@pellux/goodvibes-tui 0.25.0 → 0.27.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
@@ -99,7 +99,7 @@
     "@anthropic-ai/vertex-sdk": "^0.16.0",
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
-    "@pellux/goodvibes-sdk": "0.33.38",
+    "@pellux/goodvibes-sdk": "0.35.0",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",

package/src/cli/bundle-command.ts

@@ -15,6 +15,7 @@ import { getPackageVersion } from './help.ts';
 import { classifyProviderSetup } from './provider-classification.ts';
 import { buildCliServicePosture } from './service-posture.ts';
 import { REDACTED_VALUE, collectSensitiveConfigValues, isRedactedValue, redactConfig, redactSerializedSecrets } from './redaction.ts';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 interface BundleInspectSummary {
   readonly type: string;
@@ -43,7 +44,7 @@ function readJsonFile(path: string): { readonly ok: true; readonly value: Record
   try {
     return { ok: true, value: JSON.parse(readFileSync(path, 'utf-8')) as Record<string, unknown> };
   } catch (error) {
-    return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    return { ok: false, error: summarizeError(error) };
   }
 }
 

package/src/cli/service-posture.ts

@@ -10,6 +10,7 @@ import { resolveRuntimeEndpointBinding } from './endpoints.ts';
 import type { RuntimeEndpointBinding, RuntimeEndpointId } from './endpoints.ts';
 import { classifyBindPosture, isNetworkFacing } from './network-posture.ts';
 import { redactText } from './redaction.ts';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 export interface CliServiceRuntime {
   readonly configManager: ConfigManager;
@@ -326,7 +327,7 @@ function readLogPosture(path: string | undefined, tailBytes: number): CliService
       exists: true,
       size: 0,
       modifiedAt: null,
-      readError: error instanceof Error ? error.message : String(error),
+      readError: summarizeError(error),
     };
   }
 }

package/src/core/conversation-rendering.ts

@@ -320,10 +320,10 @@ export function appendConversationMessages(
 
   for (let msgIdx = 0; msgIdx < messages.length; msgIdx++) {
     const message = messages[msgIdx];
-    messageLineRegistry[msgIdx] = context.history.getLineCount();
     // absoluteIdx aligns the slice-relative loop counter with the absolute
-    // message index used as the key in messageKindRegistry.
+    // message index used as the key in messageKindRegistry and messageLineRegistry.
     const absoluteIdx = msgIndexOffset + msgIdx;
+    messageLineRegistry[absoluteIdx] = context.history.getLineCount();
     if (message.role === 'user') {
       renderConversationUserMessage(context, message, width);
     } else if (message.role === 'assistant') {

package/src/core/conversation.ts

@@ -64,7 +64,15 @@ export class ConversationManager extends SdkConversationManager {
   private collapseState: Map<string, boolean> = new Map();
   /** Block registry: track rendered blocks for copy/apply. */
   protected blockRegistry: BlockMeta[] = [];
-  /** Message index -> first rendered line index in the history buffer. */
+  /**
+   * Absolute message index -> first rendered line index in the history buffer.
+   * Keyed by the message's ABSOLUTE position in the full (unsliced) snapshot —
+   * appendConversationMessages writes `messageLineRegistry[absoluteIdx]`, not the
+   * slice-relative loop counter — so transcript-event navigation
+   * (next/prevTranscriptEventLine), whose event.messageIndex is absolute, resolves
+   * correctly even after clearDisplay() renders only a tail slice. Holes (indices
+   * not currently rendered) read back as undefined and are filtered out by consumers.
+   */
   private messageLineRegistry: number[] = [];
   /**
    * Registry of rendered line indices for system messages whose kind is
@@ -91,6 +99,13 @@ export class ConversationManager extends SdkConversationManager {
    * Reset to 0 on startStreamingBlock and finalizeStreamingBlock.
    */
   private _lastStreamRenderMs = 0;
+  /**
+   * Terminal width captured when the current streaming block was anchored.
+   * If the width changes mid-stream, updateStreamingBlock forces a rebuild so
+   * streamingStartLine is re-anchored to the new buffer (see rebuildHistory).
+   * -1 when no stream is active.
+   */
+  private _streamWidth = -1;
   /**
    * Message index at the time of the last clearDisplay() call.
    * rebuildHistory() renders only messages at or after this index, so the
@@ -229,6 +244,7 @@ export class ConversationManager extends SdkConversationManager {
     // Reset the render throttle so the first delta always renders immediately.
     this.flushHistory();
     this.streamingStartLine = this.history.getLineCount();
+    this._streamWidth = this._getWidth();
     this._lastStreamRenderMs = 0;
   }
 
