feat(config): add interactive settings center

AGENTS.md

@@ -79,6 +79,7 @@ assets remain responsibilities of release CI.
 
 ```
 src/
+  atomic_file.rs   same-directory atomic replacement with permission retention
   main.rs          module wiring
   cli.rs           clap command definitions
   config.rs        TOML config + default paths (RECALL_CONFIG override)
@@ -97,7 +98,9 @@ src/
   tui/
     app.rs         App state + key handling
     ui.rs          ratatui rendering
-    mod.rs         terminal setup (renders to stderr) + event loop
+    runtime.rs     shared raw-mode / alternate-screen terminal lifecycle
+    config/        interactive configuration state, effects, and rendering
+    mod.rs         history TUI event loop (renders to stderr)
   commands/        one module per CLI command; optional import adapters live
     import/        below import.rs and must not leak into core models/config
 shell/recall.zsh   embedded shell integrations (include_str!)
@@ -183,6 +186,25 @@ for editing (exit 0); `Ctrl+Enter` exits with code 2, which tells the widget to
 execute immediately (`Ctrl+E` is the fallback where `Ctrl+Enter` is not
 distinguishable, e.g. Windows Terminal).
 
+### Configuration TUI
+
+- Bare `recall config` opens the settings TUI; `path`, `show`, and `default`
+  remain non-interactive. Keep `RECALL_CONFIG` resolution identical for reads,
+  writes, and path display.
+- `ConfigStore` reloads the active TOML before every mutation, validates the
+  complete effective config, and replaces it atomically. Preserve comments,
+  unrelated keys, permissions, newline style, BOM, and symlink targets. Never
+  overwrite a malformed or unsupported config.
+- TOML is the source of truth for UI preferences. The legacy
+  `ui.list_width_pct` SQLite setting is read only for one-time migration and is
+  deleted only after the TOML write succeeds.
+- Configuration UI state and rendering must stay testable without a live
+  terminal. Add PTY coverage for input and terminal restoration; keep a ConPTY
+  smoke test for Windows.
+- Shell integration actions call the same setup inspection and apply functions
+  as `recall setup`. Do not duplicate profile rendering or marker handling in
+  the TUI.
+
 ### Key invariants
 
 - The end marker must be emitted in-band before the prompt, otherwise the next
@@ -212,7 +234,7 @@ distinguishable, e.g. Windows Terminal).
   - PowerShell: capture `$?` and `$LASTEXITCODE` before any statement changes
     them, then restore them before rendering the user's prompt. The integrations
     guard against double-loading and only install when PSReadLine is present.
-    `Set-PSReadLineKeyHandler` binds a single chord.
+    PSReadLine multi-stroke shortcuts use a comma-separated chord string.
 - Output is stored zstd-compressed; a truncated plain-text projection lives in
   `output_text` for FTS. Keep the two in sync.
 - DB access uses WAL + `busy_timeout`; multiple processes may write.

Cargo.toml

@@ -29,6 +29,7 @@ ulid = { version = "3.0.0", features = ["serde"] }
 unicode-width = "0.2.2"
 zstd = "0.14.0"
 zip = { version = "8.2.0", default-features = false, features = ["deflate"] }
+toml_edit = "0.25.15"
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2.182"

README.md

@@ -196,11 +196,11 @@ The key is configured in `~/.config/recall/config.toml` as a semantic name that
 search_key = "alt-r"   # alt-r, ctrl-t, or a two-stroke sequence "ctrl-x ctrl-r"
 ```
 
-Supported forms are `alt-<letter>`, `ctrl-<letter>`, or a space-separated
-sequence such as `"ctrl-x ctrl-r"`. The default is `alt-r`. After editing the
-file, reopen the shell (or re-run `eval "$(recall init zsh)"`) to apply it.
-PSReadLine binds a single chord, so on Windows a two-stroke sequence uses its
-first key.
+Supported forms are `alt-<letter>`, `ctrl-<letter>`, `ctrl-space`, or a
+space-separated sequence such as `"ctrl-x ctrl-r"`. The default is `alt-r`.
+Run `recall config` to record and validate a shortcut interactively. Reopen the
+shell after changing it; PowerShell sequences are passed to PSReadLine as a
+comma-separated chord.
 
