@pellux/goodvibes-tui 2.0.14 → 2.0.15

package/src/input/onboarding/onboarding-wizard-apply.ts

@@ -54,11 +54,11 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
     };
     // Every credential the first-run wizard captures is one the DAEMON executes
     // with: model provider API keys (the daemon runs the model), the Cloudflare
-    // API token, and the masked fields of the external surfaces — all of which
+    // API token, and the masked fields of the external surfaces, all of which
     // live under daemon-owned `surfaces.*` config paths. So they all go to the
     // daemon tier, which is the one tier every surface AND the daemon read.
     //
-    // 'project' — what this used to pass — filed them under whatever directory
+    // 'project', what this used to pass, filed them under whatever directory
     // the wizard happened to be run from. Run the wizard in ~/code/foo and the
     // daemon, which has no idea that directory exists, found nothing; run it
     // again elsewhere and the first setup silently stopped applying. First-run
@@ -108,7 +108,7 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
     // One-Platform daemon-by-default (SDK docs/decisions/2026-07-05-daemon-by-default.md):
     // the loopback-only cross-surface session daemon is safe-by-design
     // (loopback bind, auth-gated, rate-limited) and runs regardless of whether
-    // browser/LAN/webhook/external-app capabilities are selected here — it is no
+    // browser/LAN/webhook/external-app capabilities are selected here, it is no
     // longer bundled with those network-exposing surfaces, so onboarding leaves
     // daemon.enabled untouched and lets the SDK's own default-true (or an existing
     // explicit user override) govern. (The deprecated danger.daemon alias this
@@ -143,7 +143,7 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
     setConfig('behavior.hitlMode', hitlMode);
     // behavior.hitlMode IS the enablement key of the hitl-ux-modes capability
     // (active for quiet/balanced/operator, off only at 'off'), so the write
-    // above already carries the enablement — no separate gating write exists,
+    // above already carries the enablement, no separate gating write exists,
     // and adding one here would clobber a non-default choice with the stock
     // mode when the batch flushes.
     setConfig('behavior.guidanceMode', controller.getStringFieldValue('experience.guidance', controller.runtimeSnapshot?.runtimeDefaults.behavior.guidanceMode ?? 'minimal'));
@@ -204,7 +204,7 @@ export function buildOnboardingApplyRequest(controller: OnboardingWizardControll
     applyFeatureUnitOperations(controller, setConfig, featureFlagOverrides);
 
     // Surface/server capabilities are authoritative for the network-exposing
-    // features they own — apply them last so they win over any feature-step
+    // features they own, apply them last so they win over any feature-step
     // override.
     for (const surfaceFlag of getServerSurfaceFeatureFlags({
       serverBacked: hasServers,
@@ -306,7 +306,7 @@ function addCloudflareOperations(
     // login-rate-limiter keys on the client address the tunnel forwards rather
     // than the tunnel's own egress address. On its own, that address is read
     // from X-Forwarded-For, which a client reaching the listener directly can
-    // set for itself — so it could still choose which address the rate limiter
+    // set for itself, so it could still choose which address the rate limiter
     // and the audit log recorded.
     //
     // httpListener.trustCloudflare is what closes that: the listener reads

package/src/input/onboarding/onboarding-wizard-cloudflare-step.ts

@@ -257,7 +257,7 @@ export function buildCloudflareStep(controller: OnboardingWizardControllerLike):
       );
     }
 
-    // Trust-proxy notice — shown when Tunnel is selected so the
+    // Trust-proxy notice, shown when Tunnel is selected so the
     // operator sees the security implication before applying.
     const tunnelSelected = enabled && components.zeroTrustTunnel;
     if (tunnelSelected) {

package/src/input/onboarding/onboarding-wizard-constants.ts

@@ -21,7 +21,7 @@ export const DEFAULT_CAPABILITIES: readonly OnboardingStep1CapabilityItem[] = [
     // Honest wording (One-Platform daemon-by-default): this avoids browser/LAN/
     // webhook/external-app exposure, but the loopback-only GoodVibes daemon
     // still runs by default for cross-surface visibility on this machine.
-    detail: 'Use GoodVibes only in this terminal. No browser access, HTTP listener, external app surface, or network setup. A loopback-only background daemon still runs by default so sessions here stay visible to other GoodVibes surfaces on this machine — turn it off in Settings > daemon if you want none at all.',
+    detail: 'Use GoodVibes only in this terminal. No browser access, HTTP listener, external app surface, or network setup. A loopback-only background daemon still runs by default so sessions here stay visible to other GoodVibes surfaces on this machine; turn it off in Settings > daemon if you want none at all.',
   },
   {
     id: 'browser-access',

