@pellux/goodvibes-tui 2.0.13 → 2.0.15

package/src/renderer/session-picker-modal.ts

@@ -1,5 +1,5 @@
 /**
- * renderSessionPickerModal — renders the /sessions picker modal as Line[]
+ * renderSessionPickerModal, renders the /sessions picker modal as Line[]
  * using ModalFactory.
  *
  * Shows a list of saved sessions with:
@@ -9,8 +9,8 @@
  * When the modal was wired with a cross-surface session union
  * (`modal.crossSurfaceView.mode !== 'local'`), an additional read-only
  * "Cross-surface sessions" section is appended, badged kind/status/project
- * (parity with the webui SessionsView) with one of three honest states —
- * true-empty, offline, or stale — never a silently-collapsed list. In
+ * (parity with the webui SessionsView) with one of three honest states,
+ * true-empty, offline, or stale, never a silently-collapsed list. In
  * 'local' mode (no sessionBroker wired, e.g. every pre-existing caller/test)
  * this section is entirely absent and the box sizing is unchanged.
  */
@@ -28,7 +28,7 @@ import { getOverlaySurfaceMetrics, getStableOverlayContentRows } from './overlay
 // Cross-surface badge helpers (parity with webui's src/lib/sessions-union.ts)
 // ---------------------------------------------------------------------------
 
-/** Verbatim for unknown/future kinds — never dropped, never guessed. */
+/** Verbatim for unknown/future kinds, never dropped, never guessed. */
 function kindLabel(kind: string): string {
   return kind.trim() || 'unknown';
 }
@@ -44,10 +44,10 @@ function isClosedStatus(status: string): boolean {
 /**
  * Closed sessions carry an optional, honest reason for WHY they
  * closed under `metadata.closeReason` (SDK's `SharedSessionCloseReason`,
- * 'closeReason' key — see `@pellux/goodvibes-sdk` platform/control-plane
+ * 'closeReason' key, see `@pellux/goodvibes-sdk` platform/control-plane
  * session-broker-sessions.ts's `readSessionCloseReason`). `metadata` is an
  * open record so old readers and records from a build that predates this
- * field ignore it safely — read it duck-typed here rather than importing the
+ * field ignore it safely, read it duck-typed here rather than importing the
  * SDK's helper, and tolerate `metadata` itself being absent or malformed.
  */
 function readCloseReason(record: SharedSessionRecord): string | undefined {
@@ -57,7 +57,7 @@ function readCloseReason(record: SharedSessionRecord): string | undefined {
 
 /**
  * A GC sweep closing an idle session ('idle-reaped') auto-reopens on the next
- * heartbeat — it is NOT the same event as a deliberate user/surface close, so
+ * heartbeat, it is NOT the same event as a deliberate user/surface close, so
  * it must never render under the same "closed" badge. Tolerant of
  * records without the field (pre-feature builds, or a deliberate close).
  */
@@ -67,16 +67,16 @@ function isReapedRecord(record: SharedSessionRecord): boolean {
 
 /**
  * UX-lens note: 'reaped' names a mechanism (the idle-session sweep),
- * not a state a first-time reader can guess — the webui pairs its own
+ * not a state a first-time reader can guess, the webui pairs its own
  * 'reaped' badge with a tooltip explaining it
- * (SessionsView.tsx: "Closed by the idle-session sweep — reopens
+ * (SessionsView.tsx: "Closed by the idle-session sweep, reopens
  * automatically on the next activity"). The TUI has no hover/tooltip
  * surface, so the plain-language explanation is rendered as its own short
- * line under the cross-surface list instead — shown ONLY when at least one
+ * line under the cross-surface list instead, shown ONLY when at least one
  * visible row actually carries the badge, so it never adds noise to a list
  * with no reaped rows.
  */
-const REAPED_BADGE_HINT = 'reaped = closed by the idle sweep — reopens on next activity';
+const REAPED_BADGE_HINT = 'reaped = closed by the idle sweep; reopens on next activity';
 
 /** True when at least one of the currently-rendered (post-truncation) cross-surface rows carries the 'reaped' badge. */
 function hasVisibleReapedRow(modal: SessionPickerModal): boolean {
@@ -114,8 +114,8 @@ function hostedRosterNote(roster: SessionPickerModal['hostedRoster']): string |
  * One hosted row: the id first, then what it is doing, what leaving it would
  * do, and finally its title.
  *
- * The id leads because it is the ACTIONABLE part — the row exists so `/hosted
- * attach <id>` can be typed off it — and a narrow terminal clips the tail. What
+ * The id leads because it is the ACTIONABLE part, the row exists so `/hosted
+ * attach <id>` can be typed off it, and a narrow terminal clips the tail. What
  * gets clipped must therefore be the descriptive end of the line, never the
  * thing the user has to retype.
  */
@@ -140,8 +140,8 @@ function hostedRowLabel(
  *
  * Absent when NOTHING is known: no roster was wired (every pre-existing caller
  * and test), so the box size and content are unchanged for them. The moment the
- * roster has an answer — rows, an empty-but-read list, or a reason it could not
- * read — the section appears, because each of those is a fact worth showing.
+ * roster has an answer, rows, an empty-but-read list, or a reason it could not
+ * read, the section appears, because each of those is a fact worth showing.
  */
 function hostedSectionVisible(modal: SessionPickerModal): boolean {
   const roster = modal.hostedRoster;
@@ -155,7 +155,7 @@ function hostedRowCount(modal: SessionPickerModal): number {
 /**
  * Extra content rows the hosted section needs: separator + header (+note)
  * + rows (+overflow line + the attach hint). Counted for the same reason the
- * cross-surface section counts its own — an uncounted trailing row is silently
+ * cross-surface section counts its own, an uncounted trailing row is silently
  * eaten by modal-factory's tail clip.
  */
 function hostedExtraRows(modal: SessionPickerModal): number {
@@ -170,12 +170,12 @@ function hostedExtraRows(modal: SessionPickerModal): number {
 /**
  * The exact honest note for the current state, or null when the union view
  * needs no caveat (fresh, with rows). Precedence: offline > stale >
- * true-empty — the three designed states, never collapsed into
+ * true-empty, the three designed states, never collapsed into
  * each other (an offline view never silently renders as "no sessions yet").
  */
 function crossSurfaceNote(view: SessionPickerModal['crossSurfaceView'], rowCount: number): string | null {
   if (view.mode === 'local') return null;
-  if (view.offlineNote) return `${view.offlineNote} — showing local sessions only`;
+  if (view.offlineNote) return `${view.offlineNote}: showing local sessions only`;
   if (view.stale) {
     if (view.lastSyncAt === null) return 'Union view may be stale.';
     const ageSeconds = Math.max(0, Math.round((Date.now() - view.lastSyncAt) / 1000));
@@ -192,7 +192,7 @@ function crossSurfaceRowCount(modal: SessionPickerModal): number {
 /**
  * Extra content rows the cross-surface section needs: separator + header
  * (+note) + rows (+the "[showing N of M]" overflow line when the union has
- * more records than MAX_CROSS_SURFACE_ROWS — previously uncounted here, which
+ * more records than MAX_CROSS_SURFACE_ROWS, previously uncounted here, which
  * let modal-factory's tail-clip silently eat that trailing line even though
  * the rest of the budget accounting held; see W3 Finding 1).
  */
@@ -201,7 +201,7 @@ function crossSurfaceExtraRows(modal: SessionPickerModal): number {
   const rows = crossSurfaceRowCount(modal);
   const noteRow = crossSurfaceNote(modal.crossSurfaceView, rows) ? 1 : 0;
   const overflowRow = modal.crossSurfaceSessions.length > MAX_CROSS_SURFACE_ROWS ? 1 : 0;
-  // W4 UX-lens: the plain-language 'reaped' explainer is its own row —
+  // W4 UX-lens: the plain-language 'reaped' explainer is its own row,
   // uncounted here it would be silently eaten by modal-factory's tail-clip
   // exactly the way W3 Finding 1 describes above.
   const reapedHintRow = hasVisibleReapedRow(modal) ? 1 : 0;
@@ -236,7 +236,7 @@ export function renderSessionPickerModal(
 
