@pellux/goodvibes-tui 1.0.0 → 1.7.0

package/CHANGELOG.md

@@ -4,138 +4,134 @@ All notable changes to GoodVibes TUI.
 
 ---
 
+## [1.7.0] — 2026-07-04
+
+The evolution release: six batched development cycles (internal 1.2.0–1.6.0, which were never published) land together as one public version. The through-line is a product that reports the truth about itself — reversible edits you can actually undo, a live fleet you can watch and steer, orchestration that runs the plan it showed you, memory that demonstrably enters the turns it claims to, and a panel surface cut down to the consoles that earn their place. Ships against @pellux/goodvibes-sdk 0.38.0.
+
+### Reversibility and checkpoints
+- Workspace checkpoints with `/checkpoints`, `/checkpoint`, and `/rewind`: snapshot the working tree, list snapshots newest-first, and preview-then-restore files from any checkpoint (files only — conversation history is left untouched). Backed by the SDK's `WorkspaceCheckpointManager` and wired through TUI services, with guards so an unguarded checkpoint call can no longer surface as a silent unhandled rejection.
+- Per-hunk accept/reject for multi-edit approval prompts: when one approval covers several hunks you accept or reject each individually, and the decision is honored end-to-end instead of being all-or-nothing.
+- `/test` runs the project test script and shows real pass/fail results, parsing both the SDK runner output and plain `bun test` output (per-test counts and the names of failing tests); the end state persists in the transcript instead of evaporating.
+- Manual `/compact` now hands the compaction subagent the real original task and the full agent roster, so the handoff summary is accurate.
+
+### Fleet observability, session tabs, and steering
+- A live Fleet panel over the real SDK process/agent registry: a process tree with per-node live states, honest cost, id-anchored selection that survives list churn, and capability-gated interrupt/kill actions. It is the fast-access surface below the prompt and the home of `F2`, `Ctrl+O`, and the footer `[Enter]`.
+- Unfocused-user alerts that actually reach you when GoodVibes is in a background terminal: budget breach, agent/chain failure, awaiting-approval, and long-task notices, gated on real terminal-focus tracking (CSI 1004) with an honest "unknown" fallback.
+- Live transcript tabs over the conversation snapshot bridge: attach to a running agent, browse its transcript read-only (with reserved-notice honesty), detach without killing it, and see interrupted vs. killed as distinct states with a frozen elapsed clock.
+- A steering composer with a `queued` / `consumed` / `dropped` badge: send an instruction to a running agent and see honestly whether it was picked up, with TTL and ordering guards, and the consumed signal deferred until the steered turn actually succeeds.
+
+### Workstream orchestration
+- `/workstream` authoring and oversight for multi-phase agent work: phases are insertable structure (float-ordinal ordering), work items flow to free capacity, and each item commits inside its own worktree through the scoped-commit machinery. The authoring view renders the real plan, so the proposal and the launched run can never disagree.
+- Resume-prefix replay with crash-artifact reconciliation: an interrupted workstream re-queues its in-phase items on resume instead of double-running or dropping them.
+- Budgets that refuse rather than kill, with a recovery path, and cooperative cancellation that reaches real child processes.
+- Fleet-tree nesting for workstreams, plus pause/resume support.
+
+### Passive memory and the code index
+- Durable memory demonstrably enters both agent turns and the main-session turn: per-turn retrieval is budgeted (800 tokens by default, floor 95), flag-gated, and inspectable — `/recall injections` shows exactly which records would be injected for a task and why, defaulting to the main-session ring.
+- A repo source-tree code index with honest bounds and labeling: `/codebase build`, `/codebase status`, and `/codebase search`.
+- Compaction quality scoring and a corrected capacity-percentage in the compaction path.
+- The model picker gained an embeddings target, so the memory index's embedding provider is selectable alongside chat models.
+
+### The panel purge and config modals
+- The panel surface was cut from roughly 50 panels to 6 surviving consoles — the Fleet hub plus git, diff, cost, tokens, and local-auth — with 19 configuration and review surfaces re-homed onto a single liveness-enforcing config-modal host. Heavy operator state that used to sprawl across dozens of panels now opens as a focused modal.
+- Every retired panel id resolves honestly: old ids become aliases, modal redirects, or friendly "this moved" notices, so `/panel open <id>` and saved layouts never silently point at nothing.
+- Live panels stay subscribed while open and now repaint while the main thread is idle, so agent, tool, and thinking updates no longer look frozen.
+
+### Keymap and focus honesty
+- The keymap advertises what it actually does: `Ctrl+PageUp` / `Ctrl+PageDown` move between panel tabs (`Ctrl+[` was removed — it is byte `0x1B` and collided with Escape, so it never fired reliably; `Ctrl+]` remains a next-tab chord), `Ctrl+O` and `F2` both open and focus the Fleet panel (the retired Ops Control and process modals fold into it), and `Ctrl+C` honestly advertises the double-press to quit.
+- Focus routing was fixed at the root: multi-character paste is detected per token instead of by a per-feed character-sum heuristic, and keyboard focus transfers only on an explicit request — so typed text no longer leaks into single-letter panel hotkeys.
+
+### Control-plane truth