package/src/input/onboarding/onboarding-wizard-external-surfaces.ts

@@ -11,8 +11,8 @@
 //   • the per-surface auto-start enablement model (see the auto-start helpers),
 //   • numeric UI bounds (min/max) the SDK schema does not carry,
 //   • radio option copy (with hints) for select fields.
-// Everything else — a field's existence, its config key, its input kind, and its
-// default value — is derived from the SDK schema + DEFAULT_CONFIG, so the two can
+// Everything else, a field's existence, its config key, its input kind, and its
+// default value, is derived from the SDK schema + DEFAULT_CONFIG, so the two can
 // never silently drift. A field the overlay names that the SDK no longer defines
 // is a loud build error; a field the SDK adds that the overlay has not curated is
 // appended automatically with SDK-derived presentation.
@@ -65,7 +65,7 @@ function kebab(value: string): string {
 
 /**
  * The default value shown for a field. Derived, not hand-authored: the current
- * snapshot value if present, otherwise the config default (DEFAULT_CONFIG) — which
+ * snapshot value if present, otherwise the config default (DEFAULT_CONFIG), which
  * is exactly what the previous per-field literals returned. Numbers stringify.
  */
 function readFieldDefault(configKey: ConfigKey, snapshot: OnboardingSnapshotState | null): string {
@@ -286,7 +286,7 @@ const SURFACE_OVERLAYS: readonly SurfaceOverlay[] = [
     onboardingId: 'telephony',
     sdkSurface: 'telephony',
     label: 'Telephony surface',
-    hint: 'Enable SMS/voice notification delivery — direct Twilio, or a self-hosted bridge.',
+    hint: 'Enable SMS/voice notification delivery: direct Twilio, or a self-hosted bridge.',
     fields: [
       { configKey: 'surfaces.telephony.provider', label: 'Telephony provider', hint: 'twilio for direct Twilio delivery, bridge for a self-hosted telephony bridge.', placeholder: 'twilio' },
       { configKey: 'surfaces.telephony.mode', label: 'Telephony mode', hint: 'sms, voice (call with spoken text), or bridge.', placeholder: 'sms' },

package/src/input/onboarding/onboarding-wizard-network-adopt.ts

@@ -1,6 +1,6 @@
 /**
  * Friction fix: the Network step's daemon-source choice
- * — start a new daemon owned by this TUI (default) vs connect to one that is
+ *, start a new daemon owned by this TUI (default) vs connect to one that is
  * already running elsewhere with a known token. Extracted from
  * onboarding-wizard-steps.ts to keep that file under the architecture line cap.
  */
@@ -19,7 +19,7 @@ export function getDaemonSource(controller: OnboardingWizardControllerLike): str
 /**
  * Push the daemon-source radio, plus the host/port/token/connect fields when
  * 'adopt' is selected, onto the Network step's field list. Independent of the
- * local/custom network mode — adopting someone else's daemon is a client-side
+ * local/custom network mode, adopting someone else's daemon is a client-side
  * choice about which daemon THIS TUI talks to, not about how THIS TUI's own
  * daemon binds to the network.
  */
@@ -79,7 +79,7 @@ export function pushDaemonAdoptionFields(
 