   // W3 Finding 1: when a cross-surface union section is present, cap the
   // LOCAL list's window to what's left after reserving extraRows for the
-  // union — otherwise the local list expands to fill metrics.contentRows
+  // union, otherwise the local list expands to fill metrics.contentRows
   // (which already includes the union's reservation) and modal-factory's
   // single tail-clip (createModal, targetContentRows) silently drops the
   // union section, or its trailing rows, once the box fills up. In local
@@ -312,7 +312,7 @@ export function renderSessionPickerModal(
     }
   }
 
-  // Cross-surface session union — visible only when a sessionBroker
+  // Cross-surface session union, visible only when a sessionBroker
   // was wired (mode !== 'local'); absent entirely otherwise, so the box size
   // and content of every pre-existing (local-only) caller is unaffected.
   if (modal.crossSurfaceView.mode !== 'local') {
@@ -353,7 +353,7 @@ export function renderSessionPickerModal(
         });
       }
       // W4 UX-lens: only ever rendered when a visible row actually carries
-      // the 'reaped' badge — never speculative noise.
+      // the 'reaped' badge, never speculative noise.
       if (hasVisibleReapedRow(modal)) {
         sections.push({
           type: 'text',
@@ -364,7 +364,7 @@ export function renderSessionPickerModal(
     }
   }
 
-  // Daemon-hosted sessions — conversations whose loop runs in the daemon rather
+  // Daemon-hosted sessions, conversations whose loop runs in the daemon rather
   // than in this terminal. Read-only here: joining one is `/hosted attach <id>`,
   // which opens a live stream this modal has no business owning, so the full id
   // is rendered for the command to be typed straight off the row.

package/src/renderer/settings-modal-connections.ts

@@ -1,5 +1,5 @@
 /**
- * settings-modal-connections.ts — rendering for the Connections category of the
+ * settings-modal-connections.ts, rendering for the Connections category of the
  * settings workspace.
  *
  * Split out of settings-modal.ts for the 800-line file cap, the same reason
@@ -18,7 +18,7 @@ import { clamp, padDisplay, stableWindow } from './fullscreen-workspace.ts';
  *
  * `checking` is rendered as its own state rather than blanked, because a row
  * that showed nothing while the probe was in flight would read as "nothing
- * configured" — the one thing this category exists to stop claiming falsely.
+ * configured", the one thing this category exists to stop claiming falsely.
  */
 export function renderConnectionRows(modal: SettingsModal, width: number, height: number): string[] {
   const rows: string[] = [];
@@ -44,7 +44,7 @@ export function renderConnectionRows(modal: SettingsModal, width: number, height
 /**
  * The detail pane for one connection: the state, what it means, and every next
  * step verbatim. The next steps are the daemon's requirements, so they are
- * listed in full rather than summarized — a truncated instruction is a wrong
+ * listed in full rather than summarized, a truncated instruction is a wrong
  * instruction.
  */
 export function buildConnectionContext(modal: SettingsModal): string[] {

package/src/renderer/settings-modal-helpers.ts

@@ -10,7 +10,7 @@ import { isSecretConfigKey, isSecretReferenceValue } from '../config/secret-conf
 import { UI_TONES } from './ui-primitives.ts';
 