+- The control plane reports real lifecycle: a `stopping…` state while a process winds down, pause↔resume (including `/schedule` jobs shown in the fleet tree), zombie reaping, and a dirty-residue commit guard so an interrupted scoped commit cannot leave stray changes behind.
+
+### New commands
+- `/search <query> [--limit <n>]` — search the web and render ranked results with source labels.
+- `/imagine <prompt>` — generate an image from a prompt (distinct from `/image`, which attaches an existing image file; the two names collided and the generator was renamed).
+- `/workstream` — author and oversee multi-phase agent workstreams.
+- `/checkpoints`, `/checkpoint`, `/rewind` — workspace checkpoint list / create / restore.
+- `/codebase` — build, inspect, and search the repo source-tree code index.
+- `/test` — run the project test script and show pass/fail.
+- `/recall injections` — inspect the memory records that would be injected for a task.
+
+### Notable fixes
+- Clearing a feature-flag override back to default now removes it from disk instead of persisting a redundant entry.
+- The `paused` process state renders with its own glyph and tone in the fleet tree.
+- Planning: dismissing a planning action no longer corrupts the project goal; the `sessions` front door opens the session picker; `/panel open` reports redirects and deleted ids honestly.
+- `Escape` cancel-first precedence and live git-init header refresh, so a directory becomes a recognized repo without a restart.
+
+### Internal
+- SDK dependency 0.36.0 → 0.38.0 (through 0.37.0 / 0.37.1 / 0.37.2); foundation artifacts regenerated against the released SDK.
+- A release-blocking gate requires the SDK pin, the lockfile resolution, and the installed package to all agree, plus a source-import sweep that fails on any non-npm SDK import — so the local-SDK development overlay can never ship.
+- Test suite at 639 files green; coverage, performance, architecture, and eval-regression gates enforced on every cycle. Each wave was verified with the full gate block, a three-lens adversarial review, and a live tmux replay of its pillar scenarios.
+
+## [1.1.0] — 2026-07-03
+
+Wave 0 of the post-1.0 evolution effort: trust repairs. Every change closes a defect found by live dogfooding v1.0.0 where the product reported something other than the truth. Ships against @pellux/goodvibes-sdk 0.36.0 (same effort, SDK side).
+
+### Fixed
+- Failing commands are visible again: the SDK masked every command-level failure as "Error: Unknown error", so a red test suite was literally invisible to the model — it would honestly conclude "no failure observed" while your tests were failing. Exit code, stdout, and stderr now reach the model byte-faithfully, and long-output truncation keeps the tail (where test runners print failures) instead of the head. Verified live: the model reads a sabotaged test's actual assertion diff and fixes the right side.
+- Agent auto-commits are scoped: a WRFC chain used to `git add --all`, sweeping your unrelated dirty files into its commit with a truncated message. Commits now include only chain-touched files, with full accurate messages, under a new policy config (`off | scoped | all`, default scoped). Verified live with bait files.
+- Agent chains can no longer die silently: transport failures surface a reasoned failure state in the transcript and status strip, with one bounded automatic retry.
+- Panels work during turns: Ctrl+P / F2 / the status-strip Enter were dead exactly while agents ran — the Inspector was unreachable whenever there was something to inspect. Verified live mid-chain.
+- Panels no longer eat typed text: multi-character input routes to the composer instead of being silently consumed as single-letter panel hotkeys, and a visible focus indicator shows where keys go.
+- Streaming honesty: a stalled provider stream now shows a real stall/reconnect indicator (with attempt counts via the SDK's new STREAM_RETRY event) instead of cycling whimsical labels over dead air — and the indicator correctly stays quiet while a tool is executing.
+- Slash routing is deterministic: `/command` in an empty composer is always a command, never sent to the model as chat (previously state-dependent after overlay use, burning tokens on junk turns).
+- Per-agent stats are real: the Inspector showed Tools 0 / Tokens 0 / Cost $0.00 for agents that wrote hundreds of lines; agents (including WRFC owners, which aggregate their whole chain) now report true token/tool counts, and footer counters survive session resume.
+- Cost is honest: models missing from the old hardcoded ~16-model price table silently showed $0.00 everywhere; pricing now resolves through the SDK catalog with an explicit "unpriced" marker when unknown.
+- Indicator truth: the footer no longer shows `hitl:balanced` alongside DANGER MODE; the effective permission posture wins.
+- Renderer truth: subprocess stderr can no longer leak raw into the transcript and garble cells (`/diff` in a non-git dir now prints one honest sentence, not a fake diff); git repos are re-detected live after `git init` without a restart; cancelled-turn echo no longer mangles its first character.
+
+### Added
+- Auto-resume offer at startup when a previous session exists.
+- `/sessions` groups subagent sessions instead of burying your real session under them.
+- `.goodvibes/` transient state is auto-gitignored in project directories.
+- Wider, persistent Ctrl+C exit-confirmation notice.
+
+### Internal
+- SDK dependency 0.35.0 → 0.36.0; foundation artifacts regenerated (new event contract entries).
+- Local-SDK overlay dev tooling (`scripts/sdk-dev.ts link|status|restore`) with release-blocking gates in release.ts and publish-check so a local SDK can never ship.
+- Wave verified three ways: full gate block, a 3-lens adversarial code review, and a live tmux scenario replay of the five previously-failing dogfood scenarios (all PASS).
+
 ## [1.0.0] — 2026-07-03
 
