@pellux/goodvibes-tui 1.0.0 → 1.7.0

package/src/core/system-message-router.ts

@@ -5,19 +5,26 @@
  * Delivery is resolved from the message KIND ('system' | 'wrfc' |
  * 'operational'), which maps to a configurable routing target
  * (ui.systemMessages / ui.wrfcMessages / ui.operationalMessages, each
- * 'panel' | 'conversation' | 'both'). resolveSystemMessageDelivery() turns that
- * target — plus whether a panel is attached — into a { toPanel, toConversation }
- * decision. The priority ('high' | 'low') only sets the panel emphasis; it does
- * not by itself decide conversation delivery.
+ * 'panel' | 'conversation' | 'both'). resolveSystemMessageDelivery() turns
+ * that target — plus whether a panel is attached — into a { toPanel,
+ * toConversation } decision.
  *
- * Critical override: errors, provider failovers, and compaction/context notices
- * (see FORCE_CONVERSATION_PREFIXES) ALWAYS also reach the main conversation,
- * regardless of target, so the user never has to open the SystemMessagesPanel
- * to discover them.
+ * W6.1 (the purge): the SystemMessagesPanel this router used to optionally
+ * push into was DELETE-disposition (no surviving human surface — a picker
+ * over the old panel registry, not something worth a dedicated console) and
+ * has been removed entirely, so this router now always resolves with
+ * `hasPanel = false`. Per resolveSystemMessageDelivery's own contract that
+ * means EVERY kind/target combination (including 'panel'-only) falls back
+ * to `toConversation: true` — nothing this router routes can vanish; it all
+ * reaches conversation.addTypedSystemMessage(), which the transcript
+ * renders as a navigable system line. This is deliberate, not a regression:
+ * operational chatter that used to be tucked away in a rarely-opened panel
+ * now surfaces inline, same as the messages that were already forced there
+ * (see FORCE_CONVERSATION_PREFIXES below).
  *
  * Usage:
  * ```ts
- * const router = createSystemMessageRouter(conversation, panel);
+ * const router = createSystemMessageRouter(conversation);
  * router.routeSystemMessage('[Provider] anthropic registered', 'low');
  * router.routeSystemMessage('[Session] Saved session abc123', 'high');
  * ```
@@ -33,7 +40,6 @@
  */
 
 import type { ConversationManager } from './conversation';
-import type { SystemMessagesPanel, SystemMessagePriority } from '../panels/system-messages-panel.ts';
 import {
   classifySystemMessageKind,
   classifySystemMessagePriority,
@@ -48,13 +54,15 @@ export type {
   SystemMessageTarget,
 } from '@/runtime/index.ts';
 
+/** Panel emphasis level. Panel delivery was removed in W6.1 (see file doc); kept as the priority vocabulary for callers and for the SDK's delivery-resolution signature. */
+export type SystemMessagePriority = 'high' | 'low';
+
 /**
  * Message categories that are operationally critical enough that the user must
  * see them inline in the main conversation, regardless of the configured
- * routing target (ui.systemMessages defaults to panel-only). Errors, provider
- * failovers, and compaction/context notices fall here: a user should never have
- * to open the SystemMessagesPanel to discover that a turn errored, a provider
- * failed over, or the context was compacted.
+ * routing target. Errors, provider failovers, and compaction/context notices
+ * fall here: a user should never have to go hunting to discover that a turn
+ * errored, a provider failed over, or the context was compacted.
  *
  * Detection is by the stable message prefix tag, mirroring how the SDK
  * classifiers key off message content. This deliberately does NOT force every
@@ -72,13 +80,12 @@ function mustReachConversation(message: string): boolean {
 // ---------------------------------------------------------------------------
 