@@ -243,6 +259,13 @@ export class ConversationManager extends SdkConversationManager {
     // Throttle renderMarkdown to the 16ms render-coalescer cadence to avoid
     // O(n) parse overhead on every delta token during streaming.
     if (this.streamingStartLine >= 0) {
+      // If the terminal was resized mid-stream, force the pending width-change
+      // rebuild now. rebuildHistory() re-anchors streamingStartLine to the new
+      // buffer (see its streaming branch), so the incremental truncate below
+      // targets the correct offset instead of a stale one.
+      if (this._getWidth() !== this._streamWidth) {
+        this.flushHistory();
+      }
       const now = Date.now();
       if (now - this._lastStreamRenderMs >= 16) {
         this._lastStreamRenderMs = now;
@@ -261,6 +284,7 @@ export class ConversationManager extends SdkConversationManager {
   public override finalizeStreamingBlock(): void {
     super.finalizeStreamingBlock();
     this.streamingStartLine = -1;
+    this._streamWidth = -1;
     this._lastStreamRenderMs = 0;
     this.markDirty();
   }
@@ -367,12 +391,23 @@ export class ConversationManager extends SdkConversationManager {
     this.dirty = false;
 
     const snapshot = this.getMessageSnapshot();
+    // During streaming, the in-progress placeholder (always the last message) is
+    // rendered here as EMPTY; the incremental streaming path (updateStreamingBlock)
+    // owns its content. This keeps streamingStartLine valid across width-change
+    // rebuilds — otherwise the placeholder would be re-rendered with its content at
+    // the new width while streamingStartLine still pointed into the old buffer.
+    const lastMsg = snapshot[snapshot.length - 1];
+    const isStreaming = this.streamingStartLine >= 0 && lastMsg?.role === 'assistant';
+    const renderSnapshot = isStreaming
+      ? [...snapshot.slice(0, -1), { ...lastMsg, content: '' } as Message]
+      : snapshot;
+
     // When _displayFromMessageIndex > 0, clearDisplay() was called. Only render
     // messages added after the clear — the pre-clear history stays off-screen.
     // On a full rebuild (e.g. width change), reset the display-start to 0 so the
     // user can scroll back to the full history if needed.
     const displayStart = this._displayFromMessageIndex;
-    const visibleSnapshot = displayStart > 0 ? snapshot.slice(displayStart) : snapshot;
+    const visibleSnapshot = displayStart > 0 ? renderSnapshot.slice(displayStart) : renderSnapshot;
 
     // Tool messages ARE rendered (as collapsed blocks); this filter is only
     // for determining whether to show the splash screen (tool-only messages
@@ -388,6 +423,18 @@ export class ConversationManager extends SdkConversationManager {
 
     this.appendMessages(visibleSnapshot, width, displayStart);
     this.appendedUpTo = snapshot.length;
+
+    if (isStreaming) {
+      // Re-anchor the streaming block to the freshly rebuilt buffer and re-render
+      // the in-progress content at the current width, mirroring startStreamingBlock.
+      this.streamingStartLine = this.history.getLineCount();
+      this._streamWidth = width;
+      this._lastStreamRenderMs = 0;
+      const streamingContent = lastMsg?.content;
+      if (typeof streamingContent === 'string' && streamingContent.length > 0) {
+        this.history.addLines(renderMarkdown(streamingContent, width, { isStreaming: true }));
+      }
+    }
   }
 
   /**

package/src/core/session-recovery.ts

@@ -26,7 +26,8 @@
  *    journal silently and return.
  * 3. If records are found, apply the final record's messages — each journal
  *    record carries the full conversation snapshot at that moment, so the
- *    last record by seq is the authoritative post-crash state.
+ *    record with the newest timestamp is the authoritative post-crash state
+ *    (resilient to seq collisions across re-inits onto a stale journal file).
  * 4. Rebuild the conversation history and call the snapshot writer so the
  *    gap is durably closed before the user sees the restored conversation.
  * 5. Rotate the journal (it is no longer needed as a gap-filler).
@@ -64,8 +65,6 @@ export interface ReplayIntoConversationResult {
   readonly replayed: number;
   /** True if the journal tail was corrupt (quarantined). */
   readonly hadCorruptTail: boolean;
-  /** True if the journal had an unrecognised schema version (quarantined). */
-  readonly hadVersionMismatch: boolean;
 }
 