-### Changes
-- d26fc23f ci: drop temporary renderer-excellence branch trigger after merge
-- 532c900b integrate renderer-excellence: renderer performance and correctness effort (v1.0.0 scope)
-- cdf5931d fix(input): normalize CR line endings from bracketed pastes
-- 1318959f chore(perf): re-capture baseline reference medians on a quiet box
-- 946a2c83 integrate WO-210 into renderer-excellence
-- 209ade5f perf(budgets): ratchet transcript.append_one 20ms->6ms; streaming tail proven non-material (WO-210)
-- c7e445c2 integrate WO-209 into renderer-excellence
-- df4d8d03 integrate WO-208 into renderer-excellence
-- f5476715 perf(conversation): per-message Line[] cache — append-one 45ms→0.9ms (WO-209)
-- 76539cd8 perf(renderer): WO-208 coalesce main.ts render() fan-out into one same-tick composite
-- 204342c4 refactor(renderer): delete the six dead exports parked during the R2 literal-ownership split
-- 9c1dbdae integrate WO-207 into renderer-excellence
-- ae660b2a integrate WO-206 into renderer-excellence
-- 6acd74f6 integrate WO-205 into renderer-excellence
-- c6eb004c feat(architecture): WO-206 no-unused-exports rule for src/renderer
-- 8997719b feat(renderer): WO-207 — palette unification across the renderer layer
-- 3ec18bb1 refactor(renderer): WO-205 dedup + dead code + honest picker
-- 43eb8165 ci: run full CI on renderer-excellence pushes for the v1.0.0 effort
-- 6e483f55 fix(renderer): diff panel keeps its shipped colors — the panels are the reference, not diff-view
-- 50755108 integrate WO-204 into renderer-excellence
-- 17425f6a integrate WO-203 into renderer-excellence
-- 68bc13c3 fix(renderer): WO-203 verified correctness fixes
-- 721f4d91 feat(renderer): WO-204 — restore conversation diff rendering, align diff surface colors
-- c5aff410 integrate WO-202 into renderer-excellence
-- 0f03a124 integrate WO-201 into renderer-excellence
-- e5ba2978 test(renderer): WO-201 golden contract expansion — splash, transcript scenes, all overlays
-- 210d5814 perf(scripts): WO-202 line-production benchmarks above the compositor
-- bf6459af fix(tests): skills delete test polls the rescanned state, not just file removal
+The renderer milestone: the full rendering pipeline measured, cached, gated, and visually pinned — plus a fix for a long-shipped multi-line paste defect. 1.0.0 marks the stability posture promised since early development: semver, with incompatible changes landing only in major releases.
+
+### Features
+- Restored conversation diff rendering: expanded diff-shaped tool results render with green add / red delete / blue hunk-header gutters through the same color tokens as the diff panel and the git panel's inline diff, so diffs look identical on every surface. This path had been unwired since v0.9.6; the new no-unused-exports gate exists so nothing goes silently dead again.
+- Unified the renderer palette onto the `UI_TONES` token set — byte-identical color swaps; genuinely distinct palettes (agent-detail neon theme, code-block VS-Code-Dark+ fallback) are preserved exactly as named accents.
+- Long-conversation append performance: a per-message line cache renders only the new message on append (~0.9ms median) instead of rebuilding the whole transcript (~45.5ms and ~71MB of throwaway allocations at 1,000 messages).
+- Render coalescing: same-tick render requests collapse into one composite — streaming bursts previously triggered up to 7 redundant composites per tick.
+- Honest profile picker: dropped the hardcoded fake "Settings" column that showed identical text for every profile; adopted proportional column widths.
+
+### Fixes
+- Multi-line paste works: terminals transmit the line breaks inside a bracketed paste as carriage returns, which the composer inserted verbatim — the input box never grew, ghost text overwrote the prompt marker, and edits acted on an invisible layout. Line endings are now normalized at the paste boundary, and history entries persisted before the fix are laundered on load. (A shipped defect since bracketed paste landed, not a regression from this effort.)
+- Seven rendering-correctness fixes at narrow/short terminal sizes: real viewport height in the agent-detail modal, overlay width clamped ahead of its 20/24-column floors, consistent compact-footer height math, and wide-glyph (CJK/fullwidth) boundary fixes — each landed with a test that failed before the fix.
+
+### Internal
+- Golden-frame harness expanded to 35 committed byte-exact reference frames: the splash at 60/100/140 columns, transcript scenes (plain and diff tool results collapsed/expanded, code blocks on both tokenizer paths, thinking blocks, streaming partials), and every overlay at normal and hostile sizes. Splash goldens render with a pinned version fixture so release version bumps can never break them (the first v1.0.0 validate run failed on exactly that).
+- Performance baseline harness with enforced CI budgets (`scripts/perf-baseline.json`, `perf:check`): startup load, frame-composite p95/p99, and line-production budgets for transcript build/append/resize, panel build, markdown, code blocks, and overlay open. `transcript.append_one` ratcheted 20ms → 6ms.
+- No-unused-exports architecture gate for the renderer layer; three dead renderer modules deleted (`progress.ts`, `file-tree.ts`, `status-token.ts`).
+- Splash art and its wide/narrow glyph typography byte-identical throughout — enforced by an empty-diff check every wave plus the splash goldens.
 