 /**
  * The guided, visible entry point for migrating a detected legacy
- * `goodvibes-daemon.service` unit — closes the fast-follow-up flagged when
+ * `goodvibes-daemon.service` unit, closes the fast-follow-up flagged when
  * `handleMigrateLegacyDaemonServiceForHandler` (handler-onboarding-daemon-adopt.ts)
  * shipped fully built but not wired to any onboarding control. Independent of
  * the daemon-source radio above: this offers to retire an old unmanaged unit
@@ -88,11 +88,11 @@ export function pushDaemonAdoptionFields(
  *
  * Visible ONLY when the runtime snapshot's read-only `legacyDaemon` detection
  * (collected via `detectLegacyUnit`, see `../../runtime/legacy-daemon-migration.ts`)
- * found a unit file present — never rendered speculatively. Confirm-gated on
+ * found a unit file present, never rendered speculatively. Confirm-gated on
  * top of the engine's own consent requirement: a checklist toggle must be
  * checked before the action executes the real migration (`confirmMigration:
  * true`); left unchecked, pressing the action still works but only prints the
- * engine's dry-run plan (`confirmMigration: false`) — see
+ * engine's dry-run plan (`confirmMigration: false`), see
  * `runLegacyDaemonMigration`'s honest dry-run branch. The action label and
  * hint change to make which mode is armed unambiguous before it is pressed.
  */
@@ -108,7 +108,7 @@ export function pushLegacyDaemonMigrationFields(
     id: 'network.migrate-legacy-daemon-detected',
     label: 'Separate install-script daemon service detected',
     // Follow-up: name the unit this host actually resolves (carried on the
-    // snapshot from `resolveConfiguredServiceName` at collection time) — the
+    // snapshot from `resolveConfiguredServiceName` at collection time), the
     // MANAGED_SERVICE_NAME fallback only covers snapshots built without it.
     hint: legacyUnitNote(legacy, legacy.trackedServiceName ?? MANAGED_SERVICE_NAME),
     defaultValue: legacy.active ? 'Installed and running' : 'Installed (not active)',

package/src/input/onboarding/onboarding-wizard-steps.ts

@@ -162,7 +162,7 @@ export function buildProvidersStep(controller: OnboardingWizardControllerLike):
     );
     const signInPending = subscription.signInPending;
     // Provider-agnostic key capture: one field per provider the registry knows
-    // accepts an API key (derived from registration truth — never a hardcoded
+    // accepts an API key (derived from registration truth, never a hardcoded
     // vendor list). No provider is named as the only option.
     const keyTargets = deriveProviderKeyCaptureTargets(controller.runtimeSnapshot?.providerAccounts?.providers);
     const configuredKeyCount = keyTargets.filter((target) => target.configured).length;
@@ -614,7 +614,7 @@ export function buildNetworkStep(controller: OnboardingWizardControllerLike): On
     if (controlPlaneRemote || listenerEnabled || browserEnabled) { // TLS warn + CORS notice.
       const cpOff = controlPlaneRemote && String(controller.runtimeSnapshot?.config.controlPlane?.tls?.mode ?? 'off') === 'off';
       const hlOff = listenerEnabled && String(controller.runtimeSnapshot?.config.httpListener?.tls?.mode ?? 'off') === 'off';
-      if (cpOff || hlOff) { const a = [cpOff ? 'control plane' : '', hlOff ? 'HTTP listener' : ''].filter(Boolean).join(' and '); fields.push({ kind: 'status', id: 'network.tls-warn', label: `TLS off — ${a} transmits plaintext`, defaultValue: 'Warning', hint: `The ${a} is network-reachable but TLS is off. Traffic travels in plaintext. Enable TLS or use a terminating reverse proxy.` }); }
+      if (cpOff || hlOff) { const a = [cpOff ? 'control plane' : '', hlOff ? 'HTTP listener' : ''].filter(Boolean).join(' and '); fields.push({ kind: 'status', id: 'network.tls-warn', label: `TLS off: ${a} transmits plaintext`, defaultValue: 'Warning', hint: `The ${a} is network-reachable but TLS is off. Traffic travels in plaintext. Enable TLS or use a terminating reverse proxy.` }); }
       if (listenerEnabled) { fields.push({ kind: 'status', id: 'network.cors-note', label: 'Browser CORS is off by default', defaultValue: 'Info', hint: 'The webhook/control-plane HTTP listener honors controlPlane.cors.enabled and controlPlane.cors.allowedOrigins. Set both from Settings > Control Plane (or /config controlPlane) to allow browser origins, then restart the daemon. CORS stays off until you enable it.' }); }
     }
     return {

package/src/input/panel-integration-actions.ts

@@ -3,11 +3,11 @@ import type { Panel } from '../panels/types.ts';
 import type { PanelManager } from '../panels/panel-manager.ts';
 