 // ─── Public API ─────────────────────────────────────────────────────────────
@@ -85,29 +84,36 @@ export function replayJournalIntoConversation(
   try {
     const { records, hadCorruptTail } = replayJournal(journalPath, snapshotTimestamp);
 
-    // Detect version mismatch: replayJournal quarantines and returns
-    // hadCorruptTail=true + 0 records when the header version is wrong.
-    // We distinguish it from a genuine corrupt tail by checking whether the
-    // journal file still exists (quarantine renames it away in both cases,
-    // so we cannot inspect the header at this point). We surface both cases
-    // through hadCorruptTail to the caller; hadVersionMismatch is derived
-    // from it to give the caller a distinct notice option.
-    const hadVersionMismatch = hadCorruptTail && records.length === 0;
-
     const journal = openTranscriptJournal(journalPath, sessionId);
 
     if (records.length === 0) {
       // Nothing to replay — rotate the (now-stale) journal silently.
       journal.rotate();
-      return { replayed: 0, hadCorruptTail, hadVersionMismatch };
+      return { replayed: 0, hadCorruptTail };
     }
 
-    // The last record (highest seq) holds the most recent full conversation
-    // state captured before the crash. Apply it.
-    const lastRecord = records[records.length - 1]!;
+    // Select the authoritative record by newest wall-clock timestamp (tie-broken
+    // by highest seq). Each record carries the full conversation snapshot at its
+    // moment, so the newest ts is by definition the most recent state. This is
+    // resilient to seq collisions that arise when a fresh process appends to a
+    // pre-existing, non-rotated journal: its records restart at seq 0 after the
+    // surviving old records, so "last by seq" could otherwise pick a stale one.
+    const lastRecord = records.reduce((newest, candidate) =>
+      candidate.ts > newest.ts ||
+      (candidate.ts === newest.ts && candidate.seq > newest.seq)
+        ? candidate
+        : newest,
+    );
     const replayedMessages = lastRecord.messages as ConversationMessageSnapshot[];
 
+    // Preserve the session identity (title/titleSource/branches/currentBranch)
+    // that the resume seam already hydrated onto the live conversation. Journal
+    // records carry only messages, so a bare fromJSON would blank the title and
+    // reset titleSource to the system default — and the next TURN_COMPLETED
+    // snapshot would then persist the empty title, making the loss permanent.
+    const preserved = conversation.toJSON();
     conversation.fromJSON({
+      ...preserved,
       messages: replayedMessages as never[],
     });
     conversation.rebuildHistory();
@@ -123,10 +129,10 @@ export function replayJournalIntoConversation(
     // Rotate the journal — it is no longer needed as a gap-filler.
     journal.rotate();
 
-    return { replayed: records.length, hadCorruptTail, hadVersionMismatch: false };
+    return { replayed: records.length, hadCorruptTail };
   } catch {
     // Absolute last-resort guard — recovery must never crash a resume.
-    return { replayed: 0, hadCorruptTail: false, hadVersionMismatch: false };
+    return { replayed: 0, hadCorruptTail: false };
   }
 }
 

package/src/core/system-message-router.ts

@@ -1,15 +1,19 @@
 /**
  * SystemMessageRouter — routes system messages to the appropriate surfaces
- * based on priority.
+ * based on their kind and configured routing target.
  *
- * Two tiers:
- *   - 'high' — appears in both the main conversation AND the SystemMessagesPanel.
- *     Use for: fatal errors, model/provider confirmations, session save/load,
- *     compaction events (e.g. [Compaction] completed).
- *   - 'low'  — appears in the SystemMessagesPanel only (panel-only routing).
- *     Use for: scan results, provider discovery, plugin load/unload, feature
- *     flag changes, tool execution status, permission decisions,
- *     health/cascade events, debug/operational info.
+ * Delivery is resolved from the message KIND ('system' | 'wrfc' |
+ * 'operational'), which maps to a configurable routing target
+ * (ui.systemMessages / ui.wrfcMessages / ui.operationalMessages, each
+ * 'panel' | 'conversation' | 'both'). resolveSystemMessageDelivery() turns that
+ * target — plus whether a panel is attached — into a { toPanel, toConversation }
+ * decision. The priority ('high' | 'low') only sets the panel emphasis; it does
+ * not by itself decide conversation delivery.
+ *
+ * Critical override: errors, provider failovers, and compaction/context notices
+ * (see FORCE_CONVERSATION_PREFIXES) ALWAYS also reach the main conversation,
+ * regardless of target, so the user never has to open the SystemMessagesPanel
+ * to discover them.
  *
  * Usage:
  * ```ts
@@ -18,9 +22,9 @@
  * router.routeSystemMessage('[Session] Saved session abc123', 'high');
  * ```
  *
- * The router can also be used as a drop-in replacement for
- * conversation.addSystemMessage() calls — it classifies messages by priority
- * automatically when using routeAuto().
+ * routeAuto() can be used as a drop-in replacement for
+ * conversation.addSystemMessage(): it classifies the message kind and priority
+ * automatically before routing.
  *
  * @remarks
  * This router handles system messages (operational status, errors). It is
@@ -28,8 +32,6 @@
  * notifications with policy-based routing.
  */
 