 ## [0.29.0] — 2026-07-03
 
-### Changes
-- 2842a791 perf(ci): parallelize the per-file test runner; raise the test job timeout
-- 218bb217 merge: panel-system remediation — 38 work orders, consoles not signposts (0.29.0)
-- a37c028e fix(input): WO-160 smoke findings — overlay write-back clobber, /ops view parity, panel-list honesty, modal viewport
-- 5741f633 fix(tests): isolate GitPanel non-repo test from the runner's in-tree TMPDIR
-- 6eaea7c4 fix(panels): WO-160 consistency sweep — alias tests, action-substitute signposts
-- 42164e34 fix(panels): cockpit c/i leave the key unconsumed on terminal or absent roster entries
-- 10247db1 feat(input): make Ctrl+O a real keybind for the Ops Control panel
-- ac598536 refactor(panels): route selected-row reads through getSelectedItem and ban raw [this.selectedIndex]
-- 34bac3f0 chore(panels): tighten hex-literal baseline to exact actual counts
-- 3d2caf90 integrate WO-153 into panel-ux-remediation
-- 1f0ed5ca integrate WO-152 into panel-ux-remediation
-- 8b6fbce6 integrate WO-151 into panel-ux-remediation
-- ce0b7cb8 fix(panels): closure-audit findings — incident/settings-sync filtered desyncs, subscription start signposts
-- ba7db35e feat(panels): WO-152 registry taxonomy, icons, always-register, lifecycle flags
-- 7cbdd4ec feat(panels): WO-153 filter-model convergence onto ScrollableListPanel
-- 40cb9153 feat(panels): WO-151 keybindings, help discoverability, one hint grammar
-- 782e7752 fix(panels): services test/detail act on the filtered selection
-- e8783a89 integrate WO-154 into panel-ux-remediation
-- cdb399b9 integrate WO-140 into panel-ux-remediation
-- 943089ea integrate WO-139 into panel-ux-remediation
-- d527c223 integrate WO-141 into panel-ux-remediation
-- a65ee307 integrate WO-150 into panel-ux-remediation
-- a73e874b feat(panels): WO-140 planning cluster polish (wrfc/project-planning/work-plan)
-- e1921ab8 feat(panels): WO-141 keep-panel hardening + residual signpost sweep
-- 8b018746 feat(panels): WO-139 provider-cost leftovers — subscription/local-auth/cost-tracker
-- da7b9550 feat(panels): WO-150 unify focus ownership in PanelManager
-- 4c569ae8 feat(shell): WO-154 main-UX shell splash, footer cost/compact, overlay posture
-- 7218349c fix(panels): wave 3a review findings — filtered-selection desyncs, residual signposts, dead constants
-- 1cc9f195 integrate WO-138 into panel-ux-remediation
-- 179a9a91 integrate WO-137 into panel-ux-remediation
-- 4df3036e integrate WO-136 into panel-ux-remediation
-- 20533671 integrate WO-135 into panel-ux-remediation
-- 2f116f82 integrate WO-134 into panel-ux-remediation
-- 595df267 integrate WO-133 into panel-ux-remediation
-- 490dc881 feat(panels): WO-137 diagnostics trio — security, debug, system-messages
-- 066fd91a feat(panels): WO-138 session-comm quad real actions (remote/communication/routes/qr)
-- a9a1ebe0 feat(panels): WO-134 Plugins + Hooks control rooms
-- e4380896 feat(panels): WO-136 Docs + Intelligence live actions
-- 8f6a3f45 feat(panels): WO-133 explorer + preview lazy loading, git decorations, diff/reload keys
-- 744dc460 feat(panels): WO-135 marketplace + skills real actions
-- a04c86e9 fix(panels): reserve summary row inside stacked scrollable section budgets
-- b2a43d9b fix(panels): reserve a row for the window-summary inside the scrollable budget
-- acb3e3b5 fix(panels): bind w to dispatch teamwork review from Tasks; stop git panel swallowing i on loaded repos
-- 4bc04330 integrate WO-130 into panel-ux-remediation
-- e15c010b integrate WO-128 into panel-ux-remediation
-- 3020d2e1 integrate WO-127 into panel-ux-remediation
-- 1a0c0d76 integrate WO-132 into panel-ux-remediation
-- 79ac40bd integrate WO-131 into panel-ux-remediation
-- 61092aa0 integrate WO-126 into panel-ux-remediation
-- f83d6820 feat(panels): WO-131 agent-runtime trio — tools + tasks + orchestration
-- 8dafc5c0 feat(panels): WO-132 Git + Diff consoles — stage/unstage/commit, explicit init confirm, self-loading diff panel
-- 24c5127e feat(panels): WO-128 plan dashboard revival
-- 2c8e8d1f feat(panels): WO-126 symbol outline on tree-sitter
-- 2d424e1c feat(panels): WO-130 Cockpit operator polish
-- 66c0deeb feat(panels): WO-127 eval console — baseline seed, live run, regressions
-- 1a53ef2c fix(panels): drop redundant slash-command guidance from knowledge review mode
-- 16ba104d fix(tests): operator-surfaces gate verifies forensics alias resolves to incident
-- a5b8f4e9 integrate FOLLOWUPS into panel-ux-remediation
-- f60988eb integrate WO-125 into panel-ux-remediation
-- 39996bfd integrate WO-124 into panel-ux-remediation
-- 78fb4916 integrate WO-123 into panel-ux-remediation
-- e5294103 integrate WO-122 into panel-ux-remediation
-- 371f4d60 integrate WO-121 into panel-ux-remediation
-- 1ff1e0ae integrate WO-120 into panel-ux-remediation
-- 933b09a3 feat(panels): WO-120 register ops-control panel and wire operator actions
-- 39bfc1a1 feat(panels): WO-125 wire worktree and sandbox lifecycle verbs to their registries
-- 4992fd03 feat(panels): WO-121 control-plane approvals console
-- ea1c47b0 feat(panels): WO-123 knowledge console replaces static command catalogue
-- 91273a60 feat(panels): WO-124 settings-sync console — resolve conflicts in-panel, Tab browse modes
-- 74f5d39d feat(panels): WO-122 policy governance console actions and depth
-- f4679a7e fix(panels): broaden hex-literal ratchet to 3/6/8-digit forms, clear remaining raw hex in fullscreen-primitives and diff-panel
-- 6e1b814c fix(panels): forensics resolves as alias to incident, not duplicate registration
-- 6a0f4405 fix(tests): operator-surfaces gate asserts merged provider-health id instead of retired providers id
-- 09d81371 fix(tests): retarget legacy-turn-bus ban from deleted context-visualizer-panel to its WO-113 successor token-budget-panel
-- e835a821 integrate WO-114 into panel-ux-remediation
-- 433b4c25 integrate WO-113 into panel-ux-remediation
-- 70466337 integrate WO-112 into panel-ux-remediation
-- a1ebf5da fix(tests): contract module count 30 after WO-110+WO-111 both deleted a module
-- fd25fb19 integrate WO-111 into panel-ux-remediation
-- 0d72a2ef integrate WO-110 into panel-ux-remediation
-- 0a344b60 WO-112: Provider console merge: providers + accounts into provider-health
-- d4c7c8b4 WO-111: Automation console merge: schedule + watchers into automation
-- 1fc22d27 WO-110: Agent console merge: agent-logs into inspector
-- 0d4858ff WO-114: Incident console merge: forensics into incident
-- a4cdfb3c WO-113: Context/token merge: context into tokens
-- fd8e84ef integrate WO-002 into panel-ux-remediation
-- 1a85ece3 WO-002: Panel palette and chrome sweep (extendPalette everywhere)
-- 1cd556da integrate WO-006 into panel-ux-remediation
-- d6effd51 integrate WO-005 into panel-ux-remediation
-- d7735d20 integrate WO-004 into panel-ux-remediation
-- 9b1de69a integrate WO-003 into panel-ux-remediation
-- e149323f integrate WO-001 into panel-ux-remediation
-- 45e90fa7 WO-006: Shared-test decongestion: per-panel spec modules
-- 2d7d5777 WO-001: Theme-token backbone + architecture-gate hex enforcement
-- 207cd46b WO-003: Action-callback plumbing pattern + ConfirmState generalization
-- abf6771b WO-005: session-maintenance evaluator dedup
-- 4fe16129 WO-004: Dead code and dead keybinding removal
+The panel remediation release: a 27-finding audit closed across 38 work orders — panels became working consoles instead of slash-command signposts.
+
+### Features
+- Panels perform their actions directly: ops task/agent interventions, approval resolution, policy simulate/preflight/promote/rollback, knowledge review, settings-sync conflict resolution, worktree/sandbox lifecycle, and git operations run from the panel — keyed, with confirm gates on destructive actions — instead of printing "run /some-command".
+- `Ctrl+O` opens the Ops Control panel as a real, rebindable keybinding.
+- Five panel merges with the old ids preserved as aliases: agent-logs→inspector, context→tokens, providers+accounts→provider-health, forensics→incident.
+
+### Fixes
+- `/shortcuts` and `/commands` overlays actually display: the token-feed pipeline was reverting overlay flags that command handlers set mid-feed, so both commands silently did nothing. Fixed with change-detecting write-back plus a regression test.
+- Every Alt-modifier keybinding works again after a tokenizer/matcher mismatch left them all dead at runtime (Alt+B/Alt+F word navigation, Alt+D and Alt+Y kill-ring bindings).
+- A stale-selection bug class across the Marketplace, Services, Incident, and Settings-sync panels: after filtering, an action could silently apply to the wrong row. Fixed via a shared `getSelectedItem()` accessor plus an architecture rule banning raw selected-index access.
+- Panel focus ownership centralized in PanelManager with a self-healing invariant, replacing scattered per-panel focus bookkeeping.
+
+### Internal
+- Parallel per-file test runner (`scripts/run-tests.ts`): min(8, cores−1) workers with isolated TMPDIRs — the suite dropped from ~10.5 minutes to under 2 locally; the CI test-job cap raised to 20 minutes as a hang backstop.
+- New architecture gates: a raw-hex-literal ratchet (424 → 262 literals, exact per-file baseline), the selected-index rule, registry-time icon uniqueness, panel contract-module parity, an 800-line source-file cap, and a focus-invariant test.
+- +278 tests across the remediation.
 