 /**
- * "Modified / active" accent for settings rows — cyan-green, no UI_TONES
+ * "Modified / active" accent for settings rows, cyan-green, no UI_TONES
  * role matches it (preserved byte-exact as a named constant).
  */
 const SETTINGS_ACCENT = '#00ffcc';
@@ -32,7 +32,7 @@ export function formatValue(entry: SettingEntry): string {
   // comma-separated list, matching how they're edited (see worktree-setup-config.ts).
   if (Array.isArray(val)) return val.length > 0 ? val.join(', ') : '(empty)';
   // Object-backed settings (e.g. pricing.modelPrices) display their JSON when
-  // short, or an honest entry count — never the useless "[object Object]".
+  // short, or an honest entry count, never the useless "[object Object]".
   if (typeof val === 'object') {
     const keys = Object.keys(val as Record<string, unknown>);
     if (keys.length === 0) return '(none set)';
@@ -77,7 +77,7 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   wrfc: 'Work-review-fix-cycle thresholds, retry limits, and automatic commit behavior.',
   helper: 'Helper model defaults used by helper subsystems when they do not use the main chat route.',
   tts: 'Text-to-speech provider, voice, and optional spoken-turn LLM overrides.',
-  voice: 'Two independent voice capabilities. Local engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro — all empty by default, configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error); once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension. Wake-word detection (voice.wake.*, rendered as its own unit below): listening continuously for a spoken wake phrase and handing the utterance that follows to speech-to-text — off by default, because holding a microphone open is meant to be an explicit act. It is live on this terminal: enabling it starts a recorder subprocess (voice.wake.captureCommand), scores every frame with the pinned classifier through a WASM runtime, plays voice.wake.activationSound at a confirmed wake, shows a persistent footer row per voice.wake.indicator, and sends what follows to the same speech-to-text call — into the composer, or submitted outright when voice.wake.autoSubmit is on. The same capture path backs push-to-talk voice input (Alt+V by default), which always lands in the composer. voice.wake.noiseSuppression: speex runs here — the filter travels with the platform, so there is nothing to install for it — and voice.wake.vadThreshold above 0 screens frames with the pinned speech gate once provisioning has fetched it, refusing to start before that rather than scoring frames it claims to be screening. The model is already on this machine: installing goodvibes downloads and checksum-verifies it, and a running daemon retries at boot if the install could not reach the network — so switching this on normally needs no setup step. Switching it on never downloads anything itself; a host whose artifacts are missing or fail verification says which and names /voice wake setup rather than pretending to listen. Its published recall figures are measured on synthesised speech only, so no human recording of the phrase is behind them.',
+  voice: 'Two independent voice capabilities. Local engines (voice.local.*): the STT and TTS engine, binary, and model-path for whisper.cpp/faster-whisper and Piper/Kokoro; all empty by default, configurable-not-configured, nothing auto-downloads, and an unconfigured machine reports honestly (never an error); once set, "Local engines" appears in the TTS provider picker beside elevenlabs, with no billing dimension. Wake-word detection (voice.wake.*, rendered as its own unit below): listening continuously for a spoken wake phrase and handing the utterance that follows to speech-to-text; off by default, because holding a microphone open is meant to be an explicit act. It is live on this terminal: enabling it starts a recorder subprocess (voice.wake.captureCommand), scores every frame with the pinned classifier through a WASM runtime, plays voice.wake.activationSound at a confirmed wake, shows a persistent footer row per voice.wake.indicator, and sends what follows to the same speech-to-text call: into the composer, or submitted outright when voice.wake.autoSubmit is on. The same capture path backs push-to-talk voice input (Alt+V by default), which always lands in the composer. voice.wake.noiseSuppression: speex runs here, the filter travels with the platform, so there is nothing to install for it, and voice.wake.vadThreshold above 0 screens frames with the pinned speech gate once provisioning has fetched it, refusing to start before that rather than scoring frames it claims to be screening. The model is already on this machine: installing goodvibes downloads and checksum-verifies it, and a running daemon retries at boot if the install could not reach the network, so switching this on normally needs no setup step. Switching it on never downloads anything itself; a host whose artifacts are missing or fail verification says which and names /voice wake setup rather than pretending to listen. Its published recall figures are measured on synthesised speech only, so no human recording of the phrase is behind them.',
   service: 'Background service posture: enabled state, autostart, restart behavior, service name, platform, and logs.',
   daemon: 'Local session daemon. It hosts the shared session broker and companion chat so a session started here is visible and steerable from other surfaces. On by default, bound to loopback (127.0.0.1) only.',
   controlPlane: 'Daemon control-plane settings for local admin/API access.',
@@ -85,10 +85,10 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   web: 'Browser surface settings for the local or network web UI.',
   batch: 'Batch execution settings, including local vs Cloudflare queue behavior.',
   automation: 'Scheduled and automated run settings, concurrency, timeout, catch-up, cooldown, and retention behavior.',
-  checkin: 'Proactive check-in: on a cadence, a briefing is judged and you are contacted only when something warrants it. Off by default; every run — scheduled or manual — leaves a receipt (see /checkin) recording whether it stayed quiet, delivered a message, or was skipped.',
-  occasions: 'Proactive occasions and plans: dated, usually-recurring things that need an action (birthdays, anniversaries) and dated ranges that need only to be known about (a vacation). On by default. Lead time before a date, active hours nudges are allowed to arrive in, the nudge channel (empty makes it pull-only through /occasions), cadence while a window is open and the daily final stretch before it closes, whether an away plan moves a nudge earlier, whether a confirmed occasion mirrors to the calendar and whether a mirrored one suppresses its own nudge, how many questions the gift interview asks, how many years of gift history it keeps, and how often the sweep pass runs. The nudge itself never names the date — only how soon.',
-  hostedSessions: 'Sessions whose conversation loop runs INSIDE the daemon instead of this terminal, so the work does not end when the window that started it closes. What happens when the last client leaves is the detach policy: the shipped default is `kill` — exactly what closing a client has always done — and `survive` is the opt-in that leaves the session idle and reattachable. A session created with /hosted new --survive or --kill overrides the setting for itself. The remaining rows bound the capability: how many hosted sessions may run at once, how many messages one keeps, and how long a terminated session\'s record (with the reason it ended) is retained before it is retired.',
-  watchers: 'File/process watcher heartbeat, polling, and recovery-window behavior, plus the trigger family (watchers.triggers.*, rendered as its own unit): stream watchers that regex-filter and batch a long-lived command\'s output, model-free condition checks running a probe/extract/rule pipeline with no LLM in the loop, and one-shot on-exit triggers that fire exactly one payload when a launched command terminates. The trigger family is off by default — a trigger supervises real processes with nobody watching — and its rows tune the backoff ladder, the strike breaker, retention bounds, batching, and process caps.',
