = await runLegacyDaemonMigration(
+      { host, port, trackedServiceName: MANAGED_SERVICE_NAME, confirmMigration: confirm },
+      manager,
+      legacy,
+    );
+    handler.commandContext?.print?.(
+      ['Migrate legacy daemon service:', ...result.lines.map((line: string) => `  ${line}`)].join('\n'),
+    );
+  } catch (error) {
+    handler.commandContext?.print?.(`Migrate legacy daemon service failed: ${summarizeError(error)}`);
+  } finally {
+    handler.onboardingApplyPending = false;
+    handler.requestRender();
+  }
+}

package/src/input/handler-onboarding.ts

@@ -1,8 +1,10 @@
-import { createOAuthLocalListener } from '@pellux/goodvibes-sdk/platform/config';
+import { createOAuthLocalListener, resolveDaemonEnabled } from '@pellux/goodvibes-sdk/platform/config';
 import { beginOpenAICodexLogin, exchangeOpenAICodexCode } from '@pellux/goodvibes-sdk/platform/config';
 import { summarizeError, openExternalUrl } from '@pellux/goodvibes-sdk/platform/utils';
 import { getProviderIdFromModel } from '../config/provider-model.ts';
 import { buildProviderAccountSnapshot } from '@/runtime/index.ts';
+import { handleConnectExistingDaemonForHandler, handleMigrateLegacyDaemonServiceForHandler } from './handler-onboarding-daemon-adopt.ts';
+import { detectLegacyUnit, resolveConfiguredServiceName } from '../runtime/legacy-daemon-migration.ts';
 import { OnboardingWizardController, type OnboardingWizardAction, type OnboardingWizardApplyFeedback } from './onboarding/onboarding-wizard.ts';
 import { handleCloudflareOnboardingActionForHandler, maybeProvisionCloudflareOnFinalApplyForHandler } from './handler-onboarding-cloudflare.ts';
 import { applyOnboardingRequest, collectOnboardingSnapshot, deleteWizardProgress, verifyOnboardingRequest, writeOnboardingCheckMarker, writeWizardProgress } from '../runtime/onboarding/index.ts';
@@ -74,6 +76,41 @@ function formatRuntimeStoppedFailureMessage(
   return `${binding.label} was disabled for ${disabledSurface}, but ${binding.host}:${binding.port} is still occupied. Settings were saved; another GoodVibes process or external service may still be running on that port.${statusDetail}`;
 }
 
+/**
+ * Verification item(s) for one runtime endpoint given whether it is expected
+ * to be running. Shared by both the "nothing server-backed selected" early
+ * path and the full server-backed path so daemon-by-default (the loopback
+ * daemon can be `expected` even when nothing else was selected) is handled
+ * identically in both places.
+ */
+function buildEndpointVerificationItems(
+  handler: InputHandler,
+  request: OnboardingApplyRequest,
+  endpoint: OnboardingRuntimeEndpoint,
+  expected: boolean,
+  state: OnboardingExternalServiceState | undefined,
+): OnboardingVerificationItem[] {
+    const idPrefix = endpoint === 'daemon' ? 'daemon' : 'http-listener';
+    if (expected) {
+      const active = isRuntimeEndpointActive(state, endpoint);
+      return [{
+        id: `runtime:${idPrefix}-active`,
+        status: active ? 'pass' : 'fail',
+        message: active
+          ? formatRuntimeActiveSuccessMessage(endpoint, state)
+          : formatRuntimeActiveFailureMessage(handler, request, endpoint, state),
+        target: 'service',
+      }];
+    }
+    if (!isRuntimeEndpointOccupyingConfiguredPort(state, endpoint)) return [];
+    return [{
+      id: `runtime:${idPrefix}-stopped`,
+      status: 'fail',
+      message: formatRuntimeStoppedFailureMessage(handler, request, endpoint, state),
+      target: 'service',
+    }];
+  }
+
 function showOnboardingApplyFeedbackForHandler(handler: InputHandler, feedback: OnboardingWizardApplyFeedback): void {
     handler.onboardingWizard.setApplyFeedback(feedback);
     const reviewIndex = handler.onboardingWizard.steps.findIndex((step) => step.id === 'review');
@@ -185,6 +222,15 @@ export function handleModelPickerCommitForHandler(handler: InputHandler): boolea
   }
 
 export async function handleOnboardingActionForHandler(handler: InputHandler, action: OnboardingWizardAction): Promise<void> {
+    if (action === 'connect-existing-daemon') {
+      await handleConnectExistingDaemonForHandler(handler);
+      return;
+    }
+    if (action === 'migrate-legacy-daemon-service') {
+      const confirm = handler.onboardingWizard.getBooleanFieldValue('network.migrate-legacy-daemon-confirm', false);
+      await handleMigrateLegacyDaemonServiceForHandler(handler, confirm);
+      return;
+    }
     if (action === 'start-openai-subscription') {
       await handler.handleOpenAiSubscriptionStart();
       return;
@@ -309,6 +355,7 @@ export async function handleOnboardingActionForHandler(handler: InputHandler, ac
     handler.requestRender();
   }
 