 ## [0.28.0] — 2026-06-30
 
@@ -185,6 +181,13 @@ Full deep-review audit of the TUI (33 findings fixed, each reviewed to a score o
 - 97f74119 chore: upgrade @pellux/goodvibes-sdk to 0.34.0
 - 6de2627a revert: remove daemon control-plane buildout — duplicated @pellux/goodvibes-sdk 0.34.0
 
+## [0.25.0] — 2026-06-21
+
+### Changes
+- 5353a7d9 chore: release v0.25.0
+- a8a4cd4f fix(daemon/remote): make runProcess timeout resolve promptly under orphaned children
+- c00461be feat(daemon): implement control-plane operator surfaces for channels, email, calendar, and remote execution
+
 ## [0.24.1] — 2026-06-17
 
 ### Changes

package/README.md

@@ -2,11 +2,11 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-1.0.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
+[![Version](https://img.shields.io/badge/version-1.7.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
 
 A terminal-native AI coding, operations, automation, knowledge, and integration console with a typed runtime, omnichannel surfaces, structured memory/knowledge, and a raw ANSI renderer.
 
-> ⚠️ **Active early development — pre-1.0.** This project is under active early development. CLI flags, config keys, slash commands, key bindings, daemon routes, and on-disk layouts can and do change quickly — sometimes across patch releases. There are no legacy/compat shims. Documentation always describes the **current** behavior, not historical behavior. When 1.0.0 ships the project freezes to enterprise-grade stability guarantees (semver, deprecation windows, migration guides). Until then: pin exact versions and read `CHANGELOG.md` before upgrading.
+> **1.0.0 shipped 2026-07-03.** From 1.0.0 the project follows the stability posture promised for this milestone: semver, with incompatible changes to CLI flags, config keys, slash commands, key bindings, daemon routes, and on-disk layouts landing only in major releases, and deprecations noted in `CHANGELOG.md` first. Documentation always describes the **current** behavior, not historical behavior.
 