-import { getConfigSnapshot } from '../config/index.ts';
-import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConversationManager } from './conversation';
 import type { SystemMessagesPanel, SystemMessagePriority } from '../panels/system-messages-panel.ts';
 import {
@@ -46,14 +48,23 @@ export type {
   SystemMessageTarget,
 } from '@/runtime/index.ts';
 
-function targetForKind(
-  configManager: Pick<ConfigManager, 'getRaw'>,
-  kind: SystemMessageKind,
-): SystemMessageTarget {
-  const ui = getConfigSnapshot(configManager).ui;
-  if (kind === 'wrfc') return ui.wrfcMessages;
-  if (kind === 'operational') return ui.operationalMessages;
-  return ui.systemMessages;
+/**
+ * Message categories that are operationally critical enough that the user must
+ * see them inline in the main conversation, regardless of the configured
+ * routing target (ui.systemMessages defaults to panel-only). Errors, provider
+ * failovers, and compaction/context notices fall here: a user should never have
+ * to open the SystemMessagesPanel to discover that a turn errored, a provider
+ * failed over, or the context was compacted.
+ *
+ * Detection is by the stable message prefix tag, mirroring how the SDK
+ * classifiers key off message content. This deliberately does NOT force every
+ * high-priority message inline (model/provider/session confirmations still
+ * honour the configured target), so the routing-target config stays meaningful.
+ */
+const FORCE_CONVERSATION_PREFIXES = ['[Error]', '[Failover]', '[Compaction]', '[Context]'] as const;
+
+function mustReachConversation(message: string): boolean {
+  return FORCE_CONVERSATION_PREFIXES.some((prefix) => message.startsWith(prefix));
 }
 
 // ---------------------------------------------------------------------------
@@ -74,10 +85,11 @@ export class SystemMessageRouter {
   // ── Public API ────────────────────────────────────────────────────────────
 
   /**
-   * Route a system message with explicit priority.
+   * Route a system message.
    *
-   * - 'high': delivered to both conversation AND panel.
-   * - 'low':  delivered to panel only (conversation is not touched).
+   * Delivery is resolved from the kind and its configured target; priority only
+   * sets panel emphasis. Critical notices (errors/failover/compaction, see
+   * FORCE_CONVERSATION_PREFIXES) are additionally forced into the conversation.
    *
    * @param message  - Message text.
    * @param priority - 'high' | 'low'.
@@ -94,7 +106,11 @@ export class SystemMessageRouter {
     if (delivery.toPanel) {
       this.panel?.push(message, priority);
     }
-    if (delivery.toConversation) {
+    // Critical notices (errors, failover, compaction) must surface inline even
+    // when the configured target is panel-only — otherwise a user without the
+    // SystemMessagesPanel open would never see them.
+    const toConversation = delivery.toConversation || mustReachConversation(message);
+    if (toConversation) {
       // addTypedSystemMessage threads the kind into the conversation so the
       // renderer can use kind-based navigability instead of substring matching.
       this.conversation.addTypedSystemMessage(message, kind);