 #### macOS: the Option key
 
@@ -297,6 +297,7 @@ recall search --cmd-only   # print the selection (used by the zsh widget)
 recall setup [shell]       # configure automatic capture and shell hooks
 recall doctor              # diagnose config, databases and clipboard
 recall prune               # drop output older than the retention window
+recall config              # open the interactive settings TUI
 recall config path|show|default
 recall uuid
 ```
@@ -309,8 +310,29 @@ recall uuid
 > database is stored, which command output is recorded, secrets filtering,
 > retention, and clipboard behavior. The defaults work out of the box, but a
 > deliberate configuration helps avoid retaining noisy or sensitive output.
-> Use `recall config path`, `recall config show`, and `recall config default`
-> to locate the file, inspect the active settings, and view a complete template.
+> Run `recall config` to review capture rules before recording sensitive output.
+> `recall config path`, `recall config show`, and `recall config default` remain
+> available to locate the file, inspect the active settings, and print a template.
+
+### Interactive configuration
+
+```sh
+recall config
+```
+
+The settings TUI manages the search shortcut, secret and interactive-command
+filtering, command/output exclusion regexes, display preferences, and shell
+integration. Changes are validated and saved atomically as you make them;
+existing TOML comments and unrelated settings are retained. Shortcut changes
+take effect in a new shell.
+
+- `Tab` / `Shift+Tab`: change category
+- `Up` / `Down`: choose a setting
+- `Left` / `Right`: adjust display values or timestamp presets
+- `Space`: toggle a setting
+- `Enter`: edit, record, or apply
+- `a` / `e` / `d`: add, edit, or delete a custom capture rule
+- `F1`: help; `Esc` / `q`: back or quit
 
 `~/.config/recall/config.toml` on Linux/macOS and
 `%APPDATA%\recall\config.toml` on Windows (all fields optional;
@@ -338,6 +360,8 @@ backend = "auto"             # auto | arboard | osc52 | wl-copy | xclip | xsel
 [ui]
 search_key = "alt-r"         # key that opens recall (alt-r, ctrl-t, "ctrl-x ctrl-r")
 list_width_pct = 42          # initial list pane width; resizing in the TUI persists
+preview_lines = 4            # output lines shown for each result
+date_format = "%Y-%m-%d %H:%M:%S"
 ```
 
 ## How it works

README.zh-CN.md

@@ -171,10 +171,10 @@ recall init pwsh | Out-String | Invoke-Expression
 search_key = "alt-r"   # 可选 alt-r、ctrl-t，或组合键 "ctrl-x ctrl-r"
 ```
 
-支持的写法有 `alt-<字母>`、`ctrl-<字母>`，或用空格分隔的组合键（如
-`"ctrl-x ctrl-r"`）。默认是 `alt-r`。修改后重开 shell（或重新执行
-`eval "$(recall init zsh)"`）即可生效。PSReadLine 只绑定单个 chord，因此在
-Windows 上组合键只会取其第一个键。
+支持的写法有 `alt-<字母>`、`ctrl-<字母>`、`ctrl-space`，或用空格分隔的组合键
+（如 `"ctrl-x ctrl-r"`）。默认是 `alt-r`。运行 `recall config` 可以直接录制并
+验证快捷键；修改后重开 shell 即可生效。PowerShell 会把多段组合转换为 PSReadLine
+使用的逗号分隔 chord。
 
 #### macOS 的 Option 键
 
@@ -262,6 +262,7 @@ recall search --cmd-only   # 打印选择结果（供 shell 组件使用）
 recall setup [shell]       # 配置自动捕获和 shell hooks
 recall doctor              # 诊断配置、数据库和剪贴板
 recall prune               # 清理超过保留期的输出
+recall config              # 打开交互式设置界面
 recall config path|show|default
 recall uuid
 ```
@@ -272,9 +273,27 @@ recall uuid
 >
 > 启用代理前，请务必检查配置文件。它直接决定数据库的存储位置、哪些命令输出会被
 > 记录、密钥过滤、数据保留期限和剪贴板行为。默认配置可以直接运行，但主动配置能
-> 避免长期保存大量无用输出或敏感内容。可使用 `recall config path`、
-> `recall config show` 和 `recall config default` 分别查看配置路径、当前生效配置和
-> 完整配置模板。
+> 避免长期保存大量无用输出或敏感内容。运行 `recall config` 可交互检查捕获规则；
+> `recall config path`、`recall config show` 和 `recall config default` 仍可分别查看
+> 配置路径、当前生效配置和完整配置模板。
+
+### 交互式配置
+
+```sh
+recall config
+```
+
+设置界面可以管理搜索快捷键、敏感信息与交互式命令过滤、命令/输出排除正则、显示
+偏好以及 Shell 集成。每项修改都会先验证，再原子保存；已有 TOML 注释和无关字段会
+被保留。快捷键需要打开新 Shell 后生效。
+
+- `Tab` / `Shift+Tab`：切换分类
+- `↑` / `↓`：选择设置
+- `←` / `→`：调整显示数值或时间格式预设
+- `Space`：切换开关
+- `Enter`：编辑、录制或应用
+- `a` / `e` / `d`：新增、编辑或删除自定义捕获规则
+- `F1`：帮助；`Esc` / `q`：返回或退出
 