 // (the purge): every instanceof-routed branch this file used to carry
-// (FileExplorerPanel/FilePreviewPanel/SymbolOutlinePanel — DELETE;
-// ApprovalPanel/TasksPanel/OrchestrationPanel/AgentInspectorPanel —
+// (FileExplorerPanel/FilePreviewPanel/SymbolOutlinePanel, DELETE;
+// ApprovalPanel/TasksPanel/OrchestrationPanel/AgentInspectorPanel,
 // RETIRE-INTO-FLEET) targeted a panel class that no longer exists. Panels
 // migrated onto the formal `Panel.handlePanelIntegrationAction` hook (the
-// preferred seam — see the comment below) are unaffected; this function now
+// preferred seam, see the comment below) are unaffected; this function now
 // only provides that passthrough. See
 // .goodvibes/audit/2026-07-04-wave6-briefs.json for the disposition
 // map.

package/src/input/panel-mouse-geometry.ts

@@ -70,7 +70,7 @@ export function getPanelUnderMouse(
 /**
  * If the mouse is over the consolidated workspace tab bar (the first panel
  * row), return the index of the tab under the cursor, else null. Recomputes the
- * tab hit regions by rendering the bar with a layout callback — cheap and keeps
+ * tab hit regions by rendering the bar with a layout callback, cheap and keeps
  * the click geometry in lockstep with what was drawn.
  */
 export function workspaceTabAtMouse(

package/src/input/panel-paste-flood-guard.ts

@@ -1,10 +1,10 @@
 // ---------------------------------------------------------------------------
-// panel-paste-flood-guard.ts — item 5.
+// panel-paste-flood-guard.ts, item 5.
 //
 // A terminal WITHOUT bracketed paste delivers a pasted block as a burst of
 // discrete 1-char 'text' tokens (isPasteToken stays false for every one of
 // them, since that flag only fires for a single token whose value.length > 1
-// — see handler-feed-routes.ts's own Invariant B doc). Before this guard,
+//, see handler-feed-routes.ts's own Invariant B doc). Before this guard,
 // each such character became a real panel hotkey on a focused non-capturing
 // panel (K arms kill, etc.) once it reached handlePanelFocusToken's per-char
 // dispatch loop.
@@ -16,15 +16,15 @@
 // same input layer already tore out once (see panel-focus-burst.test.ts's
 // header doc): that old guard summed one feed()'s character count with no
 // timing signal at all, so two ordinary nav keystrokes landing in a single
-// feed() — a real, common case, not an edge case — were misread as a burst
+// feed(), a real, common case, not an edge case, were misread as a burst
 // and focus was silently flipped to the composer. This guard:
 //   - never touches focus (panelFocused is untouched by trackPanelPasteFloodGuard
 //     and by its caller);
 //   - is keyed on WALL-CLOCK TIMING, not a per-feed token count, so it
 //     doesn't care how many tokens land in one feed() call, only how fast
 //     they arrive relative to each other;
-//   - is sticky once tripped (only a quiet gap — no qualifying token for a
-//     full window — clears it) so it doesn't flap dispatch on/off as the
+//   - is sticky once tripped (only a quiet gap, no qualifying token for a
+//     full window, clears it) so it doesn't flap dispatch on/off as the
 //     count oscillates near the threshold mid-flood.
 //
 // ~8 keys/120ms is far beyond sustained human typing (a fast typist peaks
@@ -39,10 +39,10 @@ export const PANEL_PASTE_FLOOD_WINDOW_MS = 120;
 export const PANEL_PASTE_FLOOD_THRESHOLD = 8;
 
 /**
- * Guard state — a single persistent instance lives on the caller's
+ * Guard state, a single persistent instance lives on the caller's
  * long-lived context (handler-feed.ts's InputFeedContext, mirroring how that
  * object already owns `nextPasteId`/`mouseDownRow`/etc.) and is MUTATED IN
- * PLACE by trackPanelPasteFloodGuard below, never replaced — so callers never
+ * PLACE by trackPanelPasteFloodGuard below, never replaced, so callers never
  * need to thread a return value back into their own state (unlike
  * `panelFocused`, which handlePanelFocusToken returns because it is NOT a
  * mutable outparam).
@@ -54,7 +54,7 @@ export interface PanelBurstGuardState {
 }
 