package/src/core/turn-event-wiring.ts

@@ -1,6 +1,5 @@
 import type { UiRuntimeEvents } from '@/runtime/index.ts';
 import { buildPersistedSessionContext, persistConversation } from '@/runtime/index.ts';
-import { maybeAutoCompact } from './context-auto-compact.ts';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import type { HookDispatcher, HookPhase, HookCategory, HookEventPath } from '@pellux/goodvibes-sdk/platform/hooks';
@@ -80,17 +79,21 @@ export interface WireTurnEventHandlersResult {
  * Responsibilities:
  *   - Auto-save conversation to persistent store after each LLM turn
  *   - Fire the Lifecycle:session:save hook
- *   - Trigger auto-compact when context usage exceeds the configured threshold
  *   - Refresh git status after turns and tool results
  *
+ * Note: auto-compaction is intentionally NOT performed here. The SDK
+ * Orchestrator already runs post-turn context maintenance every turn
+ * (handlePostTurnContextMaintenance) using the resolved context window and
+ * its own getAutoCompactDecision; re-triggering it from the TUI duplicated
+ * that work and raced the SDK's compaction on the shared message array.
+ *
  * Returns refreshGit (callable externally) and unsubs (push into parent unsubs).
  */
 export function wireTurnEventHandlers(
   options: WireTurnEventHandlersOptions,
 ): WireTurnEventHandlersResult {
   const {
-    events, conversation, runtime, orchestrator, configManager,
-    providerRegistry, systemMessageRouter, hookDispatcher,
+    events, conversation, runtime, configManager, hookDispatcher,
     workingDir, homeDirectory, sessionManager, gitStatusProvider,
     lastGitInfoRef, buildSessionContinuityHints, render, webhookNotifier,
     _clock = Date.now,
@@ -161,18 +164,11 @@ export function wireTurnEventHandlers(
       } catch { /* best-effort */ }
       logger.debug('auto-save on turn:complete failed', { error: summarizeError(e) });
     }
-    // Auto-compact: check context usage and compact if threshold exceeded
-    const currentModelForCompact = providerRegistry.getCurrentModel();
-    maybeAutoCompact({
-      configManager: configManager as Parameters<typeof maybeAutoCompact>[0]['configManager'],
-      conversation,
-      providerRegistry: providerRegistry as Parameters<typeof maybeAutoCompact>[0]['providerRegistry'],
-      systemMessageRouter: systemMessageRouter as Parameters<typeof maybeAutoCompact>[0]['systemMessageRouter'],
-      model: runtime.model,
-      provider: runtime.provider,
-      lastInputTokens: orchestrator.lastInputTokens,
-      contextWindow: currentModelForCompact.contextWindow,
-    }).catch((err: unknown) => logger.debug('maybeAutoCompact error', { error: summarizeError(err) }));
+    // Auto-compaction is owned by the SDK Orchestrator's post-turn maintenance
+    // (handlePostTurnContextMaintenance), which runs on every turn against the
+    // resolved context window (getContextWindowForModel) via the SDK's
+    // getAutoCompactDecision (percentage threshold + 15k safety buffer +
+    // small-window handling). The TUI must not independently re-trigger it.
     refreshGit();
   }));
 

package/src/daemon/{calendar → handlers/calendar}/caldav-client.ts

@@ -1,8 +1,8 @@
-// CalDAV client for the calendar operator surface.
+// CalDAV client for the calendar handler surface.
 //
 // Authenticates to the user's CalDAV endpoint using credentials resolved from
 // the daemon credential store (config keys under `surfaces.calendar.*`). It
-// implements the CalDAV/WebDAV verbs the operator methods need:
+// implements the CalDAV/WebDAV verbs the gateway methods need:
 //   - REPORT (calendar-query)  -> list / get events
 //   - PUT                      -> create / import events
 //   - REPORT (multiget) / GET  -> export a collection
@@ -16,9 +16,9 @@
 //   * Event hrefs are returned to callers as opaque relative identifiers, never
 //     as fully-qualified authenticated URLs.
 
-import type { OperatorContext } from '../operator/types.ts';
-import { OperatorError } from '../operator/types.ts';
-import { createDaemonCredentialStore } from '../operator/credential-store.ts';
+import { HandlerError } from '../errors.ts';
+import type { HandlerContext } from '../context.ts';
+import type { DaemonCredentialStore } from '../credentials.ts';
 import {
   generateCalendar,
   generateICS,
@@ -26,6 +26,7 @@ import {
   type GenerateICalInput,
   type ParsedICalEvent,
 } from './ics.ts';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 // ---------------------------------------------------------------------------
 // Configuration
@@ -112,12 +113,15 @@ export interface CalDavClient {
   exportIcs(opts: { calendarId?: string; from?: string; to?: string }): Promise<ExportResult>;
 }
 
