@pellux/goodvibes-tui 1.1.0 → 1.9.0

package/CHANGELOG.md

@@ -4,29 +4,93 @@ All notable changes to GoodVibes TUI.
 
 ---
 
+## [1.7.0] — 2026-07-04
+
+The evolution release: six batched development cycles (internal 1.2.0–1.6.0, which were never published) land together as one public version. The through-line is a product that reports the truth about itself — reversible edits you can actually undo, a live fleet you can watch and steer, orchestration that runs the plan it showed you, memory that demonstrably enters the turns it claims to, and a panel surface cut down to the consoles that earn their place. Ships against @pellux/goodvibes-sdk 0.38.0.
+
+### Reversibility and checkpoints
+- Workspace checkpoints with `/checkpoints`, `/checkpoint`, and `/rewind`: snapshot the working tree, list snapshots newest-first, and preview-then-restore files from any checkpoint (files only — conversation history is left untouched). Backed by the SDK's `WorkspaceCheckpointManager` and wired through TUI services, with guards so an unguarded checkpoint call can no longer surface as a silent unhandled rejection.
+- Per-hunk accept/reject for multi-edit approval prompts: when one approval covers several hunks you accept or reject each individually, and the decision is honored end-to-end instead of being all-or-nothing.
+- `/test` runs the project test script and shows real pass/fail results, parsing both the SDK runner output and plain `bun test` output (per-test counts and the names of failing tests); the end state persists in the transcript instead of evaporating.
+- Manual `/compact` now hands the compaction subagent the real original task and the full agent roster, so the handoff summary is accurate.
+
+### Fleet observability, session tabs, and steering
+- A live Fleet panel over the real SDK process/agent registry: a process tree with per-node live states, honest cost, id-anchored selection that survives list churn, and capability-gated interrupt/kill actions. It is the fast-access surface below the prompt and the home of `F2`, `Ctrl+O`, and the footer `[Enter]`.
+- Unfocused-user alerts that actually reach you when GoodVibes is in a background terminal: budget breach, agent/chain failure, awaiting-approval, and long-task notices, gated on real terminal-focus tracking (CSI 1004) with an honest "unknown" fallback.
+- Live transcript tabs over the conversation snapshot bridge: attach to a running agent, browse its transcript read-only (with reserved-notice honesty), detach without killing it, and see interrupted vs. killed as distinct states with a frozen elapsed clock.
+- A steering composer with a `queued` / `consumed` / `dropped` badge: send an instruction to a running agent and see honestly whether it was picked up, with TTL and ordering guards, and the consumed signal deferred until the steered turn actually succeeds.
+
+### Workstream orchestration
+- `/workstream` authoring and oversight for multi-phase agent work: phases are insertable structure (float-ordinal ordering), work items flow to free capacity, and each item commits inside its own worktree through the scoped-commit machinery. The authoring view renders the real plan, so the proposal and the launched run can never disagree.
+- Resume-prefix replay with crash-artifact reconciliation: an interrupted workstream re-queues its in-phase items on resume instead of double-running or dropping them.
+- Budgets that refuse rather than kill, with a recovery path, and cooperative cancellation that reaches real child processes.
+- Fleet-tree nesting for workstreams, plus pause/resume support.
+
+### Passive memory and the code index
+- Durable memory demonstrably enters both agent turns and the main-session turn: per-turn retrieval is budgeted (800 tokens by default, floor 95), flag-gated, and inspectable — `/recall injections` shows exactly which records would be injected for a task and why, defaulting to the main-session ring.