 export interface PanelBurstGuardResult {
-  /** False while suspended — the caller must drop this token, not dispatch it. */
+  /** False while suspended, the caller must drop this token, not dispatch it. */
   readonly dispatch: boolean;
   /** True exactly once per burst: the call that just tripped suspension. */
   readonly showHintNow: boolean;
@@ -66,7 +66,7 @@ export function trackPanelPasteFloodGuard(guard: PanelBurstGuardState, now: numb
   const isQuietGap = now - lastAt > PANEL_PASTE_FLOOD_WINDOW_MS;
   if (isQuietGap && guard.suspended) {
     // A silence at least as long as the window means whatever burst was
-    // happening has ended — un-suspend so a LATER burst gets its own fresh
+    // happening has ended, un-suspend so a LATER burst gets its own fresh
     // count and its own one-shot hint.
     guard.suspended = false;
     guard.hintShown = false;

package/src/input/payments-config.ts

@@ -1,16 +1,16 @@
 /**
- * payments-config.ts — TUI-local synthetic settings for the payment card
+ * payments-config.ts, TUI-local synthetic settings for the payment card
  * capability's card MATERIAL fields.
  *
  * The SDK's CONFIG_SCHEMA now has a full real `payments` section (28 keys:
  * enabled, defaultCardId, currency, cvvHandling, the six budget keys,
  * shipping.preferredTier, the fourteen billing/shipping address sub-fields
- * (name, line1, line2, city, region, postalCode, country — each repeated for
+ * (name, line1, line2, city, region, postalCode, country, each repeated for
  * billingAddress and shippingAddress), the two window keys, and
- * notifyChannels — see `@pellux/goodvibes-sdk/platform/config`). Every one of
+ * notifyChannels, see `@pellux/goodvibes-sdk/platform/config`). Every one of
  * those keys reads and writes through the ordinary CONFIG_SCHEMA-driven path
  * in settings-modal-data.ts's buildSettingGroups, exactly like `relay.*` or
- * any other real SDK domain — no synthetic entry or dedicated store is needed
+ * any other real SDK domain, no synthetic entry or dedicated store is needed
  * for them, and this module builds none. (An earlier round of this module
  * modeled billing/shipping address as two flat TUI-local strings; the SDK's
  * own structured per-field keys superseded that the moment they shipped, so
@@ -25,39 +25,39 @@
  * SDK does not yet expose an equivalent config-level path for a single
  * implicit card the way this app's `/payments card` flow models it, so these
  * four fields are synthetic sub-keys under the SDK's real `payments`
- * section — the same established pattern this codebase already uses for
+ * section, the same established pattern this codebase already uses for
  * `behavior.notifyAfterSeconds`, `storage.codeIndexEnabled`, etc.: a key one
  * level under an EXISTING section that CONFIG_SCHEMA has no scalar entry for.
  *
  * That one-level-under-an-existing-section shape matters mechanically: the
  * real ConfigManager's dotted-path resolver only throws "Invalid config path"
  * when an INTERMEDIATE segment is missing (e.g. `payments.card.number`, where
- * `card` is not itself a section) — it does not throw for a final leaf that
+ * `card` is not itself a section), it does not throw for a final leaf that
  * the schema has not declared (`payments.cardNumber`), the same tolerance
  * `storage.codeIndexEnabled` relies on under `storage`. So these four keys are named
  * FLAT (`payments.cardNumber`, not `payments.card.number`) specifically so
- * `ConfigManager.get/setDynamic` accepts them — verified against the real
+ * `ConfigManager.get/setDynamic` accepts them, verified against the real
  * ConfigManager (not the fake store this module used before this round): a
  * flat sub-key persists to the real daemon-owned settings file precisely
  * because `payments.` is a `DAEMON_OWNED_CONFIG_PREFIXES` entry, which is
  * exactly what makes the daemon (and every other surface) able to see it
- * after this TUI closes — the thing the local JSON store this module used to
+ * after this TUI closes, the thing the local JSON store this module used to
  * use never gave them.
  *
  * All four keys are secret-tier (see config/secret-config.ts's
  * SECRET_CONFIG_KEYS). Primary entry for those is the concealed-input flow in
  * commands/payment-card-intake.ts, itself gated on the SDK's
  * `mayOfferCardEntryFlow` (card details may only be typed at a local
- * terminal or the webui, never over a remote messaging surface — see that
+ * terminal or the webui, never over a remote messaging surface, see that
  * file's header); they are also reachable as ordinary secret-backed settings
- * rows here, which is what makes them masked mid-edit — see
+ * rows here, which is what makes them masked mid-edit, see
  * renderer/settings-modal.ts's currentSettingValue().
  *
- * cvvHandling — real now, not built here — selects whether the CVV is stored
+ * cvvHandling, real now, not built here, selects whether the CVV is stored
  * (the default, per the 2026-07-27 payment-capability ruling) or requested at
  * purchase time; see `CVV_PROMPT_TRADEOFF_WARNING`, imported directly from
  * `@pellux/goodvibes-sdk/platform/payments` by every caller that needs it
- * (renderer/settings-modal.ts, settings-modal.ts) — no local copy lives here
+ * (renderer/settings-modal.ts, settings-modal.ts), no local copy lives here
  * or anywhere else in this app.
  */
 