+
 export async function refreshOnboardingHydrationForHandler(handler: InputHandler, options: {
     readonly preserveValues?: boolean;
     readonly targetStepId?: string;
@@ -336,6 +383,9 @@ export async function refreshOnboardingHydrationForHandler(handler: InputHandler
             secretsManager: handler.uiServices.platform.secretsManager,
           }),
         },
+        legacyDaemon: {
+          detect: () => ({ ...detectLegacyUnit({ homeDir: handler.uiServices.environment.homeDirectory }), trackedServiceName: resolveConfiguredServiceName(handler.uiServices.platform.configManager) }),
+        },
       });
       if (!handler.onboardingWizard.active || hydrationSerial !== handler.onboardingHydrationSerial) return;
       handler.onboardingWizard.hydrateRuntimeState({ snapshot }, { resetValues: !(options.preserveValues ?? false) });
@@ -572,7 +622,8 @@ export function getOnboardingRuntimePostureForHandler(handler: InputHandler, req
     const serviceEnabled = getConfigValue('service.enabled') === true;
     const serviceAutostart = getConfigValue('service.autostart') === true;
     const restartOnFailure = getConfigValue('service.restartOnFailure') === true;
-    const daemonEnabled = getConfigValue('danger.daemon') === true || getConfigValue('controlPlane.enabled') === true;
+    const daemonReader = { get: (key: string): boolean | string | number | undefined => getConfigValue(key) as boolean | string | number | undefined };
+    const daemonEnabled = resolveDaemonEnabled(daemonReader) || getConfigValue('controlPlane.enabled') === true;
     const listenerEnabled = getConfigValue('danger.httpListener') === true;
     const webEnabled = getConfigValue('web.enabled') === true;
     const controlPlaneRemote = getConfigValue('controlPlane.hostMode') === 'network'
@@ -593,7 +644,10 @@ export function getOnboardingRuntimePostureForHandler(handler: InputHandler, req
       restartOnFailure,
       expectedDaemon: daemonEnabled || webEnabled,
       expectedHttpListener: listenerEnabled,
-      serverBacked: serviceEnabled || daemonEnabled || listenerEnabled || webEnabled,
+      // Daemon-by-default: the loopback session daemon can be expected to run
+      // even when nothing else was explicitly enabled here, so it does not
+      // belong in "did onboarding opt into a network-facing bundle."
+      serverBacked: serviceEnabled || listenerEnabled || webEnabled,
       remoteExposure,
     };
   }
@@ -683,28 +737,20 @@ export function verifyOnboardingRuntimePostureForHandler(handler: InputHandler,
         }];
       }
 
-      const stoppedItems: OnboardingVerificationItem[] = [];
-      if (isRuntimeEndpointOccupyingConfiguredPort(externalState, 'daemon')) {
-        stoppedItems.push({
-          id: 'runtime:daemon-stopped',
-          status: 'fail',
-          message: formatRuntimeStoppedFailureMessage(handler, request, 'daemon', externalState),
-          target: 'service',
-        });
-      }
-      if (isRuntimeEndpointOccupyingConfiguredPort(externalState, 'httpListener')) {
-        stoppedItems.push({
-          id: 'runtime:http-listener-stopped',
-          status: 'fail',
-          message: formatRuntimeStoppedFailureMessage(handler, request, 'httpListener', externalState),
-          target: 'service',
-        });
-      }
+      // Daemon-by-default: expectedDaemon can be true here (loopback daemon
+      // running for cross-surface visibility) even though nothing else was
+      // selected, so this is not simply "everything must be stopped."
+      const stoppedItems: OnboardingVerificationItem[] = [
+        ...buildEndpointVerificationItems(handler, request, 'daemon', posture.expectedDaemon, externalState),
+        ...buildEndpointVerificationItems(handler, request, 'httpListener', posture.expectedHttpListener, externalState),
+      ];
       if (externalState && stoppedItems.length === 0) {
         stoppedItems.push({
           id: 'runtime:external-services-stopped',
           status: 'pass',
-          message: 'Background daemon and HTTP listener are stopped for Local TUI Only.',
+          message: posture.expectedDaemon
+            ? 'HTTP listener is stopped for Local TUI Only; the background daemon is running as expected for cross-surface visibility on this machine.'
+            : 'Background daemon and HTTP listener are stopped for Local TUI Only.',
           target: 'service',
         });
       }
@@ -742,44 +788,10 @@ export function verifyOnboardingRuntimePostureForHandler(handler: InputHandler,
       });
     }
 