 /**
- * Routes system messages to the conversation and/or the SystemMessagesPanel
- * based on priority level.
+ * Routes system messages to the conversation based on priority level and
+ * configured target. See file doc for the W6.1 panel removal.
  */
 export class SystemMessageRouter {
   constructor(
     private readonly conversation: ConversationManager,
-    private panel: SystemMessagesPanel | null,
     private readonly getTargetForKind: (kind: SystemMessageKind) => SystemMessageTarget = defaultSystemMessageTarget,
   ) {}
 
@@ -87,28 +94,26 @@ export class SystemMessageRouter {
   /**
    * Route a system message.
    *
-   * Delivery is resolved from the kind and its configured target; priority only
-   * sets panel emphasis. Critical notices (errors/failover/compaction, see
-   * FORCE_CONVERSATION_PREFIXES) are additionally forced into the conversation.
+   * Delivery is resolved from the kind and its configured target. Critical
+   * notices (errors/failover/compaction, see FORCE_CONVERSATION_PREFIXES)
+   * are additionally forced into the conversation.
    *
    * @param message  - Message text.
-   * @param priority - 'high' | 'low'.
+   * @param priority - 'high' | 'low' (kept for callers; no longer changes
+   *                   delivery now that there is no panel to emphasize on).
    * @param kind     - Classification kind ('system' | 'wrfc' | 'operational');
    *                   used to resolve routing target and conversation navigability.
    */
   routeTypedSystemMessage(
     message: string,
-    priority: SystemMessagePriority,
+    _priority: SystemMessagePriority,
     kind: SystemMessageKind,
   ): void {
     const target = this.getTargetForKind(kind);
-    const delivery = resolveSystemMessageDelivery(target, this.panel !== null);
-    if (delivery.toPanel) {
-      this.panel?.push(message, priority);
-    }
-    // Critical notices (errors, failover, compaction) must surface inline even
-    // when the configured target is panel-only — otherwise a user without the
-    // SystemMessagesPanel open would never see them.
+    // hasPanel is always false post-W6.1 — resolveSystemMessageDelivery's own
+    // contract means every target ('panel' | 'conversation' | 'both')
+    // resolves toConversation: true in that case (see file doc).
+    const delivery = resolveSystemMessageDelivery(target, false);
     const toConversation = delivery.toConversation || mustReachConversation(message);
     if (toConversation) {
       // addTypedSystemMessage threads the kind into the conversation so the
@@ -153,21 +158,6 @@ export class SystemMessageRouter {
   wrfc(message: string, priority: SystemMessagePriority = 'high'): void {
     this.routeTypedSystemMessage(message, priority, 'wrfc');
   }
-
-  /**
-   * Returns the current panel reference.
-   */
-  getPanel(): SystemMessagesPanel | null {
-    return this.panel;
-  }
-
-  /**
-   * Replace the panel reference after construction (late binding).
-   * Pass null to detach the panel.
-   */
-  setPanel(panel: SystemMessagesPanel | null): void {
-    this.panel = panel;
-  }
 }
 
 // ---------------------------------------------------------------------------
@@ -175,17 +165,13 @@ export class SystemMessageRouter {
 // ---------------------------------------------------------------------------
 
 /**
- * Create a SystemMessageRouter wired to the given conversation and panel.
+ * Create a SystemMessageRouter wired to the given conversation.
  *
- * @param conversation - The ConversationManager for high-priority messages.
- * @param panel        - The SystemMessagesPanel for all messages. Can be null
- *                       (router still works; messages to panel are silently
- *                       dropped until a panel is available).
+ * @param conversation - The ConversationManager all routed messages reach.
  */
 export function createSystemMessageRouter(
   conversation: ConversationManager,
-  panel: SystemMessagesPanel | null = null,
   getTargetForKind: (kind: SystemMessageKind) => SystemMessageTarget = defaultSystemMessageTarget,
 ): SystemMessageRouter {
-  return new SystemMessageRouter(conversation, panel, getTargetForKind);
+  return new SystemMessageRouter(conversation, getTargetForKind);
 }