@@ -65,7 +65,7 @@ import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigKey } from '@pellux/goodvibes-sdk/platform/config';
 import type { SettingEntry } from './settings-modal-types.ts';
 
-/** Real ConfigManager's read surface — these four keys are defensive reads (see header comment). */
+/** Real ConfigManager's read surface, these four keys are defensive reads (see header comment). */
 export type PaymentsConfigReader = Pick<ConfigManager, 'get'>;
 
 export const PAYMENTS_CARD_NUMBER_CONFIG_KEY = 'payments.cardNumber' as ConfigKey;
@@ -73,14 +73,14 @@ export const PAYMENTS_CARD_EXPIRY_CONFIG_KEY = 'payments.cardExpiry' as ConfigKe
 export const PAYMENTS_CARD_CVV_CONFIG_KEY = 'payments.cardCvv' as ConfigKey;
 export const PAYMENTS_CARD_CARDHOLDER_NAME_CONFIG_KEY = 'payments.cardholderName' as ConfigKey;
 
-/** The real SDK schema key for the CVV-handling selector — no longer synthetic. */
+/** The real SDK schema key for the CVV-handling selector, no longer synthetic. */
 export const PAYMENTS_CVV_HANDLING_CONFIG_KEY = 'payments.cvvHandling' as ConfigKey;
 
 function readStringField(configManager: PaymentsConfigReader, key: ConfigKey): string {
   // Defensive try/catch, same rationale as worktree-setup-config.ts's
   // readWorktreeSetupList and this codebase's other one-level-under-a-real-
   // section synthetic reads (behavior.notifyAfterSeconds, storage.codeIndexEnabled): the real
-  // ConfigManager never throws for these particular keys (verified — see
+  // ConfigManager never throws for these particular keys (verified, see
   // header comment), but degrading to empty rather than crashing the whole
   // settings modal is the same posture every synthetic setting here takes
   // toward an unexpected value.

package/src/input/profile-picker-modal.ts

@@ -1,5 +1,5 @@
 /**
- * ProfilePickerModal — state management for the /profiles picker modal.
+ * ProfilePickerModal, state management for the /profiles picker modal.
  *
  * Lists profiles from ProfileManager.list(), tracks selected index,
  * and handles load/delete/save actions.

package/src/input/provider-key-intake.ts

@@ -1,12 +1,12 @@
 /**
- * Provider key intake — capture a provider's API key at the moment the user
+ * Provider key intake, capture a provider's API key at the moment the user
  * selects an unconfigured provider or model, store it through the secrets
  * manager (never env-only, never cleartext into config or provider JSON), let
  * the provider re-register live, then complete the user's original selection.
  *
  * The decision of whether a key is needed is read from the provider's own
- * registration-time auth state (describeAuthState / isConfigured) — never a
- * hardcoded vendor list — so this works for any provider the registry knows
+ * registration-time auth state (describeAuthState / isConfigured), never a
+ * hardcoded vendor list, so this works for any provider the registry knows
  * accepts a key. The secrets-store key name is the provider's declared auth env
  * var; it is used only as the storage key and is never shown to the user.
  */
@@ -48,7 +48,7 @@ export function decideProviderKeyIntake(provider: LLMProvider | undefined): Prov
   return { needsKey: false, alreadyConfigured: configured };
 }
 