 <!-- screenshot -->
 
@@ -146,6 +146,7 @@ The TUI now consumes the extracted `@pellux/goodvibes-sdk` (`0.34.0`) platform l
 - Shared panel workspace layout budgeting with renderer-owned visible-row budgets
 - Copy/selection logic that strips decorative gutters and visual scaffolding from clipboard output
 - Line-count indicator rendered right-aligned inside the prompt border on multi-line input (footer height stays stable regardless of prompt line count)
+- Multi-line clipboard paste handled at the input boundary: bracketed-paste carriage-return line separators are normalized to newlines, the composer grows to the pasted line count, and pastes longer than 8 lines collapse to a compact paste marker
 
 ### Conversation And Transcript Workflow
 - Markdown rendering, syntax highlighting, inline diffs, collapsible blocks, bookmarks, block copy, and block save
@@ -156,12 +157,12 @@ The TUI now consumes the extracted `@pellux/goodvibes-sdk` (`0.34.0`) platform l
 
 ### Panels, Control Rooms, And Workspaces
 - Split-pane panel system with panel picker, layout control, and keyboard-first focus behavior
-- Dedicated control rooms for provider accounts, provider health, local auth, settings sync, remote, MCP, marketplace, orchestration, tasks, intelligence, worktrees, approvals, forensics, security, policy, cockpit, system messages, and more
-- Summary-first heavy panels with posture, issues, next actions, and detail regions
-- Routed system-message workspace for startup discovery and operational notices
+- Six persistent consoles — the Fleet hub plus git, diff, cost, tokens, and local-auth — with heavier operator surfaces (providers, remote, MCP, marketplace, orchestration, tasks, intelligence, worktrees, approvals, policy, security, settings sync, and more) re-homed as configuration/review modals on a single liveness-enforcing config-modal host
+- Retired panel ids resolve honestly through aliases, modal redirects, and "this moved" notices, so `/panel open <id>` and saved layouts never point at nothing
+- Summary-first heavy surfaces with posture, issues, next actions, and detail regions
 - Cross-panel actions between Explorer, Preview, and Symbols so file browsing can open previews and jump to symbol locations directly from panel focus
-- Live panels stay subscribed while open, so agent, tool, and thinking updates continue while the panel is visible
-- Dedicated `Agents` panel provides a view-only live peek into running agent sessions while the background-process strip remains the fast-access surface below the prompt
+- Live panels stay subscribed while open and repaint while the main thread is idle, so agent, tool, and thinking updates never look frozen
+- The Fleet panel is the live control room for running agents, workstreams, and scheduled jobs — attach/detach (detach never kills), steer, pause/resume, and capability-gated interrupt/kill — reached by `F2`, `Ctrl+O`, or the footer `[Enter]`
 
 ### Modal And Selection UX
 - Modal stack navigation that unwinds correctly back to the slash-command menu and prior nested modals
@@ -586,7 +587,7 @@ Changing `service.autostart` or `service.enabled` from `/config` reconciles the
 
 GoodVibes is built around routing runtime state to the right surface.
 
-The current product ships dedicated workspaces for:
+The Fleet panel is the one persistent operator control room; most other operator surfaces now open as configuration and review modals on a shared, liveness-enforcing config-modal host rather than as standing panels. The product surfaces state for:
 
 - provider accounts and provider health
 - local auth and local service posture
@@ -1264,6 +1265,9 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/session [action]` | `/sess` | Full session management: list, rename, resume, fork, save, info, export, search, delete |
 | `/undo [file]` | `/u` | Remove last turn, or `/undo file` to revert last file write/edit |
 | `/redo [file]` | — | Restore last undone turn, or `/redo file` to re-apply last reverted file |
+| `/checkpoints` | — | List workspace checkpoints, newest first |
+| `/checkpoint [label]` | — | Create a manual workspace checkpoint (forensic retention) |
+| `/rewind [id]` | — | Preview and restore a workspace checkpoint (files only — conversation history is unchanged) |
 | `/retry [text]` | `/r` | Re-send the last user message |
 | `/template` | `/tmpl` | Manage prompt templates: save, use, list, edit, delete |
 | `/tools` | `/t` | List available tools |
@@ -1274,8 +1278,9 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/memory [action]` | — | Session memory management: `list`, `add <text>`, `remove <id>` |
 | `/keep <text>` | — | Pin text to session memory; survives context compaction |
 | `/memory-sync [action]` | `/memsync` | Durable memory export/import and bundle exchange: `export <path> [scope]`, `import <path>` |
-| `/recall [action]` | `/rc` | Durable knowledge and memory substrate: capture, review, explain, export, import, and handoff |
+| `/recall [action]` | `/rc` | Durable knowledge and memory substrate: capture, review, explain, inspect `injections`, export, import, and handoff |
 | `/knowledge [action]` | `/know`, `/kb` | Structured knowledge graph: ingest URLs/bookmarks, inspect issues, build packets, and run consolidation jobs |
+| `/codebase [action]` | — | Repo source-tree code index: `build`, `status`, and `search` |
 | `/context` | `/ctx` | Inspect context window usage (token breakdown per message) |
 | `/next-error` | `/ne` | Jump to the next error message in the conversation |
 | `/prev-error` | `/pe` | Jump to the previous error message in the conversation |
@@ -1286,6 +1291,7 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/scan` | — | Scan for local LLM servers |
 | `/plan [goal]` | — | Inspect or seed TUI-owned project planning state; `panel`, `approve`, `list`, and `show <id>` are supported |
 | `/work-plan [action]` | `/wp`, `/todo`, `/workplan` | Open or update the persistent workspace work-plan checklist |
+| `/workstream [action]` | — | Author and oversee multi-phase agent workstreams (orchestration engine) |
 | `/panel [action]` | `/panels` | Panel management: open, close, list, toggle, move, focus, split, width, height |
 | `/plugin [action]` | — | Manage plugins (enable/disable/reload/list) |
 | `/marketplace [action]` | — | Browse curated plugin, skill, hook-pack, and policy-pack surfaces |
@@ -1296,6 +1302,7 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/wrfc` | — | Show WRFC chain status, constraint satisfaction counts, and per-constraint `[SAT]`/`[UNS]`/`[UNV]` breakdown |
 | `/health [action]` | — | Unified runtime health review and repair entry point |
 | `/guidance [action]` | — | Contextual operational guidance without cluttering the conversation |
+| `/test [pattern]` | — | Run the project test script and show pass/fail results |
 | `/remote [action]` | — | Distributed peer, node-host contract, work-queue, and artifact control room |
 | `/sandbox [action]` | — | Isolation presets, doctor/probe, sessions, and QEMU setup flows |
 | `/setup [action]` | — | First-run readiness, services, sandbox, transfer bundles, and deep links |
@@ -1309,6 +1316,8 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/keybindings` | `/kb` | List current keyboard bindings and their config file path |
 | `/schedule [action]` | `/sched` | Manage scheduled agent tasks (cron): add, list, remove, enable, disable, run |
 | `/image <path>` | `/img` | Attach an image file to the next message |
+| `/imagine <prompt>` | — | Generate an image from a prompt |
+| `/search <query>` | — | Search the web and render ranked results with source labels (`--limit <n>`) |
 | `/paste` | `/clip` | Pull supported text or image data directly from the system clipboard into the prompt |
 | `/refresh-models` | — | Refresh model catalog, benchmarks, and token limits |
 | `/notify [action]` | `/ntf` | Manage webhook notifications (ntfy.sh): add, remove, list, clear, test |
@@ -1318,7 +1327,8 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/diff [target]` | `/d` | Show unified diff: session, head, working, staged, or a git ref |
 | `/mcp [add\|remove\|reload\|tools]` | — | Manage MCP servers at runtime and list connected tools |
 | `/help [command]` | `/h`, `/?` | Show available commands and keyboard shortcuts |
-| `/quit` | `/q`, `/:q` | Exit the application |
+| `/quit` | `/:q` | Exit the application |
+| `/wq` | `/:wq` | Commit all git changes, then exit |
 