 Linux/macOS 为 `~/.config/recall/config.toml`，Windows 为
 `%APPDATA%\recall\config.toml`（所有字段均可选；`recall config default`
@@ -301,6 +320,8 @@ backend = "auto"             # auto | arboard | osc52 | wl-copy | xclip | xsel
 [ui]
 search_key = "alt-r"         # 打开 recall 的按键（alt-r、ctrl-t、"ctrl-x ctrl-r"）
 list_width_pct = 42          # 列表面板初始宽度；在 TUI 中调整后会持久化
+preview_lines = 4            # 每条结果显示的输出预览行数
+date_format = "%Y-%m-%d %H:%M:%S"
 ```
 
 ## 工作原理

docs/shell-integration.md

@@ -0,0 +1,122 @@
+# Shell integration settings
+
+The **Shell integration** category in `recall config` controls how recall is
+loaded when a new interactive shell starts. It modifies the shell startup file;
+it does not modify the terminal emulator's configuration.
+
+Use `Tab` or `Shift+Tab` to select **Shell integration**, then use the up and
+down arrow keys to select a row. Press `Enter` on an action to apply it.
+
+## Status fields
+
+The first four rows describe the detected configuration and the shell that is
+currently running the settings interface.
+
+### Detected shell
+
+The shell for which recall is showing and editing integration settings, such as
+`zsh`, `bash`, `fish`, or `pwsh`. recall normally derives this from the user's
+login shell or the current platform's shell discovery rules.
+
+### Startup file
+
+The file that recall will update for the detected shell. Common examples are
+`~/.zshrc`, `~/.bashrc`, `~/.config/fish/config.fish`, and the PowerShell
+profile. The CLI command `recall setup --profile <path>` remains available for
+advanced setups that use a different file.
+
+### Current setup
+
+The integration found in the startup file:
+
+- **Automatic capture**: new interactive shells start through the recall PTY
+  proxy and load recall's hooks. Commands, metadata, and command output are
+  captured automatically.
+- **Hooks only**: recall's hooks are loaded, but the shell is not automatically
+  wrapped by the PTY proxy. Command metadata is recorded, while full output is
+  captured only inside a shell started with `recall shell`.
+- **Legacy automatic setup** or **Legacy hooks setup**: recall found an older
+  installer-managed configuration. Applying either current mode migrates it to
+  the current managed format.
+- **Unmanaged hooks**: the startup file contains a user-written `recall init`
+  command. recall recognizes and reuses it instead of adding another copy.
+- **Not configured**: no recall integration was found in the startup file.
+- **Malformed recall markers**: a managed block is incomplete or damaged.
+  recall will not edit the file automatically because doing so could overwrite
+  user configuration. Repair or remove the damaged markers manually before
+  applying a mode again.
+- **Unavailable** or **Error**: recall could not determine or safely inspect the
+  startup file. The accompanying message describes the reason.
+
+### Runtime
+
+This row describes the current shell process, not merely the startup file:
+
+- **hooks On** means recall's shell hooks are loaded in this shell.
+- **proxy On** means this shell is running inside `recall shell`, so full output
+  capture is active.
+
+It is normal to see **Automatic capture** with **proxy Off** immediately after
+changing the setting: the current shell started before the change. Open a new
+terminal or start a new shell to activate automatic capture. Similarly,
+removing integration does not unload hooks that are already running; it affects
+new shells.
+
+## Actions
+
+### Use automatic capture
+
+This is the recommended default. recall adds two managed blocks to the startup
+file:
+
+1. A lightweight block near the top starts `recall shell` for a supported
+   interactive TTY.
+2. A block near the end loads recall's hooks after the user's prompt, theme, and
+   line editor configuration.
+
+The proxied child shell skips the first block, so the user's startup file is
+loaded once rather than recursively. Non-interactive shells do not start the
+proxy. To bypass automatic capture for a particular new shell, set
+`RECALL_PROXY=0` before starting it.
+
+The equivalent CLI command is:
+
+```sh
+recall setup <shell> --mode auto
+```
+
+### Use hooks only
+
+This installs the search shortcut and command metadata hooks without launching
+the proxy automatically. Choose this when automatic output capture is not
+wanted for every terminal. Run `recall shell` manually whenever full command
+output should be captured.
+
+The equivalent CLI command is:
+
+```sh
+recall setup <shell> --mode hooks
+```
+
+### Remove integration
+
+This removes only blocks managed by recall and asks for confirmation first.
+Other startup-file content is preserved. A user-written, unmanaged
+`recall init` command is not deleted automatically.
+
+The equivalent CLI command is:
+
+```sh
+recall setup <shell> --remove
+```
+
+## Which mode should I choose?
+
+| Mode | Search shortcut | Command metadata | Full output by default |
+| --- | --- | --- | --- |
+| Automatic capture | Yes | Yes | Yes |
+| Hooks only | Yes | Yes | No; run `recall shell` when needed |
+| Removed / not configured | No | No | No |
+
+Review the command and output exclusion rules in the **Capture rules** category
+before enabling automatic capture for sensitive work.