-/** Human-facing name for a provider — plain, vendor-neutral, never an env var. */
+/** Human-facing name for a provider, plain, vendor-neutral, never an env var. */
 export function providerIntakeLabel(providerId: string): string {
   return `the ${providerId} provider`;
 }
@@ -57,7 +57,7 @@ export function providerIntakeLabel(providerId: string): string {
 export interface ProviderKeyIntakeDeps {
   /** The provider instance whose registration-time auth state drives the decision. */
   readonly provider: LLMProvider | undefined;
-  /** Canonical secret store — the same path /secrets set writes through. */
+  /** Canonical secret store, the same path /secrets set writes through. */
   readonly secretsManager?: {
     set(key: string, value: string, options?: { scope?: SecretScope; medium?: 'secure' | 'plaintext' }): Promise<void>;
   } | undefined;
@@ -72,8 +72,8 @@ export interface ProviderKeyIntakeDeps {
 /**
  * If the selected provider needs a key, open the concealed prompt, store the
  * pasted value through the secrets manager, re-register the provider live, then
- * run `proceed` (the user's original selection). If no key is needed — or the
- * concealed surface is unavailable — `proceed` runs immediately. `proceed`
+ * run `proceed` (the user's original selection). If no key is needed, or the
+ * concealed surface is unavailable, `proceed` runs immediately. `proceed`
  * always runs exactly once, including when the user skips (empty/Escape), so a
  * selection is never stranded.
  */
@@ -89,7 +89,7 @@ export function runProviderKeyIntake(
   }
   const { secretsManager, beginConcealedInput } = deps;
   if (!secretsManager || !beginConcealedInput) {
-    // No canonical store or no concealed surface here — keep the selection
+    // No canonical store or no concealed surface here, keep the selection
     // rather than blocking it; the user can add the key via /secrets set later.
     proceed();
     return;
@@ -114,7 +114,7 @@ export function runProviderKeyIntake(
       void (async () => {
         try {
           // Daemon scope, not user scope. The DAEMON is the process that runs
-          // the model — it answers Telegram, ntfy, mail and every scheduled
+          // the model, it answers Telegram, ntfy, mail and every scheduled
           // run with this TUI closed. A model key filed in this surface's own
           // tier is readable only while the TUI is open, so the daemon has no
           // provider to call and cannot answer at all. Daemon tier is the one

package/src/input/relay-settings-descriptions.ts

@@ -1,9 +1,9 @@
 /**
- * relay-settings-descriptions.ts — appends the relay threat-model one-liner to
+ * relay-settings-descriptions.ts, appends the relay threat-model one-liner to
  * the `relay.*` CONFIG_SCHEMA descriptions shown in /config and the settings
  * modal.
  *
- * `relay.*` is a real SDK CONFIG_SCHEMA domain (schema-domain-runtime.ts) —
+ * `relay.*` is a real SDK CONFIG_SCHEMA domain (schema-domain-runtime.ts),
  * the settings-modal-data.ts CONFIG_SCHEMA loop already surfaces it once
  * `relay` is listed in SETTINGS_CATEGORIES (see settings-modal-types.ts). The
  * SDK's own descriptions explain WHAT each key does but not the trust
@@ -18,7 +18,7 @@ import type { SettingEntry, SettingsCategory } from './settings-modal-types.ts';
 
 /** The threat-model note every relay.* setting description gets appended with. */
 export const RELAY_THREAT_MODEL_NOTE =
-  'The relay operator sees only ciphertext and connection metadata — it cannot read message contents. Self-host your own relay for full control.';
+  'The relay operator sees only ciphertext and connection metadata; it cannot read message contents. Self-host your own relay for full control.';
 
 /** Append the threat-model note to every relay.* entry's description, in place. */
 export function enrichRelaySettingDescriptions(groups: Map<SettingsCategory, SettingEntry[]>): void {