+  checkin: 'Proactive check-in: on a cadence, a briefing is judged and you are contacted only when something warrants it. Off by default; every run, scheduled or manual, leaves a receipt (see /checkin) recording whether it stayed quiet, delivered a message, or was skipped.',
+  occasions: 'Proactive occasions and plans: dated, usually-recurring things that need an action (birthdays, anniversaries) and dated ranges that need only to be known about (a vacation). On by default. Lead time before a date, active hours nudges are allowed to arrive in, the nudge channel (empty makes it pull-only through /occasions), cadence while a window is open and the daily final stretch before it closes, whether an away plan moves a nudge earlier, whether a confirmed occasion mirrors to the calendar and whether a mirrored one suppresses its own nudge, how many questions the gift interview asks, how many years of gift history it keeps, and how often the sweep pass runs. The nudge itself never names the date; only how soon.',
+  hostedSessions: 'Sessions whose conversation loop runs INSIDE the daemon instead of this terminal, so the work does not end when the window that started it closes. What happens when the last client leaves is the detach policy: the shipped default is `kill`, exactly what closing a client has always done, and `survive` is the opt-in that leaves the session idle and reattachable. A session created with /hosted new --survive or --kill overrides the setting for itself. The remaining rows bound the capability: how many hosted sessions may run at once, how many messages one keeps, and how long a terminated session\'s record (with the reason it ended) is retained before it is retired.',
+  watchers: 'File/process watcher heartbeat, polling, and recovery-window behavior, plus the trigger family (watchers.triggers.*, rendered as its own unit): stream watchers that regex-filter and batch a long-lived command\'s output, model-free condition checks running a probe/extract/rule pipeline with no LLM in the loop, and one-shot on-exit triggers that fire exactly one payload when a launched command terminates. The trigger family is off by default, a trigger supervises real processes with nobody watching, and its rows tune the backoff ladder, the strike breaker, retention bounds, batching, and process caps.',
   runtime: 'Runtime guardrails such as companion chat limiter and event bus listener caps.',
   telemetry: 'Telemetry payload policy.',
   cache: 'Provider and model cache behavior, TTL, and hit-rate monitoring.',
@@ -96,12 +96,12 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   mcp: 'MCP server trust and scope review. Trust changes can expose local files, tools, databases, browsers, or remote automation depending on the server.',
   sandbox: 'Isolation strategy for REPL, MCP, Windows, and QEMU-backed execution. Use these settings to separate risky tools from the host shell.',
   surfaces: 'External app surfaces such as Slack, Discord, ntfy, Home Assistant, Telegram, webhooks, chat bridges, and messaging providers.',
-  device: 'Posture for using a PAIRED phone as a tool — its cameras, its screen, its location, its clipboard, and a small set of device effects. Every row here changes behaviour, and every change applies to the next request without a restart. device.capabilities.mode is the master switch: off stops every capability request reaching any paired device (nothing is dispatched and nobody is asked), ask-every-time asks on every single request and never consults or offers a durable grant, and honor-grants (stock) asks the first time and every time after unless you chose "always allow" for that one capability on that one phone. allowAlwaysOffer decides which capabilities may offer that durable grant at all: every-capability (stock), standard-only (the elevated ones — front camera, screen capture, precise location, clipboard read — keep asking and an "always" answer is honoured for that one request only), or never. requestTimeoutSeconds is the deadline on three things at once: how long the phone has to answer, the deadline written into the request the phone receives, and how long the confirmation prompt itself stays open. device.location.precision gates the street-level fix (coarse-only refuses it and still serves approximate; ask-precise serves it but never remembers it), and device.clipboard.readMode gates reading the clipboard the same way — putting text ON the clipboard is a different capability and is unaffected. Captures from the camera and the screen are kept for capture.retentionHours and capped at capture.maxArtifacts, whichever bites first; housekeeping runs at every start and then every capture.sweepIntervalMinutes, deleting expired grants and captures and recording what it removed and why. A grant lasts grants.expiryDays and is never honoured past it, one phone holds at most grants.maxPerNode grants (the oldest are reaped past the cap), and the ledger of grants given, used, revoked and expired is kept for grants.auditRetentionDays. device.nodes.maxPaired is enforced at the moment a device pairs: at the cap a NEW device is refused with a message naming the setting, the cap and how many are already paired, while a phone that is already in the list simply supersedes its own record and keeps working. Lowering the cap below the number already paired unpairs no one — existing devices keep working and only the next new pairing is refused; a device moving off the legacy shared token to its own is exempt so it cannot be stranded. A nonsensical value anywhere here (zero, negative, not a number, an enum value that is not on the list) is read as the stock value rather than passed through, so a broken setting can neither lock you out of your own daemon nor widen the posture.',
-  conversationGate: 'What a message arriving from one of those channels does. By default it gets a conversational answer, and work is proposed and waits for your agreement rather than starting on its own; you can instead confirm every run, or restore the old behavior where a message starts work immediately. Also how long a pending proposal stays answerable and how many can wait at once. This governs messages from channels only — what you type here always runs, and schedules and triggers were authorized when created.',
+  device: 'Posture for using a PAIRED phone as a tool: its cameras, its screen, its location, its clipboard, and a small set of device effects. Every row here changes behaviour, and every change applies to the next request without a restart. device.capabilities.mode is the master switch: off stops every capability request reaching any paired device (nothing is dispatched and nobody is asked), ask-every-time asks on every single request and never consults or offers a durable grant, and honor-grants (stock) asks the first time and every time after unless you chose "always allow" for that one capability on that one phone. allowAlwaysOffer decides which capabilities may offer that durable grant at all: every-capability (stock), standard-only (the elevated ones: front camera, screen capture, precise location, clipboard read; keep asking and an "always" answer is honoured for that one request only), or never. requestTimeoutSeconds is the deadline on three things at once: how long the phone has to answer, the deadline written into the request the phone receives, and how long the confirmation prompt itself stays open. device.location.precision gates the street-level fix (coarse-only refuses it and still serves approximate; ask-precise serves it but never remembers it), and device.clipboard.readMode gates reading the clipboard the same way; putting text ON the clipboard is a different capability and is unaffected. Captures from the camera and the screen are kept for capture.retentionHours and capped at capture.maxArtifacts, whichever bites first; housekeeping runs at every start and then every capture.sweepIntervalMinutes, deleting expired grants and captures and recording what it removed and why. A grant lasts grants.expiryDays and is never honoured past it, one phone holds at most grants.maxPerNode grants (the oldest are reaped past the cap), and the ledger of grants given, used, revoked and expired is kept for grants.auditRetentionDays. device.nodes.maxPaired is enforced at the moment a device pairs: at the cap a NEW device is refused with a message naming the setting, the cap and how many are already paired, while a phone that is already in the list simply supersedes its own record and keeps working. Lowering the cap below the number already paired unpairs no one; existing devices keep working and only the next new pairing is refused; a device moving off the legacy shared token to its own is exempt so it cannot be stranded. A nonsensical value anywhere here (zero, negative, not a number, an enum value that is not on the list) is read as the stock value rather than passed through, so a broken setting can neither lock you out of your own daemon nor widen the posture.',