package/src/core/turn-cancellation.ts

@@ -0,0 +1,20 @@
+import type { Orchestrator } from './orchestrator';
+import type { SpokenTurnRuntime } from '../audio/spoken-turn-wiring.ts';
+
+/**
+ * Builds the shared "cancel the active turn" action: stops any in-flight
+ * spoken output, then aborts the orchestrator's turn if one is actively
+ * streaming. Extracted from main.ts so the file can stay under its 800-line
+ * cap while still wiring `commandContext.isGenerating` (see W1.6 FIX 1).
+ */
+export function createCancelGeneration(
+  orchestrator: Orchestrator,
+  spokenTurns: Pick<SpokenTurnRuntime, 'stop'>,
+): () => void {
+  return () => {
+    spokenTurns.stop('Spoken output stopped.');
+    if (orchestrator.isThinking) {
+      orchestrator.abort();
+    }
+  };
+}

package/src/core/turn-event-wiring.ts

@@ -6,7 +6,12 @@ import type { HookDispatcher, HookPhase, HookCategory, HookEventPath } from '@pe
 import type { ConversationManager } from './conversation.ts';
 import { journalPathFor, openTranscriptJournal, type TranscriptJournal } from './transcript-journal.ts';
 import type { WebhookNotifier } from '@pellux/goodvibes-sdk/platform/integrations';
+import { notifyCompletion } from '@pellux/goodvibes-sdk/platform/utils';
 import { maybeNotifyLongTask, readNotifyAfterSeconds, type LongTaskStatus } from './long-task-notifier.ts';
+import type { FocusTracker } from './focus-tracker.ts';
+import { shouldFireAlert, FORCE_NOTIFY_DURATION_MS } from './alert-gating.ts';
+import { createBudgetBreachNotifier, type BudgetBreachNotifier } from './budget-breach-notifier.ts';
+import { readBudgetAlertUsd } from '../export/cost-utils.ts';
 
 /** Infer the options param of persistConversation to pick up SessionManager correctly. */
 type PersistOptions = NonNullable<Parameters<typeof persistConversation>[5]>;
@@ -14,11 +19,13 @@ type PersistOptions = NonNullable<Parameters<typeof persistConversation>[5]>;
 /** Minimal orchestrator surface required by turn-event wiring. */
 interface TurnOrchestrator {
   readonly lastInputTokens: number;
+  /** Cumulative session usage — same object CostTrackerPanel reads, used here for budget-breach checks. */
+  readonly usage: { readonly input: number; readonly output: number; readonly cacheRead: number; readonly cacheWrite: number };
 }
 
 /** Minimal provider registry surface required by turn-event wiring. */
 interface TurnProviderRegistry {
-  getCurrentModel(): { readonly contextWindow: number };
+  getCurrentModel(): { readonly contextWindow: number; readonly id?: string };
   getContextWindowForModel(model: { readonly contextWindow: number }): number;
 }
 
@@ -57,6 +64,16 @@ export interface WireTurnEventHandlersOptions {
    * when absent.
    */
   readonly webhookNotifier?: WebhookNotifier | null;
+  /**
+   * Terminal focus tracker (W2.3). Gates the long-task, budget-breach, and
+   * agent/chain-failure desktop alerts wired in this module — see
+   * alert-gating.ts. Optional; when absent, none of the new W2.3 alert
+   * behavior is gated by focus (long-task keeps its pre-W2.3 always-fire
+   * behavior, and budget-breach/failure alerts are skipped entirely, since
+   * they are new-in-W2.3 and have no pre-existing unconditional-fire path
+   * to fall back to).
+   */
+  readonly focusTracker?: Pick<FocusTracker, 'shouldAlertWhenUnfocused'> | null;
   /**
    * Minimal test seam: injectable clock for controlling Date.now() in tests.
    * Defaults to the real Date.now when absent.
@@ -94,13 +111,14 @@ export function wireTurnEventHandlers(
   options: WireTurnEventHandlersOptions,
 ): WireTurnEventHandlersResult {
   const {
-    events, conversation, runtime, configManager, hookDispatcher,
+    events, conversation, runtime, configManager, hookDispatcher, orchestrator, providerRegistry,
     workingDir, homeDirectory, sessionManager, gitStatusProvider,
-    lastGitInfoRef, buildSessionContinuityHints, render, webhookNotifier,
+    lastGitInfoRef, buildSessionContinuityHints, render, webhookNotifier, focusTracker,
     _clock = Date.now,
   } = options;
 