package/src/input/sandbox-exec-config.ts

@@ -1,29 +1,29 @@
 /**
- * sandbox-exec-config.ts — TUI-local synthetic settings entries for
+ * sandbox-exec-config.ts, TUI-local synthetic settings entries for
  * sandbox.egressAllowlist / sandbox.workspaceWritable.
  *
  * The SDK's per-command exec sandbox (bubblewrap on Linux, gated by the
  * graduation-tracked `exec-sandbox` feature flag) reads its full configuration
  * straight off `configManager.getCategory('sandbox')` inside
- * `registerAllTools` (platform/tools/index.ts) — `sandbox.enabled`,
+ * `registerAllTools` (platform/tools/index.ts), `sandbox.enabled`,
  * `sandbox.egressAllowlist`, `sandbox.workspaceWritable`. `sandbox.enabled` is
  * already a real CONFIG_SCHEMA key (with its own honest "requires bubblewrap
  * on Linux, reports unavailable elsewhere" description) and needs no synthetic
- * entry — the CONFIG_SCHEMA loop in settings-modal-data.ts already surfaces it.
+ * entry, the CONFIG_SCHEMA loop in settings-modal-data.ts already surfaces it.
  * `egressAllowlist`/`workspaceWritable` are NOT in CONFIG_SCHEMA, so this file
  * mirrors worktree-setup-config.ts's synthetic-entry pattern for them.
  *
  * UNLIKE worktree.setup.* / learning.consolidation.*, no defensive try/catch is
  * needed here: DEFAULT_CONFIG.sandbox already carries both fields (as empty
  * arrays), so ConfigManager.resolvePath finds the `sandbox` section on a plain
- * get()/set() without throwing — only a missing SECTION throws, and `sandbox`
+ * get()/set() without throwing, only a missing SECTION throws, and `sandbox`
  * has existed since before this repack (it backs the older VM/REPL isolation
  * settings). Writing through these entries takes effect for real: the exec
  * sandbox reads the same `sandbox` config category at tool-registration time.
  *
  * Both keys hold a JSON array of strings on disk. The settings modal's inline
- * editor is a single-line text field, so — matching worktree.setup.* and
- * controlPlane.cors.allowedOrigins — they are displayed and edited as a
+ * editor is a single-line text field, so, matching worktree.setup.* and
+ * controlPlane.cors.allowedOrigins, they are displayed and edited as a
  * comma-separated list and parsed back into an array on commit (see
  * isSandboxExecListConfigKey's use in settings-modal.ts#commitEdit).
  */
@@ -50,7 +50,7 @@ export function readSandboxExecList(configManager: Pick<ConfigManager, 'get'>, k
   return raw.filter((entry): entry is string => typeof entry === 'string' && entry.length > 0);
 }
 
-/** Parse a comma-separated edit-buffer submission back into a string array (trimmed, empties dropped). Shared with worktree.setup.* — same convention. */
+/** Parse a comma-separated edit-buffer submission back into a string array (trimmed, empties dropped). Shared with worktree.setup.*, same convention. */
 export function parseSandboxExecListInput(text: string): string[] {
   return text.split(',').map((part) => part.trim()).filter((part) => part.length > 0);
 }
@@ -59,14 +59,14 @@ export const SANDBOX_EGRESS_ALLOWLIST_SYNTHETIC_SETTING: ConfigSetting = {
   key: SANDBOX_EGRESS_ALLOWLIST_CONFIG_KEY,
   type: 'string',
   default: [],
-  description: 'Comma-separated command base names (or "*" for all) whose network access is re-enabled inside the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants network"). Empty = the sandbox disables network for every command. Only takes effect when sandbox.enabled is on, the exec-sandbox setting is on, and bubblewrap is available (Linux only — reports unavailable elsewhere).',
+  description: 'Comma-separated command base names (or "*" for all) whose network access is re-enabled inside the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants network"). Empty = the sandbox disables network for every command. Only takes effect when sandbox.enabled is on, the exec-sandbox setting is on, and bubblewrap is available (Linux only; reports unavailable elsewhere).',
 };
 
 export const SANDBOX_WORKSPACE_WRITABLE_SYNTHETIC_SETTING: ConfigSetting = {
   key: SANDBOX_WORKSPACE_WRITABLE_CONFIG_KEY,
   type: 'string',
   default: [],
-  description: 'Comma-separated absolute paths outside the workspace bound writable into the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants path outside workspace"). Empty = only the workspace (and an isolated /tmp) is writable. Only takes effect when sandbox.enabled is on, the exec-sandbox setting is on, and bubblewrap is available (Linux only — reports unavailable elsewhere).',
+  description: 'Comma-separated absolute paths outside the workspace bound writable into the per-command exec sandbox boundary, as a named escalation the approval flow surfaces ("wants path outside workspace"). Empty = only the workspace (and an isolated /tmp) is writable. Only takes effect when sandbox.enabled is on, the exec-sandbox setting is on, and bubblewrap is available (Linux only; reports unavailable elsewhere).',
 };
 
 function buildSandboxExecListEntry(configManager: Pick<ConfigManager, 'get'>, setting: ConfigSetting): SettingEntry {