-    if (posture.expectedDaemon) {
-      const daemonActive = isRuntimeEndpointActive(externalState, 'daemon');
-      items.push({
-        id: 'runtime:daemon-active',
-        status: daemonActive ? 'pass' : 'fail',
-        message: daemonActive
-          ? formatRuntimeActiveSuccessMessage('daemon', externalState)
-          : formatRuntimeActiveFailureMessage(handler, request, 'daemon', externalState),
-        target: 'service',
-      });
-    }
-    if (!posture.expectedDaemon && isRuntimeEndpointOccupyingConfiguredPort(externalState, 'daemon')) {
-      items.push({
-        id: 'runtime:daemon-stopped',
-        status: 'fail',
-        message: formatRuntimeStoppedFailureMessage(handler, request, 'daemon', externalState),
-        target: 'service',
-      });
-    }
-    if (posture.expectedHttpListener) {
-      const httpListenerActive = isRuntimeEndpointActive(externalState, 'httpListener');
-      items.push({
-        id: 'runtime:http-listener-active',
-        status: httpListenerActive ? 'pass' : 'fail',
-        message: httpListenerActive
-          ? formatRuntimeActiveSuccessMessage('httpListener', externalState)
-          : formatRuntimeActiveFailureMessage(handler, request, 'httpListener', externalState),
-        target: 'service',
-      });
-    }
-    if (!posture.expectedHttpListener && isRuntimeEndpointOccupyingConfiguredPort(externalState, 'httpListener')) {
-      items.push({
-        id: 'runtime:http-listener-stopped',
-        status: 'fail',
-        message: formatRuntimeStoppedFailureMessage(handler, request, 'httpListener', externalState),
-        target: 'service',
-      });
-    }
+    items.push(
+      ...buildEndpointVerificationItems(handler, request, 'daemon', posture.expectedDaemon, externalState),
+      ...buildEndpointVerificationItems(handler, request, 'httpListener', posture.expectedHttpListener, externalState),
+    );
 
     return items;
   }

package/src/input/handler-picker-routes.ts

@@ -22,13 +22,15 @@ export function handleModelPickerToken(state: ModelPickerRouteState, token: Inpu
 
   if (token.type === 'key') {
     if (token.logicalName === 'escape') {
-      if (state.modelPicker.searchFocused && state.modelPicker.mode !== 'contextCap') {
-        if (state.modelPicker.query.length > 0) {
-          state.modelPicker.clearQuery();
-        } else {
-          state.modelPicker.blurSearch();
-        }
-      } else if (state.modelPicker.query.length > 0) {
+      // W3-T2: search now starts focused by default (see
+      // ModelPickerModal.openAllModels() doc comment). Escape with an empty
+      // query used to only blurSearch() here, leaving the picker open and
+      // requiring a SECOND Escape to actually close it — confusing on a
+      // freshly-opened, untouched picker where there is nothing to "clear".
+      // Clearing a non-empty query is still a distinct first Escape (whether
+      // or not search is focused); an empty query falls through to the same
+      // effort/contextCap/previousMode/close cascade as before.
+      if (state.modelPicker.mode !== 'contextCap' && state.modelPicker.query.length > 0) {
         state.modelPicker.clearQuery();
       } else if (state.modelPicker.mode === 'effort') {
         state.modelPicker.mode = 'model';
@@ -129,7 +131,12 @@ export function handleModelPickerToken(state: ModelPickerRouteState, token: Inpu
       }
       if (state.modelPicker.canFocusSearch() && !state.modelPicker.searchFocused && state.modelPicker.selectedIndex === 0) {
         state.modelPicker.focusSearch();
-      } else if (!state.modelPicker.searchFocused) {
+      } else if (state.modelPicker.searchFocused) {
+        // Symmetric with 'down' (below): search now starts focused by default
+        // (W3-T2), so 'up' must have a way out of it too, or it would be a
+        // silent no-op the very first time a user reaches for the list.
+        state.modelPicker.blurSearch();
+      } else {
         const maxVis = Math.max(5, state.getViewportHeight() - MODEL_PICKER_CHROME_LINES - 4);
         state.modelPicker.moveUp(maxVis);
       }