   const unsubs: Array<() => void> = [];
+  const configGet = (k: string): unknown => configManager.get(k as Parameters<typeof configManager.get>[0]);
 
   // Create the per-session transcript journal. Path mirrors recovery-file
   // convention (homeDirectory-scoped). Created lazily on first append.
@@ -112,6 +130,13 @@ export function wireTurnEventHandlers(
   // Track turn start time for long-task notification threshold.
   let turnStartTime: number | null = null;
 
+  // Budget-breach edge-trigger checker (W2.3) — one instance per session,
+  // piggybacking on the same TURN_COMPLETED handler as the long-task
+  // notification below rather than adding a second TURN_COMPLETED subscription.
+  const budgetBreachNotifier: BudgetBreachNotifier | null = focusTracker
+    ? createBudgetBreachNotifier({ focusTracker, configGet, webhookNotifier: webhookNotifier ?? null, sessionId: runtime.sessionId })
+    : null;
+
   const refreshGit = (): void => {
     gitStatusProvider.refresh().then((info) => { lastGitInfoRef.value = info; render(); }).catch(() => { /* non-fatal */ });
   };
@@ -140,7 +165,15 @@ export function wireTurnEventHandlers(
       sessionId: runtime.sessionId,
       thresholdSeconds: notifyThreshold,
       webhookNotifier: webhookNotifier ?? null,
+      focusTracker,
+      configGet,
     });
+    // Budget-breach alert (W2.3): edge-triggered, piggybacks on this same
+    // TURN_COMPLETED handler rather than a second subscription.
+    if (budgetBreachNotifier) {
+      const sessionModel = providerRegistry.getCurrentModel().id ?? 'unknown';
+      budgetBreachNotifier.check(orchestrator.usage, sessionModel, readBudgetAlertUsd(configGet));
+    }
     // Auto-save after every LLM turn so kills don't lose the session
     try {
       const snapshot = conversation.toJSON() as { messages: Array<import('./conversation.ts').ConversationMessageSnapshot>; timestamp?: number };
@@ -180,5 +213,33 @@ export function wireTurnEventHandlers(
     refreshGit();
   }));
 
+  // Agent/chain-failure desktop alerts (W2.3). The SDK's WebhookNotifier and
+  // Notifier already fire webhook/Slack/Discord notifications for these two
+  // events unconditionally (attachToRuntimeBus in the SDK's
+  // platform/integrations — pre-existing, not focus-gated: an out-of-band
+  // push to another device is useful regardless of terminal focus). What was
+  // missing was a desktop notification, gated by focus like the other three
+  // alert classes — that's the only thing added here, to avoid double-firing
+  // a webhook that's already covered.
+  if (focusTracker) {
+    unsubs.push(events.agents.on('AGENT_FAILED', (payload) => {
+      if (!shouldFireAlert(focusTracker, configGet, 'behavior.notifyOnAgentFailure')) return;
+      try {
+        notifyCompletion('GoodVibes — agent failed', `agent ${payload.agentId.slice(0, 8)} failed: ${payload.error}`, FORCE_NOTIFY_DURATION_MS);
+      } catch (err) {
+        logger.debug('turn-event-wiring: agent-failure notify error', { error: String(err) });
+      }
+    }));
+    unsubs.push(events.workflows.on('WORKFLOW_CHAIN_FAILED', (payload) => {
+      if (!shouldFireAlert(focusTracker, configGet, 'behavior.notifyOnChainFailure')) return;
+      const kindLabel = payload.failureKind === 'transport' ? 'transient transport error' : payload.reason;
+      try {
+        notifyCompletion('GoodVibes — WRFC chain failed', `chain ${payload.chainId.slice(0, 12)} failed: ${kindLabel}`, FORCE_NOTIFY_DURATION_MS);
+      } catch (err) {
+        logger.debug('turn-event-wiring: chain-failure notify error', { error: String(err) });
+      }
+    }));
+  }
+
   return { refreshGit, unsubs, transcriptJournal };
 }