+  conversationGate: 'What a message arriving from one of those channels does. By default it gets a conversational answer, and work is proposed and waits for your agreement rather than starting on its own; you can instead confirm every run, or restore the old behavior where a message starts work immediately. Also how long a pending proposal stays answerable and how many can wait at once. This governs messages from channels only; what you type here always runs, and schedules and triggers were authorized when created.',
   cloudflare: 'Optional Cloudflare control plane, batch queue, Worker, Tunnel, Access, DNS, KV, Durable Objects, Secrets Store, and R2 settings.',
   release: 'Release-channel preference.',
-  power: 'Host sleep ownership. Keep-awake holds the host awake (the always-visible "sleep disabled" chip is the safety mechanism — no timer, no AC-only option); automatic inhibition keeps the host awake while real work runs, with an honest hard cap on that work hold.',
-  memory: 'Memory provenance surfacing. Whether turns that drew on your standing memories show a small "used N memories" chip with a drill-in listing them. Off by default — when off, nothing is rendered and no context is added.',
+  power: 'Host sleep ownership. Keep-awake holds the host awake (the always-visible "sleep disabled" chip is the safety mechanism; no timer, no AC-only option); automatic inhibition keeps the host awake while real work runs, with an honest hard cap on that work hold.',
+  memory: 'Memory provenance surfacing. Whether turns that drew on your standing memories show a small "used N memories" chip with a drill-in listing them. Off by default: when off, nothing is rendered and no context is added.',
   danger: 'High-impact switches for daemon and HTTP listener behavior. These are operational overrides, not normal preferences.',
   tools: 'Tool LLM and helper model routing. Empty provider/model values inherit the active chat route unless a specific helper/tool route is set.',
   network: 'Combined network view for daemon control-plane, HTTP listener, browser web surface, and general outbound network settings.',
@@ -112,13 +112,13 @@ export const CATEGORY_INFO: Record<SettingsCategory, string> = {
   connections: 'Whether mail and calendar are actually usable right now. Each row is answered by asking the daemon that owns the connection, not by reading config here, so a row says ready only when a real request succeeded.',
   policy: 'Policy-as-code bundle loading: where the startup policy bundle is loaded from and its file path. Gated by the Policy-as-Code feature.',
   notifications: 'Notification router burst-suppression tuning: burst window, threshold, and cooldown. Gated by the Adaptive Notification Suppression feature.',
-  relay: 'Outbound zero-knowledge relay reachability, for reaching this daemon from outside the LAN without opening an inbound port. Off by default — relay.enabled is the switch. The relay operator sees only ciphertext and connection metadata — self-host your own relay for full control.',
-  learning: 'Idle-time memory consolidation: merging duplicate standing memory records and decaying/archiving stale ones. Off by default — nothing runs until enabled.',
-  payments: 'Payment card on file for daemon-initiated purchases: card number, expiry, CVV, cardholder name, billing and shipping address, and whether the CVV is stored or requested at purchase time. Card fields are entered through /payments card (concealed input) and are secret-tier — never rendered in plaintext.',
-  email: 'The daemon\'s own mailbox connection — IMAP and SMTP hosts, ports and security, the mailbox and drafts folders, and the username. Password fields hold secret-store references, never values; /google connects a Gmail-backed setup in one action.',
+  relay: 'Outbound zero-knowledge relay reachability, for reaching this daemon from outside the LAN without opening an inbound port. Off by default: relay.enabled is the switch. The relay operator sees only ciphertext and connection metadata; self-host your own relay for full control.',
+  learning: 'Idle-time memory consolidation: merging duplicate standing memory records and decaying/archiving stale ones. Off by default; nothing runs until enabled.',
+  payments: 'Payment card on file for daemon-initiated purchases: card number, expiry, CVV, cardholder name, billing and shipping address, and whether the CVV is stored or requested at purchase time. Card fields are entered through /payments card (concealed input) and are secret-tier; never rendered in plaintext.',
+  email: 'The daemon\'s own mailbox connection; IMAP and SMTP hosts, ports and security, the mailbox and drafts folders, and the username. Password fields hold secret-store references, never values; /google connects a Gmail-backed setup in one action.',
   calendar: 'Calendar connections the daemon reads and writes: the Google or Microsoft OAuth client for CalDAV-free access, or a read-only ICS URL. Secret fields hold secret-store references, never values.',
   google: 'The Google OAuth connection record: project id, publishing status, and the refresh-token reference the mail and calendar services share. Established by /google in one action; a dead grant is diagnosed in plain words there.',
-  profile: 'What the platform knows about you — your name, how to reach you, where you are, how you like answers written, the people and places you mention — kept as one Markdown file at daemon scope that you can open and edit by hand at any time; your edits win and are never rewritten. These rows decide whether it is loaded at all, whether the assistant records facts it learns from things you say directly to it, whether it tells you in one line each time it does, whether the harmless part (how you are addressed, your city, your timezone, your formatting preferences, your style) is put in the model\'s context so it stops guessing, whether using a private detail such as your address is announced in the reply, whether settings left unset read their value from the profile, and where the file lives. Everything private — your name, contact details, home address, billing and shipping details, quiet hours, and the People, Places, Work and Notes sections — is never put in context in bulk and is reachable only by a named lookup that is disclosed when it happens. Run /profile to read the whole thing, /profile where <field> to see the surface, date and your exact words behind any recorded line, and /profile forget <field> to delete one.',
+  profile: 'What the platform knows about you: your name, how to reach you, where you are, how you like answers written, the people and places you mention, kept as one Markdown file at daemon scope that you can open and edit by hand at any time; your edits win and are never rewritten. These rows decide whether it is loaded at all, whether the assistant records facts it learns from things you say directly to it, whether it tells you in one line each time it does, whether the harmless part (how you are addressed, your city, your timezone, your formatting preferences, your style) is put in the model\'s context so it stops guessing, whether using a private detail such as your address is announced in the reply, whether settings left unset read their value from the profile, and where the file lives. Everything private: your name, contact details, home address, billing and shipping details, quiet hours, and the People, Places, Work and Notes sections, is never put in context in bulk and is reachable only by a named lookup that is disclosed when it happens. Run /profile to read the whole thing, /profile where <field> to see the surface, date and your exact words behind any recorded line, and /profile forget <field> to delete one.',
 };
 