+- A repo source-tree code index with honest bounds and labeling: `/codebase build`, `/codebase status`, and `/codebase search`.
+- Compaction quality scoring and a corrected capacity-percentage in the compaction path.
+- The model picker gained an embeddings target, so the memory index's embedding provider is selectable alongside chat models.
+
+### The panel purge and config modals
+- The panel surface was cut from roughly 50 panels to 6 surviving consoles — the Fleet hub plus git, diff, cost, tokens, and local-auth — with 19 configuration and review surfaces re-homed onto a single liveness-enforcing config-modal host. Heavy operator state that used to sprawl across dozens of panels now opens as a focused modal.
+- Every retired panel id resolves honestly: old ids become aliases, modal redirects, or friendly "this moved" notices, so `/panel open <id>` and saved layouts never silently point at nothing.
+- Live panels stay subscribed while open and now repaint while the main thread is idle, so agent, tool, and thinking updates no longer look frozen.
+
+### Keymap and focus honesty
+- The keymap advertises what it actually does: `Ctrl+PageUp` / `Ctrl+PageDown` move between panel tabs (`Ctrl+[` was removed — it is byte `0x1B` and collided with Escape, so it never fired reliably; `Ctrl+]` remains a next-tab chord), `Ctrl+O` and `F2` both open and focus the Fleet panel (the retired Ops Control and process modals fold into it), and `Ctrl+C` honestly advertises the double-press to quit.
+- Focus routing was fixed at the root: multi-character paste is detected per token instead of by a per-feed character-sum heuristic, and keyboard focus transfers only on an explicit request — so typed text no longer leaks into single-letter panel hotkeys.
+
+### Control-plane truth
+- The control plane reports real lifecycle: a `stopping…` state while a process winds down, pause↔resume (including `/schedule` jobs shown in the fleet tree), zombie reaping, and a dirty-residue commit guard so an interrupted scoped commit cannot leave stray changes behind.
+
+### New commands
+- `/search <query> [--limit <n>]` — search the web and render ranked results with source labels.
+- `/imagine <prompt>` — generate an image from a prompt (distinct from `/image`, which attaches an existing image file; the two names collided and the generator was renamed).
+- `/workstream` — author and oversee multi-phase agent workstreams.
+- `/checkpoints`, `/checkpoint`, `/rewind` — workspace checkpoint list / create / restore.
+- `/codebase` — build, inspect, and search the repo source-tree code index.
+- `/test` — run the project test script and show pass/fail.
+- `/recall injections` — inspect the memory records that would be injected for a task.
+
+### Notable fixes
+- Clearing a feature-flag override back to default now removes it from disk instead of persisting a redundant entry.
+- The `paused` process state renders with its own glyph and tone in the fleet tree.
+- Planning: dismissing a planning action no longer corrupts the project goal; the `sessions` front door opens the session picker; `/panel open` reports redirects and deleted ids honestly.
+- `Escape` cancel-first precedence and live git-init header refresh, so a directory becomes a recognized repo without a restart.
+
+### Internal
+- SDK dependency 0.36.0 → 0.38.0 (through 0.37.0 / 0.37.1 / 0.37.2); foundation artifacts regenerated against the released SDK.
+- A release-blocking gate requires the SDK pin, the lockfile resolution, and the installed package to all agree, plus a source-import sweep that fails on any non-npm SDK import — so the local-SDK development overlay can never ship.
+- Test suite at 639 files green; coverage, performance, architecture, and eval-regression gates enforced on every cycle. Each wave was verified with the full gate block, a three-lens adversarial review, and a live tmux replay of its pillar scenarios.
+
 ## [1.1.0] — 2026-07-03
 