package/src/export/cost-utils.ts

@@ -1,13 +1,38 @@
 // ---------------------------------------------------------------------------
 // cost-utils — canonical pricing source for token cost calculations (consumed by CostTrackerPanel and share-runtime)
+//
+// Pricing resolution order (resolvePricing):
+//   1. `:free` suffix (OpenRouter free-tier convention) — always priced at $0.
+//   2. The live SDK model catalog, when a source has been wired via
+//      setPricingSource() (bootstrap-core.ts wires ProviderRegistry.getRawCatalogModels()
+//      once catalog init completes) — exact id match, then prefix/substring.
+//   3. STATIC_FALLBACK_PRICING — a small hand-maintained safety net for common
+//      frontier models, used when the catalog has no source wired (e.g. tests)
+//      or hasn't matched (catalog not yet loaded, or a model this net covers
+//      that the catalog happens to miss).
+//   4. Unpriced: the model is genuinely unknown to every source above. This is
+//      reported explicitly via `priced: false` so consumers can render an
+//      honest "unpriced" state instead of a silent $0.
 // ---------------------------------------------------------------------------
 
+import type { CatalogModel } from '@pellux/goodvibes-sdk/platform/providers';
+
 export interface ModelPricing {
   input: number;
   output: number;
 }
 
-const MODEL_PRICING: Record<string, ModelPricing> = {
+/** Result of a pricing lookup: the resolved (possibly zero) price, and whether it's real. */
+export interface PricingResult {
+  pricing: ModelPricing;
+  /** False when no source (catalog or static fallback) recognized the model — the zero pricing is a placeholder, not a real price. */
+  priced: boolean;
+}
+
+// Hand-maintained safety net, used only when the live catalog has no source
+// wired or does not recognize the model. NOT the primary pricing source —
+// see resolvePricing() below.
+const STATIC_FALLBACK_PRICING: Record<string, ModelPricing> = {
   // Free tier
   'openrouter/free': { input: 0, output: 0 },
 
@@ -34,17 +59,71 @@ const MODEL_PRICING: Record<string, ModelPricing> = {
   'gemini-2.5-pro':        { input: 1.25,  output: 5 },
 };
 