 > **Tip:** Use the `/add-provider` skill for interactive guided provider setup with smart defaults for popular providers.
 >
@@ -1386,9 +1396,14 @@ All shortcuts are customizable via `~/.goodvibes/tui/keybindings.json`. Use `/ke
 | Key | Action |
 |-----|--------|
 | `Ctrl+P` | Toggle panel sidebar |
-| `Ctrl+}` | Next panel tab |
-| `Ctrl+~` | Previous panel tab |
-| `,` / `.` | Cycle panel tabs (when panel focused) |
+| `F2` | Open and focus the Fleet panel |
+| `Ctrl+]` / `Ctrl+PageDown` | Next panel tab |
+| `Ctrl+PageUp` | Previous panel tab |
+| `Alt+1`…`Alt+9` | Jump to panel tab 1–9 |
+| `Ctrl+X` | Close the focused panel |
+| `Ctrl+Shift+X` | Close all panels |
+| `Ctrl+O` | Open and focus the Fleet panel (formerly Ops Control) |
+| `Ctrl+G` | Toggle focus between split panes |
 
 ### System
 
@@ -1652,6 +1667,9 @@ src/
 - **Backend-first external surface** — the daemon/control plane exposes typed HTTP/gateway methods for knowledge, artifacts, media, search, channels, and remote peers so future clients do not have to reimplement runtime logic
 - **Plugin system** — manifest.json + sandboxed API surface for commands, providers, tools, gateway methods, channels, embeddings, voice, media, and search
 - **Crash recovery** — periodic JSONL snapshots with recovery prompt on next startup; an fsync-per-record append-only transcript journal between snapshots is replayed at every resume seam (command resume, Ctrl+R crash recovery, panel resume) for SIGKILL-proof durability
+- **Golden-frame regression harness** — 35 committed byte-exact reference frames (including the splash at three widths) pin the renderer's output; any unintended visual change fails CI
+- **Render coalescing** — same-tick render requests collapse into one composite via `src/runtime/render-scheduler.ts`, so a streaming burst pays for one frame instead of several
+- **Per-message line cache** — `src/core/conversation-line-cache.ts` renders only the appended message on transcript growth (~0.9ms) instead of rebuilding the whole conversation (~45ms at 1,000 messages)
 