 export const CATEGORY_LABELS: Record<(typeof SETTINGS_CATEGORIES)[number], string> = {

package/src/renderer/settings-modal.ts

@@ -30,7 +30,7 @@ import {
 
 const ENUM_VALUE_DESCRIPTIONS: Record<string, Record<string, string>> = {
   'display.themeMode': {
-    auto: 'Probe the terminal background colour (OSC 11) once at startup and pick light or dark. Falls back to dark on unreadable/unsupported terminals. Only evaluated at startup — selecting auto takes effect next launch.',
+    auto: 'Probe the terminal background colour (OSC 11) once at startup and pick light or dark. Falls back to dark on unreadable/unsupported terminals. Only evaluated at startup: selecting auto takes effect next launch.',
     dark: 'Force the dark theme regardless of terminal background. Applies immediately.',
     light: 'Force the light theme regardless of terminal background. Applies immediately.',
   },
@@ -46,7 +46,7 @@ const ENUM_VALUE_DESCRIPTIONS: Record<string, Record<string, string>> = {
   },
   'permissions.mode': {
     prompt: 'Normal: ask before powerful or risky actions according to tool policy.',
-    plan: 'Plan mode: read-only planning posture — writes, commands, and network calls are blocked so the model can plan without changing anything. Toggle with /plan or Shift+Tab.',
+    plan: 'Plan mode: read-only planning posture; writes, commands, and network calls are blocked so the model can plan without changing anything. Toggle with /plan or Shift+Tab.',
     'accept-edits': 'Accept edits: file writes and edits are auto-approved, but exec, network, and escalations are still gated.',
     'allow-all': 'Auto: allow all actions without prompting. Fast, but removes an important safety gate.',
     custom: 'Use per-tool-class permission settings from the rows below.',
@@ -128,11 +128,11 @@ function formatDefaultValue(value: unknown): string {
 
 function currentSettingValue(modal: SettingsModal, entry: SettingEntry, selected: boolean): string {
   if (selected && modal.editingMode) {
-    // Secret-backed keys (surfaces.*.botToken, .signingSecret, etc. — see
+    // Secret-backed keys (surfaces.*.botToken, .signingSecret, etc., see
     // secret-config.ts) must never echo the in-progress plaintext buffer:
     // not in the row, not in the "Current: ..." context line, not in search
     // results. Reuse the composer's concealed-input mask (concealed-input.ts)
-    // rather than a second masking implementation — same bullet-per-character
+    // rather than a second masking implementation, same bullet-per-character
     // shape, so keystrokes still visibly register without revealing content.
     const buffer = isSecretConfigKey(entry.setting.key) ? maskConcealedText(modal.editBuffer) : modal.editBuffer;
     return `${buffer}${GLYPHS.surface.cursor}`;
@@ -254,7 +254,7 @@ function buildFlagContext(entry: SettingEntry | null): string[] {
     `State: ${displayState}`,
     // A capability the registry declares not operable reads as disabled no
     // matter what its settings key says. Without this line the row shows a
-    // value of true beside a state of disabled and explains nothing — the
+    // value of true beside a state of disabled and explains nothing, the
     // written reason exists in the registry, so render it where the user meets
     // the contradiction rather than leaving it to be discovered.
     ...(feature.operable === false && feature.inoperableDetail
@@ -680,10 +680,10 @@ function footerText(modal: SettingsModal, width: number): string {
       { key: 'Esc', verb: 'Close' },
     ]));
   // Every topical category that hosts feature units flows through the default
-  // settings footer below — Enter/Space toggles a feature-unit header exactly
+  // settings footer below, Enter/Space toggles a feature-unit header exactly
   // as it edits/toggles any setting row.
   // Default settings pane: tier the reset affordances by available width.
-  // W<80:  minimal — only the most critical action survives.
+  // W<80:  minimal, only the most critical action survives.
   // W<160: compact but still shows both reset affordances.
   // W≥160: standard with all navigation tokens.
   if (width < 80)
@@ -720,18 +720,18 @@ export function renderSettingsModal(
   const metrics = getFullscreenWorkspaceMetrics({ width, height: viewportHeight });
   const categoryRows = renderCategories(modal, metrics.leftWidth - 2, metrics.bodyRows);
   // Documentation pane: long content SCROLLS (PgUp/PgDn) with honest
-  // more-above/below markers — it is never silently clipped.
+  // more-above/below markers, it is never silently clipped.
   const allContextLines = buildContextLines(modal, metrics.contextWidth);
   const visibleContext = metrics.contextRows;
   const maxContextScroll = Math.max(0, allContextLines.length - visibleContext);
   const contextOffset = Math.min(Math.max(0, modal.contextScroll ?? 0), maxContextScroll);
   const windowedContext = allContextLines.slice(contextOffset, contextOffset + visibleContext);
   if (contextOffset > 0) {
-    windowedContext[0] = `${GLYPHS.navigation.moreAbove} ${contextOffset} more line(s) above — PgUp`;
+    windowedContext[0] = `${GLYPHS.navigation.moreAbove} ${contextOffset} more line(s) above; PgUp`;
   }
   if (contextOffset + visibleContext < allContextLines.length) {
     const below = allContextLines.length - contextOffset - visibleContext;
-    windowedContext[windowedContext.length - 1] = `${GLYPHS.navigation.moreBelow} ${below} more line(s) below — PgDn`;
+    windowedContext[windowedContext.length - 1] = `${GLYPHS.navigation.moreBelow} ${below} more line(s) below; PgDn`;
   }
   const contextRows = windowedContext.map((text, row): WorkspaceRow => {
     const selectedSetting = modal.getSelected();