+// Module-level injection point. Kept as a bare singleton (not threaded through
+// call sites) because the 9 existing consumers are pure functions with no
+// ProviderRegistry in scope; see WO-315 brief for the tradeoff. Tests that
+// never call setPricingSource() fall through to the static-fallback path,
+// which keeps them isolated from catalog state by default.
+let pricingSource: (() => readonly CatalogModel[]) | null = null;
+
+/** Wire (or clear, with null) the live catalog as the primary pricing source. */
+export function setPricingSource(source: (() => readonly CatalogModel[]) | null): void {
+  pricingSource = source;
+}
+
+function findInCatalog(modelId: string, models: readonly CatalogModel[]): ModelPricing | null {
+  const exact = models.find((m) => m.id === modelId);
+  if (exact) return exact.tier === 'free' ? { input: 0, output: 0 } : exact.pricing;
+  for (const m of models) {
+    if (modelId.startsWith(m.id) || modelId.includes(m.id)) {
+      return m.tier === 'free' ? { input: 0, output: 0 } : m.pricing;
+    }
+  }
+  return null;
+}
+
+function findInStaticFallback(modelId: string): ModelPricing | null {
+  const exact = STATIC_FALLBACK_PRICING[modelId];
+  if (exact) return exact;
+  for (const [key, pricing] of Object.entries(STATIC_FALLBACK_PRICING)) {
+    if (modelId.startsWith(key) || modelId.includes(key)) return pricing;
+  }
+  return null;
+}
+
+/**
+ * resolvePricing — resolve USD-per-1M-token pricing for a model ID, and
+ * whether that pricing is real (vs. an unpriced placeholder). See the module
+ * header for the full resolution order.
+ */
+export function resolvePricing(modelId: string): PricingResult {
+  if (modelId.endsWith(':free')) return { pricing: { input: 0, output: 0 }, priced: true };
+
+  const models = pricingSource?.() ?? [];
+  const catalogHit = findInCatalog(modelId, models);
+  if (catalogHit) return { pricing: catalogHit, priced: true };
+
+  const fallbackHit = findInStaticFallback(modelId);
+  if (fallbackHit) return { pricing: fallbackHit, priced: true };
+
+  // Genuinely unknown — no source recognizes this model. Report honestly
+  // rather than collapsing into the same zero a free model would return.
+  return { pricing: { input: 0, output: 0 }, priced: false };
+}
+
 /**
  * getPricing — resolve USD-per-1M-token pricing for a model ID.
- * Exact match first; then prefix/substring; falls back to zero.
+ * Back-compat wrapper over resolvePricing(); returns zero for both genuinely
+ * free and genuinely unknown models (use resolvePricing/isModelPriced to
+ * distinguish the two).
  */
 export function getPricing(modelId: string): ModelPricing {
-  if (MODEL_PRICING[modelId]) return MODEL_PRICING[modelId]!;
-  if (modelId.endsWith(':free')) return { input: 0, output: 0 };
-  for (const [key, pricing] of Object.entries(MODEL_PRICING)) {
-    if (modelId.startsWith(key) || modelId.includes(key)) return pricing;
-  }
-  return { input: 0, output: 0 };
+  return resolvePricing(modelId).pricing;
+}
+
+/** True when `modelId` resolves to a real price (free or paid), false when it's an unpriced placeholder. */
+export function isModelPriced(modelId: string): boolean {
+  return resolvePricing(modelId).priced;
 }
 
 /**
@@ -56,6 +135,9 @@ export function getPricing(modelId: string): ModelPricing {
  * cacheRead      — cumulative cache-read tokens
  * cacheWrite     — cumulative cache-write tokens
  * modelId        — registry model identifier
+ *
+ * Unpriced models contribute 0 to the total (same as before this WO) — only
+ * the display layer distinguishes "genuinely free/priced" from "unpriced".
  */
 export function calcSessionCost(
   inputTokens: number,
@@ -69,3 +151,39 @@ export function calcSessionCost(
   const billableInput = inputTokens + cacheRead + cacheWrite;
   return (billableInput * pricing.input + outputTokens * pricing.output) / 1_000_000;
 }
+
+/**
+ * computeBudgetBreach — pure predicate shared by CostTrackerPanel's render-time
+ * "OVER BUDGET" flag and the background budget-breach notifier
+ * (core/budget-breach-notifier.ts), so both agree on exactly one definition
+ * of "over budget". `budgetThreshold <= 0` means no budget is configured
+ * (disabled), which can never be breached.
+ */
+export function computeBudgetBreach(sessionCost: number, budgetThreshold: number): boolean {
+  return budgetThreshold > 0 && sessionCost > budgetThreshold;
+}
+
+/** Read/write access to the `behavior.budgetAlertUsd` TUI-local config key. Plain
+ * callbacks (rather than a ConfigManager reference) so callers can pass a
+ * generic-key-cast wrapper without this module depending on the SDK config types. */
+export interface BudgetAlertConfigAccess {
+  readonly get: (key: string) => unknown;
+  readonly set: (key: string, value: unknown) => void;
+}
+
+/** Default for the `behavior.budgetAlertUsd` synthetic setting: 0 = no budget configured. */
+export const BUDGET_ALERT_USD_DEFAULT = 0;
+
+/**
+ * readBudgetAlertUsd — read the session cost-budget alert threshold (USD) from
+ * config. This is the single source of truth CostTrackerPanel and the
+ * background budget-breach notifier (core/budget-breach-notifier.ts) both
+ * read, so a threshold set via the panel's 'b' key is immediately visible to
+ * the notifier and vice versa. Falls back to BUDGET_ALERT_USD_DEFAULT (off)
+ * when the key is absent or invalid.
+ */
+export function readBudgetAlertUsd(configGet: (key: string) => unknown): number {
+  const raw = configGet('behavior.budgetAlertUsd');
+  const parsed = typeof raw === 'number' ? raw : Number(raw);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : BUDGET_ALERT_USD_DEFAULT;
+}