-### Changes
-- e3d20840 chore(artifacts): regenerate foundation artifacts against SDK 0.36.0
-- 2dab222b integrate wave0: trust repairs (v1.1.0 scope)
-- d3116e0a chore(deps): bump @pellux/goodvibes-sdk to 0.36.0 (Wave-0 trust repairs)
-- 08caa3a3 test(tools): pin the SDK 0.36 tail-preserving truncation contract
-- e1e124b7 chore: trim stall-gate comment to keep main.ts under the 800-line cap
-- 57a9c5bd fix(stream): suppress stall indicator false-positive during tool execution
-- 96225275 fix(test-runner): fence git discovery at the per-file temp root
-- efbfc8de chore(wave0): trim main.ts/git-panel.ts back to the 800-line cap after wave merges
-- e7d166e4 integrate WO-315 (W0.10 cost-truth unpriced markers) into wave0
-- 83d77e50 integrate WO-314 (W0.9 per-agent stats + footer usage hydration) into wave0
-- 5801ced8 integrate WO-313 (W0.7 stream stall honesty, TUI half) into wave0
-- 5abfed54 integrate WO-312 (W0.4/5/6/11/12 diff+slash+ctrlc cluster) into wave0
-- 40fdee43 integrate WO-311 (W0.8 panel focus/burst/indicator) into wave0
-- 8e61b248 fix(wo312): Wave 0 TUI trust-repair cluster (W0.4/W0.5/W0.6/W0.11/W0.12)
-- 210b4b80 fix(W0.9): honest per-agent usage display + footer token hydration after resume
-- b791dbd2 fix(cost): catalog-backed pricing with honest unpriced state (WO-315/W0.10)
-- 1af7105e fix(input,renderer): panel entry points reachable + burst guard + focus indicator (W0.8)
-- 000250a1 fix(streaming): honest stall indicator + mid-stream watchdog re-arm (W0.7)
-- 74141d53 feat(dev): local SDK overlay for rapid iteration, with release-blocking gates
-- 69c282a1 docs: reconcile documentation with the shipped 0.29.0 and 1.0.0 releases
+Wave 0 of the post-1.0 evolution effort: trust repairs. Every change closes a defect found by live dogfooding v1.0.0 where the product reported something other than the truth. Ships against @pellux/goodvibes-sdk 0.36.0 (same effort, SDK side).
+
+### Fixed
+- Failing commands are visible again: the SDK masked every command-level failure as "Error: Unknown error", so a red test suite was literally invisible to the model — it would honestly conclude "no failure observed" while your tests were failing. Exit code, stdout, and stderr now reach the model byte-faithfully, and long-output truncation keeps the tail (where test runners print failures) instead of the head. Verified live: the model reads a sabotaged test's actual assertion diff and fixes the right side.
+- Agent auto-commits are scoped: a WRFC chain used to `git add --all`, sweeping your unrelated dirty files into its commit with a truncated message. Commits now include only chain-touched files, with full accurate messages, under a new policy config (`off | scoped | all`, default scoped). Verified live with bait files.
+- Agent chains can no longer die silently: transport failures surface a reasoned failure state in the transcript and status strip, with one bounded automatic retry.
+- Panels work during turns: Ctrl+P / F2 / the status-strip Enter were dead exactly while agents ran — the Inspector was unreachable whenever there was something to inspect. Verified live mid-chain.
+- Panels no longer eat typed text: multi-character input routes to the composer instead of being silently consumed as single-letter panel hotkeys, and a visible focus indicator shows where keys go.
+- Streaming honesty: a stalled provider stream now shows a real stall/reconnect indicator (with attempt counts via the SDK's new STREAM_RETRY event) instead of cycling whimsical labels over dead air — and the indicator correctly stays quiet while a tool is executing.
+- Slash routing is deterministic: `/command` in an empty composer is always a command, never sent to the model as chat (previously state-dependent after overlay use, burning tokens on junk turns).
+- Per-agent stats are real: the Inspector showed Tools 0 / Tokens 0 / Cost $0.00 for agents that wrote hundreds of lines; agents (including WRFC owners, which aggregate their whole chain) now report true token/tool counts, and footer counters survive session resume.
+- Cost is honest: models missing from the old hardcoded ~16-model price table silently showed $0.00 everywhere; pricing now resolves through the SDK catalog with an explicit "unpriced" marker when unknown.
+- Indicator truth: the footer no longer shows `hitl:balanced` alongside DANGER MODE; the effective permission posture wins.
+- Renderer truth: subprocess stderr can no longer leak raw into the transcript and garble cells (`/diff` in a non-git dir now prints one honest sentence, not a fake diff); git repos are re-detected live after `git init` without a restart; cancelled-turn echo no longer mangles its first character.
+
+### Added
+- Auto-resume offer at startup when a previous session exists.
+- `/sessions` groups subagent sessions instead of burying your real session under them.
+- `.goodvibes/` transient state is auto-gitignored in project directories.
+- Wider, persistent Ctrl+C exit-confirmation notice.
+
+### Internal
+- SDK dependency 0.35.0 → 0.36.0; foundation artifacts regenerated (new event contract entries).
+- Local-SDK overlay dev tooling (`scripts/sdk-dev.ts link|status|restore`) with release-blocking gates in release.ts and publish-check so a local SDK can never ship.
+- Wave verified three ways: full gate block, a 3-lens adversarial code review, and a live tmux scenario replay of the five previously-failing dogfood scenarios (all PASS).
 