 ---
 
@@ -1669,7 +1687,7 @@ bun run dev
 bun test
 ```
 
-8,978 tests across contract, security, release gate, runtime, renderer, panel, integration, and UX anti-regression suites. Performance budget gate runs as part of CI — the build fails if any of the 5 perf budgets (store update latency, event dispatch latency, tool execution overhead, compaction duration, startup time) are exceeded.
+The suite spans 623 test files (contract, security, release gate, runtime, renderer, panel, integration, and UX anti-regression), run through a parallel per-file runner (`scripts/run-tests.ts`). Performance budgets run as a CI gate — the build fails if startup load, frame-composite p95/p99, or any line-production budget (transcript build/append/resize, panel two-pane build, markdown render, code-block render on both tokenizer paths, overlay open) exceeds the ratcheted values in `scripts/perf-baseline.json`. Architecture gates run alongside: import-cycle and layer rules, an 800-line cap on non-test source files, a raw-hex-literal ratchet, icon-uniqueness and panel contract-parity checks, and a no-unused-exports rule for the renderer layer (`scripts/check-architecture.ts`, `scripts/no-unused-exports-rule.ts`).
 
 ### Build standalone binary
 

package/docs/foundation-artifacts/operator-contract.json

@@ -3,7 +3,7 @@
   "product": {
     "id": "goodvibes",
     "surface": "operator",
-    "version": "0.35.0"
+    "version": "0.38.0"
   },
   "auth": {
     "modes": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "1.0.0",
+  "version": "1.7.0",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
@@ -99,7 +99,7 @@
     "@anthropic-ai/vertex-sdk": "^0.16.0",
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
-    "@pellux/goodvibes-sdk": "0.35.0",
+    "@pellux/goodvibes-sdk": "0.38.0",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",

package/src/cli/ensure-goodvibes-gitignore.ts

@@ -0,0 +1,32 @@
+import { existsSync, readFileSync, appendFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+/**
+ * The TUI's own `.goodvibes/` directory (logs, overflow buffers, exec output,
+ * cache, session state, etc.) is transient scratch space, not project source —
+ * but nothing else in the codebase excludes it from the *project's* git
+ * history. Any `git add -A` (write-quit's auto-commit, a WRFC chain's own
+ * commit, etc.) sweeps the whole tree in unless the project's .gitignore
+ * already happens to exclude it. Idempotent and append-only: never rewrites
+ * or reorders a project's existing .gitignore, only adds the rule if it is
+ * verifiably absent, and never touches a directory that isn't a git repo.
+ */
+const GOODVIBES_IGNORE_PATTERN = /(^|\n)[ \t]*\/?\.goodvibes\/?\*?[ \t]*(\n|$)/;
+
+export function ensureGoodvibesGitignore(projectRoot: string): void {
+  try {
+    if (!existsSync(join(projectRoot, '.git'))) return; // only matters for git projects
+    const gitignorePath = join(projectRoot, '.gitignore');
+    const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, 'utf-8') : '';
+    if (GOODVIBES_IGNORE_PATTERN.test(existing)) return; // already excluded
+    const rule = '# goodvibes-tui transient state\n.goodvibes/\n';
+    if (existing.length === 0) {
+      writeFileSync(gitignorePath, rule);
+      return;
+    }
+    const separator = existing.endsWith('\n') ? '\n' : '\n\n';
+    appendFileSync(gitignorePath, separator + rule);
+  } catch {
+    // Best-effort only — never block startup on a gitignore write failure.
+  }
+}

package/src/cli/entrypoint.ts

@@ -22,6 +22,7 @@ import {
   renderOnboardingCliStatus,
 } from './index.ts';
 import { buildCliServicePosture } from './service-posture.ts';
+import { ensureGoodvibesGitignore } from './ensure-goodvibes-gitignore.ts';
 
 type ShellEntrypointOwnership = {
   readonly workingDirectory: string;
@@ -95,6 +96,7 @@ export async function prepareShellCliRuntime(
     homeDirectory: bootstrapHomeDirectory,
   } = resolveShellEntrypointOwnership(roots, cli.flags.workingDir ?? (cli.command === 'tui' ? cli.commandArgs[0] : undefined));
   configureActivityLogger(join(bootstrapWorkingDir, '.goodvibes', 'logs'));
+  ensureGoodvibesGitignore(bootstrapWorkingDir);
   const configManager = new ConfigManager({
     workingDir: bootstrapWorkingDir,
     homeDir: bootstrapHomeDirectory,

package/src/core/alert-gating.ts

@@ -0,0 +1,67 @@
+/**
+ * alert-gating — shared config + focus gating logic for the unfocused-user
+ * alert classes (budget-breach, long-task, agent/chain failure,
+ * awaiting-approval). Each alert class has its own on/off config key
+ * (default true); a single master key, `behavior.notifyOnlyWhenUnfocused`
+ * (default true), decides whether any of them additionally require the
+ * terminal to be unfocused-or-unknown before firing.
+ *
+ * Extracted so every alert-class module (long-task-notifier.ts,
+ * budget-breach-notifier.ts, approval-alert.ts, and the agent/chain-failure
+ * wiring in turn-event-wiring.ts) shares one implementation of "should this
+ * fire right now" instead of re-deriving the same two config reads and the
+ * same focus check.
+ */
+import type { FocusTracker } from './focus-tracker.ts';
+
+/** Minimal config-read surface every gating check needs. */
+export type ConfigGet = (key: string) => unknown;
+
+/** Read a TUI-local synthetic boolean setting, defaulting when absent/invalid. */
+export function readBooleanConfig(configGet: ConfigGet, key: string, defaultValue: boolean): boolean {
+  const raw = configGet(key);
+  if (typeof raw === 'boolean') return raw;
+  if (raw === undefined || raw === null) return defaultValue;
+  // Tolerate string/number forms the same way the rest of the config layer does
+  // (settings-modal writes real booleans, but env/file edits may not).
+  if (raw === 'true' || raw === 1) return true;
+  if (raw === 'false' || raw === 0) return false;
+  return defaultValue;
+}
+
+/** `behavior.notifyOnlyWhenUnfocused` — master gate, default on. */
+export function readNotifyOnlyWhenUnfocused(configGet: ConfigGet): boolean {
+  return readBooleanConfig(configGet, 'behavior.notifyOnlyWhenUnfocused', true);
+}
+
+/**
+ * Decide whether a given alert class should fire right now.
+ *
+ * `classConfigKey` is the per-class on/off switch (e.g.
+ * 'behavior.notifyOnBudgetBreach'); default true when absent. When that key
+ * is off, the class never fires regardless of focus. When it's on, the
+ * result additionally depends on the master `notifyOnlyWhenUnfocused` gate:
+ * if that master gate is off, the class fires unconditionally (today's
+ * pre-focus-tracking behavior); if on (the default), it only fires when the
+ * terminal is unfocused or focus state was never observed (see
+ * FocusTracker.shouldAlertWhenUnfocused).
+ */
+export function shouldFireAlert(
+  focusTracker: Pick<FocusTracker, 'shouldAlertWhenUnfocused'>,
+  configGet: ConfigGet,
+  classConfigKey: string,
+): boolean {
+  if (!readBooleanConfig(configGet, classConfigKey, true)) return false;
+  if (!readNotifyOnlyWhenUnfocused(configGet)) return true;
+  return focusTracker.shouldAlertWhenUnfocused();
+}
+
+/**
+ * notifyCompletion (SDK platform/utils) only rings the bell above 5s of
+ * "duration" and only pops a desktop notification above 30s — a heuristic
+ * tuned for long-running-turn notifications. The alert classes in this
+ * directory are point-in-time events with no natural duration, so they pass
+ * this constant as the `durationMs` argument to force both the bell and the
+ * desktop popup unconditionally.
+ */
+export const FORCE_NOTIFY_DURATION_MS = 30_001;