package/src/renderer/shell-surface.ts

@@ -11,7 +11,7 @@ export interface ShellFooterBuildOptions {
   readonly promptFocused?: boolean;
   /**
    * True when the panel workspace owns keyboard focus. Only consulted as a
-   * fallback when `promptFocused` is not supplied — see buildShellFooter's
+   * fallback when `promptFocused` is not supplied, see buildShellFooter's
    * default expression. Callers that already compute `promptFocused`
    * themselves (main.ts does) do not need to also pass this.
    */
@@ -64,7 +64,7 @@ export interface ShellFooterBuildOptions {
   /**
    * The one-key retry/switch-model affordance's transient hint text (see
    * retry-affordance.ts). Rendered as its own line ABOVE the context
-   * pressure hint while armed; present here only means "show it now" — the
+   * pressure hint while armed; present here only means "show it now", the
    * caller is responsible for passing null the instant it disarms, so this
    * is a time-bounded status line, never a lingering claim.
    */
@@ -83,10 +83,10 @@ export interface ShellFooterBuildOptions {
   readonly sessionSpineStatus?: 'online' | 'offline';
   /** The web surface's reachable URL, when that surface is enabled; a persistent footer segment. */
   readonly webSurfaceUrl?: string;
-  /** True while power.keepAwake holds — renders the always-visible "sleep disabled" chip. */
+  /** True while power.keepAwake holds, renders the always-visible "sleep disabled" chip. */
   readonly powerKeepAwake?: boolean;
   /**
-   * Live microphone state — a push-to-talk recording, or the wake detector for
+   * Live microphone state, a push-to-talk recording, or the wake detector for
    * as long as it runs. Rendered as a persistent row beside the process
    * indicator, because a capture device held open with nothing on screen saying
    * so is the one state a voice feature must never be in. Null (or a wake state
@@ -131,7 +131,7 @@ const DIM_STATUS_FG = '#64748b';
 let lastRenderedFooterHeight: { compact: boolean; height: number } | null = null;
 
 /**
- * The wrapped-prompt shape the composer reports each frame — the subset
+ * The wrapped-prompt shape the composer reports each frame, the subset
  * promptCursorOffset needs (see InputHandler.getWrappedPromptInfo).
  */
 export interface WrappedPromptCursorInfo {
@@ -226,17 +226,17 @@ export function buildShellFooter(
     // indicator: an open microphone is a live condition the user is acting inside,
     // while the process indicator is a background summary.
     lines.splice(inputBoxRows, 0, ...renderVoiceCaptureIndicator(options.width, options.voiceCapture ?? null), ...processIndicator);
-    // Scriptable status line — dim informational line above the prompt. Unshifted
+    // Scriptable status line, dim informational line above the prompt. Unshifted
     // before the context hint so the context hint (if any) sits above it.
     if (options.scriptableStatusLine) {
       lines.unshift(UIFactory.stringToLine(options.scriptableStatusLine, options.width, { fg: DIM_STATUS_FG }));
     }
-    // Passive context status hint — rendered as a dim informational line before the prompt.
+    // Passive context status hint, rendered as a dim informational line before the prompt.
     if (options.contextStatusHint) {
       const hintLine = UIFactory.stringToLine(options.contextStatusHint, options.width, { fg: DIM_STATUS_FG });
       lines.unshift(hintLine);
     }
-    // Retry affordance — topmost of the passive hint lines while armed (an
+    // Retry affordance, topmost of the passive hint lines while armed (an
     // actionable, time-bounded prompt outranks the passive status hints
     // below it); simply absent the instant it disarms.
     if (options.retryHint) {

package/src/renderer/status-glyphs.ts

@@ -1,5 +1,5 @@
 // ---------------------------------------------------------------------------
-// status-glyphs.ts — canonical glyph map for status states.
+// status-glyphs.ts, canonical glyph map for status states.
 //
 // Extracted as a neutral module so both status-token.ts and polish.ts can
 // import from here without creating a circular ESM dependency.
@@ -11,12 +11,12 @@
 // drift from the registry again. Re-exported under the historical name so
 // status-token.ts and polish.ts import unchanged.
 //
-// Glyphs (unchanged — this module's historical values, the TUI reference the
+// Glyphs (unchanged, this module's historical values, the TUI reference the
 // contract was extracted from):
-//   good  ✓  (CHECK MARK U+2713)     — GLYPHS.status.success
-//   warn  ⚠  (WARNING SIGN U+26A0)    — GLYPHS.status.warn
-//   bad   ✕  (MULTIPLICATION X U+2715) — GLYPHS.status.failure
-//   info  ○  (WHITE CIRCLE U+25CB)    — GLYPHS.status.info
+//   good  ✓  (CHECK MARK U+2713)    , GLYPHS.status.success
+//   warn  ⚠  (WARNING SIGN U+26A0)   , GLYPHS.status.warn
+//   bad   ✕  (MULTIPLICATION X U+2715), GLYPHS.status.failure
+//   info  ○  (WHITE CIRCLE U+25CB)   , GLYPHS.status.info
 // ---------------------------------------------------------------------------
 
 export { STATE_GLYPHS, type StatusState } from '@pellux/goodvibes-sdk/platform/presentation';

package/src/renderer/syntax-highlighter.ts

@@ -1,5 +1,5 @@
 /**
- * SyntaxHighlighter — Tree-sitter-powered syntax highlighting for code blocks.
+ * SyntaxHighlighter, Tree-sitter-powered syntax highlighting for code blocks.
  *
  * Designed for the synchronous TUI render loop:
  * - Initializes tree-sitter WASM and grammar parsers asynchronously in background
@@ -372,7 +372,6 @@ function isLeafLike(node: Node): boolean {
  * Handles multi-line spans (e.g., block comments, template literals).
  */
 function spansToLines(spans: Span[], codeLines: string[]): HighlightedLine[] {
-  // Initialize result: one entry per code line, each starting with no tokens
   const result: HighlightedLine[] = codeLines.map(() => []);
 
   // Track the current position to emit default-colored text for gaps
@@ -491,7 +490,7 @@ export class SyntaxHighlighter {
   }
 
   /**
-   * Schedule an async parse. Fires and forgets — result lands in cache.
+   * Schedule an async parse. Fires and forgets, result lands in cache.
    * Callers will pick it up on the next render cycle.
    */
   private scheduleParse(code: string, langId: string, key: string): void {

package/src/renderer/system-message.ts

@@ -15,7 +15,7 @@ export function classifySystemMessage(content: string): SystemMessageType {
 