 ## [1.0.0] — 2026-07-03
 

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-1.1.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
+[![Version](https://img.shields.io/badge/version-1.9.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
 
 A terminal-native AI coding, operations, automation, knowledge, and integration console with a typed runtime, omnichannel surfaces, structured memory/knowledge, and a raw ANSI renderer.
 
@@ -84,7 +84,7 @@ Typical workflows:
 - ingest URLs, bookmarks, docs, spreadsheets, and artifacts into the structured knowledge system for later retrieval
 - dispatch and review work across remote peers and node-host runners
 
-The compiled binary is the TUI entrypoint built from `src/main.ts`. When `danger.daemon` and/or `danger.httpListener` are enabled, that same binary starts the daemon and HTTP listener in-process. `bun run daemon` uses the separate headless daemon entrypoint from source.
+The compiled binary is the TUI entrypoint built from `src/main.ts`. The daemon (`daemon.enabled`, on by default, loopback-bound) and, when `danger.httpListener` is enabled, the HTTP listener both start in-process from that same binary. `bun run daemon` uses the separate headless daemon entrypoint from source.
 
 Inbound TLS can run in `off`, `proxy`, or `direct` mode. Direct mode defaults to the certificate files above unless explicit paths are configured. Outbound HTTPS trust uses Bun’s bundled roots by default and can be extended or replaced with custom CA files/directories for internal or enterprise endpoints. Operator auth now supports bearer headers and local session cookies across REST, SSE, and control-plane WebSocket flows.
 
@@ -157,12 +157,12 @@ The TUI now consumes the extracted `@pellux/goodvibes-sdk` (`0.34.0`) platform l
 
 ### Panels, Control Rooms, And Workspaces
 - Split-pane panel system with panel picker, layout control, and keyboard-first focus behavior
-- Dedicated control rooms for provider accounts, provider health, local auth, settings sync, remote, MCP, marketplace, orchestration, tasks, intelligence, worktrees, approvals, forensics, security, policy, cockpit, system messages, and more
-- Summary-first heavy panels with posture, issues, next actions, and detail regions
-- Routed system-message workspace for startup discovery and operational notices
+- Six persistent consoles — the Fleet hub plus git, diff, cost, tokens, and local-auth — with heavier operator surfaces (providers, remote, MCP, marketplace, orchestration, tasks, intelligence, worktrees, approvals, policy, security, settings sync, and more) re-homed as configuration/review modals on a single liveness-enforcing config-modal host
+- Retired panel ids resolve honestly through aliases, modal redirects, and "this moved" notices, so `/panel open <id>` and saved layouts never point at nothing
+- Summary-first heavy surfaces with posture, issues, next actions, and detail regions
 - Cross-panel actions between Explorer, Preview, and Symbols so file browsing can open previews and jump to symbol locations directly from panel focus
-- Live panels stay subscribed while open, so agent, tool, and thinking updates continue while the panel is visible
-- Dedicated `Agents` panel provides a view-only live peek into running agent sessions while the background-process strip remains the fast-access surface below the prompt
+- Live panels stay subscribed while open and repaint while the main thread is idle, so agent, tool, and thinking updates never look frozen
+- The Fleet panel is the live control room for running agents, workstreams, and scheduled jobs — attach/detach (detach never kills), steer, pause/resume, and capability-gated interrupt/kill — reached by `F2`, `Ctrl+O`, or the footer `[Enter]`
 