package/src/input/command-registry.ts

@@ -7,6 +7,7 @@ import type { ToolRegistry } from '@pellux/goodvibes-sdk/platform/tools';
 import type { PermissionRequestHandler } from '@pellux/goodvibes-sdk/platform/permissions';
 import type { SelectionItem, SelectionResult, SelectionAction } from './selection-modal.ts';
 import type { FileUndoManager } from '@pellux/goodvibes-sdk/platform/state';
+import type { WorkspaceCheckpointManager } from '@pellux/goodvibes-sdk/platform/workspace';
 import type { PanelManager } from '../panels/panel-manager.ts';
 import type { KeybindingsManager } from './keybindings.ts';
 import type { OnboardingWizardMode } from './onboarding/onboarding-wizard.ts';
@@ -68,6 +69,9 @@ export interface CommandUiActions {
   };
   executeCommand?: (name: string, args: string[]) => Promise<boolean>;
   cancelGeneration?: () => void;
+  /** True while an LLM turn is actively streaming. Used to give Escape
+   *  cancel-turn precedence over a focused panel's own escape handling. */
+  isGenerating?: () => boolean;
   completeModelSelection?: (selection: {
     model: { id: string; provider: string; displayName: string; registryKey: string };
     effort: string;
@@ -75,9 +79,25 @@ export interface CommandUiActions {
     /** Which config target to write the selected model to. Defaults to 'main'. */
     target?: import('./model-picker.ts').ModelPickerTarget;
   }) => void;
+  /**
+   * Commit an embedding-provider selection from the model picker's
+   * 'embeddingProvider' mode (the 'embeddings' target). Deliberately separate
+   * from completeModelSelection — embedding providers are not
+   * ModelDefinition-shaped, so routing them through the same commit path
+   * would require fabricating a fake model object.
+   */
+  completeEmbeddingProviderSelection?: (providerId: string) => void;
   clearScreen?: () => void;
   activatePlan?: (planId: string, task: string) => void;
   requestPermission?: PermissionRequestHandler;
+  /**
+   * Force a full-screen repaint on the next frame (reuses Compositor.resetDiff(),
+   * the same call resize/bootstrap already use). Defense-in-depth for command
+   * handlers whose spawned subprocess may have written to the real tty (e.g. a
+   * stderr-capture regression) — nulls the diff buffers so the next composite()
+   * repaints over any stray output instead of leaving it until an unrelated resize.
+   */
+  requestFullRepaint?: () => void;
 }
 