   // [WRFC] messages
   if (/^\[WRFC\]/.test(content)) {
-    // Failed gate result → error (red) — must be checked before generic FAILED
+    // Failed gate result → error (red), must be checked before generic FAILED
     if (/Gate:.*FAILED/i.test(content)) return 'error';
     // Hard failures and cascade aborts → error (red)
     if (/FAILED|cascade abort/i.test(content)) return 'error';
@@ -40,13 +40,13 @@ export function classifySystemMessage(content: string): SystemMessageType {
   // [Plan] messages are always informational
   if (/^\[Plan\]/.test(content)) return 'info';
 
-  // [Model] messages — "Unknown model" is a warning, switch is info
+  // [Model] messages, "Unknown model" is a warning, switch is info
   if (/^\[Model\]/.test(content)) {
     if (/Unknown model/i.test(content)) return 'warning';
     return 'info';
   }
 
-  // [Routing] chip — a mid-session model change is informational (the [Failover]
+  // [Routing] chip, a mid-session model change is informational (the [Failover]
   // line, not this, carries the alarming transport-error cases).
   if (/^\[Routing\]/.test(content)) return 'info';
 

package/src/renderer/tab-strip.ts

@@ -43,7 +43,7 @@ export interface TabStripConfig {
   readonly overflowIndicatorLeft?: string;
   /**
    * Optional callback invoked with the absolute column ranges of each rendered
-   * tab. Used by the compositor to hit-test mouse clicks onto tabs. Additive —
+   * tab. Used by the compositor to hit-test mouse clicks onto tabs. Additive,
    * the function still returns a `Line` so existing callers are unaffected.
    */
   readonly onLayout?: (regions: readonly TabHitRegion[]) => void;
@@ -91,7 +91,7 @@ function makeSegments(
   let used = entryWidths[activeIndex] + closing;
 
   if (totalAll <= maxWidth) {
-    // Everything fits — show all tabs, no windowing.
+    // Everything fits, show all tabs, no windowing.
     start = 0;
     end = n - 1;
   } else {

package/src/renderer/term-caps.ts

@@ -1,15 +1,15 @@
 /**
- * term-caps.ts — Terminal capability detection and color downsampling.
+ * term-caps.ts, Terminal capability detection and color downsampling.
  *
  * Probes the terminal's color support level once at renderer init and exposes
  * a `downsampleColor` function that maps hex/RGB color strings to the
  * appropriate SGR parameter string for the detected capability level.
  *
  * Capability levels (in ascending order):
- *   none      — NO_COLOR set or TERM=dumb; emit no SGR color sequences.
- *   basic16   — 16 ANSI colors (\x1b[30-37m / \x1b[90-97m / \x1b[40-47m).
- *   ansi256   — 256-color palette (\x1b[38;5;Nm).
- *   truecolor — 24-bit RGB (\x1b[38;2;R;G;Bm).
+ *   none     , NO_COLOR set or TERM=dumb; emit no SGR color sequences.
+ *   basic16  , 16 ANSI colors (\x1b[30-37m / \x1b[90-97m / \x1b[40-47m).
+ *   ansi256  , 256-color palette (\x1b[38;5;Nm).
+ *   truecolor, 24-bit RGB (\x1b[38;2;R;G;Bm).
  *
  * References:
  *   - NO_COLOR spec: https://no-color.org/ (any non-empty value disables color)
@@ -89,7 +89,7 @@ function parseHex(hex: string): [number, number, number] | null {
  * Parse a sanitized color string in one of two forms:
  *   - "#rrggbb"  → RGB tuple
  *   - "r;g;b"    → RGB tuple (already decomposed by sanitizeColor)
- *   - "N"        → null (already a palette index — pass through)
+ *   - "N"        → null (already a palette index, pass through)
  * Returns [r, g, b] or null (non-RGB / palette index).
  */
 function parseRgbString(color: string): [number, number, number] | null {
@@ -114,7 +114,7 @@ function parseRgbString(color: string): [number, number, number] | null {
  * Map [r, g, b] (0-255 each) to the nearest xterm-256 palette index.
  *
  * The 256-color palette is structured as:
- *   0-15:   System colors (16 named colors) — we avoid these for predictability
+ *   0-15:   System colors (16 named colors), we avoid these for predictability
  *           and instead target the 6×6×6 cube + grayscale ramp.
  *   16-231: 6×6×6 color cube, index = 16 + 36*r6 + 6*g6 + b6
  *           where r6/g6/b6 ∈ 0-5 map via [0,95,135,175,215,255]
@@ -240,11 +240,11 @@ function ansi16FgToBg(fgCode: number): number {
  *   sanitizeColor() decomposition. Supported forms:
  *   - "#rrggbb"  hex
  *   - "r;g;b"    pre-decomposed RGB (from sanitizeColor)
- *   - "N"        already a palette index — returned as-is for ansi256/truecolor,
+ *   - "N"        already a palette index, returned as-is for ansi256/truecolor,
  *                or omitted for none
  *
  * @param caps - The probed terminal capabilities.
- * @param role - 'fg' or 'bg' — determines which SGR range to use for basic16.
+ * @param role - 'fg' or 'bg', determines which SGR range to use for basic16.
  *
  * @returns The SGR parameter string suitable for embedding in \x1b[38;2;...m
  *   (truecolor), \x1b[38;5;Nm (ansi256), \x1b[Nm (basic16 fg), etc.
@@ -257,7 +257,7 @@ function ansi16FgToBg(fgCode: number): number {
  *     style += isRgb ? `\x1b[38;2;${fg}m` : `\x1b[38;5;${fg}m`;
  *   }
  *
- * For basic16 the caller must use a different SGR prefix — see applyStyles.
+ * For basic16 the caller must use a different SGR prefix, see applyStyles.
  */
 export function downsampleColor(
   rawColor: string,
@@ -272,13 +272,13 @@ export function downsampleColor(
   if (caps.capability === 'truecolor') {
     // Pass hex through as r;g;b decomposed, pass r;g;b through as-is
     if (rgb) return `${rgb[0]};${rgb[1]};${rgb[2]}`;
-    // Already a palette index — emit as 256-color
+    // Already a palette index, emit as 256-color
     return rawColor; // caller will use 38;5;N or 48;5;N
   }
 
   if (caps.capability === 'ansi256') {
     if (rgb) return String(nearestAnsi256(rgb[0], rgb[1], rgb[2]));
-    // Already a palette index — pass through
+    // Already a palette index, pass through
     return rawColor;
   }