 ### Modal And Selection UX
 - Modal stack navigation that unwinds correctly back to the slash-command menu and prior nested modals
@@ -446,7 +446,7 @@ bun run build
 # outputs dist/goodvibes
 ```
 
-`bun run build` compiles `src/main.ts` into `dist/goodvibes`. The compiled binary runs the TUI and can also host the daemon and HTTP listener in-process when `danger.daemon` and/or `danger.httpListener` are enabled in config. The default build does not produce a separate compiled daemon-only executable.
+`bun run build` compiles `src/main.ts` into `dist/goodvibes`. The compiled binary runs the TUI and also hosts the daemon in-process (`daemon.enabled`, on by default) plus, when `danger.httpListener` is enabled, the HTTP listener. The default build does not produce a separate compiled daemon-only executable.
 
 ---
 
@@ -560,7 +560,7 @@ Related storage paths:
 | `web.port` | `3423` | Web/browser surface port |
 | `danger.agentRecursion` | `false` | Allow agents to spawn subagents |
 | `danger.maxGlobalAgents` | `8` | Max simultaneous agents |
-| `danger.daemon` | `false` | Enable daemon mode (POST /task) |
+| `daemon.enabled` | `true` | Run the local session daemon (loopback-bound; on by default) |
 | `danger.httpListener` | `false` | Enable HTTP webhook listener |
 | `tools.autoHeal` | `false` | Auto-fix syntax errors on write/edit |
 | `tools.hooksFile` | `hooks.json` | Hook configuration file name |
@@ -587,7 +587,7 @@ Changing `service.autostart` or `service.enabled` from `/config` reconciles the
 
 GoodVibes is built around routing runtime state to the right surface.
 
-The current product ships dedicated workspaces for:
+The Fleet panel is the one persistent operator control room; most other operator surfaces now open as configuration and review modals on a shared, liveness-enforcing config-modal host rather than as standing panels. The product surfaces state for:
 
 - provider accounts and provider health
 - local auth and local service posture
@@ -740,10 +740,11 @@ Key commands:
 
 ### Local daemon and HTTP listener
 
-Local service surfaces are opt-in:
+The local session daemon runs by default (`daemon.enabled`, loopback-bound); the HTTP
+webhook listener is opt-in:
 
-- `danger.daemon`
-- `danger.httpListener`
+- `daemon.enabled` (default `true`)
+- `danger.httpListener` (default `false`)
 
 They are protected by local auth, which includes:
 
@@ -1265,6 +1266,9 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/session [action]` | `/sess` | Full session management: list, rename, resume, fork, save, info, export, search, delete |
 | `/undo [file]` | `/u` | Remove last turn, or `/undo file` to revert last file write/edit |
 | `/redo [file]` | — | Restore last undone turn, or `/redo file` to re-apply last reverted file |
+| `/checkpoints` | — | List workspace checkpoints, newest first |
+| `/checkpoint [label]` | — | Create a manual workspace checkpoint (forensic retention) |
+| `/rewind [id]` | — | Preview and restore a workspace checkpoint (files only — conversation history is unchanged) |
 | `/retry [text]` | `/r` | Re-send the last user message |
 | `/template` | `/tmpl` | Manage prompt templates: save, use, list, edit, delete |
 | `/tools` | `/t` | List available tools |
@@ -1272,11 +1276,12 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/services` | `/svc` | Manage API service configurations |
 | `/accounts [action]` | — | Review provider-account routes, auth posture, and repair actions |
 | `/auth [action]` | — | Review auth posture and manage local service auth users/sessions |
-| `/memory [action]` | — | Session memory management: `list`, `add <text>`, `remove <id>` |
+| `/note [action]` | — | Session note management (pinned across context compaction): `list`, `add <text>`, `remove <id>` |
 | `/keep <text>` | — | Pin text to session memory; survives context compaction |