 export interface CommandShellUiOpeners {
@@ -99,6 +119,13 @@ export interface CommandShellUiOpeners {
     callback: (result: SelectionResult | null) => void,
   ) => void;
   openSettingsModal?: (target?: string) => void;
+  /**
+   * Open a MIGRATE-TO-MODAL surface by name (W6.1 purge skeleton — WO-A/B
+   * command runtimes call this instead of openCommandPanel once their panel
+   * is converted to a ModalFactory config). Threaded from ui-openers.ts the
+   * same way openSettingsModal is.
+   */
+  openModal?: (name: string) => void;
   openSessionPicker?: () => void;
   openProfilePicker?: () => void;
   openShortcutsOverlay?: () => void;
@@ -141,6 +168,26 @@ export interface CommandSessionServices {
   readonly sessionLineageTracker?: import('@pellux/goodvibes-sdk/platform/core').SessionLineageTracker;
   readonly wrfcController?: import('@pellux/goodvibes-sdk/platform/agents').WrfcController;
   readonly changeTracker?: import('@pellux/goodvibes-sdk/platform/sessions').SessionChangeTracker;
+  /**
+   * Recompute the Orchestrator's session-wide usage totals from the
+   * conversation's current message history. Call after a session resume
+   * replays historical messages, before the next render, so the footer's
+   * token counter reflects the resumed session's real usage instead of a
+   * fresh Orchestrator's zeroed default (W0.9).
+   */
+  readonly hydrateSessionUsage?: () => void;
+  /** Wave 4 (wo703): the orchestration engine's command-facing facade — see runtime/workstream-services.ts. */
+  readonly workstreamEngine?: import('../runtime/workstream-services.ts').WorkstreamCommandService;
+  /** Wave 5 (wo804): the repo source-tree code index — see runtime/code-index-services.ts. */
+  readonly codeIndexStore?: import('@pellux/goodvibes-sdk/platform/state').CodeIndexStore;
+  /**
+   * Wave 5 (wo805): the MAIN interactive session's per-turn passive-injection
+   * honesty ring — `Orchestrator.getTurnInjections()`, the main-session
+   * counterpart to `AgentRecord.turnInjections` (wo801). `/recall injections`
+   * with no agent id reads this. Optional so command contexts built without an
+   * orchestrator (headless, tests) fall back to the honest empty state.
+   */
+  readonly getMainSessionTurnInjections?: () => readonly import('../renderer/turn-injection.ts').TurnInjectionEntry[];
 }
 
 export interface CommandProviderServices {
@@ -157,6 +204,7 @@ export interface CommandProviderServices {
 export interface CommandWorkspaceUiServices {
   keybindingsManager?: KeybindingsManager;
   fileUndoManager?: FileUndoManager;
+  workspaceCheckpointManager?: WorkspaceCheckpointManager;
   panelManager?: PanelManager;
   profileManager?: import('@pellux/goodvibes-sdk/platform/profiles').ProfileManager;
   bookmarkManager?: import('@pellux/goodvibes-sdk/platform/bookmarks').BookmarkManager;
@@ -174,6 +222,11 @@ export interface CommandPlatformConfigServices {
   readonly configManager: ConfigManager;
   readonly voiceProviderRegistry?: VoiceProviderRegistry;
   readonly voiceService?: VoiceService;
+  /** Direct-command consumer (`/search`) alongside the existing agent-tool consumer. */
+  readonly webSearchService?: import('@pellux/goodvibes-sdk/platform/web-search').WebSearchService;
+  /** Direct-command consumer (`/image`) — first production caller of `.generate()`. */
+  readonly mediaProviders?: import('@pellux/goodvibes-sdk/platform/media').MediaProviderRegistry;
+  readonly artifactStore?: import('@pellux/goodvibes-sdk/platform/artifacts').ArtifactStore;
 }
 
 export interface CommandPlatformServices
@@ -186,7 +239,7 @@ export interface CommandOpsServices
 export interface CommandExtensionRegistryServices {
   readonly toolRegistry: ToolRegistry;
   readonly mcpRegistry: McpRegistry;
-  readonly evalRegistry?: import('../panels/eval-panel.ts').EvalRegistry;
+  readonly evalRegistry?: import('../panels/eval-registry.ts').EvalRegistry;
 }
 
 export interface CommandExtensionServices