+/** Subset of the handler context the CalDAV config resolver needs. */
+export type CalDavConfigContext = Pick<HandlerContext, 'configManager' | 'credentials'>;
+
 // ---------------------------------------------------------------------------
 // Config resolution
 // ---------------------------------------------------------------------------
 
 function readConfigString(
-  ctx: Pick<OperatorContext, 'configManager'>,
+  ctx: Pick<HandlerContext, 'configManager'>,
   key: string,
 ): string | undefined {
   const value = ctx.configManager.get(key as never);
@@ -147,16 +151,17 @@ function parseCollectionMap(raw: string | undefined): Record<string, string> {
  * Resolve the full CalDAV configuration from config + credential store.
  * The password is resolved from the daemon credential store — either as a
  * goodvibes://secrets/ reference stored in config, or the config-key-derived
- * secret. Throws OperatorError when the surface is not configured.
+ * secret. Throws HandlerError when the surface is not configured. The resolved
+ * password is held only in memory and never returned to callers.
  */
 export async function resolveCalDavConfig(
-  ctx: Pick<OperatorContext, 'configManager' | 'secrets'>,
+  ctx: CalDavConfigContext,
 ): Promise<CalDavConfig> {
-  const credentials = createDaemonCredentialStore(ctx.secrets);
+  const credentials: DaemonCredentialStore = ctx.credentials;
   const baseUrl = readConfigString(ctx, CFG_URL);
   const username = readConfigString(ctx, CFG_USER);
   if (!baseUrl || !username) {
-    throw new OperatorError(
+    throw new HandlerError(
       'CalDAV is not configured. Set surfaces.calendar.caldavUrl and surfaces.calendar.caldavUser.',
       'CALENDAR_NOT_CONFIGURED',
       412,
@@ -174,7 +179,7 @@ export async function resolveCalDavConfig(
     password = await credentials.resolveConfigSecret(CFG_PASSWORD);
   }
   if (!password) {
-    throw new OperatorError(
+    throw new HandlerError(
       'CalDAV password is not available in the credential store.',
       'CALENDAR_CREDENTIALS_MISSING',
       412,
@@ -204,7 +209,7 @@ function joinUrl(base: string, segment: string): string {
 /** Extract the scheme+host origin from an absolute URL (no trailing slash). */
 export function originOf(url: string): string {
   const match = /^(https?:\/\/[^/]+)/i.exec(url.trim());
-  return match ? match[1] : stripTrailingSlash(url);
+  return match ? match[1]! : stripTrailingSlash(url);
 }
 
 /**
@@ -227,7 +232,7 @@ function resolveCollectionUrl(baseUrl: string, path: string): string {
 export function toRelativeHref(href: string): string {
   const trimmed = href.trim();
   const schemeMatch = /^https?:\/\/[^/]+(\/.*)$/i.exec(trimmed);
-  if (schemeMatch) return schemeMatch[1];
+  if (schemeMatch) return schemeMatch[1]!;
   return trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
 }
 