 | `/memory-sync [action]` | `/memsync` | Durable memory export/import and bundle exchange: `export <path> [scope]`, `import <path>` |
-| `/recall [action]` | `/rc` | Durable knowledge and memory substrate: capture, review, explain, export, import, and handoff |
+| `/recall [action]` | `/rc`, `/memory`, `/mem` | Durable knowledge and memory substrate: capture, review, explain, inspect `injections`, export, import, and handoff |
 | `/knowledge [action]` | `/know`, `/kb` | Structured knowledge graph: ingest URLs/bookmarks, inspect issues, build packets, and run consolidation jobs |
+| `/codebase [action]` | — | Repo source-tree code index: `build`, `status`, and `search` |
 | `/context` | `/ctx` | Inspect context window usage (token breakdown per message) |
 | `/next-error` | `/ne` | Jump to the next error message in the conversation |
 | `/prev-error` | `/pe` | Jump to the previous error message in the conversation |
@@ -1287,6 +1292,7 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/scan` | — | Scan for local LLM servers |
 | `/plan [goal]` | — | Inspect or seed TUI-owned project planning state; `panel`, `approve`, `list`, and `show <id>` are supported |
 | `/work-plan [action]` | `/wp`, `/todo`, `/workplan` | Open or update the persistent workspace work-plan checklist |
+| `/workstream [action]` | — | Author and oversee multi-phase agent workstreams (orchestration engine) |
 | `/panel [action]` | `/panels` | Panel management: open, close, list, toggle, move, focus, split, width, height |
 | `/plugin [action]` | — | Manage plugins (enable/disable/reload/list) |
 | `/marketplace [action]` | — | Browse curated plugin, skill, hook-pack, and policy-pack surfaces |
@@ -1297,6 +1303,7 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/wrfc` | — | Show WRFC chain status, constraint satisfaction counts, and per-constraint `[SAT]`/`[UNS]`/`[UNV]` breakdown |
 | `/health [action]` | — | Unified runtime health review and repair entry point |
 | `/guidance [action]` | — | Contextual operational guidance without cluttering the conversation |
+| `/test [pattern]` | — | Run the project test script and show pass/fail results |
 | `/remote [action]` | — | Distributed peer, node-host contract, work-queue, and artifact control room |
 | `/sandbox [action]` | — | Isolation presets, doctor/probe, sessions, and QEMU setup flows |
 | `/setup [action]` | — | First-run readiness, services, sandbox, transfer bundles, and deep links |
@@ -1310,6 +1317,8 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/keybindings` | `/kb` | List current keyboard bindings and their config file path |
 | `/schedule [action]` | `/sched` | Manage scheduled agent tasks (cron): add, list, remove, enable, disable, run |
 | `/image <path>` | `/img` | Attach an image file to the next message |
+| `/imagine <prompt>` | — | Generate an image from a prompt |
+| `/search <query>` | — | Search the web and render ranked results with source labels (`--limit <n>`) |
 | `/paste` | `/clip` | Pull supported text or image data directly from the system clipboard into the prompt |
 | `/refresh-models` | — | Refresh model catalog, benchmarks, and token limits |
 | `/notify [action]` | `/ntf` | Manage webhook notifications (ntfy.sh): add, remove, list, clear, test |
@@ -1388,12 +1397,13 @@ All shortcuts are customizable via `~/.goodvibes/tui/keybindings.json`. Use `/ke
 | Key | Action |
 |-----|--------|
 | `Ctrl+P` | Toggle panel sidebar |
-| `Ctrl+]` | Next panel tab |
-| `Ctrl+[` | Previous panel tab |
+| `F2` | Open and focus the Fleet panel |
+| `Ctrl+]` / `Ctrl+PageDown` | Next panel tab |
+| `Ctrl+PageUp` | Previous panel tab |
 | `Alt+1`…`Alt+9` | Jump to panel tab 1–9 |
 | `Ctrl+X` | Close the focused panel |
 | `Ctrl+Shift+X` | Close all panels |
-| `Ctrl+O` | Open the Ops Control panel |
+| `Ctrl+O` | Open and focus the Fleet panel (formerly Ops Control) |
 | `Ctrl+G` | Toggle focus between split panes |
 
 ### System