@@ -302,7 +307,7 @@ function propfindCalendarsBody(): string {
 function toCalDavStamp(iso: string): string {
   const date = new Date(iso);
   if (Number.isNaN(date.getTime())) {
-    throw new OperatorError(`Invalid date range value: ${iso}`, 'CALENDAR_BAD_RANGE', 400);
+    throw new HandlerError(`Invalid date range value: ${iso}`, 'CALENDAR_BAD_RANGE', 400);
   }
   const pad = (n: number): string => (n < 10 ? `0${n}` : String(n));
   return (
@@ -353,7 +358,7 @@ export function parseMultiStatus(xml: string): MultiStatusEntry[] {
   const responseRe = /<(?:[a-zA-Z0-9]+:)?response(?:\s[^>]*)?>([\s\S]*?)<\/(?:[a-zA-Z0-9]+:)?response>/gi;
   let match: RegExpExecArray | null;
   while ((match = responseRe.exec(xml)) !== null) {
-    const block = match[1];
+    const block = match[1]!;
     const hrefRaw = tagContent(block, 'href');
     if (!hrefRaw) continue;
     const href = decodeXmlEntities(hrefRaw.trim());
@@ -425,18 +430,18 @@ export function createCalDavClient(options: CreateCalDavClientOptions): CalDavCl
       // (e.g. "getaddrinfo ENOTFOUND cal.example.com") leaks the CalDAV
       // hostname/URL into caller-visible output (importIcs errors[]).
       // Never include creds/URL/host or raw fetch detail.
-      throw new OperatorError('CalDAV request failed: network error.', 'CALENDAR_NETWORK_ERROR', 502);
+      throw new HandlerError('CalDAV request failed: network error.', 'CALENDAR_NETWORK_ERROR', 502);
     }
     const text = await response.text();
     if (!response.ok) {
-      // Map auth/permission/not-found to operator errors. Never include creds/URL.
+      // Map auth/permission/not-found to handler errors. Never include creds/URL.
       const status = response.status;
       const code = status === 401 || status === 403
         ? 'CALENDAR_AUTH_FAILED'
         : status === 404
           ? 'CALENDAR_NOT_FOUND'
           : 'CALENDAR_REQUEST_FAILED';
-      throw new OperatorError(
+      throw new HandlerError(
         `CalDAV server returned HTTP ${status}.`,
         code,
         status >= 400 && status < 500 ? status : 502,
@@ -472,7 +477,7 @@ export function createCalDavClient(options: CreateCalDavClientOptions): CalDavCl
         const rel = toRelativeHref(entry.href);
         // Derive a stable logical id from the last path segment.
         const segments = rel.split('/').filter((s) => s.length > 0);
-        const logical = segments.length > 0 ? decodeURIComponent(segments[segments.length - 1]) : config.defaultCalendarId;
+        const logical = segments.length > 0 ? decodeURIComponent(segments[segments.length - 1]!) : config.defaultCalendarId;
         if (seen.has(logical)) continue;
         seen.add(logical);
         calendars.push({ calendarId: logical, displayName: entry.displayName ?? logical });
@@ -509,7 +514,7 @@ export function createCalDavClient(options: CreateCalDavClientOptions): CalDavCl
           single = await request(resourceUrl, 'GET', undefined, { Depth: '0' });
         } catch (error) {
           // A 404 maps to "not found"; any other failure propagates.
-          if (error instanceof OperatorError && error.code === 'CALENDAR_NOT_FOUND') {
+          if (error instanceof HandlerError && error.code === 'CALENDAR_NOT_FOUND') {
             return null;
           }
           throw error;
@@ -517,7 +522,7 @@ export function createCalDavClient(options: CreateCalDavClientOptions): CalDavCl
         const parsed = parseICS(single.text);
         if (parsed.length === 0) return null;
         const relHref = toRelativeHref(eventId);
-        return { ...parsed[0], href: relHref, calendarId: id };
+        return { ...parsed[0]!, href: relHref, calendarId: id };
       }
 
       // Strategy 2 — bare UID: ask the server for ONLY the matching resource via
@@ -566,7 +571,7 @@ export function createCalDavClient(options: CreateCalDavClientOptions): CalDavCl
       const id = calendarId && calendarId.length > 0 ? calendarId : config.defaultCalendarId;
       const parsed = parseICS(icsContent);
       if (parsed.length === 0) {
-        throw new OperatorError('No VEVENT components found in .ics content.', 'CALENDAR_EMPTY_ICS', 400);
+        throw new HandlerError('No VEVENT components found in .ics content.', 'CALENDAR_EMPTY_ICS', 400);
       }
       const collectionUrl = collectionUrlFor(id);
       const eventIds: string[] = [];
@@ -582,7 +587,7 @@ export function createCalDavClient(options: CreateCalDavClientOptions): CalDavCl
           eventIds.push(toRelativeHref(joinUrl(collectionPathOrRoot(collectionUrl, config.baseUrl), resourcePath)));
           imported += 1;
         } catch (error) {
-          const message = error instanceof OperatorError ? error.message : error instanceof Error ? error.message : String(error);
+          const message = error instanceof HandlerError ? error.message : summarizeError(error);
           errors.push(`${uid}: ${message}`);
         }
       }
@@ -646,7 +651,7 @@ function parsedToGenerateInput(event: ParsedICalEvent, uid: string): GenerateICa
     description: event.description,
     location: event.location,
     // Re-emit attendees by their raw value so import preserves the original
-    // addressing; display-name-only redaction applies to operator responses,
+    // addressing; display-name-only redaction applies to handler responses,
     // not to server-side payloads.
     attendees: event.attendees.map((a) => a.rawValue),
     organizer: event.